An Industrial Wireless Sensor Network Security Defense Method Based on the Uniqueness of Clock Slope

Abstract

The present invention discloses a security defense method for industrial wireless sensor networks based on the uniqueness of clock slope, belonging to the field of industrial wireless networks. Aiming at the security defense problem under the constraints of low power consumption and low cost in industrial wireless sensor networks, the method makes full use of the uniqueness and stability characteristics of the clock slope parameter in the key technology of time synchronization, and uses a low-pass filter to estimate N groups of relative clock slopes. Secondly, based on statistical analysis, a threshold of the relative clock slope is preset in advance, the relative clock slope values are grouped, and suspicious nodes are determined, realizing node identity recognition. The present invention solves the problems of large communication overhead and high computational complexity of traditional security defense mechanisms, without the need for additional protocol and algorithm design, and is compatible with existing time synchronization technologies, realizing node identity recognition in a large-scale industrial wireless sensor network environment.

Description

Technical Field

[0001] The present invention relates to the field of industrial wireless networks, and more particularly to a security defense method for industrial wireless sensor networks based on the uniqueness of clock slope. Background Art

[0002] Wireless sensor networks have been widely used in the process industry due to their low cost, flexible networking, easy maintenance, and easy configuration, which have greatly promoted the deep integration of industrialization and informatization. Subsequently, the concept of industrial wireless sensor networks (IWSNs) was proposed. With the development of industrial wireless network technology, three major industrial wireless network standards, namely ISA100.11a, WirelessHART, and WIA-PA, have gradually emerged. Since the industrial production environment often features harsh scenarios such as high temperature, high humidity, and complex electromagnetic environments, sensor network nodes are often deployed in unattended industrial sites. At the same time, the communication characteristics of wireless broadcasts make IWSNs more vulnerable to attacks, and security issues have become an indispensable factor in the industrial manufacturing environment. The lack of an effective protection mechanism further restricts the development and application promotion of IWSNs.

[0003] As a special attack mode, node identity spoofing allows attackers to arbitrarily disguise themselves as legitimate nodes and inject illegal information into the network to disrupt the normal operation of the network. Compared with other attacks, identity spoofing can mislead nodes into establishing incorrect neighbor information tables, and its destructive power is stronger. Existing security defense mechanisms, including cryptographic techniques, key management mechanisms, authentication techniques, etc., all require complex algorithm operations and additional communication overhead. However, the sensor nodes of IWSNs usually have limited resources, and their randomly deployed characteristics result in a lack of prior knowledge of the network. Therefore, existing security mechanisms have certain limitations and are not suitable for direct application in IWSNs. Therefore, finding a low-power and low-cost security defense mechanism is crucial for IWSNs.

[0004] Time synchronization technology is crucial as the basis for many applications of IWSNs, such as time-division multiple access communication, deterministic scheduling, data fusion, low-power sleep control, target tracking, etc., and has become one of the essential technologies for IWSNs. Moreover, clock slope is the core parameter for the network to achieve time synchronization, and existing research shows that this parameter has uniqueness and stability. Therefore, if the uniqueness of the clock slope can be utilized to identify the identities of network nodes and thus achieve network security defense without adding additional computation and communication overhead, it will surely bring contributions. Summary of the Invention

[0005] In view of the above deficiencies in the prior art, the technical problem to be solved by the present invention is to provide a security defense method for industrial wireless sensor networks with low overhead and low cost. Considering the inherent requirements of industrial network time synchronization and taking advantage of the uniqueness of clock slope, a high-precision estimation method for the relative clock slope between nodes is proposed to identify the identities of nodes and achieve the purpose of network security defense.

[0006] The technical solution adopted by the security defense method for industrial wireless sensor networks based on the uniqueness of clock slope of the present invention includes the following steps:

[0007] 1) Construct an industrial wireless sensor network IWSNs and establish a network topology graph G=(V, E);

[0008] 2) Nodes in the IWSNs periodically broadcast messages containing local time information;

[0009] 3) Each node records and stores the local time when it receives neighbor time messages; and identifies suspicious nodes according to the relative clock slope with surrounding neighbor nodes.

[0010] The construction of the industrial wireless sensor network and the establishment of the network topology graph G=(V, E) means: defining a randomly deployed industrial wireless sensor network and mapping its network topology to an undirected connected graph G=(V, E); where, V={1, 2,..., n} is the set of nodes, and E={e ij |i, j = 1, 2,..., n} is the set of edges; e ij =(i, j) indicates that nodes i and j communicate with each other; that is, d ij ≤r, where r is the communication radius of the node, and d ij is the Euclidean distance between nodes i and j. The neighbor node set N i of node i ={j|j∈V, e ij ∈E}, the degree d i of node i is the number of neighbor nodes, that is, d i =|N i |.

