Domestic Industrial Internet Security Hardware Device

Abstract

The present invention provides a domestically produced industrial Internet security hardware device, which belongs to the field of network security technology. The central processing unit module coordinates the work of each module and executes security policies. The industrial protocol parsing module parses a variety of industrial communication protocols and transmits the results to the anomaly detection module. The anomaly detection module adopts an edge computing architecture to detect network traffic and device behavior anomalies. The security policy execution module executes access control and security measures based on the anomaly detection output. The encryption communication module supports the national secret algorithm to ensure the encrypted transmission of industrial data. The firmware security module performs secure startup and firmware integrity verification at system startup, and continuously monitors the system integrity. The physical isolation module dynamically adjusts the isolation status of the control network and the information network according to security requirements. The centralized management interface module realizes configuration interaction and log transmission with the upper-level security management platform. The device provides a comprehensive industrial Internet security solution through the collaborative work of multiple modules.

Description

Technical Field

[0001] The present invention belongs to the field of network security technology and relates to a domestically produced industrial Internet security hardware device. Background Art

[0002] In the prior art, the security devices of the Industrial Internet mainly rely on a variety of discrete security modules, including protocol analysis, anomaly detection, encrypted communication, firmware security and physical isolation modules. These modules usually run independently, interact with each other and work together through the network. In addition, the security devices in the prior art have different degrees of delay and resource consumption in executing security policies and managing network traffic.

[0003] The main problems in the existing technology include: First, the coordination between the discrete modules is complex and inefficient, resulting in slow response speed. Second, due to the lack of a unified core control unit, it is difficult to effectively execute and dynamically adjust multiple security policies. Third, traditional encryption and firmware security measures are relatively simple and difficult to meet the high security requirements of the industrial Internet environment. In addition, the physical isolation and centralized management interface functions of existing equipment are imperfect, making it difficult to achieve efficient network isolation and centralized management.

[0004] Therefore, it is very necessary to develop a new domestically produced industrial Internet security hardware device. Summary of the invention

[0005] In response to the above problems, this application provides a domestically produced industrial Internet security hardware device, which provides a comprehensive industrial Internet security solution through the collaborative work of multiple modules to improve the response efficiency of security equipment in the industrial Internet.

[0006] The domestically produced industrial Internet security hardware device provided in this application includes:

[0007] The central processing unit module, as the core control unit, is used to coordinate the work of other modules of the device and implement security policies;

[0008] An industrial protocol parsing module, connected to the central processing unit module, for parsing a variety of industrial communication protocols and transmitting the parsing results to the anomaly detection module;

[0009] An anomaly detection module is used to receive data from the industrial protocol analysis module; based on the received data, it detects network traffic and device behavior anomalies in real time and transmits the detection results to the central processing unit module; the anomaly detection module adopts an edge computing architecture and works in conjunction with the central processing unit module to perform local processing and analysis on the massive industrial data transmitted from the industrial protocol analysis module;

[0010] The security policy execution module is triggered by the CPU module according to the output of the anomaly detection module to execute corresponding access control and security measures;

[0011] An encryption communication module, integrated with the security policy execution module, supports the national encryption algorithm, and is used to encrypt and transmit industrial data under the control of the security policy execution module;

[0012] A firmware security module, connected to the CPU module, is used to perform secure boot and firmware integrity verification at system startup and continuously monitor system integrity;

[0013] The physical isolation module is controlled by the central processing unit module and is used to dynamically adjust the isolation status of the control network and the information network according to security requirements;

[0014] The centralized management interface module is connected to the central processing unit module and is used for configuration interaction and log transmission with the upper-level security management platform.

[0015] Furthermore, the central processing unit module includes a multi-core processor architecture, and each core is responsible for executing different types of security policies.

[0016] Furthermore, the industrial protocol parsing module adopts a reconfigurable hardware architecture, including:

[0017] Protocol identification engine for automatic identification of unknown industrial protocols;

[0018] Dynamic loading unit, used to hot load new protocol parsing plug-ins without interrupting system operation;

[0019] The protocol optimizer is used to automatically adjust the protocol parsing strategy according to the real-time network traffic characteristics to improve the parsing efficiency.

