A terminal supporting AI glasses to securely access a private network through a wired manner

Abstract

The application provides a terminal supporting AI glasses to access a private network in a wired manner safely, and belongs to the technical field of security authentication and communication transmission. The technical scheme connects the AI glasses through a physical wired link in one direction, disables wireless connection, and the glasses do not save keys and private network protocols; a trusted authentication module intercepts illegal devices through device white list, certificate verification and face secondary verification; a hardware encryption chip stores a national secret key, and data encryption and decryption are completed locally; a private network tunnel relies on IPSec or SM2 / SM4 algorithm to build an encrypted tunnel with a gateway, a data transfer module forwards data in isolation, and an access white list is set to strictly limit the AI glasses to access only authorized private network resources, and all-round protection of private network access security is realized. The application collects private network permissions of the AI glasses to a hardware terminal, relies on a pure wired physical link to eliminate wireless risks, prevents key leakage through national secret encryption of a security chip, blocks leakage penetration through four layers of isolation, and realizes full-process security audit, and meets the specification of a secret private network.

Description

Technical Field

[0001] This invention relates to the field of security authentication and communication transmission technology, specifically a terminal that supports AI glasses to securely access a private network via a wired connection. Background Technology

[0002] AI glasses are wearable terminals equipped with micro-computing units, multiple sensors, and optical display modules. They project images using near-eye display technology and collect visual, audio, and posture environmental data using built-in cameras, microphones, and inertial sensors. Real-time AI calculations are performed through lightweight inference via local chips or wireless links to large cloud models. Optical solutions mainly include waveguides, freeform surfaces, and holographic gratings, which can overlay text, images, and 3D information without obstructing the natural field of vision. The devices integrate micro-batteries, bone conduction, or speaker audio modules to solve audio interaction. They also support human-computer interaction through input methods such as touch, voice, eye tracking, and gesture recognition. Compared to mobile phones, they have the advantages of freeing up hands and providing real-time first-person perception.

[0003] In recent years, AI glasses have been gradually applied in police work. Police AI glasses, relying on near-eye optical display, high-definition acquisition lenses, built-in NPU, and 5G / private network communication, form a wearable mobile police terminal for individual officers. This frees up officers' hands for dynamic patrols. The lens captures images, which are then processed by a lightweight AI model on the device for real-time facial and license plate comparison. In online mode, it directly connects to the public security business database, projecting risk information such as monitored personnel, overdue inspections, and cloned license plates onto the lens in milliseconds. Some models support offline recognition, adapting to areas with weak network coverage, such as underground passages and suburban checkpoints. The device natively features first-person perspective audio and video recording, with locally encrypted storage of evidence and real-time transmission back to the command center, enabling visualized remote dispatch of the scene. Commanders can issue instructions based on the glasses' transmitted images, overlay maps, and AR information such as case clues to assist in on-site handling. It also integrates voice interaction and real-time multilingual translation to meet the needs of foreign law enforcement and multi-scenario inquiries. In scenarios such as security for large events, road traffic control, patrols in commercial areas and stations, and emergency response, it achieves seamless pre-screening, significantly improving dynamic verification efficiency compared to traditional police terminals, which require no downtime.

[0004] The integration of police AI glasses with the public security intranet presents a significant challenge in balancing convenience and security. Convenience is primarily limited by the device's form factor. AI glasses are lightweight wearable devices that mostly rely on wireless data transmission. Public security intranets generally prioritize wired and dedicated network terminals for access, and existing access standards and network access points are rarely optimized for mobile individual wearable devices. On-site patrols and outdoor checkpoints lack convenient intranet access points. Furthermore, when switching between scenarios, there is a lack of automated adaptation mechanisms for switching between public networks, public security mobile intranets, and local offline modes. Police officers manually switching access methods is cumbersome. Additionally, the glasses' interaction is mainly based on voice and simple touch controls, making complex intranet authentication, key import, and network parameter configuration difficult to perform quickly. In scenarios with multiple terminals accessing concurrently, a large number of frontline officers simultaneously use AI glasses to transmit high-definition video and AI recognition streams, increasing the pressure on intranet bandwidth resources and easily leading to access delays and screen stuttering. Simplifying the access process, however, directly increases security risks.

[0005] Security challenges are more prominent. First, there are risks associated with wireless transmission links. The private network wireless links used in police AI glasses are susceptible to signal eavesdropping and man-in-the-middle attacks, with less defined protection boundaries compared to fixed terminals. Second, there are inherent security weaknesses in the terminals themselves. The glasses' limited hardware computing power makes it difficult to deploy robust security software. Sensitive police data such as facial and license plate information stored locally in the device's recognition algorithms are vulnerable to theft and tampering. Insufficient protection mechanisms after device loss can easily lead to data leaks. Third, there are challenges in identity and access control. Private networks have strict access policies, making traditional hardware certificates and UKey authentication methods difficult to implement. For small-sized glasses devices, if a lightweight authentication solution is adopted, there is a risk of identity theft; fourth, the boundaries of data flow are difficult to control. The glasses collect first-person audio and video in real time, and the recognition results interact directly with the business database, which can easily lead to problems such as unauthorized access and unauthorized downloading and forwarding of data. At the same time, in the process of end-to-cloud collaboration, the recognition traffic and interaction commands cross multiple nodes such as terminals, wireless base stations and private network platforms, making auditing and tracing more difficult than fixed police terminals; fifth, there is the pressure of equipment operation and maintenance security. The large number of wearable devices and their scattered distribution make it easy for terminal system patches and security policies to be pushed out in a timely manner, which can easily lead to long-term vulnerabilities. Summary of the Invention

[0006] This invention aims to address the technical deficiencies of existing technologies by providing a terminal that supports secure wired access to a private network for AI glasses, thereby resolving the current technical problem that police AI glasses struggle to fully balance security and convenience when accessing the public security private network.

[0007] To achieve the above technical objectives, the present invention adopts the following technical solution: A terminal that supports secure wired access to a private network for AI glasses includes a wired external interface, a hardware security encryption module, a private network tunnel communication module, a trusted authentication and control module, and a data relay isolation module. The external wired interface is a dedicated wired physical interface that connects to the AI ​​glasses in a one-way physical manner via a wired cable to establish a wired data transmission link. It is prohibited to establish a wireless communication link with the AI ​​glasses. The AI ​​glasses do not store private network keys locally and are not configured with a private network communication protocol stack. The trusted authentication and control module performs device whitelist verification and trusted identity authentication on wired AI glasses, allowing only compliant AI glasses with pre-recorded device certificates to access the system, blocking unauthorized peripheral devices from accessing the system, and completing secondary verification and authorization of the operator's identity. The hardware security encryption module has a built-in hardware-level security encryption chip, which pre-stores the private network compliance access certificate and the national cryptographic encryption key, and completes the encryption and decryption operations of all uplink and downlink private network data locally on the terminal. The private network tunnel communication module establishes a two-way authentication encrypted communication tunnel with the private network boundary gateway, and constructs a private network transmission channel based on IPSec or the national cryptographic SM2 / SM4 encryption algorithm. The data relay isolation module encapsulates and encrypts the data uploaded by the AI ​​glasses before sending it to the private network. It also decrypts and parses the business data sent from the private network before forwarding it to the AI ​​glasses. At the same time, it configures a whitelist for accessing private network resources, restricting the AI ​​glasses to accessing only authorized private network business resources.

[0008] Preferably, the external wired interface is a full-function USB-C physical interface, equipped with a wired transmission cable. The wired transmission cable carries the full transmission of camera image data, voice acquisition data, posture sensing data and AR display output data of the AI ​​glasses, and also supports power supply to the connected AI glasses.

[0009] Preferably, the trusted authentication and control module has a built-in device certificate whitelist, an operator identity verification unit, and a session control unit. The device certificate whitelist database stores the unique device identifier and encrypted certificate of compliant AI glasses. It is compared and verified during access. AI glasses with mismatched certificates or not entered into the whitelist have their data links blocked. The operator identity verification unit supports at least one authentication method, such as card swipe verification, face verification, and password verification. The private network encrypted tunnel establishment process is triggered only after the operator's identity verification is successful. The session management unit monitors the status of access sessions in real time and supports remote session cancellation, active disconnection, and automatic offline locking functions.

[0010] Preferably, the hardware-level security encryption chip is an SE security element. The private network access certificate and encryption key are stored internally within the SE security element and are not exported or cached to the terminal's ordinary storage area. The key is supported for periodic automatic updates.

[0011] Preferably, the private network tunnel communication module supports dual-mode network isolation communication, including pure private network isolation mode and dual-network switching isolation mode; In the pure private network isolation mode, the terminal only connects to the private private network gateway, completely cutting off the public network communication link. In the dual-network switching isolation mode, the terminal hardware distinguishes between private network channels and public network channels, and only one channel is activated at any given time.

[0012] Preferably, the data relay isolation module has a built-in traffic auditing unit and an access control unit; The traffic auditing unit records the AI ​​glasses' access time, data transmission behavior, private network resource access records, and session operation logs throughout the entire process. The log data is encrypted, stored, and cannot be tampered with. The access control unit is configured with private network resource access policies to prohibit AI glasses from initiating unauthorized private network scanning, cross-domain access, and data export operations.

[0013] Preferably, the terminal also integrates an emergency protection module, which includes a physical one-button network disconnection button and a physical disassembly detection unit. When the physical one-click network disconnection button is triggered, the current private network encrypted tunnel is destroyed, the temporary session key is cleared, and all data links are cut off. When the physical disassembly detection unit detects illegal disassembly of the terminal, damage to the outer casing, or violent disassembly, it triggers a permanent key clearing operation.

[0014] Preferably, the terminal has a portable integrated structure with a built-in energy storage battery for independent power supply, and can complete the entire process of AI glasses power supply, identity authentication, encrypted tunnel establishment and private network data transfer without external power supply.

[0015] Preferably, the terminal has a built-in link status monitoring and fault tolerance recovery module, which monitors the connection status and data transmission status of the wired connection link and the private network encrypted tunnel in real time. When a momentary disconnection of the wired link, signal fluctuation, or data packet loss is detected, the private network data forwarding is immediately suspended and the local data to be transmitted is cached. Once the link is restored to normal, the data transmission will be automatically resumed, while the private network encrypted tunnel session will be kept uninterrupted. When a link abnormality is detected and timed out without being restored, the current private network session will be automatically terminated and the temporary cached data will be cleared.

[0016] Preferably, the terminal has a built-in data desensitization and filtering module, which is configured in the data relay link between the AI ​​glasses and the private network. The data desensitization and filtering module performs pre-desensitization processing on the on-site images, voice, and raw sensor data uploaded by the AI ​​glasses. It automatically masks and removes faces, privacy tags, and redundant sensitive information before encrypting and uploading them to the private network. At the same time, it performs compliance filtering on the confidential text and drawing data issued by the private network, blocking unauthorized sensitive fields before forwarding them to the AI ​​glasses for display.

[0017] This invention provides a terminal that supports secure wired access to private networks for AI glasses. This terminal is suitable for application scenarios with stringent security requirements, such as classified private networks, industrial private networks, and government private networks. This invention removes network permissions and key storage permissions from the AI ​​glasses, using a dedicated wired physical link as the transmission foundation. The dedicated terminal uniformly completes device authentication, personnel identity verification, encrypted tunnel establishment, data isolation and relay, security auditing, and risk protection, completely resolving the security risks associated with traditional AI glasses wireless access to private networks, such as signal leakage, key theft, peripheral device hijacking, and cross-network penetration.

[0018] This terminal adopts a core architecture of "purely transparent peripheral transmission + full terminal control + hardware-level isolation + full encryption using national cryptographic standards". The AI ​​glasses serve only as a pure human-computer interaction peripheral, responsible only for collecting on-site audio and video, posture sensing data, and receiving and displaying AR service data from the private network. They have no local private network communication protocol stack, no key storage, and no independent network connectivity. All functions related to identity verification, link encryption, data forwarding, access control, and security auditing for private network access are independently completed by this terminal. The terminal locks the transmission channel through a physical wired link, solidifies encryption credentials through a hardware security chip, achieves trusted access to the private network through a two-way authentication tunnel, and achieves secure isolation between internal and external networks through data isolation and filtering mechanisms, constructing a triple private network security protection system from the physical layer, link layer, and application layer.

[0019] The technical principle of this invention is as follows: 1. Physical wired connection, locking in a dedicated transmission link (physical layer isolation) Before operation, the operator physically connects the AI ​​glasses to the terminal's external wired interface using a dedicated shielded USB-C wired cable, automatically establishing a purely wired data transmission link. At the terminal hardware level, all wireless communication protocols related to the AI ​​glasses are disabled, completely eliminating bypass transmission channels such as Bluetooth, Wi-Fi, and near-field wireless, ensuring that all data between the AI ​​glasses and the terminal can only be transmitted via the wired link. Simultaneously, the terminal powers the AI ​​glasses via the wired link, achieving integrated one-wire data transmission and device power supply. The core principle of this stage is the unique locking of the physical channel, eliminating the attack surface for wireless channel eavesdropping, spoofing, and hijacking.

[0020] 2. Two-layer trusted identity authentication to complete access authorization (identity layer verification). After the wired link is established, the terminal trusted authentication and management module initiates a dual authentication mechanism. If authentication is not completed, any private network data interaction is prohibited. The first layer is device trust authentication: The terminal retrieves the locally stored device certificate whitelist database, automatically reads the unique device identifier and built-in certificate of the AI ​​glasses, and compares and verifies them with the whitelist data. Only compliant AI glasses with valid certificates and matching device information can proceed to the next step. Peripherals not entered into the whitelist, with expired certificates, or illegally counterfeited will have their links directly blocked, and illegal access will be logged.

[0021] The second layer is personnel authentication: After the device verification is successful, the terminal triggers a multi-factor authentication mechanism, supporting one or more combinations of authentication methods such as card swiping, facial recognition, and password. Only after the operator's identity is verified will the terminal grant permission to establish a private network tunnel, eliminating the security risk of compliant devices being misused by unauthorized personnel.

[0022] 3. Establish encrypted tunnel negotiation to achieve trusted access to the private network (network layer encryption). After successful identity authentication, the terminal's private network tunnel communication module initiates the private network access process. The terminal initiates a two-way identity authentication handshake with the private network boundary gateway using the private network access certificate and national cryptographic key embedded in the built-in SE security element. Based on IPSec or SM2 / SM4 national cryptographic algorithms, a dynamic session key is negotiated and generated to establish an end-to-end encrypted private communication tunnel.

[0023] The terminal supports two network isolation modes: in pure private network isolation mode, the terminal hardware cuts off all public network access, retaining only the encrypted private network tunnel; in dual-network switching mode, the terminal hardware physically distinguishes between private and public network channels, activating only one channel at a time, strictly preventing lateral penetration risks caused by public-private network interconnection. After the tunnel is established, all private network data is transmitted in encrypted form, with no plaintext data exposed in the link.

[0024] 4. Data anonymization and access control (application layer protection) Once the encrypted tunnel is established, the terminal data relay isolation module and the data desensitization and filtering module start working simultaneously, undertaking all data interaction proxy functions between the AI ​​glasses and the private network. The AI ​​glasses have no direct data interaction permissions. Uplink data flow: Raw data such as on-site images, voice, posture sensing, and operation commands collected by AI glasses are transmitted to the terminal via a wired link. The terminal first automatically removes and blocks facial information, privacy labels, and redundant sensitive data through a data desensitization and filtering module. After completing the compliant desensitization process, the data is then encapsulated and encrypted through an encrypted tunnel before being uploaded to the designated business system on the private network.

[0025] Downlink data flow: Encrypted information such as business drawings, instruction texts, and task data issued by the private network are decrypted and parsed by the terminal. The data desensitization and filtering module then masks the confidential and sensitive fields, retaining only the authorized display content, before forwarding it to the AI ​​glasses to complete the AR screen display.

[0026] Meanwhile, the access control unit monitors data access behavior in real time. Relying on a pre-defined whitelist of private network resources, it prohibits AI glasses from initiating unauthorized operations such as cross-domain access, port scanning, and data export, thereby achieving fine-grained permission control.

[0027] 5. Real-time link fault tolerance and full-scale security audit (runtime layer protection) The terminal operates a continuous link status monitoring and fault-tolerant recovery mechanism, monitoring the connection status and data transmission status of wired links and private network encrypted tunnels in real time. In the event of abnormal situations such as momentary disconnection, signal fluctuation, or data packet loss, the terminal immediately suspends data forwarding, caches pending data locally, and automatically resumes transmission after the link is restored, ensuring uninterrupted service. If the link fails to recover within the timeout period due to abnormality, the private network session is automatically terminated and the temporary cache is cleared to prevent abnormal or dirty data from flowing into the private network and causing security risks.

[0028] Meanwhile, the traffic audit unit records all operation logs throughout the process, including device access time, personnel operation records, data transmission trajectory, private network resource access details, link anomaly information, etc. The log data is encrypted, solidified, and tamper-proof, meeting the compliance requirements for private network security auditing and traceability.

[0029] 6. Session Termination and Risk Emergency Protection (Closing Layer Security) When a service ends or a risk event is triggered, the terminal automatically or manually executes a security cleanup mechanism: During normal exit, the terminal proactively destroys the current session key, closes the encrypted tunnel, disconnects the wired data link, and clears temporary cached data; in emergency scenarios, the tunnel and session key can be instantly destroyed via a physical one-click network disconnect button, achieving second-level network protection. If the terminal detects physical attacks such as unauthorized disassembly, casing damage, or forced disassembly, the SE security element will automatically trigger a permanent key erasure mechanism, completely preventing key and private network credential leakage. After the device goes offline or the session times out, the terminal automatically locks its private network access permissions, requiring re-authentication before it can reconnect.

[0030] Compared with the prior art, the present invention has the following beneficial effects: 1. Access Control Stripping: Completely strip the network capabilities and key storage capabilities of the lightweight AI glasses, and consolidate all private network security permissions to the hardware-level trusted terminal, solving the industry pain point of insufficient security protection capabilities of thin and light peripherals.

[0031] 2. Physical closed loop: A unique transmission channel is built based on a dedicated wired link, and all wireless bypasses are disabled to achieve closed-loop transmission that is physically impossible to eavesdrop on or forge.

[0032] 3. Hardware trusted encryption: Relying on the tamper-proof SE security element to solidify the key and certificate, the entire process is encrypted with national cryptographic standards. The key is never stored, exported, or cached, thus avoiding the risk of key leakage from the root.

[0033] 4. Layered isolation protection: Through four layers of protection—physical link isolation, network channel isolation, business permission isolation, and data content anonymization—the AI ​​glasses peripheral is completely isolated from the confidential private network, preventing lateral penetration and data leakage.

[0034] 5. Full lifecycle management: Enables full-process security management and audit traceability from device access, identity authentication, data transmission, operation monitoring to session destruction, and is fully compatible with the security specifications of private network confidential applications. Attached Figure Description

[0035] Figure 1 This is a logic block diagram of the present invention.

[0036] Figure 2 This is the software flowchart of the present invention. Detailed Implementation

[0037] The specific embodiments of the present invention will be described in detail below. To avoid excessive and unnecessary detail, well-known structures or functions will not be described in detail in the following embodiments. The approximate language used in the following embodiments is for quantitative purposes, indicating that a certain degree of variation in quantity is permissible without changing the basic function. Unless otherwise defined, the technical and scientific terms used in the following embodiments have the same meaning as commonly understood by those skilled in the art to which this invention pertains.

[0038] A terminal that supports secure wired access to private networks for AI glasses. The device is a handheld, portable hardware form factor, with a size suitable for handheld carrying and industrial mounting scenarios. Internally, the terminal integrates a main control processing unit, an SE hardware security encryption chip, a wired physical interface module, a battery management unit, a multi-factor authentication acquisition unit, a network isolation communication unit, and a status monitoring and fault-tolerant unit. This terminal addresses a series of substantial technical deficiencies in existing smart AR glasses that commonly use Wi-Fi or Bluetooth wireless network access, including over-the-air eavesdropping, fake base station hijacking, man-in-the-middle attacks, lateral penetration of private networks by malware implanted in peripheral firmware, and the lack of secure key storage for lightweight glasses. It employs a complete technical system: pure peripheral pass-through + physical wired locked link + dual-dimensional trusted access + hardware-level national cryptographic encryption tunnel + two-way data desensitization + link fault-tolerant retransmission + physical self-destruction closed-loop protection. This enables lightweight AI glasses without keys, protocol stacks, or network capabilities to compliantly, securely, and controllably access classified private networks, industrial private networks, power intranets, and government dedicated networks.

[0039] In this invention, all wireless transmission and reception paths are completely eliminated at the terminal hardware level. No Wi-Fi modules, Bluetooth modules, 4G / 5G cellular modules, or any near-field wireless communication circuits are included. The wireless radio frequency circuits are physically eliminated during the hardware PCB design phase, eliminating the risk of malicious wake-up or backdoor activation after software shutdown. The terminal retains only one shielded, full-function USB-C physical interface as the sole external peripheral channel. This interface simultaneously achieves three-in-one wired transmission: full wired transmission of high-definition video image data, voice audio data, and nine-axis attitude sensing data from the AI ​​glasses; downlink transmission from the terminal to the AR display screen of the AI ​​glasses; and regulated power supply from the terminal to the AI ​​glasses. The physical link uses double-shielded dedicated cables to eliminate electromagnetic leakage and signal crosstalk during transmission, constructing a dedicated closed transmission channel at the physical layer.

[0040] This terminal strictly limits the peripheral attributes of the AI ​​glasses. The AI ​​glasses' local Flash and memory areas do not store any confidential parameters such as private network IPs, tunnel parameters, encryption keys, device certificates, or intranet ledger addresses. Furthermore, the glasses' firmware is fixed in a pure data acquisition and display mode, without deploying a TCP / IP private network protocol stack, and it lacks the ability to independently initiate network connections or actively access intranet resources. All uplink raw data from the glasses is transmitted to this terminal without any encryption, encapsulation, or networking; it is simply transmitted to this terminal via wired pass-through in raw data stream form. All network authentication, encryption, proxy, and access control logic is exclusively handled by this terminal, achieving zero confidential data retention and zero network access permissions for external peripherals from an architectural perspective.

[0041] The trusted authentication and control module of this terminal adopts a serial mandatory dual authentication mechanism. If any authentication step fails, the entire business link is locked. During the device whitelist authentication phase, the terminal locally stores a private network access device whitelist database with encryption. Each whitelist entry is bound to the AI ​​glasses' unique factory serial number (SN) and the device's asymmetric encryption certificate. When the AI ​​glasses are plugged into the wired interface, the terminal automatically completes the device certificate handshake verification within 200ms. For four abnormal scenarios—expired certificate, mismatched SN, no registered certificate, and illegally counterfeited device—the data path is immediately physically blocked, and the access time, device characteristics, and abnormal type are encrypted and written to an immutable audit log partition for permanent retention and traceability. After the device is successfully authenticated, the multi-factor authentication interface for operators is automatically triggered. This terminal preferably uses a two-factor mandatory authentication method: "IC card hardware swiping + facial liveness recognition." Authorization cannot be granted by swiping the card or facial recognition alone. Both factors must be verified simultaneously before the terminal grants permission to negotiate the private network tunnel, completely avoiding the security vulnerability of compliant devices being misused or borrowed by others.

[0042] This terminal's encryption system is entirely built upon a hardware-level root of trust. The terminal is equipped with an industrial-grade, financial-security-level SE (Secure Element) security component. The private network root key, device certificate, and tunnel negotiation key are all permanently stored in a secure, isolated storage area within the SE chip. The chip possesses hardware protection features against tampering, physical probes, side-channel power analysis, and key reading / export. All encryption and decryption operations are performed within the SE chip; plaintext data and key data are never output to the terminal's main memory or flash memory, eliminating attacks such as memory sniffing, memory dumps, and system privilege escalation to steal keys. Simultaneously, the system is configured with a dynamic key update mechanism; the private network tunnel session key is automatically rotated every 30 minutes, and the device access certificate supports remote renewal and revocation in the background, achieving dynamic key control and traceability of key expiration.

[0043] During the private network tunnel establishment phase, this terminal adopts a national cryptographic two-way authentication tunnel mechanism. The terminal completes two-way identity authentication with the private network boundary gateway based on the SM2 asymmetric algorithm. After confirming the legitimacy of both ends, an SM4 symmetric session key is negotiated and generated to establish a point-to-point encrypted private tunnel. All data packets within the tunnel are encrypted, encapsulated, and protected against replay. This terminal is equipped with hardware-level dual-network mutual exclusion isolation logic, distinguishing between two working conditions: In high-density and confidential operation scenarios, the terminal's hardware network port is only connected to the private network gateway, completely disconnecting the public network link and achieving physical single-network isolation; In ordinary field operation scenarios, the terminal reserves both private and public network channels, but the hardware switch and system logic force only one network to be active at a time. When the private network tunnel is activated, the public network channel is powered off and locked. When the public network is used, the private network tunnel is automatically destroyed and taken offline, physically eliminating the risks of public-private network cross-network penetration, tunnel bypass leakage, etc.

[0044] During the business data interaction phase, this terminal adopts a proxy-based isolation relay architecture. The AI ​​glasses do not directly interact with the private network in any data packet exchange; all requests and responses are forwarded by the terminal proxy. The terminal has a built-in fine-grained private network resource access whitelist, allowing access only to pre-defined authorized business IPs and ports such as internal network operation drawings, equipment ledgers, inspection tasks, and command instructions. It automatically blocks high-risk behaviors such as external network requests, internal network port scanning, cross-network segment traversal, batch data downloads, and unauthorized file uploads. The terminal records each data access behavior, data packet transmission and reception time, data traffic size, and operation account and device information in encrypted logs. The log partitions are read-only, non-deletable, and non-tamperable, supporting private network security auditing, event backtracking, and responsibility determination, fully meeting the network security operation and maintenance standards for classified information.

[0045] To address complex vibration, tension, and interference environments such as law enforcement and industrial workshops, this terminal incorporates millisecond-level link monitoring and an intelligent fault-tolerant resuming mechanism. Every 10ms, the terminal checks the wired link connectivity and encrypted tunnel keep-alive status. In the event of momentary anomalies such as slight cable loosening, transient electromagnetic interference, short-term packet loss, or link interruption, the terminal does not directly disconnect the private network tunnel. Instead, it immediately activates a local high-speed cache queue to temporarily store uplink images and sensor data, suspends downlink data push, and maintains a long-term tunnel session connection. Once the link stabilizes and the packet loss rate returns to a normal threshold, it automatically resumes transmission of cached data from the point of interruption, achieving seamless service recovery. If the link interruption lasts for more than 3 seconds, it is considered a link failure. The terminal proactively destroys the current session key, clears temporary cache data, terminates the private network connection, and returns to a secure standby state, preventing incomplete, abnormal, or illegal data from being injected into the private network and causing network disturbances and security risks.

[0046] This terminal implements end-to-end bidirectional intelligent data anonymization protection, employing differentiated filtering strategies for uplink field data and downlink classified data. Uplink, the terminal intelligently identifies high-definition images, videos, and audio content collected by the AI ​​glasses, automatically masking faces, employee IDs, privacy identifiers, and irrelevant classified signs, eliminating redundant and invalid images and noisy audio, and encrypting and uploading only valid operational information such as equipment status, equipment defects, and the field environment to the dedicated network. Downlink, the terminal filters classified drawings, parameters, and permission-based text sent from the dedicated network, automatically blocking top-level classified parameters, core key fields, and unauthorized information, displaying only compliant content within the current operator's access permissions. This achieves hierarchical display of classified information and minimum access privileges, preventing the risk of excessive distribution and leakage of classified information.

[0047] This terminal is equipped with a multi-layered physical emergency security protection system, forming an anomaly closed-loop destruction mechanism. An independent physical one-button disconnection button is located on the side of the terminal. This button is triggered directly by hardware, without going through system software logic. In emergency situations, abnormal intrusions, or device malfunctions, pressing the button instantly clears the session key, destroys the encrypted tunnel, and cuts off all data transmission links, achieving zero-delay physical disconnection. Simultaneously, a physical disassembly detection circuit is deployed internally. When the device is subjected to physical damage such as forced disassembly, casing breakage, missing screws, or abnormal opening, the detection circuit immediately triggers the SE chip's security destruction mechanism, permanently erasing all private network certificates, keys, and tunnel parameters. The hardware security area is locked and cannot be recovered, completely avoiding the risk of large-scale private network data leaks due to terminal disassembly and key theft.

[0048] In summary, this terminal, through a comprehensive security architecture that includes physical layer wireless blocking, link layer wired closed-loop, identity layer dual-person dual-certificate access control, encryption layer hardware national cryptographic reliability, application layer desensitization and audit control, and anomaly layer fault tolerance and self-destruction as a fallback, completely solves the industry pain points of traditional AI glasses' wireless network access security shortcomings and the inability of lightweight peripherals to adapt to classified private networks. The device has a compact structure, is easy to operate, has a high security level, and strong fault tolerance. It can stably adapt to various high-security private network operation scenarios such as police, military, government, and industrial intelligent manufacturing, and has outstanding creativity, novelty, and engineering practical value.

[0049] The embodiments of the present invention have been described in detail above, but the content described is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the scope of the present invention should be included within the protection scope of the present invention.

Claims

1. A terminal that supports secure wired access to a private network for AI glasses, characterized in that, It includes a wired interface for external devices, a hardware security encryption module, a private network tunnel communication module, a trusted authentication and control module, and a data relay isolation module; The external wired interface is a dedicated wired physical interface that connects to the AI ​​glasses in a one-way physical manner via a wired cable to establish a wired data transmission link. It is prohibited to establish a wireless communication link with the AI ​​glasses. The AI ​​glasses do not store private network keys locally and are not configured with a private network communication protocol stack. The trusted authentication and control module performs device whitelist verification and trusted identity authentication on wired AI glasses, allowing only compliant AI glasses with pre-recorded device certificates to access the system, blocking unauthorized peripheral devices from accessing the system, and completing secondary verification and authorization of the operator's identity. The hardware security encryption module has a built-in hardware-level security encryption chip, which pre-stores the private network compliance access certificate and the national cryptographic encryption key, and completes the encryption and decryption operations of all uplink and downlink private network data locally on the terminal. The private network tunnel communication module establishes a two-way authentication encrypted communication tunnel with the private network boundary gateway, and constructs a private network transmission channel based on IPSec or the national cryptographic SM2 / SM4 encryption algorithm. The data relay isolation module encapsulates and encrypts the data uploaded by the AI ​​glasses before sending it to the private network. It also decrypts and parses the business data sent from the private network before forwarding it to the AI ​​glasses. At the same time, it configures a whitelist for accessing private network resources, restricting the AI ​​glasses to accessing only authorized private network business resources.

2. A terminal that supports secure wired access to a private network for AI glasses according to claim 1, characterized in that, The external wired interface is a full-function USB-C physical interface, equipped with a wired transmission cable. The wired transmission cable carries the full transmission of camera image data, voice acquisition data, posture sensing data and AR display output data of the AI ​​glasses, and also supports power supply to the connected AI glasses.

3. A terminal that supports secure wired access to a private network for AI glasses according to claim 1, characterized in that, The trusted authentication and control module has a built-in device certificate whitelist, an operator identity verification unit, and a session control unit. The device certificate whitelist database stores the unique device identifier and encrypted certificate of compliant AI glasses. It is compared and verified during access. AI glasses with mismatched certificates or not entered into the whitelist have their data links blocked. The operator identity verification unit supports at least one authentication method, such as card swipe verification, face verification, and password verification. The private network encrypted tunnel establishment process is triggered only after the operator's identity verification is successful. The session management unit monitors the status of access sessions in real time and supports remote session cancellation, active disconnection, and automatic offline locking functions.

4. A terminal that supports secure wired access to a private network for AI glasses according to claim 1, characterized in that, The hardware-level security encryption chip is an SE security element. The private network access certificate and encryption key are only permanently stored inside the SE security element and are not exported or cached to the terminal's ordinary storage area. It supports automatic key updates on a regular basis.

5. A terminal that supports secure wired access to a private network for AI glasses according to claim 1, characterized in that, The private network tunnel communication module supports dual-mode network isolation communication, including pure private network isolation mode and dual-network switching isolation mode. In the pure private network isolation mode, the terminal only connects to the private private network gateway, completely cutting off the public network communication link. In the dual-network switching isolation mode, the terminal hardware distinguishes between private network channels and public network channels, and only one channel is activated at any given time.

6. A terminal that supports secure wired access to a private network for AI glasses according to claim 1, characterized in that, The data relay isolation module has a built-in traffic auditing unit and an access control unit; The traffic auditing unit records the AI ​​glasses' access time, data transmission behavior, private network resource access records, and session operation logs throughout the entire process. The log data is encrypted, stored, and cannot be tampered with. The access control unit is configured with private network resource access policies to prohibit AI glasses from initiating unauthorized private network scanning, cross-domain access, and data export operations.

7. A terminal that supports secure wired access to a private network for AI glasses according to claim 1, characterized in that, The terminal also integrates an emergency protection module, which includes a physical one-button network disconnection button and a physical disassembly detection unit. When the physical one-click network disconnection button is triggered, the current private network encrypted tunnel is destroyed, the temporary session key is cleared, and all data links are cut off. When the physical disassembly detection unit detects illegal disassembly of the terminal, damage to the outer casing, or violent disassembly, it triggers a permanent key clearing operation.

8. A terminal that supports secure wired access to a private network for AI glasses according to claim 1, characterized in that, The terminal is a portable, integrated structure with a built-in energy storage battery for independent power supply. It can complete the entire process of powering AI glasses, identity authentication, establishing encrypted tunnels, and transferring private network data without an external power source.

9. A terminal that supports secure wired access to a private network for AI glasses according to claim 1, characterized in that, The terminal has a built-in link status monitoring and fault tolerance recovery module, which monitors the connection status and data transmission status of wired links and private network encrypted tunnels in real time. When a momentary disconnection of the wired link, signal fluctuation, or data packet loss is detected, the private network data forwarding is immediately suspended and the local data to be transmitted is cached. Once the link is restored to normal, the data transmission will be automatically resumed, while the private network encrypted tunnel session will be kept uninterrupted. When a link abnormality is detected and timed out without being restored, the current private network session will be automatically terminated and the temporary cached data will be cleared.

10. A terminal that supports secure wired access to a private network for AI glasses according to claim 1, characterized in that, The terminal has a built-in data desensitization and filtering module, which is configured in the data relay link between the AI ​​glasses and the private network. The data desensitization and filtering module performs pre-desensitization processing on the on-site images, voice, and raw sensor data uploaded by the AI ​​glasses. It automatically masks and removes faces, privacy tags, and redundant sensitive information before encrypting and uploading them to the private network. At the same time, it performs compliance filtering on the confidential text and drawing data issued by the private network, blocking unauthorized sensitive fields before forwarding them to the AI ​​glasses for display.

Images