Low altitude air route admission method, system, device and medium based on three-field certificate

Abstract

The present disclosure discloses a low-altitude air route access method, system, device and medium based on a three-field certificate. The low-altitude air route access method based on the three-field certificate comprises: obtaining a task request, a low-altitude corridor map, a candidate departure window, a heterogeneous Internet of Things infrastructure map with a time index, and access constraints, dividing facility services into three types of capabilities: monitoring, control takeover, and trusted auditing; constructing a route-departure time pair and forming a per-slot availability sequence of the three types of capabilities, pruning in a time-expanded state diagram according to a continuous monitoring capability loss and a continuous control takeover capability loss, calculating a longest continuous monitoring blind area, a worst takeover waiting time, and an audit record completeness for a complete candidate, and generating a three-field certificate; determining whether to release according to three core verification fields and energy consumption and deadline constraints, and outputting a disposal result. The present disclosure can jointly access the route and the departure time.

Description

Technical Field

[0001] This disclosure relates to the technical management and IoT collaborative protection of low-altitude unmanned aerial vehicle (UAV) operations, and in particular to a low-altitude route access method, system, device, and medium based on a three-field certificate that utilizes cellular base stations, remote identification receivers, Wi-Fi / BLE / LoRa gateways, edge nodes, and trusted log facilities to jointly verify the monitoring, control takeover, and auditing capabilities of UAV candidate routes and their departure times. Background Technology

[0002] Low-altitude missions such as logistics, inspection, emergency response, and environmental monitoring are shifting from isolated test flights to repetitive operations in shared urban, industrial park, and corridor airspace. When assessing mission eligibility, it is necessary to determine before takeoff whether the aircraft possesses the required monitoring capabilities within the occupied time slots of the candidate airway, whether it can obtain control takeover opportunities within a limited timeframe after an anomaly occurs, and whether it meets the service conditions for establishing a credible audit log.

[0003] The capabilities offered by heterogeneous infrastructure are not equivalent: a remote identification receiver may only be able to observe but not issue control commands; a cellular link may support commands and control, but may not necessarily create a trusted third-party audit log; an edge gateway can log events locally, but may not cover the entire flight path. If the above services are characterized only by a single connection status or average coverage, it may be impossible to distinguish between the three types of capabilities: monitoring, control takeover, and trusted auditing, and may also overlook the inadequacy of one of these capabilities.

[0004] Average coverage is insufficient to characterize the temporal structure of continuous capability gaps. For example, ten scattered uncovered time slots and ten consecutive uncovered time slots may have the same average coverage, but their corresponding longest continuous monitoring blind zones differ. Therefore, it is necessary to project heterogeneous infrastructure services according to capability categories onto continuously occupied time slots for candidate route-departure time pairs, evaluate the availability of continuous monitoring blind zones, control takeover waiting, and audit services respectively, and provide interpretable admission results under corresponding resource constraints. Summary of the Invention

[0005] I. Purpose of the Invention

[0006] This disclosure aims to address the issues of unequal monitoring, control takeover, and trusted auditing capabilities provided by heterogeneous IoT infrastructures, and the difficulty of using unified connectivity metrics to simultaneously characterize continuous monitoring blind spots, control takeover wait times, and auditing service availability. It proposes to make interpretable joint admission decisions for candidate route-departure time pairs based on capability categories and continuous occupancy time slots before mission departure.

[0007] II. Technical Solution

[0008] To address the aforementioned technical issues, this disclosure provides a low-altitude airway access method based on a three-field certificate, comprising: acquiring a heterogeneous IoT infrastructure map of a low-altitude flight mission, including a mission request, a low-altitude corridor map, candidate departure windows, and a time-indexed map, as well as monitoring thresholds, control takeover thresholds, audit thresholds, energy consumption constraints, and deadline constraints; classifying the services provided by the heterogeneous IoT infrastructure into three categories: monitoring, control takeover, and trusted audit capabilities; constructing candidate airway-departure time pairs, determining the non-empty occupied time slot set and spatiotemporal trajectory for each candidate airway-departure time pair, and forming a time-slot-by-time availability sequence of monitoring capability, control takeover capability, and audit capability; and maintaining a continuous monitoring capability missing counter and a continuous control takeover capability missing counter along the occupied time slot set in the time-extended state map. The system performs a countdown, removes states where the count exceeds the corresponding threshold after the update, and deletes the termination states where the count of missing end-to-end control takeover capability is greater than zero after processing the last occupied time slot. In the pruned time-expanded state graph, a path search is performed based on the audit missing amount, energy consumption constraints, and deadline constraints. For the complete candidates obtained from the search, the longest continuous monitoring blind zone, worst-case takeover waiting time, and audit record completeness are calculated. A three-field certificate is generated using the longest continuous monitoring blind zone, worst-case takeover waiting time, and audit record completeness as the three core verification fields. Only when the three core verification fields satisfy their respective thresholds, and both energy consumption constraints and deadline constraints are satisfied, are the corresponding candidates determined as release candidates. For non-release candidates, the violation reason and corresponding handling result are output.

[0009] The "three fields" refer to the three core verification fields: longest continuous monitoring blind zone, worst-case takeover waiting time, and audit record completeness. Departure time, candidate route, monitoring redundancy margin, and violation reason can be recorded as related information in the certificate, but are not included in the three core verification fields.

[0010] In the implementation of enabling monitoring redundancy evaluation, physical facilities with multiple capabilities can be divided into corresponding virtual capability sources, retaining common deployment identifiers and applicable common failure identifiers, and establishing common failure groups based on common failure relationships; for candidates with complete monitoring evaluation windows, the monitoring redundancy margin is calculated according to independent observation failure modes or common failure modes, and single candidate monitoring probability verification is enabled when the corresponding independence conditions and failure probability upper bound conditions are met.

[0011] In the multi-task shared capacity implementation, shared capacity verification is performed only on candidates that have passed the verification of the three core verification fields, energy consumption constraints, and time limit constraints. For the corresponding shared resources, the resource requirements of the candidates to be released are summarized according to the shared resources and their occupied time slots. Under the condition that at most one candidate is selected in each task and the total resource requirements of any shared resource in any corresponding occupied time slot do not exceed the corresponding shared capacity, the release set is determined.

[0012] Specifically, in the first aspect, this disclosure provides a low-altitude airway access method based on a three-field certificate, including:

[0013] Step S1, Data and Constraint Acquisition:

[0014] Obtain a heterogeneous IoT infrastructure map of mission requests, low-altitude corridor maps, candidate departure windows, and time indices for low-altitude flight missions, and obtain monitoring thresholds, control takeover thresholds, audit thresholds, energy consumption constraints, and deadline constraints.

[0015] Step S2, Ability Classification:

[0016] Based on the heterogeneous IoT infrastructure map, the services provided by the heterogeneous IoT infrastructure are divided into three categories: monitoring, control takeover, and trusted auditing capabilities.

[0017] Step S3, Candidate Construction and Capability Projection:

[0018] Construct candidate route-departure time pairs, determine the spatiotemporal trajectory and non-empty time slot set for each candidate route-departure time pair, and project the three types of capabilities onto the spatiotemporal trajectory according to the service availability status of the candidate route-departure time pairs at the corresponding locations and time slots, forming a time slot-by-time availability sequence of monitoring capabilities, control takeover capabilities, and audit capabilities.

[0019] Step S4, continuous risk pruning:

[0020] In the time-extended state diagram, a continuous monitoring capability missing counter and a continuous control takeover capability missing counter are maintained along the set of occupied time slots for each candidate route-departure time slot. The corresponding counters are cleared or incremented according to the corresponding capability availability status of each time slot. State transitions where the updated corresponding counter exceeds the monitoring threshold or control takeover threshold are removed. After processing the last occupied time slot, the termination state where the end continuous control takeover capability missing counter is greater than zero is deleted.

[0021] Step S5, Three-field certificate generation:

[0022] In the time-extended state diagram after pruning, path search is performed according to the audit missing amount, energy consumption constraint and deadline constraint. For the complete candidates obtained by the search, the longest continuous monitoring blind zone, the worst takeover waiting time and the audit record completeness are calculated, and a three-field certificate is generated with the longest continuous monitoring blind zone, the worst takeover waiting time and the audit record completeness as the three core verification fields.

[0023] Step S6, Admission Decision and Disposal Output:

[0024] The corresponding candidate is determined as a release candidate only when the longest continuous monitoring blind zone is not greater than the monitoring threshold, the worst takeover waiting time is not greater than the control takeover threshold, the audit record completeness is not lower than the audit threshold, and both energy consumption constraints and time limit constraints are met; the release result is determined from the release candidates returned by the actual search and reviewed according to the original indicator definition and original constraints; for candidates that are not released or for tasks that cannot be released within the actual inspection range, the reason for the violation is recorded, and the handling result of rerouting, adjusting the departure time, adding temporary facilities, or refusing to release the current task is output;

[0025] The original indicators include the longest continuous monitoring blind zone, the worst takeover waiting time, and the audit record completeness calculated according to the non-empty occupied time slot set and the time slot-by-time slot capability availability sequence of candidate route-departure time pairs; the original constraints include: monitoring threshold, control takeover threshold, audit threshold, energy consumption constraint, and deadline constraint.

[0026] Specifically, in the second aspect, this disclosure provides a low-altitude airway access system based on a three-field certificate, including a data and constraint acquisition module, a capability classification module, a candidate construction and capability projection module, a continuous risk pruning module, a three-field certificate generation module, and an access decision and disposal output module. Each module is used to perform the corresponding data processing, path search, certificate generation, and access disposal functions in the aforementioned method.

[0027] Specifically, in a third aspect, this disclosure provides an electronic device including a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor performs the method described in the first aspect above.

[0028] Specifically, in a fourth aspect, this disclosure provides a computer-readable medium having a computer program stored thereon, which, when executed by a processor, implements the method described in the first aspect above.

[0029] III. Beneficial Effects

[0030] Depending on the specific implementation method adopted, this disclosure may have one or more of the following beneficial effects:

[0031] (1) Achieve joint evaluation of flight route and departure time

[0032] This disclosure identifies the admission targets as candidate routes-departure time pairs, enabling infrastructure capacity assessment to simultaneously correspond to the spatial location of the route and the actual time slot occupied by the mission. This allows for the identification of service capacity differences for the same geometric route due to different departure times, avoiding the need to make release decisions solely based on the existence of the geometric path.

[0033] (2) Differentiate the different service capabilities of heterogeneous facilities

[0034] This disclosure divides facility services into three categories: monitoring, control takeover, and trusted auditing capabilities, and forms a time-slot availability sequence for each. This allows each facility to participate in verification according to the services it can provide, avoiding the compression of observation capabilities, control links, and trusted log services into a single connection quality that masks capability deficiencies.