[0020] Furthermore, the protocol identification engine is specifically used for:

[0021] The characteristic vector of the protocol in the data packet is obtained by the following formula (1): :

[0022] ;

[0023] in, Indicates basic features, including header field length, protocol version, message type, and timestamp; Indicates complex features, including the entropy value of the data packet , Byte frequency distribution , standard deviation of packet length , Correlation between header fields , Distribution characteristics of serial numbers ; Entropy value of the data packet Calculate according to the following formula (2):

[0024] ;

[0025] in, For the The frequency of occurrence of byte values; is the total number of possible byte values;

[0026] Byte frequency distribution Calculate according to the following formula (3):

[0027] ;

[0028] in, For the The frequency of occurrence of byte values; is the total number of possible byte values;

[0029] Standard deviation of packet length Calculate according to the following formula (4):

[0030] ;

[0031] in, For the The length of the data packet; is the average value of the packet length; is the total number of data packets;

[0032] Correlation between header fields Calculate according to the following formula (5):

[0033] ;

[0034] in, is the number of basic features, and Respectively and The value of the basic feature;

[0035] Distribution characteristics of serial numbers Calculate according to the following formula (6):

[0036] ;

[0037] in, For the The sequence number of the data packet; For the The sequence number of the data packet; is the total number of data packets;

[0038] Protocol matching is performed according to the following formula (7):

[0039] ;

[0040] in, Represents the current data packet feature vector Compared with the protocol feature vector in the known protocol feature library The weighted Euclidean distance of ; is the number of basic features; is the number of complex features; For the The weight of the basic features; For the The weight of a complex feature;

[0041] When calculated Less than the preset threshold , it is determined to be a known protocol; otherwise, it is marked as an unknown protocol, and the dynamic loading unit is notified to hot load a new protocol parsing plug-in.

[0042] Furthermore, the dynamic loading unit is specifically used for:

[0043] Register new protocol parsing plug-ins through the centralized management interface module;

[0044] Map the new protocol parsing plugin to system memory;

[0045] Under the coordination of the CPU module, hot loading is achieved through the following commands:

[0046] LoadPlugin(PluginID)

[0047] PluginID is the unique identifier of the new protocol parsing plug-in.

[0048] Furthermore, the protocol optimizer is specifically used for:

[0049] Monitor network traffic in real time and record the number of packets for each protocol and flow rate ;

[0050] According to the following formula (8), the priority of each protocol is calculated :

[0051] ;

[0052] in , and is the weight coefficient, which is used to adjust the impact of the number of protocols and traffic size; is the total number of protocols;

[0053] Based on the calculated priority Dynamically adjust the protocol parsing order and resource allocation. Specific strategies include:

[0054] Increase the parsing frequency of high priority protocols;

[0055] Allocate more computing resources to the parsing tasks of high-priority protocols.

[0056] Furthermore, the anomaly detection module includes:

[0057] The feature extraction unit is used to calculate the feature value and the frequency feature value from the received current data packet, and the feature value is calculated according to the following formula (9):

[0058] ;

[0059] in, Indicates the characteristic value of the current data packet; Indicates that the current The features of the data packet include the data packet size, source IP address, destination IP address and timestamp; Indicates The weight coefficient associated with each feature; The total number of features representing the data packet;

[0060] The frequency characteristic value is calculated according to the following formula (10):

[0061] ;

[0062] in, Indicates the frequency characteristic value of the current data packet; Indicates that the current data packet is in The frequency characteristics of the current data packet include the number of repetitions of the data packet and the frequency of occurrence of the protocol type; Indicates The weights associated with each frequency feature; Represents the total number of frequency features; and To adjust the parameters;

[0063] The anomaly scoring unit is used to calculate the anomaly score S of each data packet based on the extracted feature value and frequency feature value, and the anomaly score S is calculated by the following formula (11):

[0064] ;

[0065] in, Indicates the historical mean of the characteristic value of the data packet; Represents the historical mean of the frequency characteristic value of the data packet; , , and is the adjustment coefficient;

[0066] The calculated abnormal score S is compared with the preset threshold T. When S exceeds T, an abnormal alarm signal is generated and transmitted to the central processing unit module.

