An industrial control vulnerability repair system based on node dynamic upgrading

Abstract

This invention relates to the field of industrial control security and discloses an industrial control vulnerability repair system based on dynamic node upgrades. The system includes: a data flow parsing unit that acquires the scan cycle status register data of the industrial control node; a patch segmentation unit that parses the target vulnerability function to extract security patch instruction blocks and decomposes the security patch instruction blocks into instruction fragments carrying timing dependency attributes; a timing scheduling unit that identifies the communication idle window period at the end of the control loop and calculates the remaining residence time; and a memory mapping takeover unit that, when the remaining residence time meets the processing time quota, loads the instruction fragments into a reserved memory isolation area and modifies the entry address pointer of the target vulnerability function. This invention utilizes a fragmented injection mechanism to eliminate the interference of vulnerability repair on the continuity of industrial control services, avoids control interruptions caused by restart upgrades, and ensures the steady-state operation of production processes in harsh industrial environments.

Description

Technical Field

[0001] This invention relates to an industrial control vulnerability repair system based on dynamic node upgrades, belonging to the field of industrial control security technology. Background Technology

[0002] Current industrial control systems typically employ a technical approach where a central dispatch node distributes security patches to edge logic nodes, which then load and activate them locally to eliminate logical defects in the underlying operating system or communication protocol. Industrial production sites have stringent requirements for business continuity. Continuous production scenarios such as power dispatching and petrochemical distributed control require logic nodes to operate in a zero-downtime state. Traditional vulnerability patching methods involve suspending control tasks, restarting the system, or resetting memory space, leading to physical breaks in the control cycle and loss of real-time signal sampling. This can induce the controlled object to deviate from the preset process curve, or even cause the production process to go out of control.

[0003] To avoid downtime losses, existing technologies attempt to load patch instructions in chunks using idle time slots at the end of the control loop. This passive, waiting-based repair method suffers from response delays when facing attacks with real-time evolving instruction streams. Furthermore, simply expanding memory capacity or increasing the clock speed cannot establish a dynamic correlation between patch assembly progress and the timing of malicious code triggering, resulting in a logically mixed state of the system during the repair transition period. For example, Chinese invention patent application CN120277676A discloses a hot patching method and related apparatus based on instruction repair, which writes the target repair instruction into memory and modifies the original vulnerability instruction into a jump instruction to achieve vulnerability repair. Specifically, existing technologies have the following shortcomings: 1. The vulnerability repair process involves system restarts, causing interruptions in control signal output; 2. There is a time domain conflict between patch deployment transactions and the execution of business control instructions; 3. During fragmented updates, there is a lack of dynamic intervention methods to target the instruction execution stream as it approaches the vulnerability region in real time.

[0004] Therefore, the technical problem to be solved by this invention is how to achieve in-situ fragmented coverage of security patches while maintaining the continuous execution of the main control logic loop, and how to establish a dynamic game relationship between patch assembly progress and the threat level of instruction flow. Summary of the Invention

[0005] To address the problems mentioned in the background art, the technical solution of the present invention is as follows: An industrial control vulnerability repair system based on dynamic node upgrades, the system comprising: The data stream parsing unit is used to acquire scan cycle status register data that characterizes the operating status of the industrial control node. The scan cycle status register data includes the linear offset data of the current instruction pointer position and the clock pulse signal of the control logic refresh cycle. The patch segmentation unit is used to parse the binary code of the target vulnerable function to extract the security patch instruction block, and decompose the security patch instruction block into multiple instruction fragments carrying time-sequence dependency attributes based on the jump relationship between instructions, while generating a time-sequence dependency mapping table that records the logical order of instruction fragments. The timing scheduling unit is used to identify the communication idle window period at the end of the control loop based on the clock pulse signal, and to calculate the remaining dwell time of the communication idle window period relative to the total cycle based on the time slice occupancy of the master control task. The memory mapping takeover unit is used to load instruction fragments into a reserved memory isolation area with physical access restrictions in the industrial control node's memory based on the remaining residency time and a timing dependency mapping table. Specifically, it includes the following steps: Step S101, comparing the remaining residency time with the preset instruction fragment single-segment processing time quota; Step S102, when the remaining residency time is greater than the processing time quota, loading the instruction fragments into the reserved memory isolation area in the order determined by the timing dependency mapping table; Step S103, after the instruction fragments complete instruction stream assembly in the reserved memory isolation area, redirecting the real-time instruction execution flow of the industrial control node to the reserved memory isolation area by modifying the entry address pointer of the target vulnerable function.

[0006] Preferably, the memory mapping takeover unit further includes a data flow diversion module, which is used to write jump control instructions to the memory entry address of the target vulnerable function before the first instruction fragment is loaded; the jump control instructions are used to construct a time-domain data flow barrier to divert the industrial control real-time data input to the target vulnerable function during the repair period to the memory bypass buffer.

