A method and system for cooperative networking of wireless mesh ad hoc network communication devices

Abstract

The application provides a cooperative networking method and system of a wireless MESH ad hoc networking device, receives a cooperative networking access request from a MESH node in a multi-trust domain, collects trust evaluation data of each MESH node, and then determines a corresponding dynamic trust evaluation result; generates a corresponding node cooperative authority configuration according to the dynamic trust evaluation result of each node, establishes a dynamic authority mapping table by using a micro-division technology according to all node cooperative authority configurations; performs access control verification on each node based on the dynamic authority mapping table, makes the corresponding node authority record effective, each node completes cooperative networking interaction according to the minimum authority constraint according to the node authority record; monitors the running behavior of each node, triggers a cooperative trust contraction process when an anomaly is detected, and realizes dynamic optimization of cooperative networking. The application can realize dynamic authority adaptation and adaptive networking optimization with topology awareness in a multi-trust domain MESH ad hoc networking scene.

Description

Technical Field

[0001] This application relates to the field of wireless ad hoc network communication and network access control technology. More specifically, this application relates to a collaborative networking method and system for wireless MESH ad hoc network communication devices. Background Technology

[0002] With the widespread application of wireless mesh (wireless mesh) self-organizing networking technology in industrial networking, emergency communication, and edge distributed networking scenarios, the mesh network is a hybrid network of devices from multiple vendors and with multiple security zones. Different security zones correspond to independent trust domains, and a large number of mesh nodes under multiple trust domains need to coordinate routing, data forwarding, and service interaction across domains.

[0003] However, traditional networking methods primarily rely on perimeter defense, such as MAC address whitelists or pre-configured static certificates. Nodes are often granted fixed communication permissions after initial access authentication. This static permission model lacks continuous evaluation of the node's actual operational status. Existing policy control mechanisms struggle to combine complex network topology and context for fine-grained permission segmentation, easily leading to over-granting of permissions and violating the principle of least privilege. When a node's normal behavior deviates or anomalies, existing networks struggle to block or dynamically reduce permissions in real time, resulting in poor network adaptability and self-healing capabilities. Therefore, how to achieve topology-aware dynamic permission adaptation and adaptive network optimization in multi-trust domain MESH self-organizing network scenarios has become a challenge for the industry. Summary of the Invention

[0004] This application provides a collaborative networking method and system for wireless MESH self-organizing network communication devices, which can realize topology-aware dynamic permission adaptation and adaptive networking optimization in multi-trust domain MESH self-organizing network scenarios.

[0005] In a first aspect, this application provides a collaborative networking method for wireless MESH self-organizing network communication devices, comprising the following steps: Receive collaborative networking access requests from MESH nodes in multiple trust domains, call the trust assessment module to collect trust assessment data from each MESH node, and determine the dynamic trust assessment result of each MESH node. Based on the dynamic trust assessment results of each MESH node, corresponding node collaboration permission configurations are generated. Based on all node collaboration permission configurations, a unified dynamic permission mapping table is established using MESH topology-oriented micro-segmentation technology. Based on the dynamic permission mapping table, access control verification is performed on the collaborative networking interaction requests of each MESH node to make the corresponding node permission records effective. Each MESH node completes the collaborative networking interaction according to the effective node permission records and the least permission constraint. Continuously monitor the operational behavior of each MESH node, and when an anomaly is detected, trigger the collaborative trust contraction process to achieve dynamic optimization of collaborative networking.

[0006] In some embodiments, a collaborative networking access request from MESH nodes in multiple trust domains is received, a trust assessment module is invoked to collect trust assessment data of each MESH node, and a dynamic weighted fusion algorithm is used to determine the dynamic trust assessment result of each MESH node.

[0007] In some embodiments, generating corresponding node collaboration permission configurations based on the dynamic trust assessment results of each MESH node specifically includes: The network strategy management module receives the dynamic trust assessment results of each MESH node and, in conjunction with the strategy decision context, constructs a global decision mapping strategy matrix. Each MESH node queries the decision mapping strategy matrix based on its own node configuration information and the trust label in the dynamic trust assessment results to obtain the corresponding permission allocation benchmark vector. A piecewise linear mapping algorithm is used to correct the permission allocation baseline vector based on the dynamic trust value in the dynamic trust evaluation results of each MESH node; The permission allocation baseline vector is dynamically adjusted based on the real-time load of the virtual network partition where the MESH node is located to obtain the permission configuration coefficient of the MESH node. Based on the permission configuration coefficients corresponding to each MESH node, an adapted node collaboration permission configuration is generated for each MESH node. The node collaboration permission configuration includes routing broadcast permissions, data forwarding permissions, and service call permissions.

[0008] In some embodiments, establishing a unified dynamic permission mapping table based on the collaborative permission configuration of all nodes and employing a MESH topology-oriented micro-segmentation technique specifically includes: The resource management module receives node collaboration permission configurations and dynamic trust assessment results from each MESH node; Based on the current topology of the MESH network, extract the node connection relationships and node roles. Combine the trust labels and node collaboration permission configurations of each MESH node, divide the node groups according to the trust level, and arrange the isolation domains for routing broadcasts, data forwarding, and service calls between groups. A token generation mechanism based on attribute-based encryption is adopted, combined with the isolation domain boundary of the node group, to generate a minimum-granularity access token for each MESH node; Using the identity identifier of each MESH node as a unique index, a unified dynamic permission mapping table is constructed by associating and binding the corresponding node group identifier, trust label, minimum granularity access token information, various communication permissions and valid timestamps.

[0009] In some embodiments, performing access control verification on the collaborative networking interaction requests of each MESH node based on the dynamic permission mapping table, and making the corresponding node permission records effective, specifically includes: For each MESH node, the network strategy management module initiates differentiated permission synchronization with the resource management module based on the existing entries in the dynamic permission mapping table, triggering the resource management module to perform atomic updates of permission policies; After the update is completed, the resource management module starts a two-dimensional verification mechanism to compare the consistency of the updated permission record of the MESH node with the corresponding entry in the dynamic permission mapping table, as well as the consistency with the node collaborative permission configuration pushed by the network strategy management module. If the verification passes, the permission record of the MESH node will take effect immediately, and the resource management module will send back the effect status to form a closed-loop confirmation. If the verification fails, the network policy management module corrects the node collaboration permission configuration of the MESH node based on the verification difference and updates the dynamic permission mapping table synchronously, iterating through the verification process until the permission takes effect.

[0010] In some embodiments, each MESH node completes collaborative networking interaction according to the least privilege constraint based on the effective node permission records. This specifically includes: When each MESH node initiates a collaborative networking access request, it submits an authorization verification application to the resource management module, carrying its own identity and encrypted access token. The resource management module retrieves and matches effective permission records based on the dynamic permission mapping table, and verifies the legality of the tokens and the validity of the permissions of each MESH node; After successful verification, the resource management module returns network access permission and permission scope definition information to each MESH node. Each MESH node, based on the corresponding effective permission record, only initiates route broadcasting, data forwarding, and service calls within the minimum permission scope.

[0011] In some embodiments, the operational behavior of each MESH node is continuously monitored, and when an anomaly is detected, the collaborative trust contraction process is triggered, specifically including: During the collaborative operation of the wireless MESH self-organizing network, the behavior monitoring module continuously collects multi-dimensional operational behavior data of each MESH node and makes anomaly judgments on the operational status of each MESH node based on preset multi-dimensional behavioral characteristics. When the confidence level of the behavior of any MESH node is lower than the preset anomaly judgment threshold, the behavior monitoring module determines that the MESH node is in an abnormal state and sends a downgrade command to the network policy management module. The network strategy management module progressively shrinks the routing broadcast permissions, data forwarding permissions, and service call permissions of abnormal nodes in a layered manner based on the severity and type of abnormal behavior.

[0012] Secondly, this application provides a cooperative networking system for wireless MESH self-organizing network communication devices, used to execute a cooperative networking method for wireless MESH self-organizing network communication devices, including: The trust assessment module is used to receive collaborative networking access requests from MESH nodes in multiple trust domains, call the trust assessment module to collect trust assessment data from each MESH node, and determine the dynamic trust assessment result of each MESH node. The permission mapping module is used to generate corresponding node collaboration permission configurations based on the dynamic trust assessment results of each MESH node. Based on all node collaboration permission configurations, a unified dynamic permission mapping table is established using MESH topology-oriented micro-segmentation technology. The networking interaction module is also used to perform access control verification on the collaborative networking interaction requests of each MESH node based on the dynamic permission mapping table, so that the corresponding node permission records take effect, and each MESH node completes the collaborative networking interaction according to the minimum permission constraint based on the effective node permission records. The anomaly control module is used to continuously monitor the operational behavior of each MESH node. When an anomaly is detected, it triggers the collaborative trust contraction process to achieve dynamic optimization of collaborative networking.

[0013] Thirdly, this application provides a computer device, the computer device including a memory and a processor, the memory storing code, and the processor being configured to acquire the code and execute the above-described collaborative networking method for wireless MESH self-organizing network communication devices.

[0014] Fourthly, this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described collaborative networking method for wireless MESH self-organizing network communication devices.

[0015] The technical solutions provided by the embodiments disclosed in this application have the following beneficial effects: This application provides a collaborative networking method and system for wireless MESH self-organizing network communication devices. The method involves receiving collaborative networking access requests from MESH nodes across multiple trust domains, calling a trust evaluation module to collect trust evaluation data from each MESH node, and determining the dynamic trust evaluation result of each MESH node. Based on the dynamic trust evaluation results of each MESH node, corresponding node collaborative permission configurations are generated. A unified dynamic permission mapping table is established using a MESH topology-oriented micro-segmentation technique based on all node collaborative permission configurations. Access control verification is performed on the collaborative networking interaction requests of each MESH node based on the dynamic permission mapping table, ensuring the corresponding node permission records take effect. Each MESH node completes collaborative networking interaction according to the least privilege constraint based on the effective node permission records. The method continuously monitors the operational behavior of each MESH node, and when an anomaly is detected, a collaborative trust contraction process is triggered to achieve dynamic optimization of the collaborative networking.

[0016] Therefore, this application firstly achieves dynamic adaptive control of trust values ​​to permissions through piecewise linear mapping, forming a two-layer differentiated permission configuration logic with trust labels as the baseline and trust values ​​for precise fine-tuning, effectively improving the dynamic adaptability of MESH cross-trust domain network permission management; secondly, it introduces micro-segmentation technology for wireless MESH topology, relying on node grouping and isolation domain orchestration to achieve fine-grained permission splitting, and combines attribute-based encryption mechanism to construct a structured dynamic permission mapping table, realizing standardized, fine-grained, and efficient retrieval of permission management; thirdly, for the permission issuance and activation stages, an atomic update mechanism is used to ensure that the mapping table is not in an inconsistent intermediate state, avoiding permission configuration chaos; and fourthly, a two-dimensional verification method is used to comprehensively check... By checking for abnormal permission configurations, the risk of missed configuration checks is reduced. Combined with an end-to-end closed-loop confirmation mechanism, configuration discrepancies caused by message loss or asynchronous delays are eliminated. Multi-hop, hop-by-hop permission verification ensures end-to-end permission synchronization across multiple nodes, improving the stability and reliability of cross-trust domain MESH collaborative networking. Finally, the introduction of confidence calculation based on multi-dimensional behavioral features transforms complex anomaly detection into quantitative indicators. Combined with adaptive anomaly judgment thresholds, this reduces the probability of false alarms in dynamic network environments. A layered, progressive permission contraction is implemented for abnormal node behavior, and a reverse-order, step-by-step recovery mechanism enhances network self-healing capabilities, prevents security risks, and ensures the continuous operation of basic services, achieving dynamic optimization and control of collaborative networking.

[0017] In summary, the technical solution adopted in this application can achieve topology-aware dynamic permission adaptation and adaptive networking optimization in multi-trust domain MESH self-organizing network scenarios. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only for this embodiment of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is an exemplary flowchart of a collaborative networking method for wireless MESH self-organizing network communication devices according to some embodiments of this application; Figure 2 This is a schematic diagram illustrating an application scenario of a collaborative networking method for wireless MESH self-organizing network communication devices according to some embodiments of this application; Figure 3 This is an exemplary flowchart illustrating the generation of node collaboration permission configurations for each MESH node according to some embodiments of this application; Figure 4 This is a schematic diagram of the structure of a collaborative networking system of wireless MESH self-organizing communication devices according to some embodiments of this application; Figure 5 This is a schematic diagram of the structure of a computer device that implements a collaborative networking method for wireless MESH self-organizing network communication devices according to some embodiments of this application. Detailed Implementation

[0020] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of the embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0021] This application provides a collaborative networking method and system for wireless MESH self-organizing network communication devices. The core of the method involves receiving collaborative networking access requests from MESH nodes in multiple trust domains, calling a trust evaluation module to collect trust evaluation data from each MESH node, and determining the dynamic trust evaluation result of each MESH node. Based on the dynamic trust evaluation results of each MESH node, corresponding node collaborative permission configurations are generated. A unified dynamic permission mapping table is established using a micro-segmentation technique oriented towards the MESH topology, based on all node collaborative permission configurations. Access control verification is performed on the collaborative networking interaction requests of each MESH node based on the dynamic permission mapping table, ensuring the corresponding node permission records take effect. Each MESH node completes collaborative networking interaction according to the least privilege constraint based on the effective node permission records. The system continuously monitors the operational behavior of each MESH node, and when an anomaly is detected, a collaborative trust contraction process is triggered to achieve dynamic optimization of the collaborative networking. This scheme enables topology-aware dynamic permission adaptation and adaptive networking optimization in multi-trust domain MESH self-organizing network scenarios.

[0022] To better understand the above technical solutions, a detailed description of the technical solutions will be provided below in conjunction with the accompanying drawings and specific embodiments. (Refer to...) Figure 1 This figure is an exemplary flowchart of a cooperative networking method for wireless MESH self-organizing network communication devices according to some embodiments of this application. The figure mainly includes the following steps: In step S101, a collaborative networking access request from MESH nodes in multiple trust domains is received, the trust assessment module is invoked to collect trust assessment data of each MESH node, and the dynamic trust assessment result of each MESH node is determined.

[0023] In some embodiments, receiving cooperative networking access requests from MESH nodes in multiple trust domains, invoking the trust assessment module to collect trust assessment data from each MESH node, and using a dynamic weighted fusion algorithm to determine the dynamic trust assessment result of each MESH node can be done in the following manner: Receive collaborative networking access requests initiated by MESH nodes in different trust domains, and verify the legitimacy of the nodes initiating the access requests; The trust assessment module is invoked to collect trust assessment data of each MESH node. Based on the collected trust assessment data, a dynamic weighted fusion algorithm with adaptive weight adjustment is used to generate the dynamic trust value of the corresponding MESH node, and the trust label corresponding to the MESH node is output according to the preset nonlinear hierarchical mapping function. For each MESH node, the dynamic trust value and the trust label are used together as the dynamic trust evaluation result of that MESH node.

[0024] It should be noted that, Figure 2This is a schematic diagram of an application scenario for a collaborative networking method for wireless MESH self-organizing network communication devices according to some embodiments of this application. As shown in the figure, in a cross-trust domain MESH collaborative networking scenario, MESH nodes deployed within various independent trust domains actively initiate collaborative networking access requests to the networking policy management module of the target trust domain based on cross-domain service interaction requirements.

[0025] It should be noted that the trust assessment data includes: historical interaction compliance data, certificate chain verification results, and cross-domain signaling path credibility data.

[0026] In specific implementation, the network strategy management module continuously captures collaborative network access request packets sent by each cross-domain MESH node through a dedicated signaling parsing interface. It uses a packet parsing algorithm to extract the unique identifier of the node within the packet and verifies the packet content based on a pre-entered node access whitelist containing legitimate wireless MESH device identifiers and a cross-domain identity authentication specification established based on the cross-domain security interaction protocol. This completes the pre-verification of the MESH node's identity legitimacy and access permissions. The network strategy management module directly intercepts forged nodes, unauthorized devices, and abnormal request packets, filtering out a set of trusted nodes that pass verification. For the trusted nodes... For each node in the node set, the trust assessment module establishes an encrypted communication link with the resource management module within the trust domain of that node, and queries the resource management module for the node's historical interaction compliance data over the past 7 days, including: the frequency of abnormal signaling interactions, the data forwarding success rate with other nodes, and the cross-domain interaction data integrity compliance rate; the collected historical interaction compliance data is normalized to form a behavioral feature vector in the interval [0, 1], and then the principal component analysis algorithm is used to reduce the dimensionality of the feature vector, outputting a comprehensive historical interaction score in the interval of 0 to 1. The higher the score, the more standardized the node's historical interaction behavior.

[0027] In addition, in specific implementation, after obtaining the certificate chains of each node and performing certificate chain verification, the trust assessment module obtains the certificate chain verification results. Then, the trust assessment module adopts a multi-level index hierarchical weighted scoring algorithm to perform sub-item quantitative judgment and assign corresponding sub-item scores for multiple verification dimensions such as the compliance of certificate validity period, certificate revocation status, and integrity of certificate chain nodes in the certificate chain verification results. Then, the security weights of each verification dimension are combined for weighted integration calculation to output the certificate chain credibility score of the node, with a value range of [0, 1]. The higher the score, the more complete the certificate chain and the more trustworthy the issuance path. The security weights of each verification dimension are determined by statistical analysis based on historical experimental data of cross-trust domain networking.

[0028] It should be noted that the network strategy management module is the control core of the MESH self-organizing network. It is mainly responsible for formulating permission policies, generating permission configurations, and linking permission verification for cross-domain collaborative networking. It coordinates the trust assessment module and resource management module to complete core processes such as trust assessment, permission control, and anomaly control. It is the core decision-making unit for permission control in cross-trust domain collaborative networking. The trust assessment module is responsible for collecting multi-dimensional data from various MESH nodes, certificate management platform, resource management module, and other related nodes, and carrying out data standardization processing, intelligent analysis, and trust assessment. This provides accurate dynamic trust assessment results to support the network strategy management module in generating permission configurations. The resource management module is responsible for storing and querying data related to node service registration, service discovery, and cross-domain interaction. This provides reliable data retrieval and access support for the trust assessment module to collect compliant historical interaction data of nodes, ensuring the integrity and timeliness of trust assessment data collection.

[0029] In practice, the trust assessment module tracks the signaling transmission paths of each MESH node during cross-trust domain interactions, collecting cross-domain signaling path trustworthiness data. This data covers three core measurement dimensions: the number of trust domains the signaling passes through in the transmission path, the enabled status of transport layer encryption, and whether the gateway or proxy used for cross-domain communication has a complete and seamless security mechanism. The trust assessment module quantifies and judges each dimension separately, and performs weighted statistical fusion calculations based on preset differentiated statistical weights to output a cross-domain signaling path trustworthiness score, with a value range of [0, 1]. The higher the score, the more secure the signaling path. The differentiated statistical weights of each dimension are pre-calibrated based on long-term measured operation data of cross-trust domain MESH networking and statistical patterns of security risk events. Through the above method, the trust assessment module generates a standardized trust score for each node in three dimensions: historical interaction comprehensive score, certificate chain trustworthiness score, and cross-domain signaling path trustworthiness score.

[0030] It should be noted that the trust assessment module is pre-configured with a non-linear hierarchical mapping function. This function has been calibrated according to the security level requirements of cross-trust domain MESH collaborative networking. It is used to convert continuous dynamic trust values ​​into discrete trust labels. The specific mapping rules are as follows: when the dynamic trust value is ≥ 0.7, the mapping output is a high trust label; when 0.3 ≤ dynamic trust value < 0.7, the mapping output is a medium trust label; when the dynamic trust value < 0.3, the mapping output is a low trust label.

[0031] In specific implementation, for each dimension, the dynamic entropy weight method is used to calculate the dispersion and information utility value of the standardized trust score corresponding to that dimension across all nodes. The information utility value is derived from the dimension's information entropy; the higher the information entropy value, the lower the information utility value for distinguishing trust differences between nodes, thus characterizing the trust discrimination capability of a single dimension. In the weight allocation rule, the dispersion, information utility value, and adaptive weight of that dimension are positively correlated, while the sum of the adaptive weights corresponding to the three dimensions is constrained to be constant at 1 after normalization. The trust evaluation module, based on the dispersion and information utility value corresponding to each dimension, combines the positive correlation to complete the weight conversion and normalization constraint solution, and determines the adaptive weight corresponding to each dimension. Subsequently, the standardized trust scores of the three dimensions of a single node are multiplied by the corresponding adaptive weights item by item and summed through weighted fusion summation to finally obtain the dynamic trust value of that node. The dynamic trust value is a continuous quantized value in the interval [0, 1], which can characterize the real-time comprehensive trust level of the node. Further, the dynamic trust value is input into a preset nonlinear hierarchical mapping function to obtain the trust label corresponding to the node. Finally, the trust assessment module binds and encapsulates the dynamic trust value of each node with the corresponding trust tag, which together serve as the dynamic trust assessment result of that node, and pushes it synchronously to the network policy management module.

[0032] It should be noted that the trust assessment module independently executes the entire assessment process for each MESH node requesting access, generating independent dynamic trust values ​​and trust tags for each node, continuously tracking the behavioral changes of each node during collaborative networking operations, and periodically iterating and updating the dynamic trust assessment results of the corresponding nodes to ensure that the trust assessment conclusions can reflect the latest status of the nodes in real time.

[0033] In addition, it should be noted that by implementing unified dimensional standardization processing on three types of heterogeneous evaluation data—historical interactions, certificate trustworthiness, and signaling transmission paths—and combining the dynamic entropy weight method to adaptively allocate the fusion weights of each dimension, the problems of inconsistent indicator scales and one-sided evaluation results caused by the direct fusion of multi-source heterogeneous data are solved. The fusion mechanism based on adaptive weights improves the objectivity, adaptability, and scenario adaptability of the cross-domain node comprehensive trust evaluation.

[0034] In step S102, based on the dynamic trust assessment results of each MESH node, a corresponding node collaborative permission configuration is generated. Based on all the node collaborative permission configurations, a unified dynamic permission mapping table is established using MESH topology-oriented micro-segmentation technology.

[0035] Preferably, in some embodiments, reference is made to Figure 3As shown in the figure, this is an exemplary flowchart of generating node collaboration permission configurations for each MESH node according to some embodiments of this application. In this embodiment, generating the corresponding node collaboration permission configurations based on the dynamic trust assessment results of each MESH node can be achieved by the following steps: In step S1021, the network strategy management module receives the dynamic trust assessment results of each MESH node and constructs a global decision mapping strategy matrix in combination with the strategy decision context. In step S1022, each MESH node queries the decision mapping strategy matrix based on its own node configuration information and the trust label in the dynamic trust assessment result to obtain the corresponding permission allocation benchmark vector. In step S1023, a piecewise linear mapping algorithm is used to correct the permission allocation benchmark vector based on the dynamic trust value in the dynamic trust evaluation result of each MESH node. In step S1024, the modified permission allocation baseline vector is dynamically adjusted according to the real-time load of the virtual network partition where the MESH node is located, so as to obtain the permission configuration coefficient of the MESH node. In step S1025, based on the permission configuration coefficients corresponding to each MESH node, an adapted node collaboration permission configuration is generated for each MESH node. The node collaboration permission configuration includes routing broadcast permission, data forwarding permission, and service call permission.

[0036] In practice, firstly, the network strategy management module receives the dynamic trust assessment results of each MESH node from the trust assessment module. Simultaneously, the network strategy management module retrieves the policy decision context output by the network management platform and topology management unit in real time through a dedicated data interaction channel. Parameters include cross-domain networking service types, virtual network partition deployment schemes, security levels of each trust domain, node service priorities, and resource allocation quotas. Based on the policy decision context and all trust labels, the network strategy management module constructs a global decision mapping policy matrix. This matrix uses trust labels as the row dimension and nodes as the node dimension. The configuration type is column-dimensional. Specifically, at the row level, the network strategy management module sorts trust labels hierarchically and normally to form an ordered row index based on the trust domain security level and business trustworthiness requirements. Trust labels with higher security requirements are placed further down the row index. At the column level, based on the node's business priority and resource allocation quota, the configuration information of each node is classified into multiple types, including high-priority control, medium-priority data forwarding, and low-priority ordinary communication, etc., and arranged in ascending order of business priority to form a column index. The higher the business priority or the larger the resource quota, the larger the corresponding column index.

[0037] In addition, in specific implementation, each element in the matrix corresponds to a set of three-dimensional structured permission allocation benchmark parameters, including: routing broadcast permission benchmark, data forwarding permission benchmark, and service call permission benchmark. Each benchmark parameter is jointly determined by the network strategy management module based on the virtual network partition deployment scheme and resource allocation quota. That is, taking the standardized unit 1 as the reference benchmark, it corresponds to the medium permission configuration of the medium trust label and ordinary communication nodes. The actual environmental parameter values ​​corresponding to the medium permission configuration are preset by the network strategy management module according to the network deployment template. For the same combination of trust label and node configuration type, the network strategy management module adjusts the benchmark parameters in combination with the partition isolation level and the remaining available resources: the higher the partition isolation level and the more abundant the remaining resources, the benchmark values ​​of the three quantifiable numerical dimensions in the permission allocation benchmark parameters are multiplied by a gain coefficient ranging from 1.0 to 2.0 for appropriate upward adjustment. Conversely, they are multiplied by an attenuation coefficient ranging from 0.5 to 1.0 for reasonable convergence. The gain coefficient and attenuation coefficient are calculated based on the real-time remaining resource ratio of the entire network.

[0038] In practice, for each MESH node, the network strategy management module uses the node configuration type and trust label of a single node as the joint retrieval key to perform precise index matching on the decision mapping strategy matrix, reads the three-dimensional permission baseline parameters corresponding to the corresponding elements, and encapsulates them to generate a permission allocation baseline vector. Then, to address the coarse-grained permission issues arising from relying solely on trust labels, a piecewise linear mapping is introduced, leveraging dynamic trust values ​​to achieve fine-grained continuous permission correction. Specifically, the network strategy management module pre-stores three piecewise linear correction functions locally, adaptively matching different correction functions based on the interval of the dynamic trust value: when the dynamic trust value < 0.3, the correction coefficient is calculated using the formula "correction coefficient = 0.5 + 0.5 × (dynamic trust value / 0.3)"; when 0.3 ≤ dynamic trust value < 0.7, the correction coefficient is fixed at 1; when the dynamic trust value ≥ 0.7, the correction coefficient is calculated using the formula "correction coefficient = 1.0 + 1.0 × ((dynamic trust value - 0.7) / 0.3)". For each node, all baseline parameters in its corresponding permission allocation baseline vector are multiplied by the corresponding correction coefficient to obtain the corrected permission allocation baseline vector for that node.

[0039] It should be noted that, through piecewise linear mapping, dynamic adaptive control of permissions can be achieved based on the dynamic trust value of MESH nodes: low-trust nodes automatically shrink access permissions to reduce cross-domain security risks, medium-trust nodes maintain basic permissions to ensure stable business operation, and high-trust nodes appropriately expand service permissions and resource quotas. This realizes a two-layer differentiated permission configuration logic of coarse-grained label setting the baseline and fine-grained trust value making precise fine-tuning, effectively improving the dynamic adaptation capability of permission control in cross-trust domain MESH collaborative networking.

[0040] In practice, the network strategy management module reads the virtual partition resource data of the node through a standardized data interface, and uses the ratio of the partition's occupied resources to the total resources as the partition load rate. A piecewise inverse proportional adjustment function is used to calculate the load adjustment coefficient. That is, when the partition load rate is ≤50%, the load adjustment coefficient is 1; when the load rate is >50%, it is calculated according to the formula "load adjustment coefficient = 1.5 - partition load rate". The values ​​of each dimension in the corrected permission allocation benchmark vector are multiplied by the load adjustment coefficient to obtain the permission configuration coefficient of the fused node's trusted status, configuration requirements, and partition load. This coefficient is a three-dimensional permission coefficient vector, which provides the core quantitative basis for the subsequent generation of node collaborative permission configuration. Finally, the network strategy management module converts each dimension of the permission configuration coefficients into executable control rules for the MESH network: the route broadcast coefficient is mapped to a route broadcast range control list, restricting the types of routes that nodes can broadcast and the sending frequency; the data forwarding coefficient is mapped to forwarding scheduling priority levels and bandwidth limit parameters; the service call coefficient is mapped to a whitelist of callable services, event subscription range rules, and control group resource limit parameters for virtualized CPUs and memory, with resource constraints executed by the containerized platform corresponding to the node deployment location; all control rules are integrated and encapsulated to generate the complete node collaborative permission configuration for that node; after the node collaborative permission configurations of all nodes are generated, the network strategy management module associates the node collaborative permission configuration of each node with the corresponding dynamic trust assessment results, and pushes them synchronously to the resource management module through a secure encrypted channel, providing raw data for the resource management module to build a full-domain dynamic permission mapping table, thus completing the closed-loop collaborative control between the policy generation and permission storage modules.

[0041] It should be noted that the baseline is first determined by trust labels and node configuration information, then nonlinear correction is made by real-time dynamic trust values, and finally adaptive adjustment is made by combining virtual network partition load. This achieves the matching of the trusted state of each node with the real-time network environment, breaking through the limitations of static and coarse-grained permission configuration in existing technologies and improving the flexibility and security of collaborative networking.

[0042] In some embodiments, based on the collaborative permission configuration of all nodes, a unified dynamic permission mapping table is established using a micro-segmentation technique oriented towards the MESH topology. Specifically, this can be achieved in the following manner: The resource management module receives node collaboration permission configurations and dynamic trust assessment results from each MESH node; Based on the current topology of the MESH network, extract the node connection relationships and node roles. Combine the trust labels and node collaboration permission configurations of each MESH node, divide the node groups according to the trust level, and arrange the isolation domains for routing broadcasts, data forwarding, and service calls between groups. A token generation mechanism based on attribute-based encryption is adopted, combined with the isolation domain boundary of the node group, to generate a minimum-granularity access token for each MESH node; Using the identity identifier of each MESH node as a unique index, a unified dynamic permission mapping table is constructed by associating and binding the corresponding node group identifier, trust label, minimum granularity access token information, various communication permissions and valid timestamps.

[0043] In practice, firstly, the resource management module receives node collaboration permission configurations, dynamic trust values, and trust labels from each wireless MESH node via a secure encrypted channel from the network strategy management module. It then performs integrity checks on the fields and matching relationships of the received content. If a check fails, the message is discarded and a retransmission is requested. If the check passes, the message is stored in a local encrypted cache module as the raw data for permission segmentation and mapping table construction. Secondly, the resource management module reads the current topology of the wireless MESH network in real time through the topology management unit's data interface, extracts the connection relationships of all nodes and the roles of each node, and, combined with node trust labels and node collaboration permission configurations, groups nodes with the same trust label into the same node group. Simultaneously, it defines access isolation boundaries for three types of interaction behaviors between groups: routing broadcasts, data forwarding, and service calls. It generates inter-domain interception policies and distributes them to each MESH node for execution, blocking cross-group interaction messages and forming corresponding permission isolation domains. Isolation domains belonging to groups with different trust levels are mutually isolated, and cross-group routing, forwarding, and service interactions are blocked by default between domains, reducing the scope of network attack exposure.

[0044] In addition, in specific implementation, for each node within an isolation domain, an attribute-based encryption-based token generation mechanism is adopted. The boundary attributes of the group isolation domain and various attributes of the node itself are extracted as encryption input fields. A symmetric key, uniformly generated and securely distributed during the network initialization phase, is used to complete attribute encryption and digital signature, generating a unique minimum-granularity access token. The token contains the node group identifier, trust label, node role, virtual network partition identifier, and token validity timestamp. The token has a default validity period of 30 minutes and automatically expires upon expiration. Finally, the resource management module uses each node's unique identifier as a globally unique index to associate and bind the node's node group identifier, trust label, minimum-granularity access token, node collaborative permission configuration, and configuration validity timestamp, forming a complete permission mapping record. The configuration validity timestamp is based on the node's dynamic trust value and node configuration type hierarchical setting; the higher the node's trust level, the longer the validity period of the permission configuration. All node mapping records are summarized to generate a unified dynamic permission mapping table for the entire domain.

[0045] It should be noted that the dynamic permission mapping table has a built-in dynamic update trigger mechanism. When the node collaborative permission configuration pushed by the network strategy management module changes, the trust assessment module updates the node dynamic trust assessment result, or the token validity timestamp is about to expire, the resource management module automatically triggers the synchronous update of the mapping table entries, calibrates the node permission-related information in real time, and ensures that the dynamic permission mapping table can accurately reflect the real-time trust status and permission configuration of each node, realize the dynamic adaptation of permission mapping, and further enhance the refinement and security of cross-domain network permission control.

[0046] It should be noted that traditional MESH networking permissions adopt a globally unified coarse-grained control, which cannot match the differentiated access constraints of different groups and different isolation domains in the topology. Therefore, this application introduces micro-segmentation technology for wireless MESH topology, which achieves fine-grained permission splitting based on topology node grouping and domain boundary division. The resource management module integrates topology micro-segmentation technology and attribute-based encryption mechanism to organize the node collaborative permission configuration and dynamic trust evaluation results into a structured and searchable dynamic permission mapping table, thereby realizing the standardization, fine-grainedness and efficiency of permission control.

[0047] In step S103, access control verification is performed on the collaborative networking interaction requests of each MESH node based on the dynamic permission mapping table, so that the corresponding node permission records take effect. Each MESH node completes the collaborative networking interaction according to the minimum permission constraint based on the effective node permission records.

[0048] In some embodiments, access control verification is performed on the collaborative networking interaction requests of each MESH node based on the dynamic permission mapping table to make the corresponding node permission records effective. Specifically, this can be achieved in the following manner: For each MESH node, the network strategy management module initiates differentiated permission synchronization with the resource management module based on the existing entries in the dynamic permission mapping table, triggering the resource management module to perform atomic updates of permission policies; After the update is completed, the resource management module starts a two-dimensional verification mechanism to compare the consistency of the updated permission record of the MESH node with the corresponding entry in the dynamic permission mapping table, as well as the consistency with the node collaborative permission configuration pushed by the network strategy management module. If the verification passes, the permission record of the MESH node will take effect immediately, and the resource management module will send back the effect status to form a closed-loop confirmation. If the verification fails, the network policy management module corrects the node collaboration permission configuration of the MESH node based on the verification difference and updates the dynamic permission mapping table synchronously, iterating through the verification process until the permission takes effect.

[0049] In practice, firstly, for each wireless MESH node, the network strategy management module reads the node's collaborative permission configuration and corresponding dynamic trust assessment results from its local storage, and queries the resource management module to see if the node already has an entry in the dynamic permission mapping table. Next, the network strategy management module compares the local configuration with the existing records in the mapping table field by field, generating a structured difference description vector. This vector includes the name of the changed permission dimension, the old and new values ​​for each dimension, and the change type (addition, modification, or deletion). If the vector is empty, it indicates that the configurations at both ends are consistent, and no update is needed. If configuration differences exist, the network strategy management module encapsulates the difference description vector, the node's collaborative permission configuration, and the dynamic trust assessment results into an atomic update request, which is then sent to the resource management module via an encrypted communication channel. Upon receiving the atomic update request, the resource management module processes the update request using a database transaction mechanism. Specifically, if any sub-operation fails during the update process, a transaction rollback is executed, restoring the original data in the mapping table and returning an update failure response. After all update operations are executed without error, the transaction is committed and persisted to ensure the integrity of the updated entries.

[0050] In addition, in specific implementation, after the atomic update of permissions for each node is completed, the resource management module immediately initiates a two-dimensional verification mechanism to perform a first-dimensional verification and a second-dimensional verification. Specifically, the first-dimensional verification is an internal self-consistency verification of the permission mapping table, which sequentially completes the verification of index integrity, field association consistency, data structure integrity, and version continuity to ensure that the internal structure of the table entries is compliant and effective. The second-dimensional verification compares the updated permission record with the node collaborative permission configuration issued by the network strategy management module, and verifies that the permission parameters, trust tags, and valid timestamps all match before the verification is deemed successful. Then, after both-dimensional verifications are passed, the resource management module determines that the permission record of the node is legal and effective, and sends an effectiveness confirmation message back to the network strategy management module. The network strategy management module performs a local comparison based on the version information carried in the message. If they match, it updates the local synchronization status and retains the effectiveness timestamp, completing the closed-loop synchronization of configurations at both ends. In the entire verification and effectiveness process, the entire cross-domain multi-hop communication transmission path of the node is traversed synchronously, and the three types of permissions—route broadcast, data forwarding, and service call—are verified for each hop node on the path to ensure that the permissions of all nodes on the entire multi-hop path are synchronously effective.

[0051] It should be noted that the atomic update mechanism ensures that the dynamic permission mapping table will not be in an inconsistent intermediate state during the update process, avoiding permission configuration chaos caused by partial failures due to successful updates of some fields. Verification is performed from two orthogonal dimensions: the consistency of the mapping table's internal structure and the consistency across nodes between the policy management module and the resource management module. This comprehensively covers all types of errors that may occur in permission configuration, effectively reducing the missed detection rate of configuration errors. Through a closed-loop confirmation mechanism, an end-to-end configuration effectiveness confirmation link is formed between the network policy management module and the resource management module, ensuring that the states of both ends are completely synchronized and eliminating permission configuration discrepancies caused by message loss, asynchronous delays, or duplicate pushes. At the same time, multi-hop hop-by-hop permission verification is provided to ensure full-link permission synchronization in cross-node multi-hop communication.

[0052] In practice, when either dimension of the dual-dimensional verification fails, the resource management module encapsulates the specific discrepancies that failed the verification in a structured manner, generates a key-value pair verification discrepancy report, and encrypts it before pushing it to the network policy management module. After parsing the discrepancy report, the network policy management module locates the conflicting permission parameters and their sources. Combining the existing entries in the dynamic permission mapping table, the local node collaborative permission configuration, and the dynamic trust assessment results, it performs local fine-tuning of the node's collaborative permission configuration. The fine-tuning process strictly follows the principle of minimum deviation correction, correcting only the fields with deviations without changing other legitimate permission parameters. After the adjustment is completed, the network policy management module issues an update command, and the resource management module synchronously modifies the corresponding entries in the dynamic permission mapping table, re-executing the entire process of atomic update, dual-dimensional verification, and multi-hop hop-by-hop verification until all verifications pass, ensuring unified cross-domain permissions across the entire network.

[0053] In some embodiments, each MESH node completes cooperative networking interaction according to the least privilege constraint based on the effective node permission records. Specifically, this can be achieved in the following manner: When each MESH node initiates a collaborative networking access request, it submits an authorization verification application to the resource management module, carrying its own identity and encrypted access token. The resource management module retrieves and matches effective permission records based on the dynamic permission mapping table, and verifies the legality of the tokens and the validity of the permissions of each MESH node; After successful verification, the resource management module returns network access permission and permission scope definition information to each MESH node. Each MESH node, based on the corresponding effective permission record, only initiates route broadcasting, data forwarding, and service calls within the minimum permission scope.

[0054] In practice, firstly, when each wireless MESH node initiates a cross-trust domain collaborative networking access request, it proactively encapsulates its unique identity and a pre-obtained encrypted access token from the resource management module, assembles a verification message according to the cross-domain signaling specification, and sends it to the resource management module. Then, the resource management module uses the node's identity as the primary key to match the active permission records in the dynamic permission mapping table, performing a two-layer verification: the first layer verifies the token's legality by parsing the token's digital signature integrity, valid timestamp, and isolation domain attributes; requests are directly blocked if the signature verification fails or the token expires; the second layer verifies the validity of each permission item by item, checking whether the routing broadcast permission, data forwarding permission, and service call permission match the current access requirement.

[0055] In addition, in specific implementation, after all two-layer security checks pass, the resource management module issues a standardized network access license instruction and simultaneously outputs structured permission scope definition information. This definition information includes the node's authorized route broadcast range, a list of allowed data forwarding neighbor nodes, and a list of service types that can be requested. Each wireless mesh node reads the effective permission records and sets independent permission gating for its local route broadcast module, data forwarding module, and service call module, enabling only communication functions within the permitted scope and actively blocking out-of-scope route broadcasts, hop forwarding, and external service calls, adhering to the principle of least privilege to reduce the network attack exposure surface. In actual implementation, throughout the entire cross-domain communication process, each wireless mesh node can also report its own communication at a fixed 30-second interval. Behavioral data, including routing broadcast actions, cross-node forwarding behavior, service call requests, and interaction objects, is reported. The resource management module continuously summarizes and reports the data, and performs real-time audits against the corresponding node's effective permission records. If unauthorized behavior is detected, the corresponding link is blocked according to the type of violation: unauthorized routing broadcasts will have the broadcast link cut off, illegal cross-hop forwarding will have the forwarding link terminated, and unauthorized service calls will have the service interaction session disconnected, and a standardized unauthorized alarm will be generated. The resource management module pushes the node identifier, violation time, and unauthorized type to the network policy management module. The network policy management module archives all security events for subsequent dynamic trust reassessment of nodes, hierarchical permission contraction, and global security policy iteration, forming a complete closed-loop control of network access verification, real-time auditing, violation blocking, and policy updates.

[0056] It should be noted that the dual-layer pre-verification of token legitimacy and permission validity can effectively identify forged tokens, expired tokens, and unauthorized access requests, intercepting illegal node access at the source. At the same time, the least privilege loading mechanism effectively reduces the security risks caused by excessive permission opening. Full-process dynamic auditing and blocking can curb the spread of violations and avoid network failures. The linkage feedback between the network strategy management module and the resource management module further improves the stability and reliability of cross-trust domain MESH collaborative networking.

[0057] In step S104, the operating behavior of each MESH node is continuously monitored. When an anomaly is detected, the collaborative trust contraction process is triggered to achieve dynamic optimization of the collaborative network.

[0058] In some embodiments, the operational behavior of each MESH node is continuously monitored. When an anomaly is detected, the collaborative trust contraction process is triggered. Specifically, this can be done in the following manner: During the collaborative operation of the wireless MESH self-organizing network, the behavior monitoring module continuously collects multi-dimensional operational behavior data of each MESH node and makes anomaly judgments on the operational status of each MESH node based on preset multi-dimensional behavioral characteristics. When the confidence level of the behavior of any MESH node is lower than the preset anomaly judgment threshold, the behavior monitoring module determines that the MESH node is in an abnormal state and sends a downgrade command to the network policy management module. The network strategy management module progressively shrinks the routing broadcast permissions, data forwarding permissions, and service call permissions of abnormal nodes in a layered manner based on the severity and type of abnormal behavior.

[0059] It should be noted that the behavior monitoring module pre-stores multi-dimensional behavior feature models for each MESH node type locally. The model construction process is as follows: During a continuous operating period (e.g., 7 days) after initial deployment and manual confirmation of no anomalies, the behavior monitoring module collects multi-dimensional operational data for each type of node. This multi-dimensional operational data includes five dimensions and their corresponding values: signaling request success rate (signaling interaction dimension), cross-domain communication frequency (service call dimension), CPU utilization (resource usage dimension), authentication failure count (security event dimension), and cross-domain message forwarding latency (collaborative behavior dimension). Then... For each dimension, the behavior monitoring module calculates the mean of all collected data within 7 days using the arithmetic mean method, and calculates the standard deviation using the sample standard deviation method. The normal fluctuation limit for this dimension is set at "mean ± 3 times standard deviation". Values ​​exceeding this range are considered abnormal. At the same time, the Pearson correlation coefficient matrix between each dimension is calculated for subsequent weight aggregation strategy adjustment. The specific adjustment rule is as follows: when the absolute value of the correlation coefficient between two dimensions is >0.8, their combined weight is appropriately reduced during weighted aggregation, and the combined weight does not exceed 80% of the sum of the initial weights of the two dimensions to avoid the same behavioral factor being scored repeatedly and to ensure the rationality of weight allocation.

[0060] In practice, during cross-trust domain MESH collaborative networking, the behavior monitoring module continuously collects multi-dimensional operational data through two methods: proactive polling via the node management interface and receiving proactively reported events from nodes, with a sampling period of 30 seconds. For each node, the behavior monitoring module calculates the node behavior confidence score every 5 minutes as a complete evaluation cycle. The confidence score ranges from [0, 1], with higher values ​​indicating that the node behavior conforms to the normal model. Specifically, for each dimension, the measured value of the current dimension is compared with the normal fluctuation limit of that dimension to determine the independent score of each dimension: if the measured value falls within the normal fluctuation limit, that dimension... A score of 0.9 to 1.0 is obtained; if the score deviates from the normal fluctuation limit, the score decreases linearly, and if it completely exceeds the limit, a score of 0 is recorded; subsequently, the behavior monitoring module adjusts the initial weights of each dimension according to the Pearson correlation coefficient matrix, wherein the initial weight of the security event dimension is 0.3, the initial weights of the signaling interaction dimension and the service call dimension are both 0.25, and the initial weights of the resource usage dimension and the collaborative behavior dimension are both 0.1; further, the independent score of each dimension is multiplied by the corresponding adjusted dimension weight, and all product results are weighted and summed and normalized to the interval [0, 1], and the final value obtained is the current behavior confidence of the node.

[0061] In addition, in practical implementation, the behavior monitoring module adaptively adjusts the anomaly detection threshold according to the operating environment of the ad hoc network to avoid excessive false alarms in a dynamic network environment when using a fixed threshold. Specifically, the anomaly detection threshold is adaptively calculated based on the baseline threshold, load impact factor, average resource utilization of the entire network, and offline statistical fixed false alarm rate. ,in, Indicates the threshold for anomaly detection; This represents the baseline threshold, with a value of 0.6, which is pre-configured by the network administrator based on the overall network security policy. This represents the load impact factor, with a value of 0.3, which is pre-configured by the system. This represents the average resource utilization rate of the entire network, obtained from the network management unit. This represents the false alarm rate correction factor, with a value of 0.8, which is pre-configured by the system. The fixed false alarm rate, which is manually verified and statistically analyzed during the 7-day trial operation phase after the initial deployment, is stored in a local configuration file and does not require real-time statistical updates during the operation phase. The threshold adaptive update cycle is set to 15 minutes and is executed autonomously by the behavior monitoring module. The updated anomaly judgment threshold is immediately applied to the anomaly judgment in the next evaluation cycle.

[0062] In practice, after each evaluation cycle, the behavior monitoring module compares the behavior confidence of each node with the current anomaly judgment threshold: if the behavior confidence is greater than or equal to the anomaly judgment threshold, the node is determined to be in normal operation and continues to be monitored normally; if the behavior confidence is less than the anomaly judgment threshold, the node is determined to be in an abnormal state and the collaborative trust contraction process is triggered; specifically, the behavior monitoring module generates a standardized degradation instruction, carrying the identity of the abnormal node, real-time behavior confidence, main anomaly dimensions, risk severity level, and appropriate suggested trust label.

[0063] It should be noted that the suggested trust labels are set according to the differentiated mapping of behavioral confidence intervals. When the behavioral confidence is below 0.3, it is recommended to reduce it to a low trust label; when it is between 0.3 and 0.5, it is recommended to reduce it to a medium trust label; and when it is above 0.5 but still below the anomaly judgment threshold, it is recommended to maintain the original label.

[0064] In practice, the downgrade command is pushed to the network strategy management module via an encrypted channel. After verifying the legality of the command, the network strategy management module synchronously updates the node trust label and retrieves the decision mapping strategy matrix to match the permission allocation benchmark vector. The network strategy management module classifies the abnormal risks into three levels based on the behavior confidence level carried by the downgrade command, and then performs a layered progressive contraction on the three types of permissions: routing broadcast, data forwarding, and service call. When the behavior confidence level ∈ [0.3, anomaly judgment threshold) is judged as a minor anomaly, the maximum number of hops of cross-domain routing broadcast is reduced, the number of neighboring nodes that can be connected for forwarding is reduced, and only high-frequency external service calls are restricted. When the behavior confidence level ∈ (0.1, 0.3) is judged as a moderate anomaly, the long-distance cross-domain forwarding channel is shut down, and half of the external service types that can be called are eliminated. When the behavior confidence level ≤ 0.1 is judged as a severe anomaly, cross-domain broadcast, cross-node forwarding, and external service call permissions are completely closed, and only local intranet basic communication is opened. After the permission contraction is completed, the effective duration of the node's collaborative permission configuration is shortened, and the sampling frequency of subsequent behavior monitoring is increased.

[0065] In addition, in specific implementation, the network strategy management module sends the adjusted permission configuration and the updated dynamic trust assessment results to the resource management module; the resource management module atomically updates the permission records, regenerates the smallest granularity access token, and sends back the effect confirmation to the network strategy management module, forming a closed loop; the network strategy management module synchronously archives the complete logs of this anomaly, trust adjustment, and permission contraction for security review and policy iteration, realizing dynamic optimization of collaborative networking.

[0066] It should be noted that the confidence calculation based on multi-dimensional behavioral characteristics transforms complex anomaly detection into quantitative indicators, avoiding misjudgments based on single indicators or fixed rules. The introduction of anomaly judgment thresholds enables the algorithm to dynamically adjust according to network load and security status, reducing the false alarm probability in dynamic network environments when fixed thresholds are combined with offline statistical false alarm parameters. From anomaly detection and degradation command issuance to permission pruning in the network strategy management module and record updates in the resource management module, the entire handling process during network operation requires no manual intervention. Only during system initialization and trial operation phases do manual parameter configuration and false alarm statistics need to be completed, improving the self-healing capability of collaborative networking in the face of internal anomalies or external attacks. Layered progressive contraction can both block the spread of anomalies and preserve basic node communication, taking into account both network security and business continuity.

[0067] Therefore, this application firstly achieves dynamic adaptive control of trust values ​​to permissions through piecewise linear mapping, forming a two-layer differentiated permission configuration logic with trust labels as the baseline and trust values ​​for precise fine-tuning, effectively improving the dynamic adaptability of MESH cross-trust domain network permission management; secondly, it introduces micro-segmentation technology for wireless MESH topology, relying on node grouping and isolation domain orchestration to achieve fine-grained permission splitting, and combines attribute-based encryption mechanism to construct a structured dynamic permission mapping table, realizing standardized, fine-grained, and efficient retrieval of permission management; thirdly, for the permission issuance and activation stages, an atomic update mechanism is used to ensure that the mapping table is not in an inconsistent intermediate state, avoiding permission configuration chaos; and fourthly, a two-dimensional verification method is used to comprehensively check... By checking for abnormal permission configurations, the risk of missed configuration checks is reduced. Combined with an end-to-end closed-loop confirmation mechanism, configuration discrepancies caused by message loss or asynchronous delays are eliminated. Multi-hop, hop-by-hop permission verification ensures end-to-end permission synchronization across multiple nodes, improving the stability and reliability of cross-trust domain MESH collaborative networking. Finally, the introduction of confidence calculation based on multi-dimensional behavioral features transforms complex anomaly detection into quantitative indicators. Combined with adaptive anomaly judgment thresholds, this reduces the probability of false alarms in dynamic network environments. A layered, progressive permission contraction is implemented for abnormal node behavior, and a reverse-order, step-by-step recovery mechanism enhances network self-healing capabilities, prevents security risks, and ensures the continuous operation of basic services, achieving dynamic optimization and control of collaborative networking.

[0068] In summary, the technical solution adopted in this application can achieve topology-aware dynamic permission adaptation and adaptive networking optimization in multi-trust domain MESH self-organizing network scenarios.

[0069] Furthermore, in another aspect of this application, in some embodiments, this application provides a collaborative networking system for wireless MESH self-organizing network communication devices, referencing... Figure 4The figure is a schematic diagram of the structure of a collaborative networking system of wireless MESH self-organizing network communication devices according to some embodiments of this application. The collaborative networking system of wireless MESH self-organizing network communication devices includes: The trust assessment module 201 is used to receive collaborative networking access requests from MESH nodes in multiple trust domains, call the trust assessment module to collect trust assessment data of each MESH node, and determine the dynamic trust assessment result of each MESH node. The permission mapping module 202 is used to generate corresponding node collaborative permission configurations based on the dynamic trust assessment results of each MESH node, and to establish a unified dynamic permission mapping table based on all node collaborative permission configurations using MESH topology-oriented micro-segmentation technology. The networking interaction module 203 is used to perform access control verification on the collaborative networking interaction requests of each MESH node based on the dynamic permission mapping table, so that the corresponding node permission record takes effect, and each MESH node completes the collaborative networking interaction according to the minimum permission constraint based on the effective node permission record. The anomaly control module 204 is used to continuously monitor the operating behavior of each MESH node. When an anomaly is detected, it triggers the collaborative trust contraction process to achieve dynamic optimization of collaborative networking.

[0070] In addition, this application also provides a computer device, the computer device including a memory and a processor, the memory storing code, and the processor being configured to acquire the code and execute the above-described collaborative networking method for wireless MESH self-organizing network communication devices.

[0071] In some embodiments, reference Figure 5 This figure is a schematic diagram of the structure of a computer device implementing a collaborative networking method for wireless MESH ad hoc network communication devices according to some embodiments of this application. The collaborative networking method for wireless MESH ad hoc network communication devices in the above embodiments can be achieved through… Figure 5 The computer device shown is used to implement this, and the computer device includes at least one processor 301, a communication bus 302, a memory 303, and at least one communication interface 304.

[0072] The processor 301 can be a general-purpose central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more devices used to control the execution of the cooperative networking method of the wireless MESH self-organizing network communication devices in this application.

[0073] The communication bus 302 can be used to transmit information between the aforementioned components.

[0074] The memory 303 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), a magnetic disk or other magnetic storage device, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but not limited thereto. The memory 303 may exist independently and be connected to the processor 301 via a communication bus 302. The memory 303 may also be integrated with the processor 301.

[0075] The memory 303 stores program code for executing the scheme of this application, and its execution is controlled by the processor 301. The processor 301 executes the program code stored in the memory 303. The program code may include one or more software modules. In the above embodiments, the determination of the cooperative networking method of the wireless MESH self-organizing network communication device can be implemented by the processor 301 and one or more software modules in the program code in the memory 303.

[0076] Communication interface 304 uses any transceiver-like device for communicating with other devices or communication networks, such as Ethernet, radio access network (RAN), wireless local area networks (WLAN), etc.

[0077] In a specific implementation, as one example, a computer device may include multiple processors, each of which may be a single-core (single-CPU) processor or a multi-core (multi-CPU) processor. Here, a processor may refer to one or more devices, circuits, and / or processing cores used to process data (e.g., computer program instructions).

[0078] The aforementioned computer device can be a general-purpose computer device or a special-purpose computer device. In specific implementations, the computer device can be a desktop computer, a portable computer, a network server, a handheld digital assistant (PDA), a mobile phone, a tablet computer, a wireless terminal device, a communication device, or an embedded device. This application does not limit the type of computer device.

[0079] In addition, this application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the above-described collaborative networking method for wireless MESH self-organizing network communication devices.

[0080] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application.

[0081] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A collaborative networking method for wireless MESH self-organizing network communication devices, characterized in that, Includes the following steps: Receive collaborative networking access requests from MESH nodes in multiple trust domains, call the trust assessment module to collect trust assessment data from each MESH node, and determine the dynamic trust assessment result of each MESH node. Based on the dynamic trust assessment results of each MESH node, corresponding node collaboration permission configurations are generated. Based on all node collaboration permission configurations, a unified dynamic permission mapping table is established using MESH topology-oriented micro-segmentation technology. Based on the dynamic permission mapping table, access control verification is performed on the collaborative networking interaction requests of each MESH node to make the corresponding node permission records effective. Each MESH node completes the collaborative networking interaction according to the effective node permission records and the least permission constraint. Continuously monitor the operational behavior of each MESH node, and when an anomaly is detected, trigger the collaborative trust contraction process to achieve dynamic optimization of collaborative networking.

2. The method as described in claim 1, characterized in that, It receives collaborative networking access requests from MESH nodes in multiple trust domains, calls the trust assessment module to collect trust assessment data from each MESH node, and uses a dynamic weighted fusion algorithm to determine the dynamic trust assessment result of each MESH node.

3. The method as described in claim 1, characterized in that, Based on the dynamic trust assessment results of each MESH node, the corresponding node collaboration permission configuration is generated, specifically including: The network strategy management module receives the dynamic trust assessment results of each MESH node and, in conjunction with the strategy decision context, constructs a global decision mapping strategy matrix. Each MESH node queries the decision mapping strategy matrix based on its own node configuration information and the trust label in the dynamic trust assessment results to obtain the corresponding permission allocation benchmark vector. A piecewise linear mapping algorithm is used to correct the permission allocation baseline vector based on the dynamic trust value in the dynamic trust evaluation results of each MESH node; The permission allocation baseline vector is dynamically adjusted based on the real-time load of the virtual network partition where the MESH node is located to obtain the permission configuration coefficient of the MESH node. Based on the permission configuration coefficients corresponding to each MESH node, an adapted node collaboration permission configuration is generated for each MESH node. The node collaboration permission configuration includes routing broadcast permissions, data forwarding permissions, and service call permissions.

4. The method as described in claim 1, characterized in that, Based on the collaborative permission configurations of all nodes, a unified dynamic permission mapping table is established using a micro-segmentation technique oriented towards the MESH topology. Specifically, this includes: The resource management module receives node collaboration permission configurations and dynamic trust assessment results from each MESH node; Based on the current topology of the MESH network, extract the node connection relationships and node roles. Combine the trust labels and node collaboration permission configurations of each MESH node, divide the node groups according to the trust level, and arrange the isolation domains for routing broadcasts, data forwarding, and service calls between groups. A token generation mechanism based on attribute-based encryption is adopted, combined with the isolation domain boundary of the node group, to generate a minimum-granularity access token for each MESH node; Using the identity identifier of each MESH node as a unique index, a unified dynamic permission mapping table is constructed by associating and binding the corresponding node group identifier, trust label, minimum granularity access token information, various communication permissions and valid timestamps.

5. The method as described in claim 1, characterized in that, Based on the dynamic permission mapping table, access control verification is performed on the collaborative networking interaction requests of each MESH node to make the corresponding node permission records effective. Specifically, this includes: For each MESH node, the network strategy management module initiates differentiated permission synchronization with the resource management module based on the existing entries in the dynamic permission mapping table, triggering the resource management module to perform atomic updates of permission policies; After the update is completed, the resource management module starts a two-dimensional verification mechanism to compare the consistency of the updated permission record of the MESH node with the corresponding entry in the dynamic permission mapping table, as well as the consistency with the node collaborative permission configuration pushed by the network strategy management module. If the verification passes, the permission record of the MESH node will take effect immediately, and the resource management module will send back the effect status to form a closed-loop confirmation. If the verification fails, the network policy management module corrects the node collaboration permission configuration of the MESH node based on the verification difference and updates the dynamic permission mapping table synchronously, iterating through the verification process until the permission takes effect.

6. The method as described in claim 1, characterized in that, Each MESH node, based on its established node permission records, completes collaborative networking interactions according to the least privilege constraint, specifically including: When each MESH node initiates a collaborative networking access request, it submits an authorization verification application to the resource management module, carrying its own identity and encrypted access token. The resource management module retrieves and matches effective permission records based on the dynamic permission mapping table, and verifies the legality of the tokens and the validity of the permissions of each MESH node; After successful verification, the resource management module returns network access permission and permission scope definition information to each MESH node. Each MESH node, based on the corresponding effective permission record, only initiates route broadcasting, data forwarding, and service calls within the minimum permission scope.

7. The method as described in claim 1, characterized in that, Continuously monitor the operational behavior of each MESH node. When an anomaly is detected, trigger the collaborative trust contraction process, which specifically includes: During the collaborative operation of the wireless MESH self-organizing network, the behavior monitoring module continuously collects multi-dimensional operational behavior data of each MESH node and makes anomaly judgments on the operational status of each MESH node based on preset multi-dimensional behavioral characteristics. When the confidence level of the behavior of any MESH node is lower than the preset anomaly judgment threshold, the behavior monitoring module determines that the MESH node is in an abnormal state and sends a downgrade command to the network policy management module. The network strategy management module progressively shrinks the routing broadcast permissions, data forwarding permissions, and service call permissions of abnormal nodes in a layered manner based on the severity and type of abnormal behavior.

8. A collaborative networking system for wireless MESH self-organizing network communication devices, characterized in that, The steps for implementing the cooperative networking method of the wireless MESH self-organizing network communication device according to any one of claims 1 to 7 include: The trust assessment module is used to receive collaborative networking access requests from MESH nodes in multiple trust domains, call the trust assessment module to collect trust assessment data from each MESH node, and determine the dynamic trust assessment result of each MESH node. The permission mapping module is used to generate corresponding node collaboration permission configurations based on the dynamic trust assessment results of each MESH node. Based on all node collaboration permission configurations, a unified dynamic permission mapping table is established using MESH topology-oriented micro-segmentation technology. The networking interaction module is also used to perform access control verification on the collaborative networking interaction requests of each MESH node based on the dynamic permission mapping table, so that the corresponding node permission records take effect, and each MESH node completes the collaborative networking interaction according to the minimum permission constraint based on the effective node permission records. The anomaly control module is used to continuously monitor the operational behavior of each MESH node. When an anomaly is detected, it triggers the collaborative trust contraction process to achieve dynamic optimization of collaborative networking.

9. A computer device, characterized in that, The computer device includes a memory and a processor, the memory storing code, and the processor being configured to retrieve the code and execute the collaborative networking method of the wireless MESH self-organizing network communication device as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the collaborative networking method of the wireless MESH self-organizing network communication device as described in any one of claims 1 to 7.

Images