[0067] Furthermore, the security policy execution module includes a policy conflict detection unit for detecting and resolving potential conflicts between multiple security policies in real time. The policy conflict detection unit is specifically used to:

[0068] Obtain and load all currently effective security policy rules from the central processing unit module;

[0069] Define conflict detection rules;

[0070] Monitor the execution of policies in real time and detect potential conflicts through rule matching; when a conflict is detected, generate a conflict report and notify the central processing module;

[0071] Conflicts are automatically resolved based on predefined priority rules or manual intervention mechanisms, and security policy rules are updated.

[0072] Furthermore, the security policy execution module includes an emergency response unit, which is used to automatically initiate preset emergency measures when a high-risk anomaly is detected. The emergency response unit is specifically used to:

[0073] Works with the anomaly detection module to trigger emergency response when high-risk anomalies are detected;

[0074] Load corresponding emergency measures from the preset emergency response database;

[0075] Automatically execute emergency response measures, including isolating infected network segments, shutting down specific services, and launching backup systems;

[0076] Send emergency response execution and status reports to the central processor module and report to the upper-level security management platform.

[0077] Furthermore, the physical isolation module adopts dynamic software-defined isolation technology, including a virtual network slicing unit, which is used to dynamically create and adjust the network isolation area according to the security policy, and the virtual network slicing unit is specifically used to:

[0078] receiving a current security policy from the central processing unit module;

[0079] Define the configuration parameters of the virtual network slice according to the security policy, including IP address range, bandwidth limit, and security rules;

[0080] Use network virtualization technology to create corresponding virtual network slices;

[0081] Dynamically adjust the configuration of virtual network slices based on real-time security requirements and network traffic conditions, including adding or reducing slices and adjusting slice resource allocation;

[0082] When the security policy changes or is no longer needed, the corresponding virtual network slice is safely destroyed to release resources.

[0083] The beneficial effects of the technical solution provided by this application include:

[0084] The present invention uses the central processing unit module as the core control unit, which can efficiently coordinate the work of each module and execute security policies, thereby realizing the comprehensive management of multiple modules. This centralized control architecture improves the system's response speed and resource utilization efficiency, and ensures seamless coordination between various security functions.

[0085] The anomaly detection module of the present invention adopts an edge computing architecture and works in conjunction with the central processing unit module to process and analyze massive industrial data in real time, realizing instant anomaly detection of network traffic and device behavior. This real-time performance significantly improves the detection and response capabilities of security incidents and reduces the harm of potential threats.

[0086] The present invention integrates multiple security function modules, including an encryption communication module that supports the national secret algorithm, a firmware security module, and a physical isolation module. The encryption communication module ensures the confidentiality and integrity of industrial data transmission, the firmware security module provides secure boot and firmware integrity verification, and the physical isolation module dynamically adjusts the network isolation status to provide all-round security protection.

[0087] The centralized management interface module of the present invention is connected to the central processing unit module and can perform configuration interaction and log transmission with the upper-level security management platform. Through continuous monitoring and optimization, the centralized management interface module provides real-time evaluation and optimization suggestions for the execution effect of security policies, further improving the security and management efficiency of the overall system. BRIEF DESCRIPTION OF THE DRAWINGS

[0088] Figure 1 It is a structural diagram of the domestically produced industrial Internet security hardware device provided in the first embodiment of the present application. DETAILED DESCRIPTION

[0089] Many specific details are described in the following description to facilitate a full understanding of the present application. However, the present application can be implemented in many other ways than those described herein, and those skilled in the art can make similar generalizations without violating the connotation of the present application, so the present application is not limited by the specific implementation disclosed below.

[0090] The first embodiment of the present application provides a domestic industrial Internet security hardware device, and its structural diagram is as follows: Figure 1 As shown, it includes: a central processing unit module, an industrial protocol parsing module, an anomaly detection module, a security policy execution module, an encryption communication module, a firmware security module, a physical isolation module, and a centralized management interface module.

[0091] The central processing unit module 101, as a core control unit, is used to coordinate the work of other modules of the device and execute security policies. This module mainly includes the following key parts: multi-core processor, memory management unit, peripheral control interface, clock management unit and security policy engine.

[0092] The multi-core processor is the core component of the central processing unit module 101. It consists of multiple independent processing cores, each of which can run different tasks in parallel, thereby improving the overall processing capability and response speed of the system. Through the built-in task scheduling algorithm, the multi-core processor can efficiently distribute and manage the workload of each module to ensure seamless collaboration between the modules.

