Rail transit-oriented passive lock hierarchical authorization security management and control method and system

Abstract

The present application belongs to the field of rail transit signal safety and lock control technology, more specifically, relates to a passive lock hierarchical authorization safety control method and system for rail transit. The present application comprises the following steps: S1, constructing a four-level interconnection and intercommunication architecture of terminal layer, edge layer, platform layer and signal layer; S2, establishing a four-dimensional dynamic permission model of role, scene, time period and device in the permission management center; S3, performing real-time risk assessment of five dimensions on the authorization request; S4, pre-storing a linkage rule table in the edge computing gateway, and acquiring the running state events of the signal system; S5, scheduling each type of data frame by priority weighted fair queuing through a special communication protocol. The present application also provides a passive lock hierarchical authorization safety control method and system for rail transit, which realizes multi-scene adaptation, hierarchical authorization, signal linkage and full-process traceability.

Description

Technical Field

[0001] The present invention belongs to the technical field of rail transit signal safety and lock control, and more specifically, relates to a hierarchical authorization safety management and control method and system for passive locks oriented to rail transit. Background Art

[0002] A large number of critical facilities requiring physical safety protection are distributed along the rail transit system, including signal equipment cabinets, switch machine junction boxes, track circuit boxes, cable junction boxes, substation doors, communication machine rooms, etc. The opening and closing management of these facilities is directly related to driving safety and operation order. At present, three types of solutions, namely traditional mechanical locks, active electronic locks and passive locks, are commonly used in the industry to manage the above facilities. Among them, the passive lock relies on the contact power supply of the intelligent key to trigger unlocking, no separate wiring is required for the lock, and it has a high protection level and strong environmental adaptability, so it is increasingly widely used in outdoor and strong electromagnetic interference scenarios. However, the existing passive lock management and control system still has three defects: first, the authorization judgment is simple, generally staying at the binary judgment of authorized or unauthorized, and cannot realize fine-grained authorization according to operation roles, operation scenarios, operation time periods and equipment importance; second, the lock control system is isolated from the core signal management and control system of rail transit, the operation status of the signal system cannot be transmitted to the lock control system in real time, and there are serious safety hazards such as live-line operation of personnel and misoperation of switches; third, unauthorized operations are difficult to detect and trace in real time, lock operation records are only stored simply, and there is a lack of cross-comparison and correlation analysis with the operation logs of the signal system.

[0003] Chinese patent document CN108447147A discloses a safety management system for distribution network communication compartment equipment based on passive intelligent locks, which includes passive electronic locks, intelligent keys and a remote management server, and the remote management server sets and issues operation permissions and instructions for the intelligent keys. Although the problem of remote authorization management of passive locks is solved, there still exist the following problems: the permission is only a simple judgment of authorized or unauthorized, a multi-dimensional hierarchical authorization model is not established, and the system cannot perceive the real-time operation status of the scenario where the managed equipment is located, so it cannot adapt to the differentiated management and control requirements of multi-role and multi-scenario in rail transit.

[0004] Chinese patent document CN107680212A discloses a five-prevention intelligent lock authorization verification method for outdoor equipment of a distribution network. A management server encrypts four pieces of information, namely the electronic key number, the number of the intelligent lock to be unlocked, the unlocking start time and the unlocking end time, to generate an unlocking key, and the intelligent lock performs the unlocking action after verifying the key and the time window. Although the unlocking authorization of limited objects and limited time is realized, there still exist the following problems: the authorization dimension is fixed and single, the dynamic influence of factors such as operation scenarios, personnel historical behaviors and equipment operation status on authorization decision-making is not considered, the authorization level cannot be adjusted according to real-time risks, and the linkage control between the lock status and the operation status of the signal system cannot be realized.

[0005] Chinese patent document CN205302375U discloses a safety interlocking management system for rail transit maintenance operations. The control host receives equipment status signals detected by equipment status detection components and outputs access control signals to the access control device based on these signals, controlling the opening and closing of the access locks. While this achieves linkage between equipment status and access control, several issues remain: the linkage is limited to on / off control at the access control level; a hierarchical authorization system for multiple roles and scenarios is not established; access control permission judgment and lock operation records lack a four-dimensional permission model; and there is a lack of cross-correlation settings between lock operation records and signal system operation logs.

[0006] In summary, there is an urgent need to provide a passive lock hierarchical authorization safety control method and system for rail transit to solve the aforementioned problems in the existing technology. Summary of the Invention

[0007] The technical problem this invention aims to solve is that existing passive lock control systems suffer from simple authorization determination, inability to perceive the operating status of signal systems, and difficulty in real-time detection and traceability of unauthorized operations. This invention provides a passive lock hierarchical authorization safety control method and system for rail transit, achieving multi-scenario adaptation, hierarchical authorization, signal linkage, and full-process traceability.

[0008] The technical terms related to this invention are explained as follows: The four-dimensional dynamic permission model is a permission calculation model constructed from four dimensions: role, scenario, time period, and device. It is used to determine the permission of a person to perform a specific operation on a specific device in a specific scenario and at a specific time period.

[0009] Authorization Score: A numerical value calculated by weighting the authorization request dimension by dimension based on the four-dimensional dynamic permission model. It is used to quantitatively evaluate the compliance of the authorization request. The higher the authorization score, the higher the degree of permission matching of the request.

[0010] Five-dimensional real-time risk assessment: The process of quantifying and scoring each of the five dimensions of the authorization request—operation type, personnel behavior, signal system status, time period, and environment—and then weighting and summing them to obtain the total risk value.

[0011] RPLCP protocol: Rail Passive Lock Control Protocol, a dedicated protocol for the control of passive locks in rail transit, used for the encapsulation, priority scheduling and transmission of various data frames in the lock control system.

[0012] Weighted Fair Queuing (WFQ) is a scheduling mechanism that allocates bandwidth resources according to queue weights and prioritizes the data frame with the shortest virtual completion time for transmission.

[0013] National cryptographic algorithms: my country's commercial cryptographic algorithm system, including the SM2 elliptic curve public key cryptography algorithm, the SM3 cryptographic hash algorithm, and the SM4 block cipher algorithm.

[0014] The technical problem to be solved by this invention is achieved by the following technical solution: A hierarchical authorization safety management method for passive locks in rail transit includes the following steps: S1. Construct a four-level interconnection architecture consisting of a terminal layer, an edge layer, a platform layer, and a signal layer. The terminal layer includes passive lock terminal nodes, smart key terminals, and field edge gateways. The edge layer includes an edge computing gateway. The platform layer includes a lock control management platform, an access control center, and a setting traceability center. The signal layer interfaces with the signal control system through a security data gateway. S2. Establish a four-dimensional dynamic permission model of role, scene, time period and device in the permission management center. When responding to an authorization request, obtain the role information, scene information, time period information and device information in the authorization request. Calculate the authorization score based on the four-dimensional dynamic permission model and map the authorization score to the authorization level. S3. Perform a real-time risk assessment on the authorization request based on five dimensions: operation type, personnel behavior, signal system status, time period, and environment, to obtain a total risk value, and make a three-level decision on the authorization level based on the total risk value: deny authorization, downgrade authorization, or grant normal authorization; S4. The linkage rule table is pre-stored in the edge computing gateway, the operation status event of the signal system is obtained, the operation status event is matched with the linkage rule in the linkage rule table, and the lock linkage control command is sent to the passive lock terminal node according to the matching result. S5. Data frames of various types are scheduled in a fair and weighted manner according to priority through a dedicated communication protocol, and the data frames are encrypted, integrity checked and signature verified by the national cryptographic algorithm before being transmitted within the four-level interconnection architecture.

[0015] In this technical solution, a four-level interconnected architecture is constructed through S1, integrating passive lock terminals, edge computing gateways, lock control management platforms, and signal control systems into a unified management system. This enables real-time communication between the four layers regarding lock status, authorization information, and the operational status of the signal system, laying the architectural foundation for coordinated control and cross-configuration. A four-dimensional dynamic permission model is established through S2, upgrading authorization judgment from a simple "authorized" or "unauthorized" approach to a joint judgment based on four dimensions: role, scenario, time period, and device. The authorization score comprehensively reflects the matching degree of the request across these dimensions and is then mapped to an authorization level, achieving refined hierarchical authorization. Finally, a five-dimensional real-time risk assessment is performed through S3, overlaying the authorization level judgment with... Real-time risk measurement of personnel behavior, signal system status, time period, and environment; rejection or downgrading of high-risk authorization requests to prevent dangerous behaviors such as live-line work and accidental switch tampering; S4 pre-stores linkage rule tables in the edge computing gateway, matching and executing the nearest linkage rules with the operational status events of the signal system, enabling real-time linkage between lock opening / closing status and signal opening / route establishment status, with safety linkage actions completed locally at the edge layer, unaffected by the platform layer network status; S5 employs weighted fair queuing scheduling and encrypted transmission using national cryptographic algorithms to prioritize the real-time performance of safety linkage data frames, while ensuring the confidentiality, integrity, and source reliability of data transmitted within the four-level architecture. These five steps work together to form a complete security management closed loop from architecture, authorization, risk control, joint debugging to transmission, solving the problems of simple authorization judgment, lack of signal linkage, and difficulty in tracing unauthorized access in existing technologies.

[0016] In addition, the method proposed above according to the present invention may also have the following additional technical features: Furthermore, the calculation of the authorization score based on the four-dimensional dynamic permission model described in S2 is specifically as follows: The authorization score (Score) is calculated according to a preset authorization score calculation formula, which is as follows:

[0017] Where: r is the operator role parameter, s is the work scenario parameter, t is the work period parameter, and d is the controlled equipment parameter; This is the role weighting coefficient. For scene weighting coefficients, The time period weighting coefficient, For equipment weighting coefficients; A correction coefficient for the correlation between scene and time period. This is a correction factor for equipment risk. Elements in the character-scene association matrix; The calculated authorization score is normalized, and the normalized authorization score is compared with the preset multiple authorization level intervals one by one to obtain the corresponding authorization level.

[0018] This technical solution defines a specific formula for calculating authorization scores. It achieves a mathematical measurement of four-dimensional permissions by multiplying the elements of the role weight, scene weight, time period weight, device weight, scene-time correlation correction coefficient, device risk coefficient, and role-scene correlation matrix. The role-scene correlation matrix reflects the differences in professional capabilities of different roles in different scenarios. A high weight in any single dimension cannot make up for the deficiencies of other dimensions. Authorization can only be obtained if all four conditions are met simultaneously.

[0019] Furthermore, the real-time risk assessment of the authorization request in S3 specifically involves: Quantify and calculate the risk value of each operation type separately. Personnel behavior risk value Signal system status risk value Time period risk value and environmental risk values The total risk of the authorization request is calculated using the total risk calculation formula. The formula for calculating the total risk value is as follows:

[0020] in: These are the dimension weight coefficients for operation type, personnel behavior, signal system status, time period, and environment, respectively. All weight coefficients are greater than 0 and satisfy the weight constraint relationships: ; Three-level authorization decisions are implemented based on the total risk value: when If the risk level exceeds the preset first risk threshold, the authorization request will be rejected; when... When the risk level is less than or equal to the first risk threshold and greater than the preset second risk threshold, the current authorization level will be downgraded, and full-process operation monitoring measures will be added simultaneously; when If the risk threshold is less than or equal to the second risk threshold, perform the normal authorization operation. The risk value of personnel behavior The risk value is calculated based on the baseline of personnel operational behavior. This baseline is constructed from all historical operational records of personnel, encompassing a set of commonly used operational time periods, a set of commonly used operational equipment, a set of commonly used work scenarios, historical average operational frequency, and the standard deviation of operational frequency. The deviations between the current operational time period and the set of commonly used time periods, the current operational equipment and the set of commonly used equipment, and the current operational frequency and the historical average operational frequency are calculated. These deviations are then weighted and summed to quantify the personnel behavioral risk value. .

[0021] This technical solution defines the weighted calculation formula for the total five-dimensional risk value and the three-level decision-making mechanism. It also specifically defines the calculation method for personnel behavior risk value based on the behavioral baseline. By using common time periods, common equipment, common scenarios, average operation frequency and standard deviation to characterize the normal operation profile of personnel, the risk of operations that deviate from the profile is quantified, so that the risk assessment has individual targeting and dynamic adaptability.

[0022] Furthermore, the linkage rules described in S4 include: The signal opening linkage rule locks all passive lock terminal nodes in the corresponding section and issues an evacuation alarm when the signal is opened. The route status linkage rule freezes the lock operation permissions on the equipment where the associated turnout is located when the route is established, and restores the operation permissions after the route is unlocked. The fault emergency linkage rules stipulate that when a fault occurs, the locks in the plan will be unlocked in response to the unlocking command issued by the emergency command center, and will be automatically restored to locking after the fault is cleared. The permission dynamic adjustment rule dynamically adjusts the authorization level based on scheduling commands and work plans.

[0023] This technical solution defines four types of linkage rules: signal opening linkage, route status linkage, fault emergency linkage, and dynamic permission adjustment. It covers three typical working conditions: normal operation, maintenance work, and fault handling. When the signal is open, all locks in the section are locked and an evacuation alarm is issued, which fundamentally eliminates live work.

[0024] Furthermore, the matching of runtime status events with linkage rules described in S4 specifically involves: The running status events are subjected to timestamp verification, deduplication, and structured parsing. Query the linkage rule table for linkage rules that match the event type of the running status event and are in the enabled state; For each candidate linkage rule, its triggering conditions are evaluated based on the local state cache, and those with true conditions are added to the matching result set; The linkage rules in the matching result set are sorted by priority. When there are mutually exclusive actions, actions with higher security levels are retained according to the principle of security priority. The actions are executed sequentially, a lock linkage control command is sent to the passive lock terminal node, and the execution result is recorded; When the edge computing gateway loses connection with the platform layer, it continues to execute the linkage logic according to the local linkage rule table, and stores the unreported events in the offline queue. After the network is restored, the events are synchronized in batches according to the time sequence.

[0025] Furthermore, the dedicated communication protocol mentioned in S5 is the RPLCP protocol. The RPLCP protocol sets up a four-level priority queue, with the weights of each queue from high to low being 8, 4, 2, and 1 respectively. It adopts weighted fair queuing scheduling and selects the data frame with the shortest virtual completion time for priority transmission. When the waiting time of a data frame in the queue reaches the starvation threshold of the corresponding queue, its temporary priority is increased by one level. When the waiting time reaches 95% of the latency limit of the corresponding queue, its temporary priority is increased to the highest level.

[0026] This technical solution defines the complete process of linkage rule matching, including event preprocessing, rule query, condition evaluation, conflict resolution, and action execution. It also defines that the edge computing gateway operates autonomously based on its local rule table during network outages and performs batch synchronization after network recovery, ensuring that the security linkage logic does not fail under network anomalies. Furthermore, the national cryptographic algorithms mentioned in S5 include SM2, SM3, and SM4 algorithms. The SM2 algorithm is used for two-way authentication, key negotiation, and digital signature; the SM4 algorithm is used to encrypt data frames; and the SM3 algorithm is used to generate hash digests for integrity verification. The received data frames are timestamped and deduplicated using a sliding window. Data frames whose timestamps exceed the preset window are discarded directly, and data frames with duplicate sequence numbers recorded in the sliding window bitmap are also discarded directly.

[0027] Furthermore, the present invention also includes: A three-tier key hierarchy system is constructed, consisting of a root key, a regional key, and a session key. The root key is burned into a security chip, the regional key is issued by the platform and rotated periodically, and the session key is negotiated and generated during two-way authentication and is periodically forced to re-authenticate. Cross-analyze the operation logs of the passive lock terminal node with the operation logs of the signal control system to generate traceability records that include personnel, time, equipment, operation content, and authorization level.

[0028] This technical solution defines a three-tier key hierarchy: root key, area key, and session key. The root key is burned into the security chip and cannot be exported. The area key is rotated periodically, and the session key is periodically forced to re-authenticate to ensure forward security. It also limits the cross-correlation analysis of lock operation logs and signal system operation logs to achieve real-time detection and full-process traceability of unauthorized operations.

[0029] In another aspect, the present invention also provides a passive lock hierarchical authorization safety control system for rail transit.

[0030] A passive lock hierarchical authorization safety control system for rail transit includes: Passive lock terminal node, smart key terminal, field edge gateway, edge computing gateway, lock control management platform and security data gateway; The passive lock terminal node is installed on facilities along the rail transit line; The smart key terminal is communicatively connected to the passive lock terminal node and is used to supply power to the passive lock terminal node and trigger it to perform unlocking or locking actions. The field edge gateway is communicatively connected to the passive lock terminal node and is used to aggregate lock status data within the jurisdiction area; The edge computing gateway is communicatively connected to the field edge gateway and has a built-in linkage rule engine; The lock control management platform is communicatively connected to the edge computing gateway and includes a permission management center and a setting traceability center. The permission management center is used to maintain a four-dimensional dynamic permission model of roles, scenarios, time periods, and devices, and the setting traceability center is used to store traceability records. One end of the security data gateway is connected to the lock control management platform, and the other end is connected to the signal control system.

[0031] This technical solution, through the cooperation of passive lock terminal nodes, smart key terminals, field edge gateways, edge computing gateways, lock control management platforms, and secure data gateways, implements four-dimensional dynamic authorization, five-dimensional risk assessment, edge linkage rule execution, and national cryptographic secure transmission at the specific device level: the smart key terminal contacts and supplies power to the passive lock terminal node and triggers the opening and closing of the lock; the field edge gateway aggregates the lock status; the edge computing gateway executes the linkage rules locally; the permission management center maintains the four-dimensional dynamic permission model; the traceability center stores traceability records; and the secure data gateway achieves secure docking with the signal control system.

[0032] Furthermore, the smart key terminal integrates a fingerprint and IC card dual-factor authentication module, a wireless power supply module, and a UWB and BeiDou dual-mode positioning module; The edge computing gateway includes a main control processor, a security chip with a built-in national cryptographic algorithm engine, a LoRa communication module, an Ethernet communication module, an RS-485 communication module, and a 4G communication module; The lock control management platform also includes a data sharing bus, which is used for bidirectional sharing of five-dimensional data with the signal control system, including equipment status, work plan, operation log, alarm events, and access control policies. The edge computing gateway and the platform layer are connected by a dual-network redundant connection, including a main network and a secondary network. The communication latency of the main network is less than or equal to 50ms, and the communication latency of the secondary network is less than or equal to 500ms.

[0033] The one or more technical solutions provided by this invention have the following advantages compared with the prior art: (1) Hierarchical authorization and precise control: Through the four-dimensional dynamic permission model and authorization score calculation, hierarchical authorization is realized by joint judgment of four dimensions: role, scene, time period and device. This completely changes the existing binary judgment mode of authorization or non-authorization, ensuring that the right person performs the right operation on the right device at the right time. (2) Signal linkage safety guarantee: Through the local linkage rule engine of the edge computing gateway, the lock opening and closing status is linked with the signal opening, route establishment and fault status in real time. When the signal is open, all locks in the section are automatically locked and an evacuation alarm is issued to prevent dangerous behaviors such as personnel working on live electricity and accidentally activating switches. The linkage response delay is less than or equal to 10ms. (3) Full-process traceability setting: The lock operation log and the signal system operation log are cross-linked. Combined with the five-dimensional real-time risk assessment, unauthorized operations can be detected and alarmed in real time. The traceability record includes personnel, time, equipment, operation content and authorization level, providing a complete chain of evidence for the determination of safety responsibility. Attached Figure Description

[0034] Figure 1 This is a flowchart illustrating the principle of the present invention. Detailed Implementation

[0035] The technical solution of the present invention will now be clearly and completely described in conjunction with the accompanying drawings.

[0036] Example 1 Please refer to Figure 1 This embodiment provides a hierarchical authorization safety management method for passive locks in rail transit, including the following steps: S1. Construct a four-level interconnection architecture consisting of a terminal layer, an edge layer, a platform layer, and a signaling layer. The terminal layer is deployed at various stations and sections along the rail transit line, including passive lock terminal nodes, smart key terminals, and field edge gateways; the edge layer consists of distributed edge computing gateways, with each gateway responsible for one station or a 3 to 5 kilometer section; the platform layer is deployed in the dispatch center, including a lock control management platform, an access control center, a settings traceability center, and a data sharing bus; the signaling layer interfaces with the CTC dispatching centralized system, interlocking system, train control system, and centralized monitoring system through a security data gateway.

[0037] S2. Establish a four-dimensional dynamic permission model in the permission management center, encompassing roles, scenarios, time periods, and equipment. Roles include dispatchers, signalmen, maintenance personnel, emergency personnel, and inspection personnel; scenarios include mainline signaling equipment, station equipment, substation equipment, and communication equipment rooms; time periods include normal operating hours, maintenance windows, and emergency periods; and equipment includes signal cabinets, switch machines, track circuit boxes, and cable junction boxes. Upon responding to an authorization request, an authorization score is calculated based on the four-dimensional dynamic permission model, and this score is mapped to an authorization level. Authorization levels are divided into five levels from high to low: L1 to L5, corresponding to all operations and configuration changes, unlocking and locking, locking only, viewing only, and complete prohibition, respectively.

[0038] S3. Real-time risk assessment of five dimensions—operation type, personnel behavior, signal system status, time period, and environment—is used to obtain a total risk value. Based on the total risk value, a three-level decision is made: if the total risk value is greater than the first threshold, the authorization request is rejected and the security administrator is notified; if the total risk value is less than or equal to the first threshold but greater than the second threshold, the authorization level is reduced and monitoring measures are added; if the total risk value is less than or equal to the second threshold, authorization is granted normally.

[0039] S4. A linkage rule table is pre-stored in the edge computing gateway. The operating status events of the signal system are obtained, and these events are matched against the linkage rules in the table. Based on the matching results, lock linkage control commands are sent to the passive lock terminal nodes. The normal operation linkage process is as follows: smart key initiates authentication, on-site edge gateway verifies, lock control management platform verifies four-dimensional permissions, signal system confirms device status, authorization result is sent, unlocking or locking is executed, and traceability records are recorded.

[0040] S5. Data frames of various types are scheduled in a weighted and fair queuing manner according to priority using the RPLCP protocol. After encryption, integrity verification, and signature verification of the data frames using SM2, SM3, and SM4 national cryptographic algorithms, they are transmitted within the four-level interconnection architecture. This embodiment achieves a complete security management closed loop from architecture, authorization, risk control, joint debugging to transmission through the above five steps. The end-to-end latency of security linkage data is less than or equal to 50ms, with the local linkage latency of the edge gateway being less than or equal to 10ms.

[0041] Example 2 Please refer to Figure 1 This embodiment provides a passive lock hierarchical authorization security management system for rail transit, used to implement the aforementioned passive lock hierarchical authorization security management method. The overall system architecture and algorithm logic are fully adapted to four-dimensional dynamic permission calculation, five-dimensional risk assessment, edge linkage control, and national cryptographic security transmission mechanism. Specifically, this system includes: a passive lock terminal node, a smart key terminal, a field edge gateway, an edge computing gateway, a lock control management platform, and a security data gateway.

[0042] The passive lock terminal nodes are deployed at various key facilities and equipment along the rail transit lines. The lock body is made of SUS316L stainless steel, with an IP68 protection rating, an operating temperature range of -40℃ to +85℃, electromagnetic compatibility reaching Level 4, and standby power consumption ≤2μA, making it suitable for the complex and highly interference-prone outdoor environment of rail transit. The node integrates a main control chip, an NFC near-field wake-up module, a LoRa communication module, a status acquisition module, and a data storage module. The main control chip has a built-in national cryptographic algorithm engine, capable of locally performing SM2, SM3, and SM4 algorithm encryption verification, supporting secure data processing on the terminal side.

[0043] The smart key terminal establishes a short-range communication connection with the passive lock terminal node, integrating a fingerprint + IC card dual-factor authentication module, a wireless power supply module, and a UWB + Beidou dual-mode positioning module. The device can wirelessly power the passive lock terminal node, wake up the lock, and trigger unlocking and locking actions. Simultaneously, it collects real-time data on the operator's identity, location, and operational behavior, providing data to the backend. The calculation of personnel behavior risk values ​​and the updating of behavior baselines provide raw data support, and all operation records are uploaded to the platform layer storage in real time.

[0044] The field edge gateway communicates with all passive lock terminal nodes in the area. Its core function is to aggregate lock status data, device online data, and operation log data within the jurisdiction. After completing data preprocessing, deduplication, and structured encapsulation, it forwards the data to the edge computing gateway in a unified manner, providing complete terminal data support for upper-layer four-dimensional permission calculation and five-dimensional risk assessment.

[0045] The edge computing gateway communicates bidirectionally with the field edge gateway. The device is equipped with a main control processor and an ATECC608B security chip integrating a national cryptographic algorithm engine, compatible with LoRa, Ethernet, RS-485, and 4G multi-mode communication. The gateway has a built-in localized linkage rule engine, capable of independently executing four core logics: signal opening linkage, route status linkage, fault emergency linkage, and dynamic permission adjustment. It can complete edge-side security management without relying on a platform. Furthermore, the edge computing gateway is part of this system. The edge execution platform, which performs authorization score calculation and total risk assessment, can complete permission matching and risk decision-making locally, reducing transmission latency. The gateway and platform layers adopt a primary and secondary dual-network redundancy architecture, with primary network communication latency ≤50ms and secondary network communication latency ≤500ms. Coupled with a 4G emergency communication channel and a backup battery of ≥72 hours, it ensures the continuous effectiveness of algorithms and linkage logic under extreme conditions such as network outages and power failures.

[0046] The lock control management platform communicates remotely with the edge computing gateway and integrates three core modules: a permission management center, a setting and tracking center, and a data sharing bus. The permission management center serves as the core carrier of the system algorithm, embedding a four-dimensional dynamic permission model that can invoke formulas in real time. Complete the quantitative calculation of authorization scores and simultaneously map authorization levels; set up a traceability center to store all authorization records, lock operation records, and risk assessment records in append-only mode, supporting full-process traceability; the data sharing bus enables bidirectional five-dimensional data exchange with the signal control system, providing... The calculation of signal system status risk value and time period risk value provides real-time signal operating condition data.

[0047] The security data gateway serves as a hub for system security isolation and data interaction. One end connects to the interlocking management platform, and the other end connects to the core signal control system of rail transit, including the CTC centralized dispatching system, interlocking system, train control system, and centralized monitoring system. It enables the secure transmission of signal operation status, dispatching instructions, and work plans, ensuring the real-time nature and accuracy of risk assessment data.

[0048] The complete working process of this system integrates core algorithm logic: the operator initiates an unlocking authorization request through the smart key terminal; the request data is aggregated and forwarded to the edge computing gateway via the on-site edge gateway; after the edge computing gateway and the lock control management platform complete two-way national cryptographic authentication, the permission management center retrieves the four-dimensional dynamic permission parameters and calculates the authorization score using a standardized authorization score formula. And map corresponding authorization levels; synchronously retrieve real-time operating conditions, personnel behavior, and environmental data, through... The formula completes the calculation of the total risk value in five dimensions and executes the three-level authorization decision. The final authorization result is sent to the smart key terminal to complete the lock opening and closing operation. All operation data and signal system data are cross-linked and archived to achieve algorithm-driven precise, safe, and traceable lock control management.

[0049] Example 3 Please refer to Figure 1 This embodiment uses three typical rail transit operation scenarios to fully verify the practical application effect of the algorithm model, hierarchical authorization mechanism, and linkage control system of this invention. This embodiment uniformly presets system thresholds: the first risk threshold is 0.7, and the second risk threshold is 0.5; the five-dimensional risk weight coefficients are uniformly configured as follows: , , , , ,satisfy Constraints.

[0050] Case 1: Normal and compliant authorization operations within the maintenance window Work Scenario: During the nighttime maintenance window for rail transit, a certified signalman applies to perform standard unlocking work on the mainline signal cabinet. The system retrieves four-dimensional permission parameters: role weight. Scene weight Time period weight Equipment weight Scene time period correction coefficient Equipment risk coefficient Character-scene association matrix elements .

[0051] Calculated according to the authorized score formula: After normalization, the score falls within the range of [0.85, 1.0], which is mapped to the highest L1 authorization level, supporting full-authority operations.

[0052] Simultaneously conduct a five-dimensional real-time risk assessment, with risk values ​​for each dimension as follows: Operational type risk Personnel behavior risks Signal system status risk Time-related risks Environmental risks Substitute into the total risk formula to calculate:

[0053] The total risk value of 0.31 is less than the second risk threshold of 0.5, so the system classifies it as a low-risk operation and executes normal authorization. After the signal system confirms that the equipment is not in operation and is in a safe shutdown state, it immediately issues the authorization command. The overall end-to-end response latency is 23ms, meeting the system's design specification of ≤50ms. After the operation is completed, the system automatically cross-references and analyzes the lock operation log with the signal system operation log to generate a complete traceability record containing personnel identity, operation time, equipment number, authorization level, and operation content.

[0054] Case 2: Risk Interception of Unauthorized Operations During Peak Hours Work scenario: During peak daytime rail transit operation, a regular maintenance worker violated regulations by requesting to unlock the mainline signal cabinet. The on-site signal system was in an open operation state, and the site was experiencing severe rainstorm weather, which constitutes a high-risk and unauthorized work scenario.

[0055] The system retrieves four-dimensional permission parameters: role weight. Scene weight Weighting during peak operating hours Equipment weight Scene time period correction coefficient Equipment risk coefficient Character-scene association matrix elements .

[0056] The authorized score is calculated using the following formula: After normalization, the score falls within the range of [0, 0.40), which is mapped to the L5 prohibition permission level.

[0057] A five-dimensional risk assessment was conducted simultaneously, with risk values ​​for each dimension as follows: High-risk lock-picking operation risk Risk of personnel deviating from routine operational baselines High-risk conditions for driving with open traffic signals Risks during peak operating periods Severe environmental risks from heavy rain Substitute into the formula to calculate the total risk:

[0058] The total risk value of 0.81 is greater than the first risk threshold of 0.7. The system triggers the highest level of risk control logic, directly rejects this authorization request, and simultaneously generates a high-risk unauthorized operation alarm, which is pushed to the safety administrator and the dispatch center to completely eliminate the major safety hazards of personnel working with electricity or accidentally tampering with equipment when the signal is open.

[0059] Case Study 3: Fault Emergency Response and Network Disaster Recovery Capability Verification Operational Scenario: A sudden equipment failure occurs in a rail transit section. The emergency command center issues an emergency unlocking command, requiring the rapid unlocking of designated locks in the contingency plan to commence repair work. The system's edge computing gateway quickly matches local emergency response rules, bypassing the conventional hierarchical authorization and approval process, and prioritizing the execution of the emergency unlocking logic. Actual testing showed that the overall latency from fault alarm triggering to emergency authorization issuance and lock unlocking completion was 67ms, meeting the system's ≤200ms response time requirement for emergency scenarios. After the fault is resolved, the system automatically restores the lock's locked state and the normal access control mechanism.

[0060] For network anomaly disaster recovery scenarios, edge network outage testing was conducted: When the edge computing gateway loses connection with the platform layer network, the system can continue to execute the entire process logic of authorization score calculation, total risk assessment, and lock linkage control without cloud intervention, relying on locally pre-stored linkage rule tables and permission algorithm models. Operation events, authorization records, and risk data not uploaded during the network outage are uniformly stored in an offline queue and synchronized to the platform layer in batches according to time sequence after network recovery. The platform side performs idempotent verification to avoid data duplication and errors. After 72 hours of continuous uninterrupted stability testing, the lock status synchronization success rate reached 99.99%, and the operation log and algorithm record synchronization success rate was 100%, ensuring that algorithm control and device linkage do not fail under extreme conditions.

[0061] Based on the above three case studies, this invention, through a standardized four-dimensional permission calculation formula and a five-dimensional risk assessment algorithm, achieves hierarchical and precise authorization of rail transit lock operations, proactive interception of high-risk operations, rapid linkage in fault scenarios, and stable operation under extreme conditions. It solves the technical defects of traditional passive locks, such as extensive authorization, lack of risk assessment, lack of signal linkage, and inability to trace the source, and is fully adapted to the safety management and control needs of rail transit in all scenarios.

[0062] Obviously, the above embodiments of the present invention are merely examples to clearly illustrate the technical solution of the present invention, and are not intended to limit the specific implementation of the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the claims of the present invention should be included within the protection scope of the claims of the present invention.

Claims

1. A method for hierarchical authorization and safety management of passive locks for rail transit, characterized in that, Includes the following steps: S1. Construct a four-level interconnection architecture consisting of a terminal layer, an edge layer, a platform layer, and a signal layer. The terminal layer includes passive lock terminal nodes, smart key terminals, and field edge gateways. The edge layer includes an edge computing gateway. The platform layer includes a lock control management platform, an access control center, and a setting traceability center. The signal layer interfaces with the signal control system through a security data gateway. S2. Establish a four-dimensional dynamic permission model of role, scene, time period and device in the permission management center. When responding to an authorization request, obtain the role information, scene information, time period information and device information in the authorization request. Calculate the authorization score based on the four-dimensional dynamic permission model and map the authorization score to the authorization level. S3. Perform a real-time risk assessment on the authorization request based on five dimensions: operation type, personnel behavior, signal system status, time period, and environment, to obtain a total risk value, and make a three-level decision on the authorization level based on the total risk value: deny authorization, downgrade authorization, or grant normal authorization; S4. The linkage rule table is pre-stored in the edge computing gateway, the operation status event of the signal system is obtained, the operation status event is matched with the linkage rule in the linkage rule table, and the lock linkage control command is sent to the passive lock terminal node according to the matching result. S5. Data frames of various types are scheduled in a fair and weighted manner according to priority through a dedicated communication protocol, and the data frames are encrypted, integrity checked and signature verified by the national cryptographic algorithm before being transmitted within the four-level interconnection architecture.

2. The passive lock hierarchical authorization safety control method for rail transit according to claim 1, characterized in that, The calculation of the authorization score based on the four-dimensional dynamic permission model described in S2 is specifically as follows: The authorization score (Score) is calculated according to a preset authorization score calculation formula, which is as follows: Where: r is the operator role parameter, s is the work scenario parameter, t is the work period parameter, and d is the controlled equipment parameter; This is the role weighting coefficient. For scene weighting coefficients, The time period weighting coefficient, For equipment weighting coefficients; A correction coefficient for the correlation between scene and time period. This is a correction factor for equipment risk. Elements in the character-scene association matrix; The calculated authorization score is normalized, and the normalized authorization score is compared with the preset multiple authorization level intervals one by one to obtain the corresponding authorization level.

3. The passive lock hierarchical authorization safety control method for rail transit according to claim 1, characterized in that, The real-time risk assessment of the authorization request in S3 is specifically performed as follows: Quantify and calculate the risk value of each operation type separately. Personnel behavior risk value Signal system status risk value Time period risk value and environmental risk values The total risk of the authorization request is calculated using the total risk calculation formula. The formula for calculating the total risk value is as follows: in: These are the dimension weight coefficients for operation type, personnel behavior, signal system status, time period, and environment, respectively. All weight coefficients are greater than 0 and satisfy the weight constraint relationships: ; Three-level authorization decisions are implemented based on the total risk value: when If the risk level exceeds the preset first risk threshold, the authorization request will be rejected; when... When the risk level is less than or equal to the first risk threshold but greater than the preset second risk threshold, the current authorization level will be downgraded, and full-process operation monitoring measures will be added simultaneously; when If the value is less than or equal to the second risk threshold, perform the normal authorization operation; The risk value of personnel behavior The risk value is calculated based on the baseline of personnel operational behavior. This baseline is constructed from all historical operational records of personnel, encompassing a set of commonly used operational time periods, a set of commonly used operational equipment, a set of commonly used work scenarios, historical average operational frequency, and the standard deviation of operational frequency. The deviations between the current operational time period and the set of commonly used time periods, the current operational equipment and the set of commonly used equipment, and the current operational frequency and the historical average operational frequency are calculated. These deviations are then weighted and summed to quantify the personnel behavioral risk value. .

4. The passive lock hierarchical authorization safety control method for rail transit according to claim 1, characterized in that, The linkage rules described in S4 include: The signal opening linkage rule locks all passive lock terminal nodes in the corresponding section and issues an evacuation alarm when the signal is opened. The route status linkage rule freezes the lock operation permissions on the equipment where the associated turnout is located when the route is established, and restores the operation permissions after the route is unlocked. The fault emergency linkage rules stipulate that when a fault occurs, the locks in the plan will be unlocked in response to the unlocking command issued by the emergency command center, and will be automatically restored to locking after the fault is cleared. The permission dynamic adjustment rule dynamically adjusts the authorization level based on scheduling commands and work plans.

5. The passive lock hierarchical authorization safety control method for rail transit according to claim 1, characterized in that, The matching of runtime status events with linkage rules as described in S4 specifically refers to: The running status events are subjected to timestamp verification, deduplication, and structured parsing. Query the linkage rule table for linkage rules that match the event type of the running status event and are in the enabled state; For each candidate linkage rule, its triggering conditions are evaluated based on the local state cache, and those with true conditions are added to the matching result set; The linkage rules in the matching result set are sorted by priority. When there are mutually exclusive actions, actions with higher security levels are retained according to the principle of security priority. The actions are executed sequentially, a lock linkage control command is sent to the passive lock terminal node, and the execution result is recorded; When the edge computing gateway loses connection with the platform layer, it continues to execute the linkage logic according to the local linkage rule table, and stores the unreported events in the offline queue. After the network is restored, the events are synchronized in batches according to the time sequence.

6. The passive lock hierarchical authorization safety control method for rail transit according to claim 1, characterized in that, The dedicated communication protocol mentioned in S5 is the RPLCP protocol. The RPLCP protocol sets up a four-level priority queue. The weights of each queue from high to low are 8, 4, 2, and 1, respectively. It adopts weighted fair queuing scheduling and selects the data frame with the shortest virtual completion time for priority transmission. When the waiting time of a data frame in the queue reaches the starvation threshold of the corresponding queue, its temporary priority is increased by one level. When the waiting time reaches 95% of the latency limit of the corresponding queue, its temporary priority is increased to the highest level.

7. The passive lock hierarchical authorization safety control method for rail transit according to claim 1, characterized in that, The national cryptographic algorithms mentioned in S5 include the SM2, SM3 and SM4 algorithms. The SM2 algorithm is used for two-way authentication, key negotiation and digital signature, the SM4 algorithm is used for data frame encryption, and the SM3 algorithm is used to generate hash digests for integrity verification. The received data frames are timestamped and deduplicated using a sliding window. Data frames whose timestamps exceed the preset window are discarded directly, and data frames with duplicate sequence numbers recorded in the sliding window bitmap are also discarded directly.

8. The passive lock hierarchical authorization safety control method for rail transit according to claim 1, characterized in that, Also includes: A three-tier key hierarchy system is constructed, consisting of a root key, a regional key, and a session key. The root key is burned into a security chip, the regional key is issued by the platform and rotated periodically, and the session key is negotiated and generated during two-way authentication and is periodically forced to re-authenticate. Cross-correlation analysis is performed between the operation logs of the passive lock terminal node and the operation logs of the signal control system to generate traceability records that include personnel, time, equipment, operation content, and authorization level.

9. A passive lock hierarchical authorization safety control system for rail transit, employing the passive lock hierarchical authorization safety control method for rail transit as described in any one of claims 1-8, characterized in that, include: Passive lock terminal node, smart key terminal, field edge gateway, edge computing gateway, lock control management platform and security data gateway; The passive lock terminal node is installed on facilities along the rail transit line; The smart key terminal is communicatively connected to the passive lock terminal node and is used to supply power to the passive lock terminal node and trigger it to perform unlocking or locking actions. The field edge gateway is communicatively connected to the passive lock terminal node and is used to aggregate lock status data within the jurisdiction area; The edge computing gateway is communicatively connected to the field edge gateway and has a built-in linkage rule engine; The lock control management platform is communicatively connected to the edge computing gateway and includes a permission management center and a setting traceability center. The permission management center is used to maintain a four-dimensional dynamic permission model of roles, scenarios, time periods, and devices, and the setting traceability center is used to store traceability records. One end of the security data gateway is connected to the lock control management platform, and the other end is connected to the signal control system.

10. The passive lock hierarchical authorization safety control system for rail transit according to claim 9, characterized in that, The smart key terminal integrates a fingerprint and IC card dual-factor authentication module, a wireless power supply module, and a UWB and Beidou dual-mode positioning module. The edge computing gateway includes a main control processor, a security chip with a built-in national cryptographic algorithm engine, a LoRa communication module, an Ethernet communication module, an RS-485 communication module, and a 4G communication module; The lock control management platform also includes a data sharing bus, which is used for bidirectional sharing of five-dimensional data with the signal control system, including equipment status, work plan, operation log, alarm events, and access control policies. The edge computing gateway and the platform layer are connected by a dual-network redundant connection, including a main network and a secondary network. The communication latency of the main network is less than or equal to 50ms, and the communication latency of the secondary network is less than or equal to 500ms.

Images