[0035] (3) Separately constrain the three types of access indicators

[0036] This disclosure calculates the longest continuous monitoring blind zone, the worst-case takeover wait time, and the audit log completeness separately, and uses these three as the three core verification fields of the three-field certificate. Each field is compared with its corresponding threshold, and they are not weighted together to form a single, mutually compensable score. The departure time, candidate route, monitoring redundancy margin, and violation reason recorded in the certificate are related information and do not change the meaning of the "three fields." The audit log completeness is evaluated based on the proportion of available audit service slots before departure, and the predicted service capacity is not equated with the verified actual flight logs.

[0037] (4) Directly identify the lack of continuous ability

[0038] This disclosure directly records the length of the current consecutive missing segment by updating a counter that resets when capability is available and increments when capability is missing. The continuous monitoring capability missing counter corresponds to the longest continuous monitoring blind zone; for a control takeover capability missing segment terminated by a subsequent available takeover time slot, its missing time slot number is equal to the number of waiting time slots from the first time slot of the missing segment to the next available takeover time slot; for a control takeover capability missing segment extending to the candidate end, the worst-case takeover waiting time is agreed to be positive infinity. Therefore, the pruning count and certificate indicators use the same occupied time slot boundary and time slot difference measurement caliber.

[0039] (5) Remove oversized transfers and verify the final section of the route.

[0040] This disclosure deletes the corresponding state transition when the continuous capability loss counter exceeds the corresponding threshold, so that subsequent searches will no longer expand branches that have been determined to have exceeded the continuous risk limit; by initializing the counter before the first occupied time slot, processing all occupied time slots one by one, and deleting the termination state that still lacks control takeover capability at the end, it avoids missing the first and last time slots or miscounting the service after the end of the route as a takeover opportunity within the candidate.

[0041] (6) Layered handling of continuous risks and cumulative resources

[0042] This disclosure first uses a counter to handle continuous risks, and then, within a search domain with a fixed departure time and a fixed route duration, converts the audit ratio requirement into a cumulative audit missing quantity constraint with an integer upper limit, which is processed together with the energy consumption constraint. Finally, it verifies the deadline requirement with the termination time, so that continuous risks, cumulative resources, and completion deadlines are each verified using verification methods appropriate to their nature.

[0043] (7) Control the search cost and maintain the original constraints within the applicable conditions.

[0044] This disclosure employs dynamic programming for accurately coded double-integer resources, deleting tags whose resource consumption and main path cost are both dominated within the same extended state; for search domains with only one pending cumulative resource constraint and satisfying conditions such as the lower bound of positive cost, a single-resource search with only scaling of the main path cost is adopted, controlling the approximate range of the returned cost under the stated conditions while keeping the original resource upper limit unchanged; when using bounded non-dominated enumeration, candidates are reviewed one by one to ensure that changes in the search method are not used to relax the admission conditions, and the search conclusions are limited to the actual inspection range.

[0045] (8) Reduce the direct impact of optimistic service quality estimates

[0046] In the implementation of the confidence lower bound determination method, this disclosure compares the confidence lower bound of the service quality estimate with the corresponding threshold. Only the capability sources that reach the threshold are included in the availability sequence. This reduces the possibility of directly using an optimistic service quality estimate as the basis for determining availability and provides a conservative basis for subsequent continuous risk and certificate indicator calculations.

[0047] (9) Avoid duplicate counting of common failure groups within the window.

[0048] This disclosure establishes groups based on common failure relationships such as sites, backhaul links, power sources, or operating entities, and deduplicates groups that have provided usable observations within the entire monitoring and evaluation window. This ensures that multiple capability sources in the same group or observations across multiple time slots in the same group are not repeatedly counted as multiple independent redundant units, thus avoiding overestimation of redundancy under common failure modes caused by the accumulation of group numbers per time slot. The statistical independence between groups is still determined according to the conditions of the corresponding probability model.

[0049] (10) Monitor redundant computing access certificates and candidate selections

[0050] This disclosure counts the number of available source-time slot observations within a window under independent observation failure mode, and counts the number of different common failure groups within a window under common failure mode. The minimum value among the statistical values ​​of each complete window is taken as the monitoring redundancy margin and written as correlation information into the three-field certificate. When it is necessary to compare the monitoring redundancy margin, only candidates with complete evaluation windows, whose margin has been determined, and which use the same failure mode are compared. The margin is not one of the three core verification fields of the three-field certificate, and no margin value is assigned to short routes without complete evaluation windows.

[0051] (11) Constrain monitoring of over-limit risks under explicit failure assumptions

[0052] This disclosure, under the condition that source-timeslot observation independent failure or group window failure events are independent between groups and the corresponding upper bound of failure probability is met, determines the minimum number of observations or groups required for each complete monitoring window based on the assessment time domain and the single candidate risk upper limit, combining nominal monitoring capability verification with robustness verification under failure conditions; this risk constraint corresponds to a single candidate, is not presumed to be statistically independent due to different group identifiers, nor is it directly extended to multi-task joint risk guarantee.

[0053] (12) Implement shared capacity verification and evidence-based differentiated handling.

[0054] This disclosure first verifies the candidate itself using three core verification fields, energy consumption constraints, and time limit constraints. Then, in a multi-task implementation, it summarizes the resource requirements of the candidates to be released according to shared resources and their occupied time slots. Under the condition that at most one candidate is selected in each task and the total requirements do not exceed the corresponding shared capacity, a release set is determined. This distinguishes between two reasons: the candidate itself is unqualified, and the candidate itself is qualified but the shared capacity is insufficient. For route rerouting or adjusting departure times, only alternative candidates that have already completed the corresponding verification are used; temporary facilities are re-verified after being written into the updated infrastructure map; when no release candidate is found within the actual inspection range, the reason and inspection range are recorded. Attached Figure Description

[0055] Figure 1 This is a flowchart of a low-altitude airway access method based on a three-field certificate, as described in an embodiment of this disclosure.

[0056] Figure 2 This is a general schematic diagram of the low-altitude airway access method according to an embodiment of this disclosure. Wherein, Figure 2 (a) is the projection of the route-time in the dimensions of monitoring, control takeover and auditing. Figure 2 (b) is the certificate used for access control.

[0057] Figure 3 This is a schematic diagram illustrating the pairwise relationships of the three certificate indicators in an embodiment of this disclosure;

[0058] Figure 4 This diagram illustrates a comparison of average coverage, access feasibility, and monitoring redundancy margin under independent failure conditions in embodiments of this disclosure. (a) shows the relationship between average coverage and the longest continuous monitoring blind zone. (b) compares access feasibility under different selection methods. (c) shows the relationship between monitoring redundancy margin and risk objectives under independent source-time slot failure conditions.

[0059] Figure 5 This is a schematic diagram illustrating the impact of infrastructure map misjudgment and common failure grouping on the alignment results in embodiments of this disclosure; wherein, Figure 5 In the middle (a), it represents the optimism error of Experiment 9a: Infrastructure Map. Figure 5 (b) indicates Experiment 9b: Common mode failure of monitoring capability. Detailed Implementation

[0060] This disclosure uses the "route-departure time" pair, consisting of candidate UAV flight paths and their departure times, as the admission criteria. It categorizes the services provided by heterogeneous IoT infrastructure into monitoring capabilities, control takeover capabilities, and trusted auditing capabilities, and forms a time-slot availability sequence for these three capabilities along the spatiotemporal trajectory of the candidate flight paths. Based on this, a continuous capability loss counter is used to exclude state transitions due to continuous risk exceeding limits. Candidate flight paths are searched under constraints of energy consumption, audit loss amount, and deadline. A three-field certificate is generated, with the longest continuous monitoring blind zone, worst-case takeover waiting time, and audit record completeness as the three core verification fields. The certificate is then used to determine whether a candidate can be released. In corresponding implementations, monitoring redundancy margin can be used as certificate association information for candidate comparison under the same failure mode; for multiple tasks, a shared capacity verification can be further performed after the candidate's own verification.

[0061] The following is combined with Figures 1 to 5 The technical solution of this disclosure will be described in detail with specific embodiments. It should be noted that, for ease of comparison, the applicant has grouped multiple related images into a single image. The time, flight duration, consecutive missing length, and waiting time mentioned below are all calculated using a unified time slot unit; the meaning of the same parameter remains consistent across different formulas and processing steps.

[0062] I. Examples of Low-Altitude Air Route Access Methods

[0063] Figure 1 This is a flowchart of a low-altitude airway access method based on a three-field certificate, as described in an embodiment of this disclosure. Figure 2 This is a general schematic diagram of the low-altitude airway access method according to an embodiment of this disclosure. Wherein, Figure 2 In the middle (a), the route-time projection is shown in the monitoring, control takeover and audit dimensions, which shows the projection of the monitoring, control takeover and audit capabilities of the candidate route in different occupied time slots. Figure 2(b) shows the certificate used for access control, illustrating the processing chain from task request and infrastructure map verification to the formation of candidate certificates and access processing results. It should be noted that... Figure 2 In this context, average coverage may mask the longest service gap and confuse different M / C / A capabilities.

[0064] like Figure 2 and Figure 1 As shown, the method in this embodiment includes the following steps in sequence: Step S1, data and constraint acquisition; Step S2, capability classification; Step S3, candidate construction and capability projection; Step S4, continuous risk pruning; Step S5, three-field certificate generation; Step S6, admission decision and disposal output.

[0065] Steps S1 to S3 establish the correspondence between mission, route, time, and three types of infrastructure capabilities. In the implementation of enabling monitoring redundancy evaluation, step S2 also establishes the correspondence between virtual capability sources and common failure groups, and step S3 saves the corresponding original quantities and group availability status. Step S4 eliminates state transitions due to continuous monitoring blind spots or continuous control takeover capability deficiencies exceeding limits. Step S5 processes audit missing quantities, energy consumption, and deadline constraints and generates a three-field certificate. Step S6 first performs candidate self-admission verification, and in the multi-task shared capacity implementation, further performs shared capacity verification. The data or processing results generated in the previous step serve as input for subsequent corresponding steps.

[0066] 1. Step S1: Data and Constraint Acquisition

[0067] Step S1 obtains the mission request, low-altitude corridor map, candidate departure windows, and heterogeneous IoT infrastructure map with time index for low-altitude flight missions, and acquires monitoring thresholds, control takeover thresholds, audit thresholds, energy consumption constraints, and deadline constraints. These data are used to limit the spatial and temporal ranges, three types of service capabilities, and the candidate's own admission criteria for each candidate route. In the multi-mission shared capacity implementation, step S1 also acquires shared capacity constraints.

[0068] A directed graph is used to describe the permitted low-altitude corridors for flight:

[0069]

[0070] in, Map showing low-altitude corridors; A set of nodes representing waypoints, landing points, or checkpoints; This represents a set of flyable flight segments. For a flight segment... ,by Indicates the flight duration of this segment, in... This indicates the energy consumption for that flight segment; A positive integer expressed in a uniform time slot unit. The value is a non-negative value expressed using a uniform energy unit.

[0071] The mission request includes the origin, destination, candidate departure windows, mission weight, and completion deadline. Candidate routes. Includes at least one flyable segment from the mission start point to the mission end point, with a flight duration of:

[0072]

[0073] in, Indicate candidate routes; This indicates the total number of time slots required to complete the flight along this route; This indicates the segment traversed along the candidate route. For the same geometric route, different departure times may correspond to different facility operating statuses, available capacity, and service capabilities; therefore, both the route and departure time are considered as candidates.

[0074] The infrastructure map includes information on cellular base stations, remote identification receivers, Wi-Fi, BLE or LoRa gateways, edge nodes, and trusted logging facilities, providing corresponding service capabilities based on location and time. The information is based on factors such as predicted or measured packet delivery, received signal quality, command and control service status, remote identification reception, edge node availability, trusted logging service status, and temporary facility deployment status. This map indicates the types and quality of service that facilities can provide at specific locations and time slots, rather than simply indicating the presence or absence of wireless connectivity.

[0075] The monitoring threshold is denoted as , indicating the longest permissible continuous monitoring blind zone length; the control takeover threshold is denoted as , representing the worst-case takeover wait time; both are non-negative integers expressed in a uniform time slot. The audit threshold is denoted as . This represents the minimum percentage that audit record completeness should achieve, with a value range of [value missing]. Subscript , and The monitoring, control takeover, and audit categories are identified separately.

[0076] Energy consumption constraints specify the maximum allowable energy consumption for candidate routes, while time-limit constraints stipulate that candidates must be completed within the mission completion period. In the multi-mission shared capacity implementation, shared capacity constraints specify capacity limits for shared control takeover resources, trusted log service bandwidth, edge processing capabilities, or corridor quotas in the corresponding occupied time slots. Each applicable constraint is verified separately, and a surplus in one constraint does not offset a violation of another. The completion time of a candidate is the sum of its departure time and flight duration, and the last occupied time slot is the time slot preceding the completion time; the completion time must not be later than the mission deadline, and all occupied time slots should be within the evaluation time domain of the infrastructure map.

[0077] In the implementation of enabling monitoring redundancy evaluation, step S1 also obtains the adopted failure modes, including independent observation failure modes and common failure modes. The former counts available source-time slot monitoring observations, while the latter counts different common failure groups that have provided available monitoring observations within the evaluation window. When further enabling monitoring probability verification, the evaluation time domain length, the upper limit of single candidate monitoring risk, and the upper bound of failure probability corresponding to the adopted failure mode are also obtained.

[0078] 2. Step S2: Ability Classification

[0079] Step S2 categorizes capability sources into three types based on the heterogeneous IoT infrastructure map: monitoring, control takeover, and trusted auditing. In the implementation method that enables monitoring redundancy evaluation, a correspondence between virtual capability sources and physical facilities is also established; when adopting a common failure mode, a correspondence between capability sources and common failure groups is further established.

[0080] Sub-step S2a: Classify capabilities.

[0081] Specifically, the capability sources are divided into monitoring capability sources, control and takeover capability sources, and trusted audit capability sources, with corresponding sets denoted as follows: , and Monitoring capability sources are used to provide the ability to observe, report positions, or acquire status of aircraft; control takeover capability sources are used to provide command and control or takeover opportunities; trusted audit capability sources are used to create trusted records and store those records or forward them to the appropriate platform.

[0082] Sub-step S2b: Decompose multi-capability facilities.

[0083] Specifically, for physical facilities that provide multiple types of services simultaneously, they are split into corresponding virtual capability sources according to capability categories. For example, when the same physical gateway provides both monitoring services and trusted log services, it is represented as a monitoring capability source and an audit capability source, respectively. Both participate in the availability calculation of their respective categories, while retaining the same physical deployment identifier and applicable common failure identifier.

[0084] Sub-step S2c: Establish a common failure group.

[0085] Capability sources with common failure relationships are grouped into the corresponding common failure group based on at least one of the following: site, backhaul link, power source, and operating entity; capability sources that do not have common failure relationships with other capability sources are grouped into separate common failure groups.

[0086] Multiple available capability sources within the same group are not counted as multiple independent redundant units under a common failure mode. The common failure identifier only describes the correlation in the model and does not automatically prove that different groups are statistically independent; when using probabilistic constraints, the independence between the corresponding groups and the upper bound condition of the group failure probability should also be satisfied.

[0087] 3. Step S3: Candidate Construction and Capability Projection

[0088] Step S3 constructs candidates based on the mission start and end points, the low-altitude corridor map, and the candidate departure window. The candidates are represented as follows:

[0089]

[0090] in, Indicates the candidate route-departure time pair; Indicate candidate routes; This indicates the candidate departure time within the candidate departure window. The spatiotemporal trajectory is determined based on the candidate route and the flight duration of each segment. ,in, Indicates the time slot index. Indicates candidate In the time slot The corresponding position.

[0091] The candidate occupancy time slot set is as follows:

[0092]

[0093] in, Indicates candidate The set of non-empty time slots occupied; All three certificate indicators use this set, without employing different route time ranges across different indicators. In the graph search implementation, infrastructure capabilities can be projected onto route-time grid points and unit-time transitions to form complete paths before summarizing spatiotemporal trajectories and capability sequences, eliminating the need to exhaustively enumerate all complete routes beforehand. For unit-time expansion of flight segments, nodes and transitions within the segment retain the original segment identifiers, allowing only progress along the predetermined expansion chain of that segment, avoiding jumps to another segment at internal nodes; each unit-time transition corresponds to an occupied time slot, and the capability status and audit missing quantity of that time slot are only accumulated once.

[0094]

[0095] in, as a candidate The set of occupied time slots, The total number of flight time slots for the candidate routes is calculated by summing the time slots for each segment the route passes through.

[0096] Further, step S3 includes:

[0097] Sub-step S3a: Obtain the service quality and confidence lower bound.

[0098] Specifically, regarding ability categories Source of ability in Get its location Time slot Service quality estimate and belief in the lower realm .in, Take the category of monitoring, control takeover, or audit; This includes virtual capability sources of corresponding categories; Indicate category The service quality threshold is defined. Service quality values ​​and thresholds use the same units and evaluation direction. For quantities such as message success rate, where higher values ​​are better, a lower bound comparison can be used directly. For quantities such as link latency, where lower values ​​are better, they should first be converted to service quality quantities with the same direction, or equivalently, judged based on the upper bound of latency confidence not exceeding the latency budget. Different quality conditions must be met simultaneously.

[0099] Sub-step S3b determines the availability status of each time slot.

[0100] In implementations employing a confidence lower bound, the slot-by-slot availability state of the capability source is determined according to the following formula:

[0101]

[0102] in, Indicates the source of capability For candidates In the time slot The available status, which can be 0 or 1; This represents the indicative function. A capability source is marked as available only when the confidence lower bound reaches the corresponding threshold. In implementations where a definite quality of service value can be directly obtained and a confidence lower bound is not used, it can be done according to... A determination should be made, but the general service quality estimate should not be recorded as the lower confidence bound. The availability of control takeover capability should also meet the quality and latency requirements of the service category itself; the subsequent takeover wait time represents the time to wait for a takeover opportunity to occur and does not replace the service latency conditions of the control link itself.

[0103] Sub-step S3c generates three types of capability sequences and the original quantity sequence:

[0104]

[0105] in, Indicates ability category A collection of capability sources; This indicates that the category is in the time slot. Does at least one qualified capability source exist? This represents the corresponding original available capability source quantity; taking three categories respectively, we obtain... , and The original quantities have not yet been deduplicated according to common failure relationships.

[0106] Sub-step S3d forms the availability sequence of the common failure group:

[0107]

[0108] in, Indicates the common failure group identifier; Representation group The set of capabilities included; This indicates the slot-by-slot availability status of the group under the corresponding category. It is set to 1 if at least one corresponding category capability source within the group is available, otherwise it is set to 0.

[0109] Sub-step S3e saves three types of capability availability sequences; in the implementation of enabling monitoring redundancy evaluation, it also saves the original sequence of available monitoring capability sources, as well as the correspondence between capability sources and deployment identifiers and common failure identifiers; when using common failure modes, it also saves the common failure group availability sequence.

[0110] The above results were used for continuous risk pruning, calculation of three-field core verification indicators, and calculation of monitoring redundancy margin under corresponding failure modes, respectively.

[0111] 4. Step S4: Continuous risk pruning

[0112] In this step, in the time-extended state diagram, a continuous monitoring capability missing counter and a continuous control takeover capability missing counter are maintained along the set of occupied time slots for each candidate route-departure time slot. The corresponding counters are cleared or incremented according to the corresponding capability availability status of each time slot. State transitions where the updated corresponding counter exceeds the monitoring threshold or control takeover threshold are removed. After processing the last occupied time slot, the termination state where the end continuous control takeover capability missing counter is greater than zero is deleted.

[0113] Further, step S4 includes:

[0114] Sub-step S4a: Construct the time-extended state diagram.

[0115] Specifically, a time-extended state diagram is constructed for fixed candidate departure times, extending the low-altitude corridor map to the time dimension; for flight segments with a flight duration greater than one time slot, the transition is decomposed into unit-time transitions, ensuring that each occupied time slot participates in capability assessment. The total flight duration and total energy consumption after decomposition remain consistent with the original flight segment, indicating that the decomposed nodes within the flight segment are not considered as new physical infrastructure.

[0116] Sub-step S4b: Set and initialize the counter state:

[0117]

[0118] in, Indicates the time extension state; Indicates a route node or a deployment node; Indicates time and location; This indicates the number of time slots that have been continuously lacking monitoring capability at the end of the occupied time slots; This indicates the number of consecutive time slots lacking control takeover capability at the end of the already processed occupied time slots. Both counters are initialized to 0 before processing the first occupied time slot.

[0119] Sub-step S4c updates the counter slot by slot.

[0120] By time The current time slot is being processed. Then proceed to the next time point. When current monitoring capabilities are available... Reset to zero; otherwise, increment by 1 from the existing count. This will be done when current control takeover capability is available. Reset to zero if necessary, otherwise increment by 1. Both counters represent the number of consecutive capability-deficient time slots ending at the most recently processed occupied time slot. For a consecutive control takeover capability-deficient interval in which control takeover capability occurs in a subsequent occupied time slot, the maximum value reached by the consecutive control takeover capability-deficient counter before the takeover opportunity occurs is equal to the time slot difference from the first missing time slot in that interval to the takeover opportunity.

[0121] Sub-step S4d performs pruning and termination checks.

[0122] Specifically, when the updated When the corresponding state transition occurs, the cause of the continuous blind zone exceeding the limit should be recorded; when When this happens, remove the corresponding state transition and record the reason for the takeover wait exceeding the limit. After processing the last occupied time slot, if the terminated state... This indicates a lack of control takeover capability at the end of the route and no subsequent takeover opportunity within the candidate occupied time slot. The corresponding waiting time is set to positive infinity, and the terminated state is deleted. Control services following arrival are not included in this candidate. The counter update, end-of-course check, and worst-case takeover waiting time are all bounded by the same set of non-empty occupied time slots and use the same time slot difference measurement caliber as in step S5.

[0123] For subproblems that only include continuous monitoring and continuous control takeover constraints, dynamic programming or the shortest path method applicable to non-negative arc costs can be used to solve them on the above extended state diagram. When it is also necessary to deal with audit missing quantities, energy consumption, deadlines, or shared capacity at the same time, steps S5 and S6 are still executed, and the feasibility of the continuous constraint subproblem is not directly equated with the feasibility under all constraints.

[0124] 5. Step S5: Generate the three-field certificate

[0125] Step S5 involves performing a path search in the pruned time-expanded state graph based on audit missing quantity, energy consumption constraints, and deadline constraints. For the complete candidates obtained from the search, three core verification fields are calculated: the longest continuous monitoring blind zone, the worst-case takeover waiting time, and the audit record completeness. A three-field certificate is then generated using the longest continuous monitoring blind zone, the worst-case takeover waiting time, and the audit record completeness as the three core verification fields. When monitoring redundancy evaluation is enabled and the candidate has a complete evaluation window, the monitoring redundancy margin is further calculated.

[0126] Specifically, the phrase "performing path search based on audit gaps, energy consumption constraints, and time constraints" means "using audit gaps and energy consumption as cumulative resources, and performing path search under the upper limit of audit gaps, the upper limit of energy consumption, and time constraints."

[0127] The longest continuous monitoring blind zone is determined by the following formula:

[0128]

[0129] in, Indicates candidate The longest continuous monitoring blind zone length, when there are no non-empty intervals with continuous monitoring capability loss, will The value is determined to be zero; Indicates that it is included in Continuous time slot intervals; This represents the number of time slots contained in the interval. If there are no non-empty missing intervals, this maximum value is set to 0. For time slots The monitoring capability is available, with one indicating availability and zero indicating absence.

[0130] The worst-case takeover waiting time is determined by the following formula:

[0131]

[0132] in, Indicates candidate The worst-case takeover waiting time; Indicates a possible abnormal start time slot; Indicates no earlier than And the available time slot for control takeover capability. If control takeover capability is available when an anomaly occurs, the waiting time is 0; for a given... exist If there are no subsequent available takeover slots within the inner layer, the minimum value of the inner layer and The value is assumed to be positive infinity. For a continuous control takeover capability deficiency interval in which a takeover opportunity arises in a subsequent occupied time slot, the waiting time from the first missing time slot in the interval to the takeover opportunity is equal to the maximum value reached by the continuous control takeover capability deficiency counter in step S4 before the takeover opportunity occurs; both use the same occupied time slot boundary and time slot difference measurement caliber.

[0133] The waiting time and the continuous control takeover capability missing counter in step S4 use the same occupied time slot boundary and time slot difference measurement caliber; for the continuous control takeover capability missing interval in which a takeover opportunity occurs in a subsequent occupied time slot, the maximum value reached by the counter before the takeover opportunity occurs is equal to the waiting time from the first missing time slot in the interval to the takeover opportunity.

[0134] The completeness of audit records is determined by the following formula:

[0135]

[0136] in, Indicates candidate The completeness of audit records; Indicates the availability of audit capabilities; This represents the total number of non-zero occupied time slots. This value is an evaluation based on infrastructure capabilities obtained before mission departure and is not equivalent to verifying the actual flight log content that has not yet occurred. The three indicators are verified separately and are not mutually compensated by forming a single score through weighting.

[0137] Furthermore, step S5 specifically includes:

[0138] Sub-step S5a: Determine the fixed search domain and resource constraints.

[0139] A search domain is established for fixed departure times and fixed route durations. Audit missing quantities and energy consumption are represented as non-negative cumulative resources. The upper limit for audit missing quantities is determined based on the fixed route duration, and the termination time is limited according to the deadline constraint. Positive integer route durations actually included in the search are processed within the candidate departure window and within the allowed deadline. Each search domain only accepts termination tags that arrive at the mission endpoint at the fixed departure time plus the fixed duration; earlier arriving tags are not directly validated based on the longer audit missing quantity upper limit.

[0140] The number of audit deficiencies and their upper limit are as follows:

[0141]

[0142] in, This indicates the total number of time slots lacking audit services; Indicates the maximum number of audit missing time slots allowed; This indicates rounding down. The upper limit is consistent within a fixed-duration search domain; search domains of different durations are calculated separately. Energy consumption is accumulated by flight segment or unit of time, with a deadline constraint limiting the termination time. The search uses a non-negative additive main path cost, and the meaning and unit of this cost remain consistent within the same search.

[0143] Sub-step S5b: Select the search method. Candidates returned by each search method are reviewed using the original metrics and resource constraints; the admission criteria cannot be relaxed due to approximate or bounded searches. Specifically,

[0144] ① When both energy consumption and audit missing quantities need to be treated as cumulative resources and can be accurately encoded as bounded non-negative integers, execute sub-step S5c and adopt dual-resource dynamic programming.

[0145] ② If only one of the constraints needs to be processed as a cumulative resource, and the other is automatically satisfied for all paths in the current search domain, and the shortest main path cost after ignoring the constraints of the resource to be processed is greater than 0, then execute sub-step S5d and use single resource cost scaling.

[0146] ③ If the above conditions are not met, sub-step S5e can be executed, using bounded non-dominated enumeration.

[0147] Sub-step S5c performs dual-resource dynamic programming. This further includes:

[0148] Sub-step S5c1 accurately encodes energy consumption and audit missing quantities as non-negative integers, and determines the upper limit of energy consumption respectively. and the upper limit of audit missing quantity Resource values ​​and their upper limits use the same units and encoding rules;

[0149] Sub-step S5c2, establish the dynamic programming state. Store the minimum main path cost that accurately reaches this state, where, For the extended state, For cumulative energy consumption, To accumulate the number of missing audit slots, and satisfy the following conditions: and ;

[0150] Sub-step S5c3 expands the tags in chronological order, adding the energy consumption, audit missing amount, and main path cost corresponding to the transfer per unit time, and deleting tags exceeding any resource limit. This applies only to the same expanded state. Compare dominance relationships; if a tag's cumulative energy consumption, cumulative audit missing count, and main path cost are all no greater than another tag's, and at least one of these is strictly hourly, delete the dominated tag. Dominance deletion is not directly applied to tags with different locations, times, or consecutive missing counters. Each tag retains precursor information for backtracking segments and departure times; nodes with the same location but different internal expansion identifiers within the original segment are handled according to their respective states.

[0151] Sub-step S5c4 determines the resource-feasible path with the lowest main path cost within the current search domain in the termination state that meets the deadline requirement, and hands it over to the subsequent candidate review and certificate generation process.

[0152] The aforementioned dominance relationship does not use monitoring redundancy margin as a label dimension; therefore, the candidate pool returned by dynamic programming does not automatically include all feasible paths with the largest monitoring redundancy margin. When comparing candidates by monitoring redundancy margin, only candidates that are actually returned and have comparable margins are ranked, and this ranking result is not represented as the result of the global maximum margin among all feasible paths. The above optimality is limited to continuous risk, audit, and energy consumption constraints within the current search domain; when monitoring probability constraints or shared capacity constraints are subsequently enabled, deleted paths may have different redundancy or resource consumption distributions. Therefore, it cannot be asserted that there are no paths that satisfy all applicable constraints simply because all returned candidates failed subsequent verifications; other actually generated candidates or records should be checked further.

[0153] Sub-step S5d performs single-resource cost scaling. This further includes:

[0154] Sub-step S5d1 calculates the shortest main path cost within a fixed search domain that has undergone continuous risk pruning and time constraints, ignoring the single cumulative resource constraint that needs to be addressed. ,in, ;

[0155] Sub-step S5d2, based on precision parameters and the number of unit time transitions contained in a fixed path calculate:

[0156]

[0157] in, This represents the scaling factor for the main path cost; This represents the number of time transitions per unit of time contained in each complete path within the current fixed-duration search domain, and is a positive integer.

[0158] Sub-step S5d3, for the unit time transfer arc Scaling the main path cost:

[0159]

[0160] in, Represents arc The non-negative original main path cost; This represents the scaled non-negative integer cost. Using the expanded state and cumulative scaling cost as dynamic programming indices, the minimum original cumulative resource value is retained for each index, and labels are removed based on the original resource upper limit. Scaling only affects the main path cost, not energy consumption or audit missing quantities. First, using the single cumulative resource as the arc weight, the complete path with the minimum cumulative resource is found in chronological order within the pruned fixed search domain. If its resource value exceeds the upper limit or no complete path exists, the fixed search domain is infeasible. Otherwise, the path is considered a feasible upper bound path, and its cumulative scaling cost is used as the upper limit of the dynamic programming index. Arcs with zero scaling cost and other arcs are processed in chronological order, retaining path backtracking information. Since the scaling cost of all arcs is non-negative, this upper limit does not exclude feasible paths with the minimum cumulative scaling cost.

[0161] Sub-step S5d4: Select the path with the lowest cumulative scaling cost from the feasible termination labels, and review it according to the original cost and original resource value; when a feasible path exists and the above applicable conditions are met, the original main path cost of the returned path shall not exceed:

[0162]

[0163] in, This represents the minimum original main path cost that satisfies the single cumulative resource constraint within a search domain with the same fixed departure time and fixed route duration. This approximation does not allow resource overruns, nor does it guarantee global optimality under all constraints. The above scaling factor is not used at this time; This document does not prove the existence of a resource-feasible path with an initial cost of 0, nor does it exclude the existence of resource-feasible paths with higher initial costs. In such cases, appropriate methods such as two-resource dynamic programming or bounded non-dominated enumeration are used. The scaling and upper bounds mentioned above guarantee a finite search domain and provide the approximate cost relationship. However, the lower bound obtained by ignoring resources alone cannot guarantee that the scaling index number depends solely on the graph size and precision parameters; therefore, this document does not claim that the specific implementation has a fully polynomial running time.

[0164] Sub-step S5e performs bounded non-dominated enumeration and verification. Within the limited enumeration range, non-dominated candidates are retained. For the returned complete candidates, the three certificate indicators, energy consumption, and completion time are recalculated according to the original definitions, and verified using the original thresholds. The absence of feasible candidates in the bounded enumeration only indicates that they were not found within the actual enumeration range; it does not mean that no feasible solution exists for all possible routes and departure times. The optimal result among the returned candidates is not presented as a globally optimal result that has not been fully proven through a search.

[0165] Sub-step S5f summarizes the candidates returned from each fixed departure time and fixed route duration search domain and verified by the original constraints. It calculates the longest continuous monitoring blind zone, worst-case takeover waiting time, and audit record completeness according to the original indicator definitions, generating a three-field certificate with these three indicators as the three core verification fields. The certificate is then selected based on the main path cost. When monitoring redundancy evaluation is enabled and monitoring redundancy margins need to be compared, comparisons are only made if all candidates have this margin and the same failure mode is used for calculation. For branches that have been pruned and have not formed a complete route, only the determined violation reasons are recorded; indicators that have not yet been calculated are not entered as determined certificate values.

[0166] when At that time, The total length of the middle is A set of consecutive time slot windows In the independent observation failure mode, the monitoring redundancy margin is:

[0167]

[0168] in, Indicates monitoring redundancy margin; This displays the complete evaluation window; Indicates time slot The original number of available monitoring capability sources. Available observations provided by the same capability source in different time slots are counted as source-time slot observations respectively.

[0169] In the common failure mode, first identify the set of different common failure groups within the window that have provided at least one available monitoring observation:

[0170]

[0171] Recalculate:

[0172]

[0173] in, This represents a set of common failure groups that include sources of monitoring capability; Display window The system provides the number of different groups of available monitoring observations. Within the same window, if the same group contains multiple capability sources or provides observations in multiple time slots, it is counted as only one independent redundant unit. The counting objects for the two failure modes are different and cannot be directly mixed or compared across modes.

[0174] when When there is no complete evaluation window, candidates are still verified according to the three basic indicators and resource constraints, but the monitoring redundancy margin is not artificially assigned to 0 or positive infinity, nor is the candidate included in the direct comparison of the dependency margin value.

[0175] For a candidate with a complete evaluation window, the certificate record can be represented as:

[0176]

[0177] in, Indicates candidate Certificate records; This indicates a identified constraint bottleneck or set of reasons for violation. A "three-field certificate" refers to a certificate whose three core verification fields are the longest continuous monitoring blind zone, the worst-case takeover wait time, and the completeness of audit records; departure time, candidate routes, monitoring redundancy margin, and the set of reasons are associated information and are not part of these three core verification fields. This is used to record identified causes, and it is not required to prove through additional algorithms that it represents the smallest set of all violation causes. Candidates without a complete monitoring and evaluation window still record the three core verification fields and other applicable related information, but do not include undefined monitoring redundancy margin values.

[0178] 6. Step S6: Access Decision and Disposal Output

[0179] In this step, the corresponding candidate is determined as a release candidate only when the longest continuous monitoring blind zone is not greater than the monitoring threshold, the worst takeover waiting time is not greater than the control takeover threshold, the audit record completeness is not lower than the audit threshold, and both energy consumption constraints and time limit constraints are met. The release result is determined from the release candidates returned from the actual search and verified according to the original indicator definitions and original constraints. For candidates that are not released or for tasks where no release candidate is found within the actual inspection range, the reason for the violation is recorded, and the handling result is output, such as rerouting, adjusting departure time, adding temporary facilities, or refusing to release the current task.

[0180] The original indicators refer to the longest continuous monitoring blind zone, worst takeover waiting time, and audit record completeness calculated according to the non-empty occupied time slot set and time slot-by-time slot capability availability sequence of candidate routes and departure times, as defined in this method. The original constraints refer to the monitoring threshold, control takeover threshold, audit threshold, energy consumption constraint, and deadline constraint obtained in step S1, as well as the shared capacity constraint and monitoring probability constraint applicable in the adopted implementation method. "Original" is relative to the cost scaling, resource integer encoding, and alternative evaluation quantities used in path search. During the review, the above-mentioned indicator definitions and corresponding thresholds, upper limits, and units of measurement are used. The three core verification fields are not replaced by the scaled path cost, average coverage, or cumulative uncovered time slots, and the constraints are not relaxed due to approximate or bounded search. When resources are encoded using equivalent integer encoding, they are verified according to the same encoding rules or restored to the unit before encoding before verification.

[0181] The process involves calculating the three-field constraint margin using three core verification fields and their corresponding thresholds, calculating the diversion cost using the path cost between the candidate route and the baseline route, and determining the resource-per-resource and time-slot-per-time-slot-per-resource requirements based on the calculation parameters of the candidate route-departure time pair and the shared resource requirements. The original constraints also include shared capacity constraints and monitoring probability constraints.

[0182] Specifically, step S6 takes candidate certificates, search results, and applicable resource constraints as input. First, it performs a self-constraint check on the candidate. For a single task, the candidate is determined as a passable candidate if all three core check fields, energy consumption constraints, and deadline constraints are met. In a multi-task shared capacity implementation, candidates that pass the self-constraint check are further checked for shared capacity; only those that also meet the shared capacity constraints are included in the pass set. If a check fails, the following actions are taken based on the determined reason: rerouting, adjusting departure time, adding temporary facilities, or rejecting the current task's pass. Figure 1 The "whether the current candidate satisfies all constraints" in the text includes the above-mentioned verification corresponding to the implementation method adopted.

[0183] Furthermore, step S6 specifically includes:

[0184] Sub-step S6a involves summarizing the candidate, three-field certificates, and violation reasons returned during the actual inspection and search of the current low-altitude flight mission. In the multi-mission shared capacity implementation, the candidate, three-field certificates, shared resource requirements, and violation reasons for each mission are summarized to form a candidate set used for admission decision-making. The formed candidate set does not necessarily represent an exhaustive list of all possible routes and departure times.

[0185] Sub-step S6b verifies each complete candidate:

[0186]

[0187] The energy consumption and completion time are also verified. Only candidates that meet all requirements are retained in the release pool.

[0188] Under the condition of independent observation failure, assume To cover the positive integer evaluation time domain length of all candidate occupied time slots, This represents the maximum allowed risk limit for the longest continuous monitoring blind zone for this candidate. Assuming that each originally available source-timeslot monitoring observation fails independently of the others, with a failure probability not exceeding [percentage missing], the failure probability is not less than [percentage missing]. , Then the following is required:

[0189]

[0190] in, Represents the natural logarithm; This indicates rounding up. This conclusion is conditional on the independence and probabilistic upper bound of source-slot observation failures.

[0191] Under common failure conditions, the failure of all previously available monitoring observations within a window for a common failure group is considered a window failure event for that group; if the window failure events of different groups are independent of each other, the probability of each group's event does not exceed , Then the following is required:

[0192]

[0193] in, This represents the upper bound of the probability of window failure events for a common failure group, relative to the service quality threshold. Different groups having different identifiers does not automatically satisfy the event independence requirement. The above probability check is only enabled when a complete evaluation window exists and the corresponding assumptions hold. This is a single candidate risk upper limit, not a direct representation of the joint risk upper limit when multiple tasks run simultaneously. If the complete evaluation window, corresponding independence conditions, or failure probability upper bound conditions are not met, no probability guarantee is made based on the aforementioned monitoring probability constraint formula. The above failure probability conclusions are predicated on the validity of the nominally available observations used for calculation and the corresponding failure probability model; they do not automatically cover the error of marking actually unavailable services as available on the infrastructure map; the confidence lower bound itself is not equivalent to a joint probability guarantee for the entire route.

[0194] In the multi-task shared capacity implementation, sub-step S6c determines the processing order or selection priority of tasks and candidates based on task weights, constraint margins, or rerouting costs. When all returned candidates have monitoring redundancy margins and use the same failure mode, the monitoring redundancy margin can be used as a ranking factor under the same counting caliber. The processing order or selection priority does not replace the verification of the candidate's own hard constraints and shared capacity hard constraints, nor does it constitute a globally optimal guarantee without corresponding search proof. Specifically, the constraint margins for monitoring and takeover are the corresponding thresholds minus the corresponding indicators, and the audit constraint margin is the audit record completeness minus the audit threshold; task weights are given by the task request and not deduced from the three certificate fields. The rerouting cost adopts the path cost caliber consistent with the baseline route.

[0195] Sub-step S6d involves summarizing the resource requirements of candidates for release based on at least one of the following shared resources: control takeover resources, trusted log bandwidth, edge processing resources, or corridor quotas. For each task, at most one candidate is selected, and the summed resource requirement of any shared resource in any corresponding time slot does not exceed the corresponding shared capacity. The release set is then determined. The release set can be determined sequentially according to the processing order or using a combination of methods. Regardless of the method used, the proposed release set is reviewed against the original shared capacity constraints. This distinguishes between two reasons: candidates failing to meet their own constraints and candidates meeting the requirements but lacking sufficient shared capacity. Shared resource requirements are determined based on task service requirements and the specific resources used by candidates in each time slot. When the same physical facility is split into multiple virtual capacity sources, the shared physical capacity is still summarized using the same resource identifier; capacity cannot be repeatedly increased due to virtual splitting. Capacity occupied by existing released tasks should be included in the summed requirements or deducted from the total capacity before using the remaining capacity.

[0196] Sub-step S6e outputs the admission and processing results. For candidates meeting all applicable conditions, output release results and save the selected route, departure time, certificate, applicable constraint margins, and infrastructure source information. If the current route does not meet the requirements, but other routes actually checked meet all applicable constraints, output a rerouting result; if the current departure time does not meet the requirements, but other times actually checked within the candidate window have release candidates, output an adjusted departure time result. Alternative routes or alternative times must have already undergone corresponding verification.

[0197] If it has been determined that monitoring, control takeover, or auditing capabilities are insufficient and corresponding temporary facilities can supplement these capabilities, suggestions should be output to add temporary monitoring receivers, control takeover nodes, or trusted log gateways, respectively. Adding a suggestion does not equate to meeting the access criteria; after the temporary facility status is written to the updated infrastructure map, candidate verification should be re-executed. If no passable candidate is found within the actual inspection scope, or if the shared capacity is insufficient and no verified alternative candidate is found, the current task should be rejected with an explanation of the reason and the inspection scope.

[0198] II. Description of Experiments and Application Scenarios

[0199] The following combination Figures 3 to 5 This section describes the candidate evaluation results under different capability configurations, thresholds, and failure conditions. The thresholds for different experiments need not be the same; methods in the same comparative experiment use a common candidate set and certificate evaluation criteria. Experimental conclusions are limited to the corresponding settings and should not be considered definitive conclusions for all operating scenarios.

[0200] 1. The relationship between the three certificate indicators

[0201] Figure 3 The diagram illustrates the pairwise relationships of the three certificate indicators, denoted as Experiment 0: the dimensions of the certificates are not collinear. In this diagram, (a) represents the relationship between monitoring and takeover; (b) represents the relationship between monitoring and auditing; and (c) represents the relationship between takeover and auditing. Figure 3 The scatter points in each graph represent the longest continuous monitoring blind zone, worst-case takeover wait time, and audit record completeness of the candidates, respectively. In the sample shown, the Pearson correlation coefficients for the three pairwise relationships are approximately 0.10, -0.15, and -0.10, and the Spearman correlation coefficients are approximately 0.14, -0.13, and -0.11; approximately 16 candidates lie on the Pareto front, representing about 0.7% of the sample. This result indicates that a candidate with a better performance on one indicator may still fail to meet the requirements on another indicator, and a single indicator cannot replace the others. The aforementioned weak correlations are results from this experimental data and should not be interpreted as necessarily indicating statistical independence among the three service types.

[0202] 2. Redundancy margin for continuous blind zones, admission results, and independent failure monitoring.

[0203] Figure 4 This diagram illustrates the comparison of monitoring redundancy margins under average coverage, access feasibility, and independent failure conditions. Figure 4 (a) shows the relationship between average coverage and the longest continuous monitoring blind zone. Figure 4 (b) Compare the access feasibility under different selection methods. Figure 4 In the middle (c), the relationship between monitoring redundancy margin and risk target is represented under independent source-time slot failure conditions.

[0204] Figure 4(a) shows the relationship between average coverage and the longest continuous blind zone; among the 2400 candidates, 278 have an average monitoring coverage of not less than 80% but the longest continuous blind zone is not less than 10 time slots, and the correlation coefficient between the two is approximately -0.83.

[0205] Figure 4 (b) Comparison of different selection methods: Within the range of 300 tasks and 8 candidates per task, 248 tasks have at least one candidate that meets the three-field requirement; the shortest route selection has 88 approved and 212 violated, of which 160 tasks had avoidable violations; the average coverage selection has 133 approved and 167 violated, of which 115 tasks had avoidable violations; after certificate filtering, 248 tasks were allowed, and the remaining 52 tasks were not allowed within the candidate range.

[0206] Figure 4 In Figure (c), the relationship between monitoring redundancy margin and risk target is shown under independent source-time slot failure conditions. In the parameter settings shown, the probability of a single observation failure is 0.2, the risk target is 0.05, the monitoring threshold is 8 time slots, the evaluation time domain is 120 time slots, and the corresponding minimum observation requirement is 5. This requirement and the 418 sample results that meet the requirement are based on the corresponding evaluation time domain and independent failure conditions, and cannot be generalized beyond the assumptions.

[0207] 3. Impact of infrastructure map misjudgments and co-failures

[0208] Figure 5 This diagram illustrates the impact of infrastructure map misjudgments and common failure grouping on the alignment results. Figure 5 In the middle (a), it represents the optimism error of Experiment 9a: Infrastructure Map. Figure 5 (b) indicates Experiment 9b: Common mode failure of monitoring capability.

[0209] Figure 5 In (a), it is shown that when an actually unavailable service is mistakenly marked as available, the predicted allowable rate may increase from approximately 91% to approximately 98%, while the violation rate obtained by reviewing the actual service status may increase from 0 to approximately 37%. This result indicates that capability determination depends on the confidence level of the input map, and the use of a confidence lower bound aims to reduce the situation where optimistic estimates are directly used to determine the availability status.

[0210] Figure 5(b) represents the difference between the original number of capability sources and the number of different co-failure groups under co-failure conditions. In the settings shown, the upper bound of the group failure probability is 0.05, the risk target is 0.05, the minimum margin requirement for counting by independent source-time slot observations is 5, and the minimum margin requirement for counting by different co-failure groups is 3; these are verification thresholds, not the fixed number of sources or groups actually present in each candidate. Calculating directly based on the original number will result in duplicate counting of capability sources within the same group. The proportion of candidates exceeding the risk target in the figure is a statistical measure of experimental candidates and is not equivalent to the actual probability of failure in all flight missions. The source counting method accepts all sampled candidates, but approximately 10% of the sampled candidates have an actual monitoring probability exceeding the risk target; the group counting method accepts fewer candidates, and the sampling verification of the accepted candidates did not show any cases exceeding the risk target. The statistical denominator for "violation" in the figure is all sampled candidates and cannot be compared with... Figure 4 (c) The single candidate monitoring out-of-limit probability is mixed.

[0211] III. Examples of Low-Altitude Airway Access Systems

[0212] This disclosure also provides a low-altitude airway access system based on a three-field certificate, including a data and constraint acquisition module, a capability classification module, a candidate construction and capability projection module, a continuous risk pruning module, a three-field certificate generation module, and an access decision and handling output module. Each module forms a functional processing chain corresponding to the method embodiment, and its inputs, outputs, parameters, and applicable conditions are consistent with the aforementioned method.

[0213] The data and constraint acquisition module is used to acquire mission requests for low-altitude flight missions, low-altitude corridor maps, candidate departure windows, heterogeneous IoT infrastructure maps with time indices, as well as monitoring, control takeover, auditing, energy consumption, and deadline requirements. In the implementation where monitoring redundancy evaluation is enabled, this module also acquires the adopted failure mode; when monitoring probability verification is further enabled, it also acquires the evaluation time domain, the upper limit of single candidate monitoring risk, and the upper bound of failure probability corresponding to the adopted failure mode; in the multi-mission shared capacity implementation, it also acquires shared capacity constraints.

[0214] The capability classification module categorizes infrastructure services into three types: monitoring, control takeover, and trusted auditing. In the implementation with monitoring redundancy assessment enabled, this module further breaks down multi-capability physical facilities into corresponding virtual capability sources and retains common deployment identifiers and applicable common failure identifiers; when adopting common failure modes, it also establishes common failure groups based on common failure relationships. The candidate construction and capability projection module constructs candidate route-departure time pairs, determines the set of non-empty occupied time slots and spatiotemporal trajectories, and forms a time-slot availability sequence for the three types of capabilities; in the implementation with monitoring redundancy assessment enabled, it also forms a sequence of the original number of available monitoring capability sources and, under common failure modes, a common failure group availability sequence.

[0215] The continuous risk pruning module is used to construct a time-extended state graph, maintain a continuous monitoring capability missing counter and a continuous control takeover capability missing counter along the candidate non-empty occupied time slot set, perform zeroing or incrementing based on the capability status of each time slot, delete the state transition of the corresponding counter after the update that exceeds the threshold and record the reason for the violation; it is also used to delete the termination state with the continuous control takeover capability missing counter greater than zero after processing the last occupied time slot, and determine the waiting time of no subsequent takeover opportunity in the candidate occupied time slot set as positive infinity.

[0216] The three-field certificate generation module performs an applicable resource constraint search on the pruned time-extended state graph. It calculates the longest continuous monitoring blind zone, worst-case takeover wait time, and audit record completeness of complete candidates according to the original indicator definitions, and generates a three-field certificate with these three indicators as the three core verification fields. When monitoring redundancy evaluation is enabled and a complete evaluation window exists, this module also calculates the monitoring redundancy margin according to the adopted failure mode and associates it with the certificate information. The candidates returned by the search are reviewed according to the original indicator definitions and original constraints.

[0217] The access decision and handling output module is used to determine whether a candidate can be released based on three core verification fields, energy consumption constraints, and deadline constraints. In the multi-task shared capacity implementation, it is also used to determine the release set under the condition that each task selects at most one candidate and the total resource demand of any shared resource in any corresponding occupied time slot does not exceed the corresponding shared capacity. The margin is compared only when the actual returned candidate has a comparable monitoring redundancy margin. For candidates that do not meet the applicable requirements or for tasks where no release candidate is found within the actual inspection range, this module outputs the reason for the violation and the handling result, such as rerouting, adjusting the departure time, adding corresponding temporary facilities, or refusing to release the current task.

[0218] IV. Examples of Electronic Devices

[0219] This disclosure also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable by the processor. When the program is executed, the electronic device acquires task and infrastructure data, performs capability classification, candidate construction and capability projection, continuous risk pruning, and resource constraint search, generates a three-field certificate with the longest continuous monitoring blind zone, worst-case takeover wait time, and audit record completeness as three core verification fields, and outputs admission and disposal results based on the three core verification fields, energy consumption constraints, and deadline constraints; in corresponding embodiments, it further performs common failure grouping, monitoring redundancy evaluation, monitoring probability verification, or multi-task shared capacity verification.

[0220] The memory is used to store task data, infrastructure capability data, thresholds and resource constraints, search status, candidate certificates, and disposal records. The processor performs calculations according to the aforementioned time range, parameter definitions, and applicable conditions. Single resource cost scaling, monitoring redundancy margins under different failure modes, and probabilistic constraints are only used when their respective conditions are met, and parameters and conclusions from different methods are not mixed.

[0221] V. Examples of Computer-Readable Storage Media

[0222] This disclosure also provides a computer-readable storage medium storing a computer program thereon. When executed by a processor, the program implements the data and constraint acquisition, capability classification, candidate construction and capability projection, continuous risk pruning, three-field certificate generation, and access decision and disposal output in the aforementioned low-altitude route access method; common failure grouping, monitoring redundancy evaluation, monitoring probability verification, and multi-task shared capacity verification are only performed when the corresponding implementation method is adopted. The candidate definitions, capability categories, formulas, resource constraints, failure modes, and output rules used by the program correspond to the method embodiments.

[0223] VI. Other Instructions

[0224] Those skilled in the art will understand that the above-described system modules are described according to their assigned processing functions, and their corresponding functions can be implemented by program code stored in memory and executed by a processor. This disclosure does not limit the specific programming language for implementing the above processing procedures, but the specific implementation should follow the stated data relationships, operation rules, and constraints, and the functional division of modules does not change the corresponding technical processing requirements.

[0225] This disclosure uses step numbers and sub-step numbers to distinguish different processing contents and indicates the correspondence between detailed processes. For processes with clear temporal order, data dependencies, and those that must be executed sequentially, they should be implemented according to the corresponding relationships; the above numbering should not be interpreted as allowing arbitrary changes to the processing order of consecutive time slots, dependencies of generation before verification, or other clearly defined execution conditions.

[0226] The use of terms such as "including" or "comprising" in this disclosure does not exclude the existence of other components or processing contents not listed, but does not omit explicitly required technical features, nor does it change explicitly stated quantities, thresholds, or applicable conditions. For example, the maximum number of candidates selected per task, the length of the complete evaluation window, and the calculation conditions for different failure modes should still be understood and implemented as described above.

[0227] The above embodiments are used to illustrate the technical solutions of this disclosure, enabling those skilled in the art to understand the corresponding technical means and their functions, rather than limiting the scope of protection to a certain set of experimental parameters or a specific scenario. When modifying or equivalently substituting the described embodiments, the compatibility between the relevant technical means and their applicable conditions should be maintained. The scope of protection of this disclosure is determined by the scope defined in the claims.

Claims

1. A low-altitude airway access method based on a three-field certificate, characterized in that, include: Step S1, Data and Constraint Acquisition: Obtain a heterogeneous IoT infrastructure map of mission requests, low-altitude corridor maps, candidate departure windows, and time indices for low-altitude flight missions, and obtain monitoring thresholds, control takeover thresholds, audit thresholds, energy consumption constraints, and deadline constraints. Step S2, Ability Classification: Based on the heterogeneous IoT infrastructure map, the services provided by the heterogeneous IoT infrastructure are divided into three categories: monitoring, control takeover, and trusted auditing capabilities. Step S3, Candidate Construction and Capability Projection: Construct candidate route-departure time pairs, determine the spatiotemporal trajectory and non-empty time slot set for each candidate route-departure time pair, and project the three types of capabilities onto the spatiotemporal trajectory according to the service availability status of the candidate route-departure time pairs at the corresponding locations and time slots, forming a time slot-by-time availability sequence of monitoring capabilities, control takeover capabilities, and audit capabilities. Step S4, continuous risk pruning: In the time-extended state diagram, a continuous monitoring capability missing counter and a continuous control takeover capability missing counter are maintained along the set of occupied time slots for each candidate route-departure time slot. The corresponding counters are cleared or incremented according to the corresponding capability availability status of each time slot. State transitions where the updated corresponding counter exceeds the monitoring threshold or control takeover threshold are removed. After processing the last occupied time slot, the termination state where the end continuous control takeover capability missing counter is greater than zero is deleted. Step S5, Three-field certificate generation: In the time-extended state diagram after pruning, path search is performed according to the audit missing amount, energy consumption constraint and deadline constraint. For the complete candidates obtained by the search, the longest continuous monitoring blind zone, the worst takeover waiting time and the audit record completeness are calculated, and a three-field certificate is generated with the longest continuous monitoring blind zone, the worst takeover waiting time and the audit record completeness as the three core verification fields. Step S6, Admission Decision and Disposal Output: The corresponding candidate is determined as a release candidate only when the longest continuous monitoring blind zone is not greater than the monitoring threshold, the worst takeover waiting time is not greater than the control takeover threshold, the audit record completeness is not lower than the audit threshold, and both energy consumption constraints and time limit constraints are met; the release result is determined from the release candidates returned by the actual search and reviewed according to the original indicator definition and original constraints; for candidates that are not released or for tasks that cannot be released within the actual inspection range, the reason for the violation is recorded, and the handling result of rerouting, adjusting the departure time, adding temporary facilities, or refusing to release the current task is output; The original indicators include the longest continuous monitoring blind zone, the worst takeover waiting time, and the audit record completeness calculated according to the non-empty occupied time slot set and the time slot-by-time slot capability availability sequence of candidate route-departure time pairs; the original constraints include: monitoring threshold, control takeover threshold, audit threshold, energy consumption constraint, and deadline constraint.

2. The low-altitude airway access method based on a three-field certificate according to claim 1, characterized in that, Step S4 includes: Sub-step S4a: Construct a time-extended state diagram for fixed candidate departure times, expand flight segments with a flight duration greater than one time slot into unit time transitions, and keep the total flight duration and total energy consumption consistent before and after expansion. Sub-step S4b represents the extended state as follows: And before processing the first occupied time slot, both counters are initialized to zero, where, Indicates a route node or expansion node. Indicates the time position of the state. and These represent the number of occupied time slots up to the most recent time slot, the number of consecutive time slots lacking monitoring capability ending at that occupied time slot, and the number of consecutive time slots lacking control takeover capability, respectively. Sub-step S4c, by time The current time slot is being processed. When the corresponding capability is available, the corresponding counter is cleared to zero; otherwise, it is incremented by one, and then the process proceeds to the next time position. For a continuous control takeover capability missing interval in which control takeover capability appears in a subsequent occupied time slot, the maximum value reached by the continuous control takeover capability missing counter before the takeover opportunity occurs is equal to the time slot difference from the first missing time slot in the interval to the takeover opportunity. Sub-step S4d, after pruning and updating, satisfies or The state transition is completed, and the reason for the violation is recorded; after processing the last occupied time slot, it is deleted. The termination state is defined as the waiting time for the candidate to have no subsequent takeover opportunity within the occupied time slot set as positive infinity, where, and These are the monitoring threshold and control takeover threshold, respectively, expressed in uniform time slot numbers, both of which are non-negative integers; The counter update, end check, and waiting time are all bounded by the same set of non-empty occupied time slots, and the time slot difference measurement caliber is the same as that of the worst takeover waiting time in step S5.

3. The low-altitude airway access method based on a three-field certificate according to claim 2, characterized in that, Step S5 includes: Sub-step S5a: Establish a search domain for fixed departure time and fixed route duration, represent audit missing quantity and energy consumption as non-negative cumulative resources, determine the upper limit of audit missing quantity based on the fixed route duration, and limit the termination time according to the deadline constraint; In sub-step S5b, depending on the cumulative number of resource constraints to be processed and the integer encoding conditions, select the search method corresponding to sub-step S5c, sub-step S5d, or sub-step S5e. For the same search domain, use a non-negative additive main path cost with consistent meaning and unit. Sub-step S5c: When both energy consumption and audit missing quantities need to be treated as cumulative resources and can be accurately encoded as bounded non-negative integers, perform dual-resource dynamic programming. Sub-step S5d: When only one cumulative resource constraint needs to be processed, the other cumulative resource constraint is automatically satisfied by all paths in the current search domain, and the shortest main path cost after ignoring the cumulative resource constraints to be processed is greater than zero, single resource cost scaling is performed. In sub-step S5e, when using bounded non-dominated enumeration, non-dominated candidates are returned within the limited enumeration range, and their longest continuous monitoring blind zone, worst-case takeover wait time, audit record completeness, energy consumption, and completion time are reviewed according to the original definition. Sub-step S5f: Summarize the candidates returned by each search domain and verified by the original constraints, calculate the three core verification fields according to the original index definition and generate a three-field certificate, and hand it over to step S6 for admission verification and selection; if no candidates that can be allowed are returned, record the actual search range and the determined reasons for violation.

4. The low-altitude airway access method based on a three-field certificate according to claim 3, characterized in that, The sub-step S5c includes: Sub-step S5c1 accurately encodes energy consumption and audit missing quantities as non-negative integers, and determines the upper limit of energy consumption respectively. and the upper limit of audit missing quantity Resource values ​​and their upper limits use the same units and encoding rules; Sub-step S5c2, establish the dynamic programming state. Store the minimum main path cost that accurately reaches this state, where, For the extended state, For cumulative energy consumption, To accumulate the number of missing audit slots, and satisfy the following conditions: and ; Sub-step S5c3 expands the states in chronological order, accumulates the corresponding energy consumption, audit missing amount, and main path cost for the transfer, and deletes tags that exceed any resource limit; for the same expanded state... When the cumulative energy consumption, cumulative audit missing amount, and main path cost of a tag are all no greater than those of another tag, and at least one of them is strictly less than the other tag, the dominated tag is deleted. Sub-step S5c4 determines the resource-feasible path with the lowest main path cost within the current search domain in the termination state that meets the deadline requirement, and hands it over to the subsequent candidate review and certificate generation process.

5. The low-altitude airway access method based on a three-field certificate according to claim 3, characterized in that, The sub-step S5d includes: Sub-step S5d1 calculates the shortest main path cost within a fixed search domain that has undergone continuous risk pruning and time constraints, ignoring the single cumulative resource constraint that needs to be addressed. ,in, ; Sub-step S5d2 determines the main path cost scaling factor according to the following formula: ； in, Using the same units as the original main path cost, This is a dimensionless approximate accuracy parameter. This represents the number of time transitions per unit of time contained in each complete path within the current fixed-duration search domain, and is a positive integer. Sub-step S5d3, for the unit time transfer arc Its main path cost is scaled according to the following formula: ； in, For arc The non-negative original principal path cost, The cost is a scaled non-negative integer. This indicates rounding down; using the extended state and cumulative scaling cost as dynamic programming indices, retaining the minimum original cumulative resource value corresponding to each index, and deleting tags whose resource value exceeds the original upper limit; In sub-step S5d4, select the path with the lowest cumulative scaling cost from the feasible termination labels, and review it according to the original cost and original resource value; if a feasible path exists, the original main path cost of the returned path shall not exceed [a certain value]. ,in, The minimum original main path cost that satisfies the single cumulative resource constraint within the same fixed search domain.

6. The low-altitude airway access method based on a three-field certificate according to claim 1, characterized in that, In step S1, failure modes for monitoring redundancy margin calculation are also obtained, and the failure modes are independent observation failure modes or common failure modes. In step S2, physical facilities with multiple capabilities are divided into corresponding virtual capability sources, and common deployment identifiers and applicable common failure identifiers are retained; when adopting the common failure mode, capability sources are grouped into common failure groups based on at least one common failure relationship among the IoT facility's site, backhaul link, power source, and operating entity. In step S3, the number of original available monitoring capability sources that have not been deduplicated according to the common failure relationship is saved, and the time slot availability status of the common failure group is saved when the common failure mode is adopted. In step S5, for candidates whose number of occupied time slots is not less than the number of time slots represented by the monitoring threshold plus one, all continuous time slot windows with a length equal to the number of time slots represented by the monitoring threshold plus one are taken as complete monitoring evaluation windows; in the independent observation failure mode, the number of available source-time slot monitoring observations in each window is counted; in the common failure mode, the same common failure group that has provided at least one available monitoring observation in each window is counted as only one independent redundant unit, and the minimum value among the statistical values ​​of each window is determined as the monitoring redundancy margin, and the monitoring redundancy margin is used as the association information of the three-field certificate; In step S6, the monitoring redundancy margin is compared only among candidates that have a complete monitoring evaluation window, have determined the monitoring redundancy margin, and use the same failure mode.

7. The low-altitude airway access method based on a three-field certificate according to claim 6, characterized in that, Step S2 includes: Sub-step S2a divides the capability sources into monitoring capability sources, control takeover capability sources, and trusted audit capability sources, which are respectively used to provide aircraft observation or status acquisition services, command and control or takeover services that meet the corresponding service quality and latency requirements, and trusted record formation, retention or forwarding services. Sub-step S2b splits physical facilities that simultaneously provide multiple types of capabilities into corresponding virtual capability sources, and ensures that the virtual capability sources formed by splitting the same physical facility retain a common deployment identifier and an applicable common failure identifier. Sub-step S2c establishes a common failure group based on common site, common backhaul link, common power source, or common operating entity relationship. For capability sources that have not established a common failure relationship with other capability sources, they are divided into a separate common failure group. The common failure groups are formed according to the preset common failure judgment rules and do not overlap with each other. Each capability source corresponds to a unique common failure group.

8. The low-altitude airway access method based on a three-field certificate according to claim 7, characterized in that, Step S3 includes: Sub-step S3a: Obtain the capability source In position Time slot For ability categories Service quality estimate and its lower bound of confidence The confidence lower bound and the corresponding service quality threshold adopt the same dimension or evaluation scale, and the service level not lower than the smaller value is represented by the larger service quality value; Sub-step S3b determines the time-slot availability status of the capability source according to the following formula: ； in, This indicates the candidate route-departure time pair. This represents the source index of the capability within the corresponding capability category. Indicates the type of monitoring, control takeover, or audit. Indicates the position to be evaluated. Indicates the time slot index. Indicates candidate In the time slot Location, Indicates ability category The service quality threshold, Indicates the availability status of the capability source. The superscript indicates an indicator function that takes a value of 1 if the condition is true and zero otherwise. Used to identify the corresponding candidate.