[0093] The memory management unit is responsible for managing the system's memory resources, including random access memory (RAM) and read-only memory (ROM). The memory management unit ensures that each module can quickly access the required data and instructions through address mapping and memory allocation strategies, while preventing memory conflicts and data leakage. In addition, the memory management unit also supports virtual memory technology, allowing the system to manage and use memory resources more flexibly.

[0094] The peripheral control interface is a bridge for the central processing unit module 101 to communicate and exchange data with other modules. Through a series of high-speed interfaces (such as PCIe, USB, Ethernet interface, etc.), the central processing unit module can receive and send data in real time, and perform efficient data interaction with the industrial protocol analysis module 102, the anomaly detection module 103, the security policy execution module 104, the encryption communication module 105, the firmware security module 106, the physical isolation module 107 and the centralized management interface module 108. Each interface has independent control logic and buffer to ensure the stability and reliability of data transmission.

[0095] The clock management unit provides accurate clock signals for the CPU module 101 and the modules connected to it. The clock management unit generates clock signals of different frequencies through programmable clock sources and clock dividers to meet the different clock frequency requirements of each module. Accurate clock management not only ensures the synchronous operation of the system, but also improves the accuracy and reliability of data processing.

[0096] The security policy engine is a key functional unit of the CPU module 101, responsible for executing predefined security policies. The security policy engine dynamically adjusts the execution of security policies based on the data from the anomaly detection module 103 and the real-time status of the system. Specifically, the security policy engine includes a policy parser, a policy executor, and a policy optimizer. The policy parser parses the security policy received by the CPU and generates corresponding execution instructions; the policy executor coordinates each module to execute specific security measures based on the parsing results; the policy optimizer continuously optimizes and adjusts the policy by continuously monitoring the execution effect of the security policy to cope with the ever-changing security threats.

[0097] In addition, the CPU module 101 also integrates advanced power management functions, through dynamic voltage and frequency scaling technology (DVFS), while ensuring performance, the system power consumption is minimized. Through intelligent power management strategies, the CPU module can automatically adjust the power consumption state under different workloads to achieve efficient energy utilization.

[0098] The design and implementation of the CPU module 101 enables the industrial Internet security hardware device to provide efficient and reliable security protection in complex and changing industrial environments. Under the coordination of the CPU, each module forms an organic whole to jointly maintain the security and stability of the industrial Internet.

[0099] More specifically, the central processing unit module includes a multi-core processor architecture, and each core is responsible for different types of security policy execution to improve system response speed and processing efficiency.

[0100] Multi-core processor architecture means that the CPU module consists of multiple independent processing cores, each of which can independently perform computing tasks. This parallel processing capability significantly improves the overall performance and flexibility of the system.

[0101] In this architecture, each processing core is specifically configured to enforce a specific type of security policy. For example, a core may be responsible for access control policies, ensuring that only authorized devices and users can access network resources. The core continuously monitors access requests and verifies and authorizes them according to preset security rules. Once unauthorized access attempts are detected, they are immediately blocked.

[0102] Another processing core may be dedicated to data encryption and decryption operations. This core handles all data that needs to be encrypted for transmission, using national encryption algorithms such as SM2, SM3, and SM4 for encryption operations. By having a dedicated core handle these computationally intensive tasks, the system can ensure the confidentiality and integrity of the data without affecting the operation of other functions. In addition, when it is necessary to decrypt the received data, this core is also responsible for performing the corresponding decryption operations to ensure that the data can be correctly read and used after entering the system.

[0103] Another processing core may be dedicated to real-time monitoring and analysis of network traffic. This core uses a variety of network traffic analysis algorithms to continuously monitor the flow of packets in the network and detect abnormal traffic patterns, such as potential DDoS attacks, unauthorized port scans, or other suspicious activities. When abnormal traffic is detected, the core immediately generates alerts and takes preventive measures, such as temporarily isolating the affected part of the network or limiting the bandwidth of suspicious traffic.

[0104] In addition, to improve the flexibility and adaptability of the system, a processing core may be dedicated to policy optimization and dynamic adjustment. This core optimizes existing security policies and rules based on real-time data and analysis results. For example, it adjusts access control policies or updates encryption algorithm parameters based on the latest threat intelligence and attack patterns. Through this dynamic optimization, the system can continuously adapt to the changing security environment and improve overall security.