[0011] Furthermore, in the IWSNs, each node i periodically sends its local time τ i (t)=α i t + β i based on the local linear clock τ i (t) and the preset time synchronization interval T; where, α i is the clock slope, β i is the initial clock offset, both of which are hardware clock parameters of the node, and t is the absolute time.

[0012] Furthermore, in IWSNs, when node i receives the time information τ broadcast by its neighbor j j (t), record the local time τ i (t), and store the time information pair <τ i (t),τ j (t)>.

[0013] Furthermore, identifying a suspicious node based on a relative clock slope with neighboring nodes includes:

[0014] 3.1) Calculate the relative clock slope between the current node and each neighbor node;

[0015] 3.2) Analyze the identities of neighboring nodes based on the N sets of estimated relative clock slope statistics and identify suspicious nodes.

[0016] Furthermore, the calculation of the relative clock slope refers to:

[0017] a) For any node i, since the absolute time t cannot be obtained, the clock slope α i and initial clock offset β i is unknown and cannot be adjusted; for node j, its clock satisfies the following conditions:

[0018]

[0019] Among them, α ij is the relative clock slope and is a fixed constant, β ij is the relative clock offset;

[0020] b) Node i based on two sets of time information <τ i (t k ),τ j (t k )> and <τ i (t k-1 ),τ j (t k-1 )> Estimate the current relative clock slope α ij (t k ),have:

[0021]

[0022] Where k is the index of the time series.

[0023] Furthermore, it also includes:

[0024] c) Using a low-pass filter to further optimize the calculated relative clock slope to overcome communication delay fluctuations and quantization errors, we have:

[0025]

[0026] in, is the updated moment, and λ∈(0,1) is the filtering parameter.

[0027] Furthermore, analyzing the identity of neighboring nodes includes:

[0028] a) For a node, continuously record N sets of estimated relative clock slopes α ij (t k ) statistics, k = 1, 2, ... N, grouping the relative clock slopes based on a preset threshold ε;

[0029] b) When there are only N α with identity j in the same group ij (t k ), then the node with identifier j is a legitimate node, otherwise the node is a suspicious node.

[0030] Furthermore, the preset threshold ε means that the hardware time of the network node is obtained based on the local crystal oscillator count, and due to the difference in manufacturing process, α i ∈(1-ρ,1+ρ), where ρ is the crystal drift; therefore,

[0031]

[0032] Right now Before the network is deployed, a large amount of statistical analysis is performed to determine the reasonable ρ value, and then α is set. ij A reasonable threshold ε.

[0033] The advantages of the present invention using the above technical solution are:

[0034] 1. The industrial wireless sensor network security defense method of the present invention fully considers the low power consumption characteristics of IWSNs and integrates the network time synchronization mechanism. Based on the uniqueness of the clock slope, it identifies suspicious nodes without the need for complex encryption and decryption mechanisms, thus achieving low-cost security defense.

[0035] 2. The present invention utilizes a low-pass filter to optimize the relative clock slope estimation value, taking into account fluctuations in network communication delays and unpredictable measurement and quantization interference, and improves the estimation accuracy of the relative clock slope by dynamically adjusting the filter parameters.

[0036] 3. This invention utilizes threshold detection technology to group relative clock slopes. This allows for dynamic adjustment of the threshold based on the clocks of different hardware devices, improving the method's universality. Furthermore, due to its compatibility with time synchronization mechanisms, it is applicable to various industrial network scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1The industrial wireless sensor network topology provided by the embodiments of the present invention;

[0038] Figure 2 The time message periodic broadcast mechanism provided by the embodiments of the present invention;

[0039] Figure 3 The security defense mechanism process provided by the embodiments of the present invention;

[0040] Figure 4 The attack defense schematic diagram provided by the embodiments of the present invention. Detailed implementation manners

[0041] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments, but the present invention is not limited to these embodiments.

[0042] The present invention includes the following contents: constructing an industrial wireless sensor network, establishing a network topology graph G=(V, E); each node in the IWSNs periodically broadcasts a message containing local time information; and the node records and stores the local time when receiving the time message of the neighbor; the node calculates the relative clock slope between it and each neighbor node based on a low-pass filter, and analyzes the node identity based on the statistical values of N groups of estimated relative clock slopes to determine the suspicious nodes.

[0043] As Figure 1 shown, consider a randomly deployed industrial wireless sensor network, which aims to monitor the factory environment and the production manufacturing process. Considering the cost constraint, the hardware resources of the network nodes are limited, including severely limited resources such as computing, communication, and storage. Therefore, complex encryption and decryption algorithms cannot be executed, and at the same time, frequent key distribution and authentication need to be avoided as much as possible. This requires that the designed security defense method needs to meet the characteristics of low power consumption.