[0007] Preferably, when decomposing a security patch instruction block, the patch splitting unit is used to extract the conditional jump logic branches in the security patch instruction block; the patch splitting unit is also used to establish context register state constraints between instruction segments in the timing dependency mapping table, so that the memory mapping takeover unit can restore the original logical semantics in the reserved memory isolation area.

[0008] Preferably, the data stream parsing unit is also used to monitor the task stack occupancy depth data of the industrial control node in real time; the timing scheduling unit is used to dynamically reduce the predicted dwell length of the communication idle window based on the task stack occupancy depth data, so as to ensure that the loading of instruction fragments does not crowd out the main control services in the industrial control node that have a higher priority than security repair.

[0009] Preferably, before modifying the entry address pointer, the memory mapping takeover unit is used to dump the original entry address of the target vulnerable function to the physical backup register; the system also includes a self-healing unit, which is used to restore the entry address pointer by extracting the stored data in the physical backup register when an instruction verification anomaly occurs in the reserved memory isolation area.

[0010] Preferably, before loading the first instruction segment, the memory mapping takeover unit performs address space layout randomization reconstruction on the reserved memory isolation area; randomization reconstruction is achieved by dynamically changing the physical page index of the memory mapping table, which is used to eliminate the linear scan path of illegal external entities targeting the physical starting base address of the reserved memory isolation area.

[0011] Preferably, the scan cycle status register data obtained by the data flow parsing unit includes a linear offset representing the current processor instruction pointer position of the industrial control node and a clock pulse signal representing the refresh frequency of the industrial control main logic, which is used to provide a physical-level timing reference for the instruction segment loading operation.

[0012] Preferably, when calculating the remaining dwell time, the timing scheduling unit deducts 10% to 15% of the communication protocol synchronization reserve from the total duration of the communication idle window period to avoid the abnormal state of communication heartbeat timeout caused by the loading process of instruction segments.

[0013] Preferably, the memory mapping takeover unit redirects the entry address pointer of the target vulnerable function to the instruction stream of the reserved memory isolation area by setting the processor's hardware breakpoint register or by modifying the instantaneous pointer value of the program counter register.

[0014] Compared with the prior art, the beneficial effects of the present invention are: 1. In industrial control system vulnerability remediation, the dwell gap at the end of the control loop is identified by reading the scan cycle status register, and the original patch is split into atomic instruction blocks. By dynamically comparing the remaining dwell time with the clock consumption quota variable, the remediation logic is loaded in segments without crowding out the main control task. This timing-based fragmented injection mechanism eliminates the interference of patch deployment on the continuity of the process, avoids production interruptions caused by traditional restart methods, and achieves deep integration of security hardening actions and the timing determinism of industrial control.

[0015] 2. The processor monitors the physical displacement between the program counter value and the absolute address of the vulnerability in real time, and builds an active defense mechanism driven by the instruction pointer offset. When the instruction pointer displacement enters the security critical threshold range, it indicates that the execution flow is approaching the vulnerability triggering area. The processor writes a truncation value to the cycle control register of the non-core business sub-thread, forcibly releases the emergency time slot and preemptively completes the writing of the remaining atomic instruction blocks. This mechanism breaks the constraint of passively relying on the system's natural idle time, eliminates the security exposure during cross-cycle patch assembly, and ensures that the defense logic achieves strong physical takeover before the malicious payload is triggered.

[0016] 3. By injecting a redirection isolation instruction at the memory entry address of the target protocol parsing function before writing the first atomic instruction block, a time-domain data flow barrier is established. This instruction diverts the real-time input data flowing through the target function to a bypass cache during fragmentation repair. After multi-cycle assembly is completed and a new security policy is generated, the isolation instruction is revoked to allow the reconstructed function to take over the data flow. This mechanism ensures the atomicity of vulnerability repair transactions at the macro level, avoids the risk of system crash due to the mixing of old and new logic during the transition period, and maintains the logical consistency of the industrial control network during the hardening process. Attached Figure Description

[0017] Figure 1 This is a flowchart illustrating the atomic repair process for industrial control system vulnerabilities in the collaborative operation of the components of this invention. Figure 2 This is a diagram showing the state transition and defense response of the industrial control node during vulnerability patching in this invention.

[0018] The objectives, features, and advantages of this invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0019] The technical solutions of the embodiments of this application will be clearly described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of this application are within the scope of protection of this application.

[0020] An industrial control system vulnerability remediation system based on dynamic node upgrades, the system includes: The data stream parsing unit is used to acquire scan cycle status register data that characterizes the operating status of the industrial control node. The scan cycle status register data includes the linear offset data of the current instruction pointer position and the clock pulse signal of the control logic refresh cycle. The patch segmentation unit is used to parse the binary code of the target vulnerable function to extract the security patch instruction block, and decompose the security patch instruction block into multiple instruction fragments carrying time-sequence dependency attributes based on the jump relationship between instructions, while generating a time-sequence dependency mapping table that records the logical order of instruction fragments. The timing scheduling unit is used to identify the communication idle window period at the end of the control loop based on the clock pulse signal, and to calculate the remaining dwell time of the communication idle window period relative to the total cycle based on the time slice occupancy of the master control task. The memory mapping takeover unit is used to load instruction fragments into a reserved memory isolation area with physical access restrictions in the industrial control node's memory based on the remaining residency time and a timing dependency mapping table. Specifically, it includes the following steps: Step S101, comparing the remaining residency time with the preset instruction fragment single-segment processing time quota; Step S102, when the remaining residency time is greater than the processing time quota, loading the instruction fragments into the reserved memory isolation area in the order determined by the timing dependency mapping table; Step S103, after the instruction fragments complete instruction stream assembly in the reserved memory isolation area, redirecting the real-time instruction execution flow of the industrial control node to the reserved memory isolation area by modifying the entry address pointer of the target vulnerable function.

[0021] Preferably, the memory mapping takeover unit further includes a data flow diversion module, which is used to write jump control instructions to the memory entry address of the target vulnerable function before the first instruction fragment is loaded; the jump control instructions are used to construct a time-domain data flow barrier to divert the industrial control real-time data input to the target vulnerable function during the repair period to the memory bypass buffer.

[0022] Preferably, when decomposing a security patch instruction block, the patch splitting unit is used to extract the conditional jump logic branches in the security patch instruction block; the patch splitting unit is also used to establish context register state constraints between instruction segments in the timing dependency mapping table, so that the memory mapping takeover unit can restore the original logical semantics in the reserved memory isolation area.

[0023] Preferably, the data stream parsing unit is also used to monitor the task stack occupancy depth data of the industrial control node in real time; the timing scheduling unit is used to dynamically reduce the predicted dwell length of the communication idle window based on the task stack occupancy depth data, so as to ensure that the loading of instruction fragments does not crowd out the main control services in the industrial control node that have a higher priority than security repair.

[0024] Preferably, before modifying the entry address pointer, the memory mapping takeover unit is used to dump the original entry address of the target vulnerable function to the physical backup register; the system also includes a self-healing unit, which is used to restore the entry address pointer by extracting the stored data in the physical backup register when an instruction verification anomaly occurs in the reserved memory isolation area.

[0025] Preferably, before loading the first instruction segment, the memory mapping takeover unit performs address space layout randomization reconstruction on the reserved memory isolation area; randomization reconstruction is achieved by dynamically changing the physical page index of the memory mapping table, which is used to eliminate the linear scan path of illegal external entities targeting the physical starting base address of the reserved memory isolation area.

[0026] Preferably, the scan cycle status register data obtained by the data flow parsing unit includes a linear offset representing the current processor instruction pointer position of the industrial control node and a clock pulse signal representing the refresh frequency of the industrial control main logic, which is used to provide a physical-level timing reference for the instruction segment loading operation.

[0027] Preferably, when calculating the remaining dwell time, the timing scheduling unit deducts 10% to 15% of the communication protocol synchronization reserve from the total duration of the communication idle window period to avoid the abnormal state of communication heartbeat timeout caused by the loading process of instruction segments.

[0028] Preferably, the memory mapping takeover unit redirects the entry address pointer of the target vulnerable function to the instruction stream of the reserved memory isolation area by setting the processor's hardware breakpoint register or by modifying the instantaneous pointer value of the program counter register.

[0029] Example 1: In a continuously operating petrochemical distributed control system with zero tolerance for downtime, the edge logic node is responsible for driving the temperature and pressure regulation loop of the reactor. Its underlying processor cycles through input sampling, logic operations, output refresh, and idle communication actions every 10ms. When the central scheduling node identifies a buffer overflow vulnerability in a specific protocol parsing function of the edge logic node through network-side monitoring, this invention uses the following method to fix the vulnerability: the central scheduling node compiles the original patch for the target vulnerability into position-independent code and breaks it down into several independent atomic instruction blocks according to the jump relationships between instructions. Simultaneously, the corresponding clock consumption quota variable is determined based on the number of opcode instruction cycles contained in each atomic instruction block. The data stream parsing unit of the edge logic node obtains the scan cycle status register of the underlying operating system in real time. The recorded data is used to determine the current timing stage of the main control logic and to synchronously read the program counter. The processor obtains the absolute starting address of the target vulnerability in memory space based on the value. Calculate the starting absolute address of the vulnerability With program counter value The absolute value of the difference between them gives the instruction pointer offset. : ,in, This is the instruction pointer offset; The absolute address of the vulnerability's starting point; The current value of the program counter is used as the basis for malicious execution flows to hijack the program counter directly using memory corruption techniques to initiate non-contiguous space jump access. To prevent this non-linear approximation, the processor synchronously obtains the historical jump source and target addresses recorded in the hardware branch trace register. The processor compares the target addresses of two consecutive control flow transfers. When the calculated physical span between the two target addresses is greater than the currently set instruction cache segment length, and the latest target address falls within the safety threshold range of the vulnerability's starting absolute address, a space jump anomaly is determined to have occurred, and the defense response flag is directly set. This no longer relies on the linear decay of the instruction pointer offset value. When the scan cycle status register is activated... The value indicates that the current main control logic has entered an idle state at the end of the cycle, and the instruction pointer offset is... Greater than the preset security critical address threshold At that time, the processor calculates the remaining dwell time in the current idle state. and compare it with the clock consumption quota variable of the atomic instruction block to be processed. Perform a comparison; if the conditions are met... The processor will complete the fragment loading of the atomic instruction block into the reserved memory isolation area within the idle time slot of the current control cycle, and update the patch progress status word. During the patch fragment loading process, if external attack traffic causes malicious instruction execution flow to approach the vulnerable area, the instruction pointer offset will be affected. Reduce to less than or equal to the critical address threshold. If the processor determines that it is in an unstable state with urgent defense response, the reduction of the offset and the determination of the safety threshold are not driven by the physical space asymptotic of the sequential execution of the program, but by the processor's hardware branch predictor and instruction prefetch pipeline, which detects the nonlinear jump target address in advance during the decoding cycle. When the next instruction out-of-bounds jump point parsed by the decoding unit directly enters the safety threshold range, the processor intercepts it in advance before the register addressing pointer makes a real physical crossing, thus solving the underlying logical contradiction of the system architecture that the instantaneous jump of the buffer overflow cannot be predicted by a single distance monitoring.

[0030] At this point, the processor no longer passively waits for the natural idle time at the end of the cycle, but directly writes a preset truncation value to the cycle control register of non-core business sub-threads, terminating the current cycle of non-real-time critical tasks such as log recording or status light refreshing, thereby releasing emergency time slots within the control loop. Operating system thread context switching and memory management unit page table refresh have a fixed clock cycle physical cost. To compensate for physical hardware latency, the processor reads the system's underlying event counter to obtain the number of pipeline flushing cycles caused by the forced truncation of the current thread, which is converted into timing compensation and added to the total emergency time slot. To ensure the consistency of register states during instruction stream assembly across cycles, the processor allocates an independent stack physical boundary in the reserved memory isolation area. Before loading any atomic instruction block, a hardware-level push instruction is written to the starting address of the isolation area, pushing the current program status word register and all general-purpose register values ​​onto the independent stack. At the end of the current segment execution sequence, the processor appends a pop instruction to restore the original hardware context, using a physical barrier to cut off the path of the repair logic running to pollute the main control business context data. The processor accelerates the writing of the remaining atomic instruction blocks within this emergency time slot, achieving defense coverage before the malicious payload triggers the vulnerability logic. To eliminate the risk caused by the mixing of old and new logic during cross-cycle segment loading, the processor processes the first atomic instruction block... Previously, an unconditional jump instruction was injected into the entry address of the target protocol parsing function. This jump instruction was used to construct a time-domain data flow barrier, diverting the industrial control real-time data flow input to the target protocol parsing function during this period to the memory bypass buffer and suspending it until the repair progress status word indicated that all atomic instruction blocks were assembled and a new security policy was generated. During the process of data diversion and suspension, the data flow diversion module extracted the packet header features and synchronously sent a placeholder confirmation flag or link keep-alive heartbeat packet adapted to the current industrial control communication protocol to the caller's network layer, constructing a virtual communication queue on the protocol stack side where communication has been delivered but is in the system busy queuing period. State machine feedback ensures that the polling scheduling logic of the upper-level master node will not actively disconnect the lower-level connection or trigger the failure protection alarm of the control loop due to timeout while waiting for a response. The processor cancels the jump instruction and modifies the entry address pointer, allowing the reconstructed safety function to take over the data flow in the memory bypass buffer. In real industrial production environments, high-frequency mechanical vibration and power grid harmonic interference are superimposed. The controlled physical quantity is manifested in real time as the physical coupling result of software logic output and external hardware noise. To accurately separate process changes caused by pure software patches, edge logic nodes use a low-pass filtering mechanism to execute noise decoupling procedures. Edge logic nodes synchronously collect equipment data through independent sensing channels. The vibration baseline amplitude of the rack environment is used to adaptively set a smoothing time constant based on the baseline amplitude. This filters out transient high-frequency glitches in the real-time sampling sequence of the controlled physical quantity. The edge logic nodes calculate the absolute difference between the filtered smoothed value and the standard process baseline value, outputting the net control deviation. Subsequently, the system verification logic uses the net control deviation as the sole input parameter to eliminate rollback misjudgments caused by occasional mechanical shocks in the field. On this basis, logical changes in the information domain can establish a definite closed-loop bridge with the macroscopic execution results in the physical domain. Specifically, the micro-adjustments of the underlying protocol parsing timing or cycle by software patches will inevitably be transmitted to the duty cycle of the digital-to-analog converter output circuit. By comparing fluctuations, the actuators are driven to produce millisecond-level motion offsets. Since the previous steps have separated the inherent frequency response of the high-frequency machinery from the background resonance, this net control deviation becomes an accurate measurement medium that transcends information and physical scales. It directly and accurately characterizes the amount of process motion drift caused by the tiny change of instruction set at the pure digital level. By synchronously monitoring the rate of change of controlled physical quantities induced by the output instructions of edge logic nodes, when the physical fluctuation is detected to be within the preset stable threshold, the repair is determined to be complete. The technical solution uses the feedback of the underlying registers to solve the exclusive contradiction between the constraints of real-time continuity in industrial control and the need for immediate deployment of safety patches.

[0031] Example 2: To verify the deterministic response and control stability of the industrial control vulnerability remediation system based on dynamic node upgrades under real industrial protocol attack loads, this experiment constructs a logic control simulation platform based on an industrial processor. It employs a microprocessor with an 800MHz clock frequency and deploys an embedded operating system with a real-time kernel. The simulation platform receives Modbus TCP protocol packets generated by a traffic generator through a physical network port, simulating high-frequency data interaction between edge logic nodes and the distributed control system in a petrochemical production line. To introduce random interference from real-world engineering scenarios, the experimental group actively superimposes Gaussian white noise with a signal-to-noise ratio of 25.5dB at the input of the protocol parsing unit and simulates register read jitter caused by 50Hz power frequency electromagnetic interference. In the initial parameter settings of this experiment, the safety critical address threshold... The determination follows this logic: identify the minimum number of instruction cycles required for the processor to process malicious jump instructions, and determine the address prediction margin based on the depth of the instruction prefetch pipeline; while ensuring coverage of the sum of malicious payload parsing time and atomic instruction block loading time, weigh the risk of system log loss caused by frequent truncation of non-core business logic; establish an address space protection model based on the above factors, and determine the address prediction margin when malicious traffic causes the program counter value to... Approaching the absolute address of the vulnerability's start Furthermore, when the difference between the two is reduced to 512 bytes, the system triggers emergency time slot preemption. The test sets the standard scanning cycle of the industrial control node to 10ms, and reserves 1.5ms as a natural idle window.

[0032] In the first phase of the experiment, the experimental group adopted the dynamic upgrade system of this invention, while a control group A was set up, namely the group with the instruction pointer offset monitoring mechanism removed. When simulated attack traffic was injected at a frequency of 20 abnormal packets per second, the experimental group observed the program counter value. relative to the absolute address of the vulnerability's starting point The generated instruction pointer offset Maintaining a dwell time of 1024 bytes or more, the system utilizes the remaining dwell time at the end of each scan cycle. A stable 128-byte atomic instruction block was loaded. Data shows that the total time for the experimental group to load a total of 2KB repair patch was 160.2ms, and the volatility of the controlled object was at a background noise level of 0.023%, without any logical execution interruption. In contrast, the patch loading time for control group A under the same conditions was 158.4ms. The above data shows that under normal operating conditions, the dynamic monitoring mechanism of the present invention does not introduce computational overhead.

[0033] In the second phase of the experiment, the nonlinear response characteristics of the system were verified as the urgency of the defense response increased. The packet density of the simulated attack traffic was linearly increased from 20 packets per second to 120 packets per second to characterize the rapid accumulation of vulnerability triggering risk. Observational data showed that when the attack density reached an inflection point of 85.6 packets per second, the program counter value increased due to the malicious protocol parsing task consuming a large number of CPU cycles. Frequently targeting the vulnerability's starting absolute address Approximation, instruction pointer offset in the test group The system suddenly dropped to 256 bytes. At this point, the system triggered an emergency preemption mechanism, writing a truncation value to the cycle control register of non-core business sub-threads. This forcibly extended the idle time within a single cycle from 1.5ms to 3.2ms, thus preemptively completing the loading and memory mapping redirection of the last three atomic instruction blocks before the attack payload triggered the vulnerability logic. Monitoring results confirmed that the experimental group still achieved takeover of the vulnerable function in the attack intensity saturation zone. However, the control group A, due to the patch loading progress lagging behind the evolution of the malicious instruction flow, triggered a buffer overflow exception in the 12th scan cycle, causing the processor to enter an abnormal suspension state, and the control signal output dropped to zero. To further prove the rationality of the numerical range setting, a control group B was established, with the security critical address threshold set. Setting it to 64 bytes, the test results show that when the security critical address threshold is reached... When the cache is too small, the system only triggers the emergency time slot after the attack payload enters the instruction prefetch cache. This causes a contention between the patch writing operation and the malicious instruction stream on the bus, ultimately resulting in a system crash rate exceeding 85.3%. Furthermore, when the security critical address threshold is set... When the limit of 4096 bytes is exceeded, the system frequently triggers preemption logic erroneously during normal protocol interactions, causing the communication success rate of non-core services such as device status monitoring and log uploading to drop below 30.2%. Experimental data shows that the defined security critical address threshold... The value range provides a stable working window between vulnerability remediation success rate and system business continuity. In-depth analysis of the aforementioned multi-dimensional gradient data confirms that the industrial control vulnerability remediation system based on dynamic node upgrades utilizes instruction pointer offsets. The driver's patch fragment loading mechanism achieves a quantitative balance between the continuity of physical control and the immediacy of security protection, meeting the high availability and security protection requirements under harsh operating conditions.

[0034] Example 3: In a power inverter control unit with timing accuracy requirements higher than 50μs, the main control logic sets the refresh frequency of the pulse width modulation signal to 20kHz, resulting in a very narrow time margin for the control task. This allows for controlled patch loading during vulnerability repair. The patch segmentation unit extracts the binary machine code of the target vulnerable function, identifies the jump instructions and call instructions contained within, and defines continuous instruction sequences without control flow transfer instructions as atomic instruction blocks. The patch segmentation unit analyzes the jump target addresses and return addresses between each atomic instruction block, constructs a directed acyclic graph with instruction execution flow as edges, uses a topological sorting algorithm to determine the loading priority sequence of each atomic instruction block, records the sequence in a timing dependency mapping table, and the processor counts the total number of machine cycles contained in each atomic instruction block. And obtain the current system clock frequency of the processor. The time quota for segmented processing is calculated according to the following formula. : ,in, This is the time quota for fragment processing; For the first The total number of machine cycles contained in an atomic instruction block; For system clock frequency, This is the instruction pipeline ripple compensation coefficient, used to cover the clock loss caused by instruction prefetch failures.

[0035] processor fetch depth of instruction prefetch buffer and the average length of a single instruction The product of the two is used as the safety critical address threshold. The calculation benchmark; when the program counter value relative to the absolute address of the vulnerability's starting point When the distance is reduced to the threshold, the system writes a truncation value to the non-core business sub-thread to release the emergency time slot. It uses atomic operation instructions in the reserved memory isolation area to redirect the jump pointer, thereby completing the protection coverage before the malicious payload enters the prefetch pipeline. The whole process transforms the address space margin into closed-loop control logic based on the processor microarchitecture parameters, eliminating the ambiguity of the timing of defense intervention. The vulnerability repair transaction and real-time industrial control task maintain stability under the competition of underlying bus resources.

[0036] Example 4: In the scenario of deploying edge logic nodes in a cross-regional power grid dispatching system, due to the differences in hardware processor architecture among different nodes, the system starts the sharding processing time quota before activating the vulnerability repair logic. The in-situ calibration process involves controlling the processor to enter a controlled self-test mode. In this mode, the processor sequentially reads the atomic instruction block sequence recorded in the timing dependency mapping table and uses a hardware timer to record the measured number of execution cycles for each atomic instruction block in an isolated environment. The activation of this controlled self-test mode is executed during the initialization phase of the industrial control node's power-on bootstrapping or within the synchronous maintenance window uniformly issued by the main control network. In this state, the system forcibly suspends all non-core external I / O responses by setting the hardware interrupt mask register, running the instruction sequence calculation with complete exclusive access to the system bus and memory channels. After the measurement data is entered into the database, the interrupt flag is reset, seamlessly returning to the normal polling state. This isolates the time-slice race condition between the test action and normal main control operations. To simulate real industrial bus competition, the processor synchronously initiates periodic interrupt sampling tasks during the calibration process to calculate the system's basic jitter. Based on the average number of measured cycles and the system's basic jitter, a fluctuation compensation coefficient for the current hardware environment is determined. This provides an underlying physical benchmark for the real-time allocation of subsequent vulnerability remediation tasks.

[0037] When the system faces increased pressure on the memory bypass buffer due to a sudden surge in traffic, the memory mapping takeover unit performs capacity verification and baseline alignment of the memory bypass buffer before writing the jump control instruction. It also determines the minimum allocation space for the memory bypass buffer by detecting the maximum protocol message step size of the industrial control real-time data stream. This ensures that it can accommodate all control messages flowing in during the remediation cycle and synchronously reads the current value of the stack pointer of the target vulnerable function; the processor then allocates space according to the minimum required space. In the non-paged memory pool, a contiguous physical address block is defined, and a synchronization flag is written to the header of the address block. This allows the data streams diverted during the repair process to carry time stamp information and be stacked in sequence. When the repair progress status word indicates that the assembly is complete, the processor uses an atomic comparison instruction to verify the sequence number of the message to be taken over in the memory bypass buffer. When it is detected that the data stream read offset coincides with the current stack pointer, the system state machine completes the switch from the repair state to the running state.

[0038] In servo motion control scenarios with extremely high deterministic latency requirements, the execution density of the control logic changes in real time with the external load, causing microsecond-level dynamic drift in the logic refresh cycle of the industrial control node. Before loading each instruction segment, the timing scheduling unit rereads the clock pulse signal recorded in the scan cycle status register to correct the timing boundary of the communication idle window. It also calculates the difference between the current time and the start time of the next scan cycle based on the linear offset of the instruction pointer position. When the remaining dwell time decreases below the preset instruction injection safety redundancy threshold, the memory mapping takeover unit suspends the loading process of the current instruction segment and stores the offset of the currently loaded instruction in the repair progress status word as a breakpoint index. After the clock pulse signal of the next scan cycle indicates the entry into the timing idle stage, the processor resumes the unfinished instruction loading action from the timing dependency mapping table based on the breakpoint index, thereby closing the dynamic temporal coupling relationship between the instruction segment injection progress and the control logic refresh cycle. During the process of loading the fragment into the reserved memory isolation area, the processor configures the underlying memory protection unit to physically limit the attributes of the reserved memory isolation area. According to the total length of the security patch instruction block, the processor writes the start and end absolute addresses of the reserved memory isolation area to the control register of the memory protection unit, sets the permission attributes within its range to allow only execution and reading, and sets the hardware write protection flag to achieve physical isolation of the reserved memory isolation area relative to the main memory space of the industrial control node. After the memory mapping takeover unit completes the redirection of the entry address pointer of the target vulnerable function, the processor switches the privilege level of the current real-time instruction execution flow from kernel mode to user isolation mode, and monitors the exception capture status fed back by the memory protection unit in real time. If the real-time instruction execution flow generates an illegal unauthorized access that exceeds the range of the start and end absolute addresses, the processor forcibly terminates the illegal process by triggering a hardware non-maskable interrupt, thereby building a physical isolation barrier against cross-space attacks at the binary execution end of the vulnerability patch.

[0039] Example 5: In an edge logic node used for chemical raw material proportioning control, to confirm the integrity of the atomic instruction block sequence loaded into the reserved memory isolation area, the processor starts verification logic based on a hardware verification engine before starting the timing scheduling unit, and sequentially retrieves each atomic instruction block recorded in the timing dependency mapping table. Corresponding reference summary value It also drives the hardware verification engine to generate a synchronous digest of the binary data stream input to the memory-mapped takeover unit, and obtains the measured digest value. Processor comparison with measured summary values Compared with reference summary value When the two values ​​are consistent, the verification flag in the repair progress status word will be set, thereby establishing a logical trust path at the physical isolation level during the instruction fragment loading stage.

[0040] In power monitoring gateways involving high-frequency concurrent access across multiple protocols, to control the risk of memory bypass buffer overflow, the field deployment unit statistically analyzes historical scan cycles to obtain peak bandwidth. And combined with the time quota for segmented processing Determine the allocation size of the memory bypass cache The processor obtains the total number of atomic instruction blocks to be assembled. And calculate the total expected time required to complete patch coverage based on the time-series dependency mapping table. Expected total duration The calculation formula is as follows: ,in, For the expected total duration, For the first The time quota for processing fragments of an atomic instruction block; This is an adjustment factor for network protocol stack jitter; the processor adjusts it according to the formula... Define the physical boundaries of the memory bypass cache area and monitor the current buffer's used space in real time during data routing. The ratio of the two values ​​is such that when this ratio exceeds a preset safety threshold, the processor sends a signal to the scan cycle status register. Write priority elevation instructions and reduce the time slice of non-core business processes to speed up patch assembly, thereby closing the physical constraint relationship between data diversion stability and patch injection timeliness in terms of memory resources.

[0041] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the present invention can be implemented in other specific forms without departing from the spirit or essential characteristics of the present invention.

[0042] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention.

Claims

1. An industrial control system vulnerability remediation system based on dynamic node upgrades, characterized in that, The system includes: The data stream parsing unit is used to acquire scan cycle status register data that characterizes the operating status of the industrial control node. The scan cycle status register data includes the linear offset data of the current instruction pointer position and the clock pulse signal of the control logic refresh cycle. The patch segmentation unit is used to parse the binary code of the target vulnerable function to extract the security patch instruction block, and decompose the security patch instruction block into multiple instruction fragments carrying time-sequence dependency attributes based on the jump relationship between instructions, while generating a time-sequence dependency mapping table that records the logical order of instruction fragments. The timing scheduling unit is used to identify the communication idle window period at the end of the control loop based on the clock pulse signal, and to calculate the remaining dwell time of the communication idle window period relative to the total cycle based on the time slice occupancy of the master control task. The memory mapping takeover unit is used to load instruction fragments into a reserved memory isolation area with physical access restrictions in the industrial control node's memory based on the remaining residency time and a timing dependency mapping table. Specifically, it includes the following steps: Step S101, comparing the remaining residency time with the preset instruction fragment single-segment processing time quota; Step S102, when the remaining residency time is greater than the processing time quota, loading the instruction fragments into the reserved memory isolation area in the order determined by the timing dependency mapping table; Step S103, after the instruction fragments complete instruction stream assembly in the reserved memory isolation area, redirecting the real-time instruction execution flow of the industrial control node to the reserved memory isolation area by modifying the entry address pointer of the target vulnerable function.

2. The industrial control system vulnerability repair system based on dynamic node upgrades according to claim 1, characterized in that, The memory mapping takeover unit also includes a data flow diversion module, which is used to write jump control instructions to the memory entry address of the target vulnerable function before the first instruction fragment is loaded. The jump control instructions are used to build a time-domain data flow barrier to divert the industrial control real-time data input to the target vulnerable function during the repair process to the memory bypass buffer.

3. The industrial control system vulnerability repair system based on dynamic node upgrades according to claim 1, characterized in that, When decomposing a security patch instruction block, the patch splitting unit is used to extract the conditional jump logic branches in the security patch instruction block; the patch splitting unit is also used to establish context register state constraints between instruction segments in the timing dependency mapping table so that the memory mapping takeover unit can restore the original logical semantics in the reserved memory isolation area.

4. The industrial control system vulnerability repair system based on dynamic node upgrades according to claim 1, characterized in that, The data stream parsing unit is also used to monitor the task stack occupancy depth data of industrial control nodes in real time; The timing scheduling unit is used to dynamically reduce the predicted dwell time of the communication idle window based on the task stack occupancy depth data, so as to ensure that the loading of instruction fragments does not crowd out the main control services with higher priority than security repair in the industrial control node.

5. The industrial control system vulnerability repair system based on dynamic node upgrades according to claim 1, characterized in that, Before modifying the entry address pointer, the memory mapping takeover unit is used to dump the original entry address of the target vulnerable function to the physical backup register; the system also includes a self-healing unit, which is used to restore the entry address pointer by extracting the stored data in the physical backup register when an instruction verification exception occurs in the reserved memory isolation area.

6. The industrial control system vulnerability repair system based on dynamic node upgrades according to claim 1, characterized in that, Before loading the first instruction segment, the memory mapping takeover unit performs address space layout randomization reconstruction on the reserved memory isolation area. Randomization reconstruction is achieved by dynamically changing the physical page index of the memory mapping table, which is used to eliminate the linear scan path of illegal external entities targeting the physical starting base address of the reserved memory isolation area.

7. The industrial control system vulnerability repair system based on dynamic node upgrades according to claim 1, characterized in that, The scan cycle status register data obtained by the data stream parsing unit includes the linear offset representing the current processor instruction pointer position of the industrial control node and the clock pulse signal representing the refresh frequency of the main logic of the industrial control system, which is used to provide a physical-level timing reference for the instruction segment loading operation.

8. The industrial control system vulnerability repair system based on dynamic node upgrades according to claim 1, characterized in that, When calculating the remaining dwell time, the timing scheduling unit deducts 10% to 15% of the communication protocol synchronization reserve from the total duration of the communication idle window to avoid the abnormal state of communication heartbeat timeout caused by the loading process of instruction segments.

9. The industrial control system vulnerability repair system based on dynamic node upgrades according to claim 1, characterized in that, The memory mapping takeover unit redirects the entry address pointer of the target vulnerable function to the instruction stream in the reserved memory isolation area by setting the processor's hardware breakpoint register or by modifying the instantaneous pointer value of the program counter register.

Images