Intelligent park equipment access control method and platform based on big data

Abstract

The application discloses a smart park equipment access control method and platform based on big data, and relates to the technical field of smart park Internet of Things access control. When potential deviation of digital access behavior is detected, the OT data of the physical space is linked to calculate the matching degree of physical and digital characteristics, and the access control baseline is updated only when the matching degree meets the standard. Based on historical trajectory, future access nodes are predicted, and transient token chains are pre-generated and issued to the edge. The edge completes the non-interaction release through zero-knowledge proof within the predicted trajectory range. When deviating, it is transferred to the cloud for re-evaluation. The edge computing gateway self-assembles a local consensus network in a network interruption state, fuses environmental sensor data and request characteristics to calculate emergency intention scores, selects a release strategy accordingly, and synchronizes the blockchain log after network recovery. The application can suppress slow poisoning attacks, reduce transit delay, and balance security and availability in a network interruption state.

Description

Technical Field

[0001] This invention relates to the field of smart park IoT access control technology, specifically to a smart park device access control method and platform based on big data. Background Technology

[0002] Smart parks typically deploy IoT infrastructure such as big data analytics platforms, edge computing gateways, access control terminals, environmental sensors, and video surveillance equipment. Each terminal uploads collected data to the cloud or edge nodes via standard IoT protocols and employs a zero-trust architecture to continuously assess the trust of each access request based on contextual information such as user identity, device status, and behavioral history, dynamically granting necessary permissions. Blockchain technology, near-field communication self-organizing network technology, isolated forest anomaly detection algorithm, and Byzantine fault-tolerant consensus algorithm are all mature technologies already disclosed in this field and can serve as the technical foundation for building a smart park access control system.

[0003] The closest existing technical solution to this invention is a zero-trust access control system based on continuous trust assessment in the cloud: after the edge access control terminal collects access requests, it uploads them to the cloud big data platform via the network. The cloud aggregates the entity's historical access records and calculates a comprehensive trust score by combining them with the current context information. When the trust score is higher than a preset threshold, an access command is issued to drive the access control terminal to open. The cloud continuously collects the entity's subsequent access behavior data and updates the historical behavior baseline using a sliding window method. The structure of this existing technical solution mainly consists of three parts: the edge access control terminal, the network transmission layer, and the cloud big data platform. These parts are connected sequentially and rely unidirectionally on the cloud decision results. The baseline update of the above-mentioned existing solution is only based on the sliding window update of digital access behavior data. It does not introduce cross-validation data sources of the physical space dimension. Trust assessment requires the edge access control terminal to request to upload to the cloud and wait for the calculation results to be sent down for each access. The access decision depends entirely on the cloud to issue instructions. The edge terminal does not have independent decision-making capabilities and can only adopt a preset fixed strategy when the network is interrupted or the cloud is abnormal. Summary of the Invention

[0004] This invention aims to solve the technical problems existing in the current smart park access control system based on big data, specifically as follows:

[0005] First, the baseline update of the existing solution is based solely on sliding window updates of digital access behavior data, without introducing cross-validation data sources of the physical space dimension. When attackers slowly poison the system by creating small, progressively abnormal access behaviors every day, the existing big data risk control model cannot distinguish between normal business drift and malicious permission drift, which leads to the access control baseline being gradually polluted and incorrectly updated, ultimately enabling attackers to obtain unauthorized high-privilege access capabilities.

[0006] Secondly, the existing solution requires the edge access control terminal to upload the request to the cloud for each access and wait for the cloud to complete the calculation before issuing the instruction. This serial link generates queuing delay and network jitter in high-concurrency scenarios, making the edge access control terminal unable to meet the low-latency response required for physical passage, resulting in a significant decrease in user experience and passage efficiency.

[0007] Third, the existing solution relies entirely on instructions issued from the cloud for passage decisions. Edge terminals do not have independent decision-making capabilities. When the network is interrupted or the cloud is abnormal, they can only adopt a preset fixed degradation strategy and cannot make dynamic judgments based on the actual situation on site. This can lead to obstruction of personnel passage or create security risks of unauthorized passage.