[0044] Map the IWSNs topology to an undirected connected graph G=(V, E), where V={1, 2,..., n} is the set of nodes, and E={e ij |i, j = 1, 2,..., n} is the set of edges; e ij =(i, j) means that nodes i and j can communicate with each other, that is, d ij ≤r, r is the communication radius of the node, and d ij is the Euclidean distance between nodes i and j. The neighbor node set N i of node i = {j|j∈V, e ij ∈E}, the degree d i of node i is the number of neighbor nodes, that is, d i =|N i |. Taking the node 6 in Figure 1 as an example, its neighbor node set N6={1, 2, 7, 10}, and the degree d6=|N6| = 4.

[0045] In IWSNs, each network node is configured with a hardware clock, which consists of a counter and an internal crystal oscillator. The timing process of the node is to count the pulse signals output by the internal crystal oscillator. According to the linear transformation characteristics of time, a first-order linear time-varying function is usually used to represent the hardware clock τ of the node itself i (t) = α i t + β i , i ∈ V, where α i is the clock slope, which determines the clock timing rate; β i is the initial clock offset, which defines the initial clock offset when the node starts. These two are the hardware clock parameters of the node

[0046] To further describe the clock relationship between two nodes, based on the clock of the current node i, the clock expression of the neighbor node j is given as follows

[0047]

[0048] where, α ij is the relative clock slope, and β ij is the relative clock offset. It can be seen from the above formula that the local hardware times between nodes i and j are linearly related. During the time synchronization process, each node needs to periodically send local clock information to its neighbor nodes. The neighbor nodes estimate relevant parameters, such as the clock slope compensation value and the clock offset compensation value, based on the received clock information and the locally recorded clock information, and then adjust the local clock to achieve network synchronization. α ij and β ij , as important parameters describing the clock relationship between two nodes, are the direct influencing factors when estimating the clock compensation value and need to be accurately estimated

[0049] For example Figure 2 , node j broadcasts its local time τ j (t k ) = kT, k ∈ N + at the time synchronization period T. Its neighbor node i, i ∈ N j records the local time τ j (t k ) when it receives the time information τ i (t k ) broadcast by j, and stores the time information pair <τ i (t k ), τ j (t k )>. During the information transmission process, the link delay d ji (t k ) cannot be ignored

[0050] Existing experimental studies have demonstrated that the clock slope differences between other nodes and fixed nodes in the network are stable and different, i.e., α j -α i is stable. And α i , as an inherent property of the node's hardware clock, is usually unchanged in a stable environment, and the influence of the external environment in the short term can be ignored. Therefore, α j / α i -1 is also stable, that is, the relative clock slope α ij between two nodes in the present invention is a fixed constant, and the identity of the node corresponds one-to-one with the relative clock slope value. Therefore, for a certain node, its neighbor node's identity can be determined by the relative clock slope value. In a large-scale IWSNs environment, especially in a high-density network environment, the number of neighbors of a node is not single, and at this time, its neighbor identity can be determined by the relative clock slope value.

[0051] For example Figure 3 , node i estimates the current relative clock slope α i (t k ), τ j (t k )> and <τ i (t k-1 ), τ j (t k-1 )> based on two consecutive sets of time information <τ ij (t k ), and there is:

[0052]

[0053] where k is the index of the time series. The above formula is the estimated value of the relative clock slope under ideal conditions.

[0054] In an industrial environment, due to communication delay fluctuations, combined with unpredictable measurement and quantization errors, directly calculating the relative clock slope using the above formula will produce certain errors. Therefore, a low-pass filter is used to further optimize the calculated relative clock slope, and there is:

[0055]

[0056] where is the updated time, and λ ∈ (0, 1) is the filtering parameter.

[0057] Since the hardware time of network nodes is obtained based on the counting of local crystal oscillators. Let τ i (t) represent the local time of node i. According to the previous analysis and the time characteristics of the node, there is τ i (t)>0, and τ i (t) is an increasing function. If τi If (t) is the standard time, then dτ i (t) / dt = 1, that is, α i = 1. However, due to manufacturing process differences, crystal oscillators will have frequency offsets, that is, ρ = |dτ i (t) / dt - 1|, α i ∈(1 - ρ, 1 + ρ), where ρ is also known as the crystal oscillator drift. Therefore,

[0058]

[0059] Before network deployment, through a large number of statistical analyses, a reasonable ρ value can be determined, and then the upper limit of the relative clock slope α ij can be clarified as

[0060] Nodes continuously record N sets of estimated relative clock slope α ij (t k ) statistical values, k = 1, 2, … N. Based on a pre-set threshold group the relative clock slopes, and it can be obtained that α ij ∈(1 / ε, ε), and those belonging to this range are in one group. When there are only N α ij (t k ) with label j in the same group, then the node with label j is a legitimate node, otherwise the node is a suspicious node, that is, for the same neighbor node, if there are multiple labels, there must be a disguised node.

[0061] For example Figure 4 , when the attacking node A disguises as nodes 8 and 11 and broadcasts time information to node 7 in the network. At this time, based on the N sets of relative clock slope α 7-8 estimated by the low-pass filter and the N sets of relative clock slope α 7-11 of node 7, both belong to the same group. Therefore, there are multiple labels of relative clock slopes in the same group. At this time, it can be determined that nodes 8 and 11 are suspicious nodes. When the attacking node A disguises as nodes 8 and 11 and broadcasts the modified local time information to the network, at this time, the 2N sets of α 7-8 and α 7-11 calculated by node 7 may all belong to multiple groups. At this time, it can also be determined that nodes 8 and 11 are suspicious nodes.

[0062] The above are only several embodiments of the present application and do not impose any form of limitation on the present application. Although the present application is disclosed above with preferred embodiments, it is not intended to limit the present application. Any person skilled in the art, without departing from the technical solution of the present application, makes some changes or modifications using the disclosed technical content, which are equivalent to equivalent embodiments and all fall within the scope of the technical solution.

Claims

1. An industrial wireless sensor network security defense method based on the uniqueness of clock slope, characterized in that, Including the following steps: 1) Construct an industrial wireless sensor network (IWSNs) and establish a network topology graph G=(V, E); including: defining a randomly deployed industrial wireless sensor network and mapping its network topology to an undirected connected graph G=(V, E); where V={1, 2, …, n} is the set of nodes, and E={e ij | i, j = 1, 2, …, n} is the set of edges; e ij =(i, j) indicates that nodes i and j communicate with each other; that is, d ij ≤r, where r is the communication radius of the node, and d ij is the Euclidean distance between nodes i and j; the neighbor node set N i of node i ={j|j∈V, e ij ∈E}, the degree d i of node i is the number of neighbor nodes, that is, d i =|N i |; 2) Nodes in IWSNs periodically broadcast messages containing local time information; 3) Each node records and stores the local time when it receives the time messages from its neighbors; Based on the relative clock slopes with surrounding neighbor nodes, identify suspicious nodes, including: 3.1) Calculate the relative clock slope between the current node and each neighbor node; 3.2) Analyze the identities of neighbor nodes based on N groups of estimated relative clock slope statistical values to determine suspicious nodes; The analysis of neighbor node identities includes: a) Continuously record N groups of estimated relative clock slopes α for the nodes ij (t k ) statistical values, based on a preset threshold Group the relative clock slopes α ij (t k ) ∈ (1 / ε, ε), those belonging to this range are grouped together; k = 1, 2, … N, and ρ is the crystal oscillator drift; b) When there are only N αs with identifier j under the same group ij (t k )), then the node with identifier j is a legitimate node; otherwise, the node is a suspicious node.

2. The security defense method for an industrial wireless sensor network based on the uniqueness of clock slope according to claim 1, characterized in that, In IWSNs, each node i periodically sends its local time τ i (t) = α i t + β i based on the local linear clock τ i (t) and the preset time synchronization interval T; where α i is the clock slope and β i is the initial clock offset. Both are hardware clock parameters of the node, and t is the absolute time.

3. The security defense method for an industrial wireless sensor network based on the uniqueness of clock slope according to claim 1, wherein In IWSNs, when node i receives the time information τ j (t) broadcast by its neighbor j, it records the local time τ i (t), and stores the time information pair <τ i (t), τ j (t)>.

4. A security defense method for an industrial wireless sensor network based on the uniqueness of clock slope according to claim 1, characterized in that The calculation of the relative clock slope means: a) For any node i, since the absolute time t cannot be obtained, the clock slope α i and the initial clock offset β i are unknown and non-adjustable; for the neighbor node j, its clock satisfies the following conditions: where α ij is the relative clock slope and is a fixed constant, β ij is the relative clock offset, τ i (t) = α i t + β i is the local line-based clock for each node i; b) Node i estimates the current relative clock slope α i (t k ), τ j (t k )> and <τ i (t k-1 ), τ j (t k-1 )> based on two sets of continuously recorded time information, and has: ij (t k ). where k is the index of the time series.

5. The security defense method for an industrial wireless sensor network based on the uniqueness of clock slope according to claim 4, wherein, It also includes: c) Further optimize the calculated relative clock slope using a low-pass filter, resulting in: where, is the updated time, and λ∈(0,1) is the filtering parameter.

Images