[0105] The multi-core processor architecture also allows the CPU module to balance the task load. When the task load of a core is too high, the system can dynamically adjust and transfer some tasks to other cores for execution. Through this load balancing mechanism, the system can avoid overloading a single core and improve overall operating efficiency and stability.

[0106] In order to ensure the coordination between the cores, an efficient communication mechanism is integrated inside the CPU module. This communication mechanism is usually based on a cache consistency protocol and a low-latency interconnect architecture to ensure that the cores can exchange information and data quickly and reliably. For example, when the network traffic monitoring core detects suspicious activity, it can quickly notify the core responsible for access control, which immediately implements the corresponding security measures.

[0107] This multi-core processor architecture not only improves the system's response speed and processing efficiency, but also enhances the system's security and reliability. By processing different types of security tasks with dedicated cores, the system can provide strong security without affecting overall performance. At the same time, through dynamic optimization and task load balancing, the system can continuously adapt to changing network environments and security threats.

[0108] The industrial protocol analysis module 102 is connected to the central processing unit module and is used to analyze various industrial communication protocols and transmit the analysis results to the abnormality detection module. The implementation of this module needs to meet the analysis requirements of various industrial protocols to ensure the accuracy and real-time performance of the data.

[0109] The industrial protocol parsing module 102 first includes a protocol identification unit, which can automatically identify the protocol type used by the received data packet. By analyzing the header information of the data packet, the identification unit can determine which industrial protocol the data packet uses, such as Modbus, OPC UA, PROFINET or EtherCAT. This identification process uses a predefined protocol feature library to quickly and accurately determine the protocol type by comparing the feature fields in the data packet.

[0110] After identifying the protocol type, the parsing module calls the corresponding protocol parser. Each protocol parser is designed for a specific protocol and can accurately parse the data structure of the protocol. The parser will gradually parse each field of the data packet. For example, when parsing the Modbus protocol, it will extract the function code, register address, data value, etc.; when parsing the OPC UA protocol, it will extract the node ID, attribute value, timestamp, etc. Through these parsing operations, the original binary data is converted into structured data with clear meaning.

[0111] In order to improve the parsing efficiency, the industrial protocol parsing module 102 adopts multi-threaded parallel processing technology. By allocating the received data packets to different threads for parsing, the parsing module can process multiple data packets at the same time, greatly improving the parsing speed. Each thread has its own parsing buffer to ensure the accuracy and integrity of data parsing under high concurrency.

[0112] After the parsing is completed, the industrial protocol parsing module 102 formats the parsing results into a standard data structure and transmits it to the anomaly detection module 103. Data transmission is achieved through a high-speed internal bus to ensure that the parsing results can be delivered to the anomaly detection module in a timely manner. The parsing results include not only the actual value of the data, but also the meta-information of the data packet, such as the receiving time, source address, etc. This information is very important for subsequent anomaly detection and analysis.

[0113] In addition, the industrial protocol parsing module 102 also has dynamic update capabilities. With the development of industrial protocols and the emergence of new protocols, the parsing module can add or update protocol parsers through hot plugging without downtime. This function is achieved through modular design. Each protocol parser is an independent plug-in that can be loaded or unloaded when the system is running. The central processing unit module 101 manages the life cycle of these plug-ins to ensure the stable operation of the system.

[0114] In order to further improve security, the industrial protocol parsing module 102 is equipped with a security detection mechanism that can identify and filter abnormal or malicious data packets. For example, for illegal operation codes, out-of-bounds access, etc. of a specific protocol, the parsing module will record these abnormal situations and report them to the central processing unit module 101 so that corresponding security measures can be taken in time.

[0115] In summary, the industrial protocol parsing module 102 achieves efficient parsing of multiple industrial communication protocols through a series of technical means such as protocol identification, precise parsing, multi-threaded parallel processing, dynamic update and security detection. Its design ensures the accuracy and real-time performance of data parsing, and provides a solid foundation for subsequent anomaly detection and security policy execution.

[0116] More specifically, the industrial protocol parsing module uses a reconfigurable hardware architecture, including a protocol identification engine, a dynamic loading unit, and a protocol optimizer. This design aims to enhance the flexibