A configurable service gateway system and method based on dynamic policies

Abstract

This invention discloses a configurable service gateway system and method based on dynamic policies, belonging to the field of data security technology. The system includes a device access module, a protocol parsing module, a data persistence module, a microservice orchestration module, a security control module, and an application interface module. The device access module is used to access heterogeneous industrial devices through various industrial communication protocols and establish a unified device description model; the protocol parsing module is used to achieve standardized conversion of multi-protocol data; the data persistence module performs hierarchical caching and storage management based on data weights; and the application interface module is used to provide various data service interfaces to the upper-layer platform. This invention enables unified management and efficient interoperability of industrial equipment data, improves system resource utilization, data processing real-time performance, and industrial network operation security, and is suitable for industrial field device access and industrial internet edge computing scenarios.

Description

Technical Field

[0001] This invention relates to the field of data security technology, specifically to a configurable service gateway system and method based on dynamic policies. Background Technology

[0002] With the continuous development of industrial internet and intelligent manufacturing technologies, the demand for networked access and data interconnection of industrial field equipment is growing. A large number of PLC control devices, power meters, sensors, automated production equipment and vision acquisition devices need to achieve data acquisition and platform interconnection through industrial internet gateways to support application scenarios such as production monitoring, equipment operation and maintenance and intelligent analysis.

[0003] Existing industrial internet gateways typically perform one-to-one protocol conversions, such as PROFINET to CANOPEN, PROFIBUS / USDP to EtherCAT, etc. Similar devices exist for field data acquisition, but these can only sample fixed protocol sets, lacking dynamic adjustment and adaptation capabilities, failing to guarantee QoS, and lacking automatic judgment and labeling of real-time data quality. Furthermore, traditional gateways often employ a protocol-by-protocol adaptation approach for data acquisition, resulting in a lack of a unified semantic model for device data, making cross-device data fusion and unified management difficult.

[0004] Against the backdrop of smart manufacturing and the industrial internet, small-batch, multi-variety customized production is a major trend. Various heterogeneous protocol devices and equipment dynamically change their access networks. Traditional one-to-one gateways and fixed-configuration gateways cannot efficiently and flexibly adapt to this trend. Considering edge computing scenarios, the issue of rationally allocating resources to maximize service capabilities is particularly prominent.

[0005] Furthermore, with the continuous growth of industrial data, existing gateways typically employ fixed data storage or forwarding strategies, failing to differentiate between real-time control data and historical analysis data. This can easily lead to problems such as data congestion, response delays, and insufficient priority for critical data processing, affecting the real-time performance and stability of industrial control systems.

[0006] With the deep integration of IT and OT, networked and transparent transmission of industrial equipment has become a trend, but this has also brought new risks. Due to historical and industry reasons, existing gateways are weak in data protection and access control, lacking the ability to dynamically assess and coordinate control based on operational status and security events, making it difficult to proactively respond to abnormal access, intrusion behavior, or system risks.

[0007] Therefore, how to build a configurable industrial internet service system that can achieve unified modeling of heterogeneous industrial equipment, dynamic scheduling of data processing, dynamic microservice orchestration, and adaptive control of security policies, so as to improve industrial data processing efficiency, system scalability, and operational security, has become a technical problem that urgently needs to be solved in this field. Summary of the Invention

[0008] To address the shortcomings of existing technologies, this invention provides a configurable service gateway system and method based on dynamic policies. It solves the problem of how to construct an industrial internet configurable service gateway system that can achieve unified modeling of heterogeneous industrial equipment, dynamic scheduling of data processing, data persistence, dynamic microservice orchestration based on dynamic policies, and adaptive control of security policies, so as to improve industrial data processing efficiency, system scalability, and operational security. This has become a technical problem that urgently needs to be solved in this field.

[0009] To achieve the above objectives, the present invention is implemented through the following technical solution: a configurable service gateway system based on dynamic policies, comprising: a device access module, a protocol parsing module, a data persistence module, a microservice orchestration module, a security control module, and an application interface module;

[0010] in,

[0011] The device access module is used to establish connections between heterogeneous industrial devices through multiple industrial communication protocols and PLC drivers, provide southbound data access capabilities, and generate a unified device description model.

[0012] The protocol parsing module is used to convert data from different protocols into a unified data object structure;

[0013] The data persistence module constructs a hierarchical cache-storage structure to manage real-time data and historical data in a hierarchical manner;

[0014] The microservice orchestration module is used to encapsulate gateway functions into independently deployable microservice units and dynamically adjust service call relationships based on system operating status.

[0015] The application interface module is used to provide various northbound data access services to the upper-layer application platform;

[0016] The security control module is used to perform authentication, access control, and security detection operations throughout the entire data interaction process.

[0017] The system establishes a dynamic service scheduling mechanism based on equipment load status and service resource utilization to achieve adaptive adjustment of industrial data processing capabilities.

[0018] Preferably, the unified device description model is constructed in the following manner:

[0019]

[0020] Where: D i For the i-th device model; ID i P is the unique identifier for the device. iFor communication protocol type; T i S is the data sampling period; i It is a set of equipment operating status parameters; through unified modeling, it achieves consistent data semantics processing for equipment with different industrial protocols.

[0021] Preferably, the data persistence module establishes a data processing priority function based on data importance:

[0022] W=αR+βF+γC

[0023] Where: R is the data real-time weight; F is the access frequency; C is the control correlation; α, β, γ are dynamic adjustment coefficients; the system determines the data caching or long-term storage strategy based on the weight value W.

[0024] Preferably, the microservice orchestration module establishes a service dependency matrix:

[0025] M ij =Dep(S i ,S j )

[0026] Used to represent the call dependencies between microservices; when the system resource utilization exceeds a set threshold, service pruning is achieved by deleting low-dependency service nodes.

[0027] Preferably, the system is based on CPU utilization U c Memory usage U m and network latency L n and network bandwidth utilization B r Calculate the service load index:

[0028]

[0029] The number of microservice instances is automatically adjusted based on the Load value.

[0030] Preferably, the security control module constructs a multi-level security scoring model:

[0031]

[0032] Among them: A n Security incident level; T n The duration of the event; when the SecScore exceeds the threshold, access isolation or data blocking policies are automatically triggered.

[0033] A configurable service method based on dynamic policies includes:

[0034] Establish communication connections for industrial equipment;

[0035] Build a unified data model for equipment;

[0036] Standardize and analyze the collected data;

[0037] Implement tiered storage based on data weight;

[0038] Build microservice dependencies;

[0039] Dynamically orchestrate services based on system load;

[0040] Data is published via the northbound interface;

[0041] Perform a full-process security assessment and access control.

[0042] Preferred,

[0043] The sampling period of the equipment is dynamically adjusted as follows: T′=T / (1+λV); where: V is the fluctuation rate of the equipment status; λ is the adjustment coefficient.

[0044] Preferably, the anomaly index is calculated using the mean deviation of historical data:

[0045]

[0046] An alarm microservice is triggered when E exceeds a preset threshold.

[0047] Preferably, when abnormal access behavior is detected, the system performs the following actions: microservice isolation; data access permission downgrade; and communication link encryption level upgrade.

[0048] Beneficial effects

[0049] This invention provides a configurable service gateway system and method based on dynamic policies. It has the following beneficial effects: This configurable service gateway system and method based on dynamic policies:

[0050] (1) Realize the unified data management capability of heterogeneous industrial equipment. This invention constructs a unified description model for equipment and performs standardized modeling processing on the data of different communication protocols and different types of industrial equipment. This enables the data of multi-source heterogeneous equipment to be uniformly expressed at the semantic layer, avoiding the data fragmentation problem caused by the traditional gateway's reliance on a single protocol adaptation, and improving the compatibility of industrial equipment access and the system's scalability.

[0051] (2) Improve the real-time performance and resource utilization efficiency of industrial data processing. By establishing a data weighting mechanism based on data real-time performance, access frequency and control correlation, a hierarchical caching and storage strategy is implemented for the collected data, so that key control data is processed first, thereby effectively reducing data congestion and improving the data response speed and overall operational stability of the industrial field.

[0052] (3) Achieving flexible trimming and dynamic expansion of gateway functions. This invention adopts microservice encapsulation and service dependency modeling to decouple the gateway function module into independently run microservice units, and dynamically orchestrates and trims them according to the system resource status, so that the system can adapt to changes in business needs, significantly reduce system coupling, and improve deployment flexibility and maintenance efficiency.

[0053] (4) Enhance the adaptive scheduling capability of edge computing resources. By constructing a system load index model, CPU utilization, memory utilization and network latency are comprehensively evaluated, and the number of microservice instances is dynamically adjusted so that the industrial Internet gateway can still maintain stable operation under limited hardware resources, thereby improving the resource utilization rate in the edge computing environment.

[0054] (5) Enhance the proactive security protection capabilities of industrial internet systems. This invention establishes a security scoring mechanism to quantitatively assess the level and duration of security events, and automatically triggers access isolation or data blocking strategies when the risk exceeds the threshold, thereby transforming from traditional passive protection to proactive security control and improving the security and reliability of industrial data interaction processes.

[0055] (6) Improve industrial data interoperability and platform access capabilities. By providing multiple northbound communication interfaces and dynamic data configuration methods, industrial data can be flexibly connected to different application platforms and Internet systems, reducing the difficulty of system integration and improving the data sharing and interoperability capabilities of the industrial Internet platform. Attached Figure Description

[0056] Figure 1 This is a schematic diagram of the overall architecture of a configurable service gateway system based on dynamic policies according to the present invention.

[0057] Figure 2 This is a schematic diagram of a configurable service processing flow structure for the Industrial Internet according to the present invention.

[0058] Figure 3 This is a schematic diagram of a microservice orchestration process for a configurable service processing flow in the industrial internet, according to the present invention. Detailed Implementation

[0059] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0060] Those skilled in the art should connect all electrical components and their compatible power supplies to each other using wires, and select appropriate controllers according to actual conditions to meet control requirements. The specific connection and control sequence should refer to the working sequence of each electrical component in the following working principle to complete the electrical connection. The detailed connection methods are well-known technologies in the art. The following mainly introduces the working principle and process, and will not explain the electrical control.

[0061] Please see Figure 1-3 The present invention provides a technical solution:

[0062] Example 1:

[0063] like Figure 1 As shown, this embodiment provides a configurable service gateway system based on dynamic policies, including a device access module, a protocol parsing module, a data persistence module, a microservice orchestration module, a security control module, and an application interface module.

[0064] In practical applications, the device access module establishes communication connections with the production line PLC controller, power monitoring instruments, and field sensors, respectively. It acquires data using protocols such as Modbus TCP, OPC UA, and CANOPEN, and transmits the data via the northbound interface according to user requirements. The system first constructs a unified device description model for each industrial device:

[0065] Di={ID i ,P i ,T i ,S i}

[0066] Among them, ID i Indicates the device number, P i Indicates the communication protocol type, T i S represents the sampling period. i This represents the set of running status parameters.

[0067] After unified modeling, data from devices from different sources is converted into a unified data structure, enabling the data to be processed and accessed uniformly within the system, thereby solving the problem of difficulty in integrating heterogeneous device data in the background technology.

[0068] The collected data then enters the data persistence module, and is written to the high-speed cache and historical database respectively according to the real-time control requirements and historical analysis requirements, so as to realize hierarchical management of real-time data and non-real-time data.

[0069] Finally, the application interface module publishes data services to the industrial cloud platform through MQTT and HTTP interfaces, realizing data interoperability between the device layer and the Internet platform.

[0070] Example 2:

[0071] In this embodiment, the system focuses on microservice-based processing of the gateway function module.

[0072] The microservice orchestration module encapsulates protocol parsing services, data storage services, alarm services, and interface publishing services into independent microservice units and establishes a service dependency matrix:

[0073] Mij=Dep(Si,Sj)

[0074] Where Dep(Si,Sj) represents the call dependency relationship between services.

[0075] The system monitors CPU utilization (Uc), memory utilization (Um), and network latency (Ln) in real time and calculates the system load index.

[0076] Load = k1Uc + k2Um + k3Ln

[0077] When the load exceeds the set threshold, the system automatically shuts down low-dependency microservices or reduces the number of service instances; when the load decreases, the corresponding service is restarted.

[0078] For example, when the number of connected devices increases from 50 to 200, the system automatically expands the number of data parsing microservice instances, reducing the data processing latency from 420ms in the traditional fixed architecture to approximately 160ms.

[0079] This implementation effectively solves the problems of fixed functions and low resource utilization in industrial gateways in the background technology.

[0080] Example 3:

[0081] In this embodiment, the security control module performs dynamic security assessments on the system's operating status.

[0082] The system establishes a security scoring model:

[0083]

[0084] Where An represents the security event level and Tn represents the event duration.

[0085] When abnormal access behavior or illegal data requests are detected, the system calculates a security score. If the score exceeds the security threshold, the following actions are automatically performed:

[0086] Restrict access permissions to abnormal terminals;

[0087] Isolate related microservice communication;

[0088] Upgrade the level of communication encryption;

[0089] Record security audit logs.

[0090] In simulated network scanning attack tests, the system in this embodiment can complete risk identification and access blocking within about 2 seconds, which significantly improves the security of industrial networks compared to traditional gateway systems that rely solely on identity authentication.

[0091] Comparative Example 1:

[0092] Traditional industrial internet gateways typically adopt a monolithic program architecture, centrally deploying protocol parsing, data storage, and data forwarding functions.

[0093] In this scheme:

[0094] Different industry protocols are parsed independently;

[0095] No unified equipment model has been established;

[0096] All data is uniformly stored in the same queue.

[0097] System functions cannot be dynamically modified;

[0098] The security mechanism only includes account authentication and simple encrypted communication.

[0099] As the number of connected devices increases, the system CPU utilization rises rapidly, data processing latency increases significantly, and proactive isolation is not possible when abnormal access behavior occurs.

[0100] Comparative tests showed that, under the same equipment scale:

[0101] project Comparative Example This invention Data delay 400~500ms 150~200ms Service scalability fixed dynamic resource utilization rate Low high Security Response passive initiative

[0102] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, the phrase "comprising an element defined as..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0103] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A configurable service gateway system based on dynamic policies, characterized in that, include: The module includes a device access module, a protocol parsing module, a data persistence module, a microservice orchestration module, a security control module, and an application interface module. in, The device access module is used to establish connections between heterogeneous industrial devices through multiple industrial communication protocols and generate a unified device description model; The protocol parsing module is used to convert data from different protocols into a unified data object structure; The data persistence module constructs a hierarchical cache-storage structure to manage real-time data and historical data in a hierarchical manner; The microservice orchestration module is used to encapsulate gateway functions into independently deployable microservice units and dynamically adjust service call relationships based on system operating status. The application interface module is used to provide various northbound data access services to the upper-layer application platform; The security control module is used to perform authentication, access control, and security detection operations throughout the entire data interaction process. The system establishes a dynamic service scheduling mechanism based on equipment load status and service resource utilization to achieve adaptive adjustment of industrial data processing capabilities.

2. The configurable service gateway system based on dynamic policies according to claim 1, characterized in that... The unified device description model is constructed as follows: Where: D i For the i-th device model; ID i P is the unique identifier for the device. i For communication protocol type; T i S is the data sampling period; i It is a set of equipment operating status parameters; through unified modeling, it achieves consistent data semantics processing for equipment with different industrial protocols.

3. The configurable service gateway system based on dynamic policies according to claim 1, characterized in that... The data persistence module establishes a data processing priority function based on data importance: W=αR+βF+γC Where: R is the data real-time weight; F is the access frequency; C is the control correlation; α, β, γ are dynamic adjustment coefficients; the system determines the data caching or long-term storage strategy based on the weight value W.

4. A configurable service gateway system based on dynamic policies according to claim 1, characterized in that... The microservice orchestration module establishes a service dependency matrix: M ij =Dep(S i ,S j ) The microservice orchestration module is used to represent the call dependencies between microservices; when the system resource utilization exceeds a set threshold, service pruning is achieved by deleting low-dependency service nodes.

5. A configurable service gateway system based on dynamic policies according to claim 1, characterized in that... The system is based on CPU utilization U c Memory usage U m and network latency L n Calculate the service load index: Load=k1U c +k2U m +k3L n The system automatically adjusts the number of microservice instances based on the Load value.

6. A configurable service gateway system based on dynamic policies according to claim 1, characterized in that... The aforementioned security control module constructs a multi-level security scoring model: Among them: A n Security incident level; T n The duration of the event; when the SecScore exceeds the threshold, access isolation or data blocking policies are automatically triggered.

7. The configurable service method used in the configurable service gateway system based on dynamic policies according to any one of claims 1-6, characterized in that... ,include: Step 1) Establish communication connections for industrial equipment; Step 2) Construct a unified data model for the equipment; Step 3) Standardize and parse the collected data; Step 4) Perform tiered storage based on data weight; Step 5) Build microservice dependencies; Step 6) Dynamically orchestrate services based on system load; Step 7) Publish data via the northbound interface; Step 8) Perform a full-process security assessment and access control.

Images