[0008] To address the aforementioned technical problems, this invention provides a smart park equipment access control method based on big data, comprising:

[0009] The edge computing gateway collects the digital access behavior feature sequence of the target entity within the observation window, performs offset detection on the digital access behavior feature sequence, and when a potential offset is detected in the digital access behavior feature sequence, obtains the physical feature sequence corresponding to the observation window, calculates the matching degree between the digital access behavior feature sequence and the physical feature sequence, allows the update of the access control baseline when the matching degree reaches a preset matching threshold, and refuses to update the access control baseline and outputs alarm information when the matching degree does not reach the preset matching threshold.

[0010] The cloud-based big data platform trains a trajectory prediction model based on the historical access trajectory data of the target entity. This model predicts multiple future access nodes for the target entity, generating transient tokens corresponding to each access node. These transient tokens are then chained together in the prediction order to form a transient token chain. This chain is distributed to the edge computing gateway corresponding to each access node. When the target entity initiates an access request, the edge computing gateway determines whether the access node falls within the predicted trajectory range covered by the transient token chain. If it does, the gateway uses the transient token corresponding to the access node and verifies the access request using zero-knowledge proof. Upon successful verification, the access control terminal allows passage. If the node does not fall within the predicted trajectory range, the gateway sends a trust assessment request to the cloud-based big data platform, receives the assessment result returned by the platform, and determines the passage result based on the assessment result.

[0011] The edge computing gateway detects the network connectivity status with the cloud big data platform. When a network outage is detected, it establishes a local consensus network with neighboring edge computing gateways, collects local environmental sensor data and current access request feature data, calculates an emergency intent fusion score based on the environmental sensor data and the access request feature data, and drives the access control terminal to execute a downgraded access control policy when the emergency intent fusion score reaches a preset emergency threshold. When the emergency intent fusion score does not reach the preset emergency threshold, it drives the access control terminal to execute a restricted access control policy. The decision-making basis data and decision results are packaged into a block and linked with the previous local block using a hash chain method to form an offline blockchain access log. When network recovery is detected, the offline blockchain access log is uploaded to the cloud big data platform.

[0012] The present invention also provides a smart park equipment access control platform based on big data, corresponding to the above method.

[0013] The three technical components mentioned above—cross-modal anti-poisoning baseline verification, cloud-edge collaborative transient token chain verification and access control, and edge network outage autonomous degradation—operate together on the same edge computing gateway and cloud big data platform architecture. They address three related technical issues: slow poisoning of the baseline, delayed normal access response, and rigid network outage decision-making. The three components share the same set of access control baselines, trust assessment resources, and access control execution terminals. The edge computing gateway calls the corresponding processing components according to the trigger conditions, thus forming a unified access control technical solution covering all scenarios.

[0014] Compared with the prior art, the beneficial effects of the present invention by adopting the above technical solution are as follows:

[0015] Firstly, by linking OT data of the physical space to perform virtual-real cross-verification of digital access behavior offsets, the access control baseline is updated only when the physical characteristics match the digital request characteristics, thereby suppressing the permission drift problem caused by slow poisoning attacks.

[0016] Secondly, by predicting the access trajectory in advance in the cloud and pre-generating a transient access token chain and sending it to the edge, the edge computing gateway only needs to perform zero-knowledge proof lightweight verification within the predicted trajectory range to complete the access decision, which reduces the network interaction latency in normal access scenarios, while retaining the cloud-based heavy evaluation capability when anomalies are triggered, thus balancing low latency and high security.

[0017] Third, by using the edge computing gateway to build a local consensus network in the event of a network outage, it integrates environmental sensor data and access request characteristics to infer emergency intent, realizes an adaptive downgrade and release strategy on site, and uploads tamper-proof offline blockchain logs after the network is restored, thus balancing the security and availability of access control in extreme scenarios. Attached Figure Description

[0018] Figure 1 An overall architecture diagram of a smart park equipment access control platform based on big data provided in an embodiment of the present invention;

[0019] Figure 2 A flowchart of the cross-modal anti-poisoning baseline verification method provided in this embodiment of the invention;

[0020] Figure 3 A flowchart of the cloud-edge collaborative elastic trust assessment and transient token chain distribution method provided in this embodiment of the invention;

[0021] Figure 4 This is a schematic diagram of the transient access token chain provided in an embodiment of the present invention;

[0022] Figure 5 A flowchart of the edge autonomy degradation consensus control method provided in an embodiment of the present invention. Detailed Implementation

[0023] The following is in conjunction with the appendix Figure 1-5 The specific embodiments of the present invention will be further described below. It should be noted that the description of these embodiments is for the purpose of helping to understand the present invention, but does not constitute a limitation of the present invention.

[0024] Furthermore, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0025] I. System Overall Architecture

[0026] The smart park equipment access control platform based on big data provided by this invention is generally divided into a three-layer architecture: cloud big data platform, edge computing gateway, and terminal execution layer.

[0027] The cloud-based big data platform is deployed in a park data center or public cloud environment. Internally, it includes a data aggregation submodule, a cross-modal anti-poisoning verification submodule, a trajectory prediction and token chain generation submodule, and a blockchain log storage submodule. The data aggregation submodule aggregates digital access request data and physical OT data uploaded by the edge computing gateway. The OT data refers to operational technology data generated by the physical world within the park, including regional power consumption curves, environmental temperature and humidity data, smoke concentration data, and entity occupancy feature data within the camera's field of view—distinct from information technology data generated by purely digital systems. The cross-modal anti-poisoning verification submodule executes the cross-modal anti-poisoning baseline verification method of this invention. The trajectory prediction and token chain generation submodule executes the trajectory prediction and transient token chain generation method of this invention. The blockchain log storage submodule performs hash chain integrity verification on offline blockchain access logs uploaded by the edge computing gateway. After successful verification, the logs are merged into the main chain for storage and subsequent auditing and traceability.

[0028] Edge computing gateways are deployed at the edge of various physical areas within the park. Internally, they include a zero-knowledge proof verification submodule, an anomaly context detection submodule, a local consensus networking submodule, and an emergency intent inference submodule. The zero-knowledge proof verification submodule performs lightweight verification of access requests under normal access scenarios. Zero-knowledge proof refers to a cryptographic verification method where the verifier can confirm the holder's legitimacy without obtaining the complete credential content. The anomaly context detection submodule detects abnormal characteristics of access requests, including high-frequency access characteristics within a short period and abnormal device fingerprint characteristics. The local consensus networking submodule establishes a local distributed decision network with neighboring edge computing gateways, i.e., an edge micro-environment consensus network, in the event of a network outage. The emergency intent inference submodule infers emergency intent by combining environmental sensor data and access request characteristics in the event of a network outage.

[0029] The terminal execution layer includes access control terminals, smart meters, environmental sensors, and security cameras. Access control terminals include electronic locks and turnstiles, which are used to receive drive commands from the edge computing gateway to complete opening and closing actions. Smart meters are used to collect regional energy consumption data. Environmental sensors include temperature and humidity sensors and smoke concentration sensors, which are used to collect regional environmental data. Security cameras are used to collect entity occupancy feature data within the field of view.

[0030] The data flow between the three layers is as follows: the digital access request data and physical OT data collected by the terminal execution layer are simultaneously uploaded to the cloud big data platform via the edge computing gateway. The verification results, transient token chain and release instructions of the cloud big data platform are sent to the edge computing gateway in the opposite direction. The edge computing gateway then drives the access control execution terminal of the terminal execution layer to complete the opening and closing action. In addition, near-field communication connections are established between multiple edge computing gateways for local consensus communication in the offline state.

[0031] In terms of specific implementation, each sub-module in the cloud big data platform and edge computing gateway described in this invention can be implemented by a processor executing program instructions stored in the memory, or by a dedicated hardware circuit. The processor can be a central processing unit, microprocessor, digital signal processor, or field-programmable gate array, etc., which have data processing capabilities. The memory can be a non-volatile storage medium used to store program instructions and data generated during operation.

[0032] II. Implementation Examples of Anti-Poisoning Baseline Construction Method Based on Physical-Digital Cross-Modal Cross-Validation

[0033] In this embodiment, the edge computing gateway continuously collects the digital access behavior feature sequence of the target entity within the observation window, denoted as... , where each feature vector It includes information such as access time, access area number, access permission level, and device fingerprint hash value.

[0034] feature sequence Input the pre-trained Isolation Forest model and calculate the anomaly score for each sample using the following formula:

[0035] ;

[0036] in, Indicates sample In containing Anomaly scores in a forest of samples Indicates sample The average path length across all decision trees in an isolated forest. Indicates the total number of samples The determined path length normalization constant is used to eliminate bias caused by differences in tree size, and outlier scores. The value ranges from 0 to 1. The closer the value is to 1, the more likely the sample is to be an outlier. The closer the value is to 0, the more likely the sample is to be a normal sample.

[0037] The abnormal score is compared with a preset offset threshold. If the abnormal score remains stable in the slow upward range near the threshold for multiple observation windows, that is, the abnormal score is greater than the preset offset threshold and shows a gradual upward trend, it is determined that there is a potential risk of slow drift and cross-modal linkage verification is triggered. If the abnormal score does not show the above characteristics, the current access control baseline is maintained and the subsequent collection of digital access behavior feature sequences continues to be monitored.

[0038] After triggering cross-modal linkage verification, the edge computing gateway initiates data retrieval requests to OT terminals such as smart meters and security cameras within the same physical space to obtain a physical feature sequence aligned with the time window corresponding to the digital access behavior feature sequence, denoted as... ,in It includes information on dimensions such as the sudden change in regional energy consumption and the number of entities occupying space in the camera's field of view.

[0039] Calculate the digital feature sequence With physical feature sequence The weighted matching degree between them is calculated using the following formula:

[0040] ;

[0041] in, This represents the combined physical and digital feature matching degree, with a value ranging from 0 to 1. Indicates the first The importance weights corresponding to each feature dimension are determined by prior domain knowledge and historical statistical data. Indicates the first Each physical characteristic component Indicates and The corresponding digital access feature components, This represents the similarity function value calculated after normalizing the physical and digital features of this dimension. The value ranges from 0 to 1. The higher the similarity value, the more closely the physical phenomenon matches the digital request.

[0042] Matching degree Compare with a preset matching threshold: if the matching degree If a preset matching threshold is reached, it is determined that the digital access behavior deviation has a real physical basis, such as changes in energy consumption and field of view caused by personnel entering and exiting. In this case, the cloud-based big data platform is allowed to update the access control baseline of the entity. If the matching degree is... If the preset matching threshold is not met, the digital access behavior is deemed to lack physical basis and is identified as a forged digital poisoning request. The baseline update is rejected and a security alarm is triggered. At the same time, the abnormal record is written to the pending review log for subsequent manual review.

[0043] For example, assuming a preset offset threshold of 0.7 and a preset matching threshold of 0.6: when the abnormal score of a certain entity's digital access behavior feature sequence slowly rises from 0.65 to 0.75 within multiple consecutive observation windows, the edge computing gateway determines that there is a potential offset. It then pulls energy consumption change data and field-of-view entity occupancy data for the corresponding time window from smart meters and security cameras in the same physical area. If the calculated matching degree is 0.75, which is greater than the preset matching threshold of 0.6, it indicates that the access behavior offset corresponds to real personnel entry and exit activities, and the access control baseline is allowed to be updated. If the calculated matching degree is 0.3, which is less than the preset matching threshold of 0.6, it indicates that the access behavior offset lacks physical basis, the baseline is refused to be updated, and a security alarm is triggered. Through the above virtual-real cross-validation mechanism, the access control baseline is only allowed to be updated when the physical features and digital request features match each other, fundamentally suppressing the risk of permission drift caused by slow poisoning attacks.

[0044] III. Implementation Examples of Adaptive Elastic Trust Assessment and Transient Token Chain Distribution Method for Cloud-Edge Collaboration

[0045] In this embodiment, the cloud-based big data platform collects historical travel trajectory data of the target entity over several past periods, which is denoted as a trajectory sequence. Each of them This indicates the region node number where the entity is located at a certain moment.

[0046] A trajectory prediction model is trained based on historical trajectory sequences. This model can employ a Markov chain model or a lightweight sequence neural network model to predict multiple regional nodes that the entity may traverse within a future time period, outputting a predicted trajectory sequence. ,in This indicates the predicted number of nodes in the region.

[0047] For each prediction node in the predicted trajectory sequence The cloud generates the corresponding transient token. The token content includes an entity identity field, a target area number field, a valid time window start and end time field, and a token hash value field generated based on the private key signature. The tokens are linked together in a chain structure according to the predicted order to form a transient token chain. In the chain structure of the transient token chain, each transient token also includes a chain head identifier field and a link field pointing to the next transient token. Each transient token corresponds to a different access node on the predicted trajectory, reflecting the structural characteristics of the token chain being pre-generated, serialized, and used only once.

[0048] Token chain in the cloud After encryption, the tokens are sent to each edge computing gateway covered by the predicted trajectory and cached locally. Each edge computing gateway only retains token fragments related to its own region, avoiding the risk of exposing the full token data to a single edge node.

[0049] When a target entity initiates an actual access request at the edge computing gateway, the edge computing gateway determines whether the regional node corresponding to the request falls within the predicted trajectory sequence. Within the covered valid window: If it falls within the window, the edge computing gateway calls the corresponding token cached locally. It uses zero-knowledge proof to verify whether the credentials held by the entity match the token hash value. Once the verification is successful, it directly drives the access control terminal to release the access. The entire verification process does not require network interaction with the cloud, thus achieving low-latency response.

[0050] If the actual access node of the target entity deviates from the predicted trajectory sequence, i.e., there is no corresponding node in the predicted trajectory, or if the edge computing gateway detects abnormal context, such as high-frequency access characteristics within a short period of time or abnormal device fingerprint characteristics, then this is determined as a trigger condition. The edge computing gateway immediately initiates a real-time heavy trust assessment request to the cloud big data platform. The cloud platform recalculates the trust score by integrating more dimensions of context information. The calculation formula is as follows:

[0051] ;

[0052] in, This indicates the trust score at the current moment. This represents the trust score at the previous moment. This represents the decay coefficient of historical trust scores, ranging from 0 to 1, and is used to balance the weight of historical trust accumulation and current immediate assessment. Indicates information based on the current context. The calculated instant trust assessment function value, wherein the current context information includes access time, access area, device status, and biometric matching degree, will be used by the cloud to calculate the trust score. The data is compared with a preset passage threshold to obtain a passage result, which includes two types: allowed passage and prohibited passage. The passage result is then sent back to the edge computing gateway for execution.

[0053] For example, if the trajectory prediction model predicts that a target entity will pass through the first, second, and third regions sequentially in the future, the cloud generates transient tokens corresponding to the three regions and sends them as a transient token chain to the corresponding edge computing gateway. When the entity initiates an access request in the first region, the edge computing gateway calls the corresponding token to complete zero-knowledge proof verification and directly drives the access control terminal to allow access, without any interaction with the cloud. If the entity then initiates an access request in the fourth region outside the predicted trajectory, the edge computing gateway determines that it has deviated from the predicted trajectory and initiates a real-time heavy trust assessment request to the cloud. Through the above cloud-edge collaboration mechanism, the edge computing gateway only needs to perform low-overhead zero-knowledge proof lightweight verification under normal conditions to complete the access decision, achieving low-latency response in high-concurrency scenarios, while retaining the cloud's real-time heavy assessment capability in case of abnormal triggering, thus balancing low latency and high security.

[0054] IV. Implementation Examples of a Network Disconnection Autonomous Degradation Control Method Based on Edge Microenvironment Consensus and Intent Inference.

[0055] In this embodiment, each edge computing gateway continuously monitors the network connectivity status with the cloud big data platform through a heartbeat mechanism. If no response is received from the cloud for several consecutive heartbeat cycles, it is determined that the network is disconnected.

[0056] The edge computing gateway that determines that it has entered a network outage state automatically searches for and connects to other edge computing gateways in the same physical area through near field communication, such as Bluetooth Mesh protocol, to form a local consensus network, namely the edge micro-environment consensus network. The nodes in the local consensus network reach a consensus on the current emergency state through a simplified Byzantine fault-tolerant consensus algorithm. The simplified Byzantine fault-tolerant consensus algorithm is a mature consensus algorithm that has been disclosed in the field.

[0057] Each node in the local consensus network collects real-time data from environmental sensors in its area, including temperature and humidity sensor data and smoke concentration sensor data. At the same time, it obtains the characteristic data of the access request that is currently initiating access, including the requester's identity, the requested area, and the request time.

[0058] An emergency intent fusion score is calculated based on the collected multi-source data. This score characterizes whether a visitor is in an emergency avoidance scenario. The calculation formula is as follows:

[0059] ;

[0060] in, The score represents the integration of emergency response intentions. This represents the environmental anomaly sub-score, calculated by normalizing environmental sensor data, namely smoke concentration and the magnitude of abnormal temperature increases. A higher sub-score indicates a greater likelihood of an emergency such as a fire at the scene. This represents the request urgency sub-score, calculated using normalized normalization based on the characteristics of the current access request, namely, the characteristics of multiple regions simultaneously initiating requests within a short period of time, and the historical permission level of the requesting identity. This represents the entity's historical behavior regularity sub-score, used to help determine whether the current request conforms to its normal behavior pattern. , , These are the weight coefficients corresponding to the three sub-scores mentioned above, and the sum of the three is 1. The specific values ​​are pre-defined by the domain prior knowledge.

[0061] Integrate emergency intent scores Compare with preset emergency thresholds: If the emergency intent fusion score Upon reaching a preset emergency threshold, a genuine emergency scenario is determined. Within the local consensus network, edge computing gateways drive access control terminals to implement a downgraded access control policy, relaxing identity verification to prioritize personnel passage efficiency. If the emergency intent is fused into a score... If the preset emergency threshold is not reached, the access control terminal will execute a restricted access policy, allowing access only to requests that meet basic identity verification conditions, thus preventing unauthorized access during network outages.

[0062] For example, assuming the preset emergency threshold is 0.8, when the edge computing gateway detects a network outage, the collected environmental sensor data shows that the area temperature rises abnormally in a short period of time and the smoke concentration exceeds the normal range. Combining the urgency characteristics of the current access request, the calculated emergency intent fusion score is 0.85, which is greater than the preset emergency threshold of 0.8. The edge computing gateways in the local consensus network determine that the current situation is a real emergency scenario and then implement a downgraded access policy to ensure the efficiency of personnel evacuation. If the calculated emergency intent fusion score is 0.4, which is less than the preset emergency threshold of 0.8, then the restricted access policy is maintained, and only requests that meet the basic identity verification conditions are allowed.

[0063] The edge computing gateway packages the complete data on which the downgrade decision was based, including intent fusion score, sensor raw data summary, access request information, decision result and timestamp, into a block, and links it with the previous local block using a hash chain method to form an tamper-proof offline blockchain access log, which is stored locally on the edge computing gateway.

[0064] The edge computing gateway continuously monitors network connectivity. Once it detects that the connection with the cloud big data platform has been restored, it immediately uploads local offline blockchain logs in batches to the cloud big data platform. The cloud big data platform verifies the integrity of the hash chain of the uploaded logs. After the verification is passed, the logs are merged into the main chain for evidence storage, which is used for subsequent auditing and traceability.

[0065] Through the aforementioned edge autonomous degradation mechanism, the edge computing gateway can dynamically select degradation and restricted access policies based on the actual situation on site when the network is down. This avoids the system falling into two extreme failure states: complete lockout hindering escape or full access after power failure leading to unauthorized access. It balances security and availability.

[0066] V. Platform Implementation Examples

[0067] Corresponding to the three method embodiments mentioned above, the smart park equipment access control platform based on big data provided by the present invention works in collaboration with the cross-modal anti-poisoning verification submodule, trajectory prediction and token chain generation submodule, and blockchain log storage submodule of the cloud big data platform, as well as the zero-knowledge proof verification submodule, abnormal context detection submodule, local consensus networking submodule, and emergency intent inference submodule of the edge computing gateway. They respectively execute the processing content described in the three method embodiments. The functional division and collaborative relationship between the submodules have been described in the above system overall architecture section and will not be repeated here.

[0068] VI. Alternative Implementation Methods

[0069] In the cross-modal anti-poisoning baseline verification stage, in addition to using the isolated forest algorithm for digital trajectory offset detection, a sliding window-based statistical process control method, such as the cumulative sum control chart method, can also be used. Potential anomalies can be determined by monitoring whether the cumulative offset of the average value of access behavior characteristics exceeds the preset control limit. The processing logic for matching degree verification of other linked physical OT data remains unchanged, which can also achieve the technical effect of suppressing slow poisoning attacks.

[0070] In the cloud-edge collaborative trust assessment stage, in addition to using the cloud to predict the trajectory in advance and pre-generate transient token chains, a lightweight trust scoring model can also be deployed locally on the edge side. That is, the cloud periodically sends trust scoring model parameters and list data, and the edge computing gateway uses the local lightweight model to autonomously complete the trust scoring calculation for regular access. Only when the scoring result is in the critical ambiguity range is it uploaded to the cloud for review. This can also achieve the technical effect of reducing the average response latency while ensuring security.

[0071] The above-described specific embodiments are only some examples of the present invention, used to illustrate the technical solutions of the present invention, and are not intended to limit the scope of protection of the present invention. Any improvements and modifications made by those skilled in the art based on the technical solutions of the present invention without creative effort should fall within the scope of protection of the present invention.

Claims

1. A smart park equipment access control method based on big data, characterized in that, include: The edge computing gateway collects the digital access behavior feature sequence of the target entity within the observation window, performs offset detection on the digital access behavior feature sequence, and when a potential offset is detected in the digital access behavior feature sequence, obtains the physical feature sequence corresponding to the observation window, calculates the matching degree between the digital access behavior feature sequence and the physical feature sequence, allows the update of the access control baseline when the matching degree reaches a preset matching threshold, and refuses to update the access control baseline and outputs alarm information when the matching degree does not reach the preset matching threshold. The cloud-based big data platform trains a trajectory prediction model based on the historical access trajectory data of the target entity. This model predicts multiple future access nodes for the target entity, generating transient tokens corresponding to each access node. These transient tokens are then chained together in the prediction order to form a transient token chain. This chain is distributed to the edge computing gateway corresponding to each access node. When the target entity initiates an access request, the edge computing gateway determines whether the access node falls within the predicted trajectory range covered by the transient token chain. If it does, the gateway uses the transient token corresponding to the access node and verifies the access request using zero-knowledge proof. Upon successful verification, the access control terminal allows passage. If the node does not fall within the predicted trajectory range, the gateway sends a trust assessment request to the cloud-based big data platform, receives the assessment result returned by the platform, and determines the passage result based on the assessment result. The passage result includes two types: allowed passage and prohibited passage. The edge computing gateway detects the network connectivity status with the cloud big data platform. When a network outage is detected, it establishes a local consensus network with neighboring edge computing gateways, collects local environmental sensor data and current access request feature data, calculates an emergency intent fusion score based on the environmental sensor data and the access request feature data, and drives the access control terminal to execute a downgraded access control policy when the emergency intent fusion score reaches a preset emergency threshold. When the emergency intent fusion score does not reach the preset emergency threshold, it drives the access control terminal to execute a restricted access control policy. The decision-making basis data and decision results are packaged into a block and linked with the previous local block using a hash chain method to form an offline blockchain access log. When network recovery is detected, the offline blockchain access log is uploaded to the cloud big data platform.

2. The method according to claim 1, characterized in that, Offset detection is performed on the digital access behavior feature sequence, including: The digital access behavior feature sequence is input into a pre-trained isolated forest model to calculate the anomaly score for each sample. The anomaly score is used to characterize the degree of deviation of the corresponding sample from the normal access pattern. When the abnormal score is greater than a preset offset threshold and shows an upward trend within multiple consecutive observation windows, it is determined that the digital access behavior feature sequence has a potential offset.

3. The method according to claim 1, characterized in that, The physical feature sequence includes regional energy consumption change data corresponding to the observation window and entity occupancy data in the camera's field of view. Calculating the matching degree between the digital access behavior feature sequence and the physical feature sequence includes: for multiple feature dimensions, calculating the similarity between the physical feature component of the corresponding dimension in the physical feature sequence and the digital access feature component of the corresponding dimension in the digital access behavior feature sequence, and weighting and summing the multiple similarities based on the weights corresponding to each feature dimension to obtain the matching degree.

4. The method according to claim 1, characterized in that, The transient token includes a chain head identifier field, an entity identity identifier field, a target area number field, a valid time window start and end time field, a token hash value field generated based on private key signature, and a link field pointing to the next transient token. Each edge computing gateway only caches transient tokens corresponding to its own area.

5. The method according to claim 1, characterized in that, After initiating a trust assessment request to the cloud-based big data platform, the process also includes: The cloud-based big data platform performs a weighted fusion of the trust score from the previous moment and the real-time trust assessment value calculated based on the current context information to obtain the trust score at the current moment. The trust score at the current moment is then compared with a preset access threshold to obtain the assessment result.

6. The method according to claim 1, characterized in that, The environmental sensor data includes temperature and humidity sensor data and smoke concentration sensor data; Calculating the emergency intent fusion score includes: calculating an environmental anomaly sub-score based on the environmental sensor data, calculating a request urgency sub-score based on the access request feature data, calculating a historical behavior sub-score based on the historical behavior patterns of the target entity, and performing a weighted summation of the environmental anomaly sub-score, the request urgency sub-score, and the historical behavior sub-score to obtain the emergency intent fusion score.

7. A smart park equipment access control platform based on big data, characterized in that, It includes a cloud-based big data platform, an edge computing gateway, and a terminal execution layer, wherein the terminal execution layer includes an access control terminal and environmental sensors; The cloud-based big data platform includes a cross-modal anti-poisoning verification submodule, a trajectory prediction and token chain generation submodule, and a blockchain log storage submodule. The edge computing gateway includes a zero-knowledge proof verification submodule, a local consensus networking submodule, and an emergency intent inference submodule; The cross-modal anti-poisoning verification submodule is used to collect the digital access behavior feature sequence of the target entity within the observation window, perform offset detection on the digital access behavior feature sequence, and when a potential offset is detected in the digital access behavior feature sequence, obtain the physical feature sequence corresponding to the observation window, calculate the matching degree between the digital access behavior feature sequence and the physical feature sequence, allow updating the access control baseline when the matching degree reaches a preset matching threshold, and refuse to update the access control baseline and output alarm information when the matching degree does not reach the preset matching threshold. The trajectory prediction and token chain generation submodule is used to train a trajectory prediction model based on the historical travel trajectory data of the target entity, use the trajectory prediction model to predict multiple future access nodes of the target entity, generate transient tokens corresponding to each access node, chain the transient tokens in the prediction order to form a transient token chain, and send the transient token chain to the edge computing gateway corresponding to the access node. The zero-knowledge proof verification submodule is used to determine whether the access node corresponding to the access request falls within the predicted trajectory range covered by the transient token chain when the target entity initiates an access request. If it falls within the predicted trajectory range, the transient token corresponding to the access node is invoked to verify the access request using the zero-knowledge proof method. After the verification is successful, the access control execution terminal is driven to allow access. If it does not fall within the predicted trajectory range, a trust assessment request is initiated to the cloud big data platform. The local consensus networking submodule is used to establish a local consensus network with the nearest edge computing gateway when the network connection with the cloud big data platform is detected to be disconnected. The emergency intent inference submodule is used to collect data from the environmental sensors and current access request feature data, calculate an emergency intent fusion score based on the environmental sensor data and the access request feature data, drive the access control terminal to execute a downgraded access control strategy when the emergency intent fusion score reaches a preset emergency threshold, and drive the access control terminal to execute a restricted access control strategy when the emergency intent fusion score does not reach the preset emergency threshold. The blockchain log storage submodule is used to package decision-making basis data and decision results into blocks, and connect them in a hash chain to form a blockchain access log.

8. The platform according to claim 7, characterized in that, The terminal execution layer also includes smart meters and security cameras. The edge computing gateway also includes an abnormal context detection submodule. The abnormal context detection submodule is used to detect the access frequency characteristics and device fingerprint characteristics of the access request. When the access frequency characteristics exceed a preset frequency threshold, it is determined that the access request triggers an abnormal context and a trust assessment request is initiated to the cloud big data platform.

9. The platform according to claim 7, characterized in that, Each transient token in the transient token chain includes a chain head identifier field, an entity identity identifier field, an effective time window field, a target area number field, a token hash value field, and a link field pointing to the next transient token.

10. The platform according to claim 7, characterized in that, The local consensus networking submodule is used to establish a communication connection with the neighboring edge computing gateway through near-field communication, and to use the Byzantine fault-tolerant consensus algorithm to enable the various edge computing gateways in the local consensus network to reach a consensus on the current emergency situation.

Images