Space-air-ground-sea integrated network multi-layer collaborative zero trust method and system

Abstract

The application discloses a space-air-ground-sea integrated network multi-layer cooperative zero-trust method and system. A digital signature edge service beacon is generated by a ground control center, broadcasted by a satellite, and used to ensure that a terminal can safely discover a legal access node. After verifying the beacon, the terminal selects an optimal unmanned aerial vehicle (UAV) access, and after being authenticated by the ground center, the UAV continuously monitors the terminal behavior and dynamically updates the trust value. The system adopts an elastic decision mechanism, dynamically allocates strategies to the UAV or the satellite according to the trust value and the network state, and generates the right to the UAV or the satellite, so that autonomous decision-making can still be ensured in the case of a broken link. When the terminal switches the UAV, the satellite safely migrates the complete trust evaluation context to a new node, and realizes seamless continuation of trust. The application effectively solves key problems such as node security discovery, autonomous operation in the case of a broken link, trust continuity and real-time threat response in a high-dynamic space-air environment, and significantly improves the overall security and reliability of the network.

Description

Technical Field

[0001] This invention relates to the field of network information and security technology, and in particular to a multi-layer collaborative zero-trust method and system for integrated air-space-ground-sea networks. Background Technology

[0002] With the development of 6G mobile communication technology, networks are evolving towards a converged approach integrating space, air, and ground. Future networks will be multi-layered, heterogeneous, and three-dimensional, composed of terrestrial cellular networks, airborne access networks (such as UAVs and HAPs), and space-based satellite networks (such as LEO satellites). This integrated space-air-ground-sea network (SAGIN-M) aims to overcome the coverage limitations of traditional terrestrial networks, providing truly ubiquitous, on-demand, and intelligent access services for various terminals worldwide.

[0003] In this converged architecture, different entities play key roles. Low Earth Orbit (LEO) satellites, due to their low latency and wide coverage, become ideal relay and convergence centers connecting the ground and the air. Aerial platforms such as unmanned aerial vehicles (UAVs) serve as mobile, decentralized edge access nodes, which can be flexibly deployed to provide low-latency, high-bandwidth edge access services to terminals within specific areas.

[0004] However, while this integrated air-space-ground-sea network brings immense convenience, it also introduces unprecedented security challenges. First, the network topology is highly dynamic, with terminals moving and switching rapidly between different drones and satellite beams. Second, air-to-space, air-to-ground, and space-to-ground links are all exposed to open space, making them highly vulnerable to eavesdropping, interference, and spoofing attacks. Third, airborne edge nodes themselves are typically resource-constrained, and their backhaul links with satellites or the ground may be unstable or even interrupted.

[0005] In such a highly dynamic, weakly connected, and highly adversarial environment, the traditional static boundary defense model based on the "castle-moat" framework has become completely ineffective. Zero Trust Architecture (ZTA), with its core principle of "never trusting, always verifying," is considered the inevitable choice for ensuring the security of such dynamic networks. Zero Trust requires continuous trust assessment and dynamic access control for any entity accessing the network, based on identity.

[0006] The closest implementation to this invention is the "Zero Trust Blockchain Enabled Scalable Secure IoT Network Framework (ZT-BlocIoT)" proposed by Salim et al. This solution also employs a layered zero trust architecture, aiming to address the security and scalability issues in the Internet of Things (IoT).

[0007] The system framework of this solution consists of three layers: the device layer, the edge layer, and the cloud layer.

[0008] Device layer: This includes various IoT devices, such as smart sensors and smart meters. They are responsible for registering their identities and continuously transmitting behavioral data (such as login patterns and access frequency) for trust scoring purposes.

[0009] Edge Layer: As an intermediate processing layer, it deploys Dynamic Trust Gateways and Shard Leaders. This layer is responsible for: 1) monitoring device behavior and updating the local trust table; 2) enforcing decentralized risk-aware access control (DRAC); and 3) periodically sending aggregated trust scores to the cloud.

[0010] Cloud Layer: Serves as the global management and optimization center. This layer is responsible for: 1) maintaining the Global Trust Table; 2) running a Deep Reinforcement Learning (DRL) model to dynamically optimize the blockchain sharding configuration based on the global trust and network state; and 3) containing a Dynamic Trust Council (DTC), responsible for updating the global trust and sending optimized sharding allocation schemes.

[0011] The core access and evaluation process of this solution is as follows: Registration and Initial Trust Phase: IoT devices register at the device layer through the nearest edge-layer dynamic trust gateway. The gateway collects their behavioral data, assigns an initial trust score, and stores it in a local trust table at the edge layer.

[0012] In the sharding allocation phase: the cloud's DTC groups devices into different shards based on the trust scores reported by edge nodes and network conditions. The cloud's DRL model is continuously trained to find the optimal sharding strategy, aiming to balance the load, reduce cross-shard transactions, and mitigate the risk of collusion.

[0013] Continuous Trust Assessment Phase: The dynamic trust gateway at the edge layer continuously monitors device activity and dynamically updates local trust scores using a sliding window mechanism. These updated scores are periodically sent to the cloud, where the DTC maintains a global trust table.

[0014] Access Control Phase: When a device submits a transaction or requests resources, the edge node verifies it using its Decentralized Risk-Aware Access Control (DRAC) mechanism. DRAC checks the device's current trust score, access context, and smart contract policies stored on the blockchain.

[0015] Dynamic Resharding Phase: Resharding is triggered when the sharding risk assessor detects that a node's trust score is below a threshold or that the cross-shard transaction ratio in a shard is too high. The cloud's DRL model receives these metrics, recalculates the optimal configuration, and distributes the new sharding allocation scheme to the edge layer for execution, in order to isolate malicious nodes or optimize performance.

[0016] Existing technologies (taking the ZT-BlocIoT solution as an example) have the following problems: The lack of support for high-dynamic mobility in its architectural design leads to the loss of "trust context." The ZT-BlocIoT solution is designed for fixed or low-speed mobile IoT scenarios such as smart cities and factories. Its Trust Model (LTT) is strongly bound to the dynamic trust gateway at the edge layer. When terminals (such as drones and aircraft) move at high speeds across air, land, sea, and air networks and cross different gateways, the solution does not provide a mechanism to securely and quickly migrate the trust context (such as trust score and behavioral state) already established by the terminal. This causes the terminal to be treated as a new device when accessing a new gateway, requiring evaluation from scratch, resulting in high-latency re-authentication, and also providing attackers with opportunities to "launder" trust by switching gateways.

[0017] The ZT-BlocIoT solution relies excessively on the stability of the "edge-cloud" link and lacks the ability to make autonomous decisions in case of link failure. Its zero-trust decision-making and optimization heavily depend on stable communication between the edge and cloud layers. The edge layer must periodically report trust scores to the cloud's DTC, and the cloud's DRL model must also distribute optimized sharding configurations. In air-space-ground-sea networks, the link between airborne nodes (drones) and the center (satellite / ground) is high-latency and unstable. Once this link is interrupted, ZT-BlocIoT's edge nodes will be unable to update global trust, let alone receive optimized policies, leading to a degradation or failure of their security decision-making capabilities, creating a "security vacuum."

[0018] The solution lacks a secure and authoritative edge node discovery mechanism. It relies on the terminal registering through the nearest edge node, but fails to detail how the terminal can securely discover and verify the legitimacy of this "nearest node" in an open, dynamic air-space-ground-sea environment, rather than a malicious attacker spoofing it. This may not be a major issue in fixed terrestrial IoT networks, but it represents a serious security vulnerability in wide-area, open air-space-ground-sea networks.

[0019] Sharding and DRL optimization mechanisms are too complex for space-to-ground edge nodes. The ZT-BlocIoT solution uses a DRL-driven dynamic sharding mechanism to address the scalability issues of terrestrial IoT. However, this AI optimization model, which requires global information and complex computation (although DTC is executed in the cloud), is too cumbersome for space-to-ground edge nodes (drones) with limited resources and rapidly changing topologies. Furthermore, its optimization objectives (such as reducing cross-shard transactions) do not fully match the core pain points of space-to-ground networks (such as link interruptions and high-speed handover). Summary of the Invention

[0020] This invention provides a multi-layer collaborative zero-trust method and system for integrated air-space-ground-sea networks, which solves the serious deficiencies in existing technologies in terms of trust continuity, autonomous decision-making in case of chain breakage, discovery of secure nodes, and resource adaptation, and realizes the "trusted anchor point" and security discovery of the zero-trust architecture.

[0021] In a first aspect, the present invention provides a multi-layer collaborative zero-trust method for an integrated air-space-ground-sea network, the method comprising: The ground control center generates a digitally signed edge service beacon and broadcasts the signed edge service beacon via satellite. The terminal receives the signed edge service beacon, verifies the validity of the digital signature in the signed edge service beacon, obtains a list of available drones, selects the optimal drone based on the list of available drones, and initiates an access request. The access request is forwarded to the ground control center via the satellite to authenticate the terminal. After successful authentication, the optimal UAV continuously monitors the terminal's behavior and dynamically updates the terminal's trust value. Based on the trust value and the current network status, the optimal UAV or the satellite is dynamically determined to generate the access control decision, and the optimal UAV executes the access control decision. When the terminal needs to switch between drones, the satellite transfers the terminal's dynamic trust assessment context to the target drone.

[0022] In conjunction with the first aspect, in one possible implementation, the ground control center includes: a policy management center, an identity information center, and an identity authentication center; The policy management center is used to generate the system master key pair and to digitally sign the edge service beacon using the private key. The identity information center is used to register terminal identity information and distribute initial master keys; The identity authentication center is used to complete identity authentication based on the initial master key when the terminal first accesses the network.

[0023] In conjunction with the first aspect, in one possible implementation, the ground control center generates a digitally signed edge service beacon and broadcasts the signed edge service beacon via satellite, including: The strategy management center of the ground control center obtains real-time status and satellite orbit data of all UAVs; Based on the real-time status of the UAV and the satellite orbit data, a list of available UAVs is generated, and the list of available UAVs is encapsulated as an edge service beacon; The edge service beacon is digitally signed using the private key of the ground control center to obtain a signed edge service beacon. The ground control center uploads the signed edge service beacon to the satellite; Within its coverage beam, the satellite periodically broadcasts signed edge service beacon messages.

[0024] In conjunction with the first aspect, in one possible implementation, the terminal receives a signed edge service beacon, verifies the validity of the digital signature in the signed edge service beacon, obtains a list of available drones, selects a drone based on the list of available drones, and initiates an access request, including: The terminal's security agent listens for and receives signed edge service beacons; The digital signature of the signed edge service beacon is verified using the public key of the pre-configured ground control center. If verification fails, the signed edge service beacon is discarded. If the verification is successful, the signed edge service beacon is parsed to obtain a list of available drones.

[0025] In conjunction with the first aspect, in one possible implementation, the step of selecting the optimal drone based on the available drone list and initiating an access request includes: The terminal filters the list of candidate drones from the list of available drones based on the drone's location information and the terminal's service requirements. The terminal iterates through each drone in the candidate drone list and performs the following operations: Scan the local beacon of the current candidate drone, and parse the local beacon to obtain the first identity identifier and the first public key hash value; Obtain the second public key hash value of the current candidate drone in the signed edge service beacon based on the first identity identifier; The hash values ​​of the first public key and the second public key are compared. If the comparison results are consistent, the candidate drone list retains the current drone; if the comparison results are inconsistent, the candidate drone list deletes the current drone. Until the traversal is completed, an updated list of candidate drones is obtained. For each drone in the updated list of candidate drones, the terminal measures the drone signal power and drone noise power, and then calculates the link signal-to-noise ratio corresponding to each drone. The terminal determines an optimal drone based on the link signal-to-noise ratio and corresponding resource status of each drone using a weighted scoring algorithm, and then initiates an access request to the optimal drone.

[0026] In conjunction with the first aspect, in one possible implementation, the optimal drone continuously monitors the behavior of the terminal and dynamically updates the trust value of the terminal, including: The ground control center generates an initial trust value and an initial state for the terminal; The behavior perception module on the optimal UAV captures the terminal's behavior event stream in real time; wherein, the behavior event stream includes: request rate and traffic characteristics; The adaptive trust evaluation and decision engine on the optimal UAV transforms the behavioral event stream into discrete semantic states. The adaptive trust assessment and decision engine on the optimal UAV recalculates the trust value of the terminal based on the discrete semantic state. The optimal drone will synchronize the updated trust value to the adaptive trust assessment and decision engine on the satellite.

[0027] In conjunction with the first aspect, in one possible implementation, the step of dynamically determining whether the optimal UAV or the satellite generates an access control decision based on the trust value and the current network state, and having the optimal UAV execute the access control decision, includes: The strategy decision coordination module on the optimal UAV calculates the local decision confidence level after the terminal's trust value is updated. The calculation is fused into the satellite link quality. and the risk score of the optimal UAV ; The strategy decision coordination module will With the first threshold If a comparison is made, Then the adaptive trust assessment and decision engine on the optimal UAV generates access control decisions; if Then the adaptive trust assessment and decision engine on the satellite generates access control decisions; The optimal UAV executes the access control decision.

[0028] In conjunction with the first aspect, in one possible implementation, when the terminal needs to switch between drones, the satellite transfers the dynamic trust assessment context of the terminal to the target drone, including: Real-time acquisition of the link quality of the optimal UAV And determine the link quality. Is it less than the second threshold? If so, the terminal sends a handover request to the satellite; wherein the handover request includes the identity identifier of the target UAV; After verifying the handover request, the satellite obtains the security context of the terminal; wherein, the security context includes: session key, trust value, and behavioral state; The satellite generates a one-time switching token and obtains a trust context block based on the security context and the one-time switching token; The satellite digitally signs the trust context block based on its corresponding private key. The satellite sends the signed trust context block to the target drone; The target drone verifies the digital signature and preloads the trust context block; The terminal initiates an attach request to the target drone; wherein the attach request carries the one-time switching token; The target drone verifies the one-time switching token. After a successful match, it uses the security context to resume the communication session and trust assessment with the terminal.

[0029] In conjunction with the first aspect, one possible implementation also includes: When the optimal UAV detects a communication link interruption with the satellite, the strategy decision coordination module on the optimal UAV determines the normalized link quality. =0; The strategy decision coordination module calculates the local decision confidence level. ; When local decision confidence When the threshold for chain disconnection is exceeded, the strategy decision coordination module switches to the chain disconnection tolerance mode. In the aforementioned chain-break tolerance mode, all access control decisions for the terminal are independently completed by the adaptive trust assessment and decision engine on the optimal UAV.

[0030] Secondly, this invention provides a multi-layered collaborative zero-trust system for integrated air-space-ground-sea networks, the system comprising: The ground control center is equipped with a policy management center and an authoritative identity authentication center, which are used to generate system parameters, digitally sign edge service beacons, and perform identity authentication and initial trust assessment on terminals. The satellite node is equipped with an edge service beacon module, an access and mobility management module, and a policy decision coordination module. It is used to broadcast the signed edge service beacon, forward the terminal's access request, and migrate its dynamic trust context to the target drone node when the terminal switches. Multiple drone nodes, each deployed with an adaptive trust assessment and decision engine, a policy decision coordination module, and a policy execution point, are used to provide edge access services to terminals, continuously monitor the behavior of connected terminals to dynamically update trust values, generate or collaboratively generate access control decisions based on the updated trust values, and enforce them. The terminal, with a built-in security proxy, receives and verifies the signed edge service beacon, selects the optimal drone node based on the verified list of available drones, and initiates an access request. One or more technical solutions provided in this invention have at least the following technical effects or advantages: This invention generates digitally signed edge service beacons via a ground control center and broadcasts them via satellite. The digital signature ensures the authority and tamper-proof nature of the edge service beacons, preventing malicious node spoofing at the source. Terminals can securely discover legitimate access points, addressing security vulnerabilities in edge node discovery in open environments. The terminal receives the signed edge service beacon, verifies the validity of the digital signature, obtains a list of available drones, and selects the optimal drone from the list to initiate an access request. The terminal uses a verification mechanism to trust only the list of legitimate drones, combining local measurements to optimize node selection, improving access security and efficiency, and avoiding access to malicious nodes. The access request is forwarded via satellite to the ground control center for terminal authentication. Strong authentication by the authoritative ground center ensures the legitimacy of the terminal's identity, preventing unauthorized devices from accessing the network and laying a trust foundation for subsequent continuous evaluation. After successful authentication, the optimal drone continuously monitors the terminal's behavior and dynamically updates the trust value; achieving zero-trust continuous evaluation, quickly identifying anomalies through real-time behavior analysis, dynamically adjusting trust scores, enhancing response capabilities to sudden threats, and improving real-time security. Based on trust values ​​and the current network state, the system dynamically determines whether to generate access control decisions using the optimal drone or satellite, with the optimal drone executing the policy. Through resilient decision-making mechanisms (such as confidence levels based on link quality and risk calculations), autonomous edge decision-making is maintained during link failures, avoiding security vacuums and ensuring the continuity and adaptability of policy execution. When a terminal needs to switch between drones, the satellite migrates the terminal's dynamic trust assessment context to the target drone. By securely migrating the trust context (such as trust score and session state), seamless continuation of trust assessment is achieved, avoiding re-authentication delays and preventing attackers from exploiting the handover to "launder" trust, ensuring security continuity even during high-speed movement. Attached Figure Description

[0031] Figure 1 A flowchart illustrating the steps of a multi-layer collaborative zero-trust method for an integrated air-space-ground-sea network provided in this embodiment of the invention; Figure 2 This is a schematic diagram of the overall system architecture provided in an embodiment of the present invention; Figure 3 A flowchart of the Edge Discovery Phase (SAEDP) provided for embodiments of the present invention; Figure 4 A flowchart of the Trust Seamless Switching Phase (STHP) provided for embodiments of the present invention; Figure 5 This is a flowchart of the access and continuous evaluation phases provided in an embodiment of the present invention. Detailed Implementation

[0032] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0033] Firstly, this invention provides a multi-layer collaborative zero-trust method for an integrated air-space-ground-sea network, as described above. Figure 1 The process includes the following steps S101 to S105.

[0034] S101, The ground control center generates a digitally signed edge service beacon and broadcasts the signed edge service beacon via satellite; Here, the ground control center includes: a policy management center, an identity information center, and an identity authentication center; The policy management center is used to generate system master key pairs and digitally sign edge service beacons using private keys; the identity information center is used to register terminal identity information and distribute initial master keys; and the identity authentication center is used to complete identity authentication based on the initial master key when a terminal first accesses the system.

[0035] Specifically, in step S101, the ground control center generates a digitally signed edge service beacon and broadcasts the signed edge service beacon via satellite, including the following steps S1011 to S1015.

[0036] S1011, the strategy management center of the ground control center obtains real-time status and satellite orbit data of all UAVs; S1012 generates a list of available drones based on real-time drone status and satellite orbit data, and encapsulates the list of available drones as an edge service beacon; S1013, use the private key of the ground control center to digitally sign the edge service beacon to obtain the signed edge service beacon; S1014, the ground control center uploads the signed edge service beacon to the satellite; S1015, within its coverage beam, the satellite periodically broadcasts signed edge service beacon messages.

[0037] For example, system parameter generation and configuration: The Policy Management Center (PCF), Identity Information Center (UDM), and Identity Authentication Center (AUSF-Master) of the ground control center serve as the system's root of trust. The PCF generates a public-private key pair for signing Edge Service Beacons (ESBs). Terminal registration: The terminal registers with the ground UDM to obtain its identity credentials and initial master key. Security agent configuration: The security agent / SDK within the terminal is pre-configured with the ground PCF's public key for subsequent verification of the ESB beacon's legitimacy.

[0038] See Figure 3 (1) ESB generation and upload Figure 3 Steps 1-5: Step 1: The ground-based PCF continuously collects telemetry data from the entire network and satellite orbit data; among which, the telemetry data from the entire network includes: the real-time location and payload of all UAVs.

[0039] Step 2: Based on this, PCF calculates the list of available drones for each satellite beam and generates an Edge Service Beacon (ESB) message. The ESB message structure includes the drone ID, service type, location, frequency information, and drone public key.

[0040] Step 3: PCF uses its private key to digitally sign the ESB message.

[0041] Step 4: PCF uploads the signed ESB to the corresponding satellite via the ground station.

[0042] Step 5: The satellite periodically broadcasts the signed ESB message within its coverage beam.

[0043] S102, the terminal receives the signed edge service beacon, verifies the validity of the digital signature in the signed edge service beacon, obtains a list of available drones, selects the optimal drone based on the list of available drones, and initiates an access request; Specifically, in step S102, the terminal receives the signed edge service beacon, verifies the validity of the digital signature in the signed edge service beacon, obtains a list of available drones, selects a drone based on the list of available drones, and initiates an access request, including the following steps S1021 to S1022.

[0044] S1021, The terminal's security agent listens for and receives the signed edge service beacon; S1022, use the pre-set public key of the ground control center to verify the digital signature of the signed edge service beacon; if the verification fails, discard the signed edge service beacon; if the verification succeeds, parse the signed edge service beacon to obtain a list of available drones.

[0045] Specifically, in step S102, the optimal drone is selected based on the available drone list and an access request is initiated, including: (1) The terminal filters the list of candidate drones from the list of available drones based on the location information of the drones and the service requirements of the terminal; (2) Traverse each drone in the candidate drone list, and the terminal performs the following operations: (2.1) Scan the local beacon of the current candidate drone, parse the local beacon to obtain the first identity identifier and the first public key hash value; (2.2) Obtain the second public key hash value of the current candidate drone in the signed edge service beacon based on the first identity identifier; (2.3) Compare the hash values ​​of the first public key and the second public key. If the comparison results are consistent, the current drone is retained in the candidate drone list; if the comparison results are inconsistent, the current drone is deleted from the candidate drone list. (3) Until the traversal is completed, the updated candidate drone list is obtained. For each drone in the updated candidate drone list, the terminal measures the drone signal power and drone noise power, and then calculates the link signal-to-noise ratio corresponding to each drone. (4) Based on the link signal-to-noise ratio and corresponding resource status of each UAV, the terminal determines an optimal UAV through a weighted scoring algorithm and initiates an access request to the optimal UAV.

[0046] For example, see Figure 3 (2) ESB terminal discovery, local evaluation and selection Figure 3 Steps 6-14: Step 6: The terminal's security agent listens for and receives the signed ESB message.

[0047] Step 7: The terminal uses the preset PCF public key to verify the signature of the ESB message. If the verification fails, the message is discarded; if successful, proceed to the next step.

[0048] Step 8: The terminal parses the drone list in the ESB and selects candidate drones based on location and its own business needs, such as the need to transmit sensitive data.

[0049] Steps 10-11: The terminal scans the local beacon based on the frequency information of the candidate drones, parses and obtains the drone ID and public key hash value, retrieves the public key from the candidate drone list, calculates the hash, compares the results, and initiates a connection request if a match is found.

[0050] Step 12: The terminal measures the link signal-to-noise ratio (SNR) for each candidate drone, using the following formula: ; Signal-to-noise ratio (SNR), measured in decibels (dB). A higher value is better. Signal power, measured in dBm. Noise power, measured in dBm.

[0051] Step 13: The terminal runs the selection algorithm and determines the optimal drone as the access target based on a weighted score of link quality, resource status, etc.

[0052] Step 14: The terminal initiates an initial access or switch authentication request to the selected drone, and proceeds to the next stage.

[0053] S103, the access request is forwarded to the ground control center via satellite to authenticate the terminal. After successful authentication, the optimal UAV continuously monitors the terminal's behavior and dynamically updates the terminal's trust value. Specifically, in step S103, the optimal UAV continuously monitors the terminal's behavior and dynamically updates the terminal's trust value, including the following steps S1031 to S1035.

[0054] S1031, The ground control center generates the initial trust value and initial state for the terminal; S1032, The behavior perception module on the optimal UAV captures the behavior event stream of the terminal in real time; wherein, the behavior event stream includes: request rate and traffic characteristics; S1033, the adaptive trust assessment and decision engine on the optimal UAV transforms the behavioral event stream into discrete semantic states; S1034, the adaptive trust assessment and decision engine on the optimal UAV recalculates the terminal's trust value based on discrete semantic states; S1035, the optimal drone will synchronize the updated trust value to the adaptive trust assessment and decision engine on the satellite.

[0055] For example, see Figure 5 As shown, it specifically includes: (1) Figure 5 S103.1 is the initial access of the terminal: The terminal initiates an access request to the selected UAV. The request follows the "terminal -> UAV -> satellite -> ground" link, and finally the ground AUSF-Master and UDM complete the identity authentication. After successful authentication, the ground generates an initial trust score T(0) and an initial state S(0) for the terminal. This initial trust state is distributed and loaded into the Adaptive Trust Assessment and Decision Engine (ATADE) on the UAV and satellite as the starting point for assessment.

[0056] (2) Figure 5S103.2 Continuous Behavior Awareness and ATADE Processing: The behavior awareness module on the UAV captures the terminal's behavior event stream in real time, such as request rate and traffic characteristics. The behavior event stream is fed to the ATADE engine on the UAV. The ATADE internal pipeline begins processing: Behavior Stateification: The raw events are transformed into discrete semantic states, such as 'file upload'. Trust Quantification: The dynamic trust score T(t) is recalculated by combining the current state and abrupt change indicators. Policy Generation: The rule engine matches the new trust score T(t) with a policy to generate decision instructions. The UAV ATADE synchronizes the updated trust score to the satellite ATADE for long-term perception.

[0057] S104, based on the trust value and the current network status, dynamically determine whether to generate the access control decision by the optimal drone or satellite, and have the optimal drone execute the access control decision; Specifically, in step S104, based on the trust value and the current network status, the optimal UAV or satellite is dynamically determined to generate the access control decision, and the optimal UAV executes the access control decision, including the following steps S1041 to S1043.

[0058] S1041, After the trust value is updated at the terminal, the strategy decision coordination module on the optimal UAV calculates the local decision confidence level. Calculate the link quality integrated into the satellite Risk analysis of the optimal drone ; S1042, the strategy decision coordination module will With the first threshold If a comparison is made, Then, the adaptive trust assessment and decision engine on the optimal UAV generates access control decisions; if Then the adaptive trust assessment and decision engine on the satellite generates access control decisions; S1043, the optimal UAV executes access control decisions.

[0059] For example, see Figure 5 , Figure 5 In step S103.3, (3) determining the attribution of strategic decision-making authority, when a critical decision needs to be made, the strategic decision coordination module PDC-Edge on the UAV is invoked. The PDC-Edge module calculates the local decision confidence level. This calculation incorporates two factors: the quality of the link to the satellite. Risks of drones .in: ; SNR represents the current signal-to-noise ratio. and They were set to 10dB and 25dB respectively.

[0060] Drone risk classification The following calculations were performed based on internal system energy status, task execution status, security and communication conditions: ; This indicates internal health risks, specifically the risks associated with the drone's internal systems. The value is the maximum value among the corresponding values ​​for battery risk, sensor risk, motor risk, etc. This indicates external environmental risks, such as the risks posed by the external environment to drones. The value is the maximum value among the corresponding values ​​for obstacle risk, strong wind risk, and no-fly zone risk. This indicates the risk of mission execution, specifically the risks associated with the drone performing the mission. The value is the maximum value among the values ​​corresponding to route deviation risk and mission timeout risk.

[0061] Each individual risk must be normalized to a range of 0 or 1. For example, calculating the "battery risk score": Safety threshold: 50% battery (risk = 0.0); Danger threshold: 20% battery (risk = 1.0); Current battery level: 35%; Calculation: (50% - 35%) / (50% - 20%) = 15% / 30% = 0.5.

[0062] The formula for local decision confidence is: ; PDC-Edge will With threshold Compare: like The confidence level is high enough that the local decision-making is dominated by the drone ATADE.

[0063] like < If the confidence level is insufficient, such as when the link is good or the risk is high, the drone will proactively report the decision-making authority to the satellite ATADE for leadership.

[0064] (4) Figure 5In section S103.4, Continuous Authentication Challenge and Policy Enforcement: The ATADE (drone or satellite) selected as the "leader" by the PDC outputs the final decision command. If the command is mandatory authentication, the Continuous Authentication Control Module (CAS) on the satellite is activated. CAS generates an authentication challenge and sends it to the terminal. The terminal responds to the challenge. The authentication result is then fed back to the ATADE as new input to update the trust score. Based on the latest trust score, the ATADE may output a new access control decision, such as "Allow" or "Deny," which is ultimately enforced on the data link by the Policy Enforcement Platform (PEP) on the drone.

[0065] S105: When the terminal needs to switch between drones, the satellite will transfer the terminal's dynamic trust assessment context to the target drone.

[0066] Specifically, in step S105, when the terminal needs to switch between drones, the satellite will transfer the terminal's dynamic trust assessment context to the target drone, including the following steps S1051 to S1058.

[0067] S1051, obtains the optimal link quality for the drone in real time. And determine the link quality Is it less than the second threshold? If so, the terminal sends a handover request to the satellite; the handover request includes the identity identifier of the target UAV. S1052, After verifying the satellite handover request, obtain the terminal's security context; wherein, the security context includes: session key, trust value, and behavioral state; S1053, the satellite generates a one-time switching token and obtains a trust context block based on the security context and the one-time switching token; S1054, The satellite digitally signs the trust context block based on the satellite's corresponding private key; S1055, the satellite sends the signed trust context block to the target drone; S1056, The target drone verifies the digital signature and preloads the trust context block; S1057, the terminal initiates an attach request to the target drone; the attach request carries a one-time handover token; S1058, the target drone verifies the one-time switching token. After a successful match, the communication session with the terminal is resumed and a trust assessment is performed using the security context.

[0068] For example, (1) Phase 1: see Figure 4 Steps 1-2, Switching Preparation: Step 1: The terminal detected that the signal-to-noise ratio of the link with UAV-A was less than 10dB.

[0069] Step 2: The terminal returns to step 6 of S102, finds the optimal UAV-B, and sends a handover request to the AMF module of its common superior (satellite), the request containing the IDs of UAV-A and UAV-B.

[0070] (2) Phase Two: See Figure 4 Steps 3-8, Satellite Coordination and Context Transfer: Steps 3-4: The satellite AMF verifies the legitimacy of the request and requests the latest security context of the terminal from the satellite ATADE-Sat, including the session key, real-time trust score, FSTM status, etc.

[0071] Step 5, the satellite AMF generates a one-time switching token ( The above information is then packaged into a "Trust Context Block (TCB)".

[0072] Step 6: The satellite AMF uses its private key to digitally sign the TCB.

[0073] Step 7: The satellite AMF securely sends the signed TCB to the target UAV-B. The UAV-B verifies the signature and preloads the TCB.

[0074] Step 8: The satellite AMF replies to the terminal with a confirmation of successful deployment.

[0075] (3) Phase Three: See Figure 4 Steps 3-8: Switch between execution and session recovery: Step 9: The satellite AMF issues a handover permission to the terminal, which includes the one-time handover token.

[0076] Step 10: The terminal immediately disconnects from the UAV-A.

[0077] Step 11: The terminal sends an attach request to the UAV-B, carrying the handover token in the request.