9. The low-altitude airway access method based on a three-field certificate according to claim 8, characterized in that, Step S3 further includes: Sub-step S3c determines the available states and the number of original available capability sources for the three types of capabilities according to the following formulas: ； in, Indicates ability category A collection of capability sources; This indicates that the category is in the time slot. Does at least one qualified capability source exist? This represents the corresponding original available capability source quantity; taking three categories respectively, we obtain... , and ; Sub-step S3d determines the slot-by-slot availability of the common failure group according to the following formula: ； in, Indicates the common failure group identifier; Representation group The set of capabilities included; This indicates the slot-by-slot availability status of the group under the corresponding category. It is set to 1 when at least one corresponding category capability source in the group is available, otherwise it is set to 0. Sub-step S3e saves the availability status of the three types of capabilities, the number of original available capability sources, the availability status of common failure groups, and the correspondence between capability sources and common deployment identifiers and common failure identifiers, for use in continuous risk pruning, three-field indicators, and monitoring redundancy margin calculation.

10. The low-altitude airway access method based on a three-field certificate according to claim 9, characterized in that, In step S5, the audit record completeness, audit missing quantity, and upper limit of audit missing quantity are calculated according to the following formula: ； in, as a candidate The set of non-empty occupied time slots, To occupy the number of time slots, For audit capability availability status, For audit record completeness, it represents the proportion of available audit capacity time slots in the occupied time slot set. For the number of time slots lacking audit services, Its allowed upper limit, As the audit threshold, This indicates rounding down; the upper limit is consistent within the same fixed-duration search domain, denoted as... ; when At that time, All lengths in A set of consecutive time slot windows The monitoring redundancy margin is determined according to the failure mode adopted; under the independent observation failure mode, it is calculated according to the following formula: ； Under common failure modes, the following formula is used for calculation: ； in, The monitoring threshold is expressed as a non-negative integer number of time slots. To provide a complete monitoring and evaluation window, This represents the original number of available monitoring capability sources. For a common set of failure groups that includes sources of monitoring capabilities, The monitoring capability availability status of the corresponding group. Provides a set of different common failure groups that can be monitored and observed at least once within the window. Let the number of groups in the set be . This is the monitoring redundancy margin for the corresponding mode; For candidates with a complete monitoring and evaluation window, generate certificate records: ； in, For certificate records, The departure time As candidate routes, and These represent the longest continuous monitoring blind zone and the worst-case takeover wait time, respectively. For the already identified constraint bottlenecks or set of violation causes; when At that time, three core indicators and other applicable information are recorded, no monitoring redundancy margin value is assigned, and the candidate is not used for direct comparisons that rely on this margin.

11. The low-altitude airway access method based on a three-field certificate according to claim 10, characterized in that, Step S1 also obtains the evaluation time domain length, the upper limit of single candidate monitoring risk, and the upper bound of failure probability corresponding to the failure mode adopted. In step S6, the corresponding monitoring probability constraint is enabled only when the candidate has a complete monitoring and evaluation window and the independence condition and failure probability upper bound condition corresponding to the failure mode are met. The conditions for the independent observation failure mode are: each originally available source-slot monitoring observation fails independently of the others, and their failure probabilities do not exceed [a certain value]. When the aforementioned conditions are met, it is required that: ； The conditions for a common failure mode are: the failure of all previously available monitoring observations within the same window of a common failure group is considered the window failure event for that group; the window failure events of different common failure groups are independent of each other, and the probability of each event does not exceed [a certain value]. When the aforementioned conditions are met, it is required that: ； in, To cover the evaluation time domain length of all candidate occupied time slots, the number of time slots is represented by a positive integer. This represents the upper limit of the risk of exceeding the longest continuous monitoring blind zone for this candidate. This is the upper bound for the probability of a single source-slot observation failure. This is the upper bound of the probability of failure events in the common failure group window. , and , Represents the natural logarithm. This indicates rounding up; only when the monitoring probability constraint is enabled, candidates that satisfy the basic three-field constraint, resource constraint, and monitoring probability constraint corresponding to the adopted failure mode are allowed to pass, and candidates that do not satisfy the monitoring probability constraint are monitored for insufficient robustness; when the enabling condition is not met, no probability guarantee is made according to the monitoring probability constraint formula.

12. The low-altitude airway access method based on a three-field certificate according to claim 1, characterized in that, Step S1 also obtains calculation parameters for shared capacity constraints, task weights, and shared resource requirements; In step S6, the constraint margin of the three fields is calculated by the three core verification fields and the corresponding thresholds, the rerouting cost is calculated by the path cost of the candidate route and the reference route, and the resource-per-resource and time-slot-per-time-slot shared resource requirements are determined according to the calculation parameters of the candidate route-departure time pair and the shared resource requirements. The original constraints also include: shared capacity constraints and monitoring probability constraints; Step S6 includes: Sub-step S6a summarizes the candidate route-departure time pairs, three-field certificates, shared resource requirements and violation reason records obtained from multiple low-altitude flight missions within the actual inspection range; Sub-step S6b removes candidates whose longest continuous monitoring blind zone or worst takeover waiting time exceeds the corresponding upper limit, whose audit record completeness is lower than the corresponding lower limit, or whose energy consumption or completion time does not meet the requirements from the release candidate pool, and retains the reason for the violation; Sub-step S6c determines the processing order or priority selection of tasks and candidates based on task weight, three-field constraint margin, or rerouting cost; Sub-step S6d: For at least one shared resource among control takeover resources, trusted log bandwidth, edge processing resources, or corridor quotas, summarize the resource requirements of the proposed release candidates according to the shared resources and their occupied time slots, and determine the release set under the condition that at most one candidate is selected for each task and the summed resource requirement of any shared resource in any corresponding occupied time slot does not exceed the corresponding shared capacity. Sub-step S6e outputs the release result and saves the selected route, departure time, and three-field certificate; for candidates that are not released, it distinguishes between candidates whose own constraints are not met and those whose shared capacity is insufficient. If the checked alternative routes or alternative departure times meet all applicable conditions, it outputs the corresponding rerouting or departure time adjustment result; if the capacity is insufficient and temporary facilities can supplement the corresponding capacity, it outputs the result of adding temporary facilities and re-verifies after the facility status is updated to the infrastructure map; if no release candidate is found within the actual inspection range, it outputs the result of rejecting the release of the current task and records the reason and inspection range.

13. The low-altitude airway access method based on a three-field certificate according to any one of claims 1 to 12, characterized in that, In step S1, the low-altitude corridor map is a directed graph. ,in, A collection of route nodes, take-off and landing points, or checkpoints. A collection of flyable segments, segments Flight duration expressed as a positive integer number of time slots and non-negative energy consumption expressed in a unified unit of energy ; In step S3, the candidate route-departure time pair is represented as follows: ,in, Candidate routes must be selected from the start point to the end point of the mission and contain at least one futile segment. The departure times within the candidate departure window; the occupied time slot set and route duration are as follows: ； in, as a candidate The set of occupied time slots, The total number of flight time slots for the candidate routes is calculated by summing the time slots for each segment the route passes through.

14. The low-altitude airway access method based on a three-field certificate according to any one of claims 1 to 12, characterized in that, In step S5, the longest continuous monitoring blind zone is determined according to the following formula: ； in, For candidate route-departure time pairs, For its occupied time slot set, Limited to continuous time slot intervals within the aforementioned set. This represents the number of time slots contained in the interval. For time slots The monitoring capability availability status is indicated by a value of 1 (available) and 0 (missing). This is the longest continuous monitoring blind zone length; when there are no non-empty intervals with continuous monitoring capability gaps, it will be... The value is determined to be zero.

15. The low-altitude airway access method based on a three-field certificate according to any one of claims 1 to 12, characterized in that, In step S5, the worst-case takeover waiting time is determined according to the following formula: ； in, For candidate route-departure time pairs, For its occupied time slot set, This is an abnormal start time slot. No earlier than The occupied time slot, To control the availability of takeover capability, a value of 1 indicates availability, and a value of zero indicates absence. The waiting time is expressed in terms of time slots. This represents the worst-case takeover wait time; when the anomaly initiation time slot already has takeover capability, the corresponding wait time is zero; when a certain... exist If no available takeover time slot earlier than its own exists within the inner layer, the corresponding inner layer minimum value and The waiting time is determined to be positive infinity, and the same occupied time slot boundary and time slot difference measurement caliber are used as the continuous control takeover capability missing counter in step S4; for the continuous control takeover capability missing interval where a takeover opportunity occurs in a subsequent occupied time slot, the maximum value reached by the counter before the takeover opportunity occurs is equal to the waiting time from the first missing time slot in that interval to the takeover opportunity.

16. A low-altitude airway access system based on a three-field certificate, characterized in that, include: The data and constraint acquisition module is used to acquire mission requests for low-altitude flight missions, low-altitude corridor maps, candidate departure windows, heterogeneous IoT infrastructure maps with time indices, monitoring thresholds, control takeover thresholds, audit thresholds, energy consumption constraints, and deadline constraints. The capability classification module is used to classify the services provided by the heterogeneous IoT infrastructure into three categories: monitoring, control takeover, and trusted auditing, based on the heterogeneous IoT infrastructure map. The candidate construction and capability projection module is used to construct candidate route-departure time pairs, determine the spatiotemporal trajectory and non-empty time slot set of each candidate route-departure time pair, and project the three types of capabilities onto the spatiotemporal trajectory according to the service availability status of the candidate route-departure time pairs at the corresponding positions and time slots, forming a time slot-by-time availability sequence of monitoring capabilities, control takeover capabilities, and audit capabilities. The continuous risk pruning module is used to maintain a continuous monitoring capability missing counter and a continuous control takeover capability missing counter along the set of occupied time slots for each candidate route-departure time pair in the time-extended state diagram. It resets or increments the corresponding counters according to the corresponding capability availability status of each time slot, prunes the state transitions where the updated corresponding counter exceeds the monitoring threshold or control takeover threshold, and deletes the termination state where the last occupied time slot's continuous control takeover capability missing counter is greater than zero after processing the last occupied time slot. The three-field certificate generation module is used to perform path search in the time-extended state graph after pruning, according to the audit missing amount, energy consumption constraint and deadline constraint. For the complete candidates obtained by the search, the longest continuous monitoring blind zone, the worst takeover waiting time and the audit record completeness are calculated, and a three-field certificate is generated with the longest continuous monitoring blind zone, the worst takeover waiting time and the audit record completeness as the three core verification fields. The access decision and handling output module is used to determine the corresponding candidate as a release candidate only when the longest continuous monitoring blind zone is not greater than the monitoring threshold, the worst takeover waiting time is not greater than the control takeover threshold, the audit record completeness is not lower than the audit threshold, and both energy consumption constraints and time limit constraints are met; determine the release result from the release candidates returned by the actual search and reviewed according to the original indicator definition and original constraints; for candidates that are not released or for tasks that cannot be released within the actual inspection range, record the reason for the violation and output the handling result of rerouting, adjusting the departure time, adding temporary facilities, or refusing to release the current task.

17. An electronic device, characterized in that, Including memory and processor; The memory stores a computer program, which, when executed by the processor, causes the processor to perform the low-altitude airway access method based on a three-field certificate as described in any one of claims 1 to 15.

18. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the low-altitude airway access method based on a three-field certificate as described in any one of claims 1 to 15.

Images