[0078] Step 12: The UAV-B verifies whether the token carried by the terminal matches the token in its pre-loaded TCB.

[0079] Step 13, (Match successful) UAV-B immediately uses the security context (such as session key, trust score, state) in the TCB to resume the session and trust assessment with the terminal. The handover is complete, avoiding re-authentication. (Match failed) UAV-B refuses the connection.

[0080] The invention also includes: when the optimal UAV detects a communication link interruption with the satellite, the strategy decision coordination module on the optimal UAV determines the normalized link quality. The confidence level is 0; the strategy decision coordination module calculates the local decision confidence level. When local decision confidence When the threshold for connection loss decision is exceeded, the policy decision coordination module switches to connection loss tolerance mode. In connection loss tolerance mode, all access control decisions for the terminal are independently completed by the adaptive trust assessment and decision engine on the optimal UAV.

[0081] For example, (1) when the link between the UAV and the satellite is interrupted, its PDC-Edge module immediately detects that LQE-S is 0.

[0082] (2) According to the decision formula in S103, It will become very high (leaning towards local decision-making).

[0083] (3) PDC-Edge immediately switches to the chain break tolerance mode, forcing all decision-making power, including high-risk decisions, to be dominated by ATADE on the local drone.

[0084] (4) At this time, the ATADE on the UAV acts as the sole decision-making core, independently completing the "perception-evaluation-decision" security closed loop for all its subordinate terminals until the link is restored.

[0085] Secondly, this invention provides a multi-layered collaborative zero-trust system for integrated air-space-ground-sea networks, the system comprising: The ground control center is equipped with a policy management center and an authoritative identity authentication center, which are used to generate system parameters, digitally sign edge service beacons, and perform identity authentication and initial trust assessment on terminals. The satellite node is equipped with an edge service beacon module, an access and mobility management module, and a policy decision coordination module. It is used to broadcast signed edge service beacons, forward terminal access requests, and migrate the dynamic trust context of the terminal to the target drone node when the terminal switches. Multiple drone nodes, each deployed with an adaptive trust assessment and decision engine, a policy decision coordination module, and a policy execution point, are used to provide edge access services to terminals, continuously monitor the behavior of connected terminals to dynamically update trust values, generate or collaboratively generate access control decisions based on the updated trust values, and enforce them. The terminal has a built-in security agent that receives and verifies the signed edge service beacon, selects the optimal drone node based on the verified list of available drones, and initiates an access request.

[0086] For example, see Figure 2The Ground Control Center, acting as the highest management and trust authority of the system, comprises the Policy Management Center (PCF), the Identity Information Center (UDM), and the Identity Authentication Center (AUSF-Master). The Ground Control Center is responsible for generating system parameters and public-private key pairs. The PCF uses the private key to digitally sign Edge Service Beacon (ESB) messages, ensuring the ESB's authority and tamper-proof nature. Simultaneously, the Ground Control Center processes terminal registration requests, the UDM assigns identity credentials and an initial master key to the terminal, and the AUSF-Master completes the terminal's initial authentication and generates an initial trust score and state. The Ground Control Center also uploads the signed ESB to satellite nodes via ground stations, enabling global policy management and trust root functions.

[0087] Satellite Nodes: Serving as aggregation centers and relays for airborne edge nodes, satellite nodes deploy Edge Service Beacon (ESB) modules, Access and Mobility Management (AMF) modules, and Policy Decision Coordination (PDC-Sat) modules. The satellite receives signed ESBs uploaded by the ground control center and periodically broadcasts these ESBs within its coverage beam, enabling terminals to discover available UAV nodes. During the terminal access phase, the satellite forwards the terminal's access request to the ground control center for authentication. During the seamless trust handover phase, the satellite's AMF module verifies the legitimacy of the terminal's handover request, obtains the terminal's latest security context (such as session key, real-time trust score, and behavioral state) from the satellite's Adaptive Trust Evaluation Engine (ATADE-Sat), generates a one-time handover token and a Trust Context Block (TCB), and securely distributes the TCB to the target UAV node after digitally signing it, ensuring continuous migration of the trust context.

[0088] Multiple UAV nodes: Each UAV node acts as an aerial edge node, providing edge access services and deploying an Adaptive Trust Assessment and Decision Engine (ATADE), a Policy Decision Coordination Module (PDC-Edge), and a Policy Enforcement Point (PEP). When a terminal selects a UAV as the optimal access node, that UAV receives the terminal's access request and forwards it to the ground control center via satellite for authentication. After successful authentication, the UAV's ATADE engine loads the terminal's initial trust state and continuously monitors the terminal's behavioral event stream, such as request rate and traffic characteristics, dynamically updating the trust score and behavioral state. The PDC-Edge module calculates the local decision confidence based on link quality and UAV risk score, determining whether the decision is led by the local ATADE or reported to the satellite ATADE. Finally, the PEP executes access control decisions, such as allowing or denying access, based on the decision instructions output by the ATADE. During the autonomous operation phase after a link failure, the UAV node can independently complete the perception-assessment-decision closed loop for the terminal, ensuring the continuity of security services.

[0089] Terminal: Terminal devices, such as user equipment or sensors, have a built-in security agent and are pre-configured with the public key of the ground-based PCF. The terminal listens for signed ESB messages broadcast by the satellite, verifies the signature using the PCF public key, and parses the list of available drones in the ESB after successful verification. Based on location, service requirements, and local scanning results, such as signal-to-noise ratio (SNR) measurements, the terminal runs a selection algorithm to determine the optimal drone node and initiates an access request to it. During the seamless trust handover phase, the terminal monitors link quality. When the SNR falls below a threshold, it rediscovers the optimal drone and initiates a handover request to the satellite, carrying a one-time handover token to access the target drone to restore the session and trust assessment.

[0090] This system achieves a zero-trust architecture through multi-layered collaboration. The ground control center serves as the root of trust, satellite nodes provide wide-area coverage and secure relay, UAV nodes perform edge trust assessment and policy enforcement, and terminals securely access and dynamically switch, jointly solving the problems of high dynamism, weak connectivity, and limited edge resources in air-space-ground-sea networks.

[0091] This invention implements a "trusted anchor point" and secure discovery in a zero-trust architecture. Traditional zero-trust schemes assume a secure connection between the terminal and the decision point (PDP), but fail to address the problem of "how to securely discover the PDP / PEP." This invention, through the SAEDP mechanism, utilizes satellite broadcasting and PCF authoritative signatures to provide terminals with a trusted method for discovering "legitimate" drones, i.e., edge PEPs. This ensures that the terminal accesses a legitimate node in the zero-trust architecture from the source, preventing ZTA from being deceived and bypassed at the entry point.

[0092] This invention achieves the flexibility and resilience of zero-trust "dynamic decision-making." Existing technologies centralize the zero-trust decision-making power (PDP) on the ground, leading to failure upon connection loss. This invention, through a PDC mechanism and an "edge-satellite" collaborative architecture, enables the flexible transfer of decision-making power. It ensures that the zero-trust dynamic decision-making PDC and continuous evaluation ATADE remain usable in space-air environments with weak connectivity and disconnections, overcoming the fatal flaw of centralized solutions that fail upon connection loss.

[0093] This invention achieves continuity of zero-trust "continuous assessment" during high-speed mobility. The core of zero-trust is "continuous assessment." Existing technologies result in the loss of trust values ​​during handover. This invention, through the STHP mechanism, securely migrates the "Trust Context Block (TCB)," which contains real-time trust scores and behavioral states, during handover. This ensures that the zero-trust "continuous assessment" strategy continues uninterrupted when the terminal traverses different access points at high speed, effectively preventing attackers from exploiting network handover to "launder" trust.

[0094] This invention achieves edge-based and real-time zero-trust "dynamic assessment." Existing technologies centralize assessment capabilities on the ground, resulting in high latency and an inability to respond to sudden threats at the edge. This invention, through a lightweight ATADE engine, pushes the zero-trust "perception-assessment-decision" security closed-loop capability down to the edge of the drone. Compared to centralized solutions that require long-distance data transmission back to the ground for analysis, ATADE can analyze behavioral flows locally in real time, quickly quantify risks, and generate dynamic access control decisions, significantly shortening response time to sudden threats at the edge.

[0095] The security of SAEDP in this invention includes: resistance to spoofing attacks: attackers cannot forge ESBs because without the private key of the ground PCF, any forged ESB cannot pass the terminal's signature verification. Resistance to replay attacks: the timestamp field in the ESB ensures that attackers cannot replay old ESB messages to mislead the terminal.

[0096] STHP's security and authentication: The handover process is three-party authenticated. The satellite verifies its handover request through the terminal's long-term key; the target UAV-B verifies the TCB's authority through the satellite's digital signature; and the UAV-B uses a one-time handover token. The system verifies that the terminal connecting is indeed the authorized one. Confidentiality and integrity: The TCB, containing sensitive keys and trust points, is protected by the satellite's digital signature and cannot be tampered with.

[0097] The core of anti-replay attack measures, the handover token, is one-time use. The expired timestamp in TCB also ensures that expired instructions are invalid. Trust continuity: Trust scores and behavioral states are fully migrated, allowing the zero-trust strategy to continue uninterrupted. This is crucial for detecting chronic attacks, such as APTs, that attempt to evade detection by exploiting handover.

[0098] PDC / ATADE's security, availability / resilience: When the satellite link is lost, PDC-Edge can immediately switch to autonomous mode, ensuring the availability of security services and preventing the zero-trust policy from failing due to network interruption.

[0099] Anti-spoofing attacks and prevention of malicious drones, i.e., edge node impersonation: The SAEDP mechanism addresses this issue at its source. The terminal only trusts drones that are signed and authenticated by the ground-based PCF and are listed in the ESB list.

[0100] Preventing malicious terminal impersonation: Initial access relies on strong identity authentication from the ground-based AUSF-Master; after access, ATADE's continuous behavior assessment mechanism, namely FSTM and trust scoring, can quickly identify abnormal behavior exhibited by terminals with legitimate credentials and trigger CAS re-authentication or policy enforcement point (PEP) blocking.

[0101] Preventing malicious satellites, i.e., impersonation of central nodes: During STHP handover, the target drone verifies the digital signature of the TCB issued by the satellite AMF to ensure that the instructions come from a legitimate satellite center, thus preventing impersonation of intermediate layer nodes.

[0102] To resist Man-in-the-Middle (MITM) attacks, during the detection phase: the integrity of the ESB beacon is protected by PCF digital signatures, so even if a man-in-the-middle intercepts it, he cannot tamper with the list of legitimate drones.

[0103] Communication phase: After the terminal successfully completes the initial access authentication on S103, it establishes encrypted communication with the drone. Subsequent business data and behavior reporting are all conducted in the encrypted channel.

[0104] During the handover phase: The STHP mechanism ensures the integrity and tamper-proof nature of the handover signaling through satellite-signed TCBs and one-time tokens, preventing man-in-the-middle attacks from hijacking or modifying the trust context.

[0105] The various embodiments described in this specification are presented in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on its differences from other embodiments. All or part of this invention can be used in numerous general-purpose or special-purpose computer system environments or configurations. Examples include: personal computers, server computers, handheld or portable devices, tablet devices, mobile communication terminals, multiprocessor systems, microprocessor-based systems, programmable electronic devices, network PCs, minicomputers, mainframe computers, and distributed computing environments including any of the above systems or devices, etc.

[0106] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the present invention.

Claims

1. A multi-layer collaborative zero-trust method for integrated air-space-ground-sea networks, characterized in that, include: The ground control center generates a digitally signed edge service beacon and broadcasts the signed edge service beacon via satellite. The terminal receives the signed edge service beacon, verifies the validity of the digital signature in the signed edge service beacon, obtains a list of available drones, selects the optimal drone based on the list of available drones, and initiates an access request. The access request is forwarded to the ground control center via the satellite to authenticate the terminal. After successful authentication, the optimal UAV continuously monitors the terminal's behavior and dynamically updates the terminal's trust value. Based on the trust value and the current network status, the optimal UAV or the satellite is dynamically determined to generate the access control decision, and the optimal UAV executes the access control decision. When the terminal needs to switch between drones, the satellite transfers the terminal's dynamic trust assessment context to the target drone.

2. The multi-layer collaborative zero-trust method for integrated air-space-ground-sea networks according to claim 1, characterized in that, The ground control center includes: a policy management center, an identity information center, and an identity authentication center; The policy management center is used to generate the system master key pair and to digitally sign the edge service beacon using the private key. The identity information center is used to register terminal identity information and distribute initial master keys; The identity authentication center is used to complete identity authentication based on the initial master key when the terminal first accesses the network.

3. The multi-layer collaborative zero-trust method for integrated air-space-ground-sea network according to claim 1, characterized in that, The ground control center generates a digitally signed edge service beacon and broadcasts the signed edge service beacon via satellite, including: The strategy management center of the ground control center obtains real-time status and satellite orbit data of all UAVs; Based on the real-time status of the UAV and the satellite orbit data, a list of available UAVs is generated, and the list of available UAVs is encapsulated as an edge service beacon; The edge service beacon is digitally signed using the private key of the ground control center to obtain a signed edge service beacon. The ground control center uploads the signed edge service beacon to the satellite; Within its coverage beam, the satellite periodically broadcasts signed edge service beacon messages.

4. The multi-layer collaborative zero-trust method for integrated air-space-ground-sea network according to claim 1, characterized in that, The terminal receives the signed edge service beacon, verifies the validity of the digital signature in the signed edge service beacon, obtains a list of available drones, selects a drone based on the list of available drones, and initiates an access request, including: The terminal's security agent listens for and receives signed edge service beacons; The digital signature of the signed edge service beacon is verified using the public key of the pre-configured ground control center. If verification fails, the signed edge service beacon is discarded. If the verification is successful, the signed edge service beacon is parsed to obtain a list of available drones.

5. The multi-layer collaborative zero-trust method for integrated air-space-ground-sea networks according to claim 1, characterized in that, The process of selecting the optimal drone from the available drone list and initiating an access request includes: The terminal filters the list of candidate drones from the list of available drones based on the drone's location information and the terminal's service requirements. The terminal iterates through each drone in the candidate drone list and performs the following operations: Scan the local beacon of the current candidate drone, and parse the local beacon to obtain the first identity identifier and the first public key hash value; Obtain the second public key hash value of the current candidate drone in the signed edge service beacon based on the first identity identifier; The hash values ​​of the first public key and the second public key are compared. If the comparison results are consistent, the candidate drone list retains the current drone; if the comparison results are inconsistent, the candidate drone list deletes the current drone. Until the traversal is completed, an updated list of candidate drones is obtained. For each drone in the updated list of candidate drones, the terminal measures the drone signal power and drone noise power, and then calculates the link signal-to-noise ratio corresponding to each drone. The terminal determines an optimal drone based on the link signal-to-noise ratio and corresponding resource status of each drone using a weighted scoring algorithm, and then initiates an access request to the optimal drone.

6. The multi-layer collaborative zero-trust method for integrated air-space-ground-sea network according to claim 1, characterized in that, The optimal drone continuously monitors the behavior of the terminal and dynamically updates the trust value of the terminal, including: The ground control center generates an initial trust value and an initial state for the terminal; The behavior perception module on the optimal UAV captures the terminal's behavior event stream in real time; wherein, the behavior event stream includes: request rate and traffic characteristics; The adaptive trust evaluation and decision engine on the optimal UAV transforms the behavioral event stream into discrete semantic states. The adaptive trust assessment and decision engine on the optimal UAV recalculates the trust value of the terminal based on the discrete semantic state. The optimal drone will synchronize the updated trust value to the adaptive trust assessment and decision engine on the satellite.

7. The multi-layer collaborative zero-trust method for integrated air-space-ground-sea networks according to claim 6, characterized in that, The step of dynamically determining whether to generate an access control decision based on the trust value and the current network state, and having the optimal UAV or the satellite execute the access control decision, includes: The strategy decision coordination module on the optimal UAV calculates the local decision confidence level after the terminal's trust value is updated. The calculation is fused into the satellite link quality. and the risk score of the optimal UAV ; The strategy decision coordination module will With the first threshold If a comparison is made, Then the adaptive trust assessment and decision engine on the optimal UAV generates access control decisions; if Then the adaptive trust assessment and decision engine on the satellite generates access control decisions; The optimal UAV executes the access control decision.

8. The multi-layer collaborative zero-trust method for integrated air-space-ground-sea network according to claim 1, characterized in that, When the terminal needs to switch between drones, the satellite transfers the dynamic trust assessment context of the terminal to the target drone, including: Real-time acquisition of the link quality of the optimal UAV And determine the link quality. Is it less than the second threshold? If so, the terminal sends a handover request to the satellite; wherein the handover request includes the identity identifier of the target UAV; After verifying the handover request, the satellite obtains the security context of the terminal; wherein, the security context includes: session key, trust value, and behavioral state; The satellite generates a one-time switching token and obtains a trust context block based on the security context and the one-time switching token; The satellite digitally signs the trust context block based on its corresponding private key. The satellite sends the signed trust context block to the target drone; The target drone verifies the digital signature and preloads the trust context block; The terminal initiates an attach request to the target drone; wherein the attach request carries the one-time switching token; The target drone verifies the one-time switching token. After a successful match, it uses the security context to resume the communication session and trust assessment with the terminal.

9. The multi-layer collaborative zero-trust method for integrated air-space-ground-sea network according to claim 1, characterized in that, Also includes: When the optimal UAV detects a communication link interruption with the satellite, the strategy decision coordination module on the optimal UAV determines the normalized link quality. =0; The strategy decision coordination module calculates the local decision confidence level. ; When local decision confidence When the threshold for chain disconnection is exceeded, the strategy decision coordination module switches to the chain disconnection tolerance mode. In the aforementioned chain-break tolerance mode, all access control decisions for the terminal are independently completed by the adaptive trust assessment and decision engine on the optimal UAV.

10. A multi-layered collaborative zero-trust system for integrated air-space-ground-sea networks, used to implement the method described in any one of claims 1-9, characterized in that, The system includes: The ground control center is equipped with a policy management center and an authoritative identity authentication center, which are used to generate system parameters, digitally sign edge service beacons, and perform identity authentication and initial trust assessment on terminals. The satellite node is equipped with an edge service beacon module, an access and mobility management module, and a policy decision coordination module. It is used to broadcast the signed edge service beacon, forward the terminal's access request, and migrate its dynamic trust context to the target drone node when the terminal switches. Multiple drone nodes, each deployed with an adaptive trust assessment and decision engine, a policy decision coordination module, and a policy execution point, are used to provide edge access services to terminals, continuously monitor the behavior of connected terminals to dynamically update trust values, generate or collaboratively generate access control decisions based on the updated trust values, and enforce them. The terminal has a built-in security agent for receiving and verifying the signed edge service beacon, selecting the optimal drone node based on the verified list of available drones, and initiating an access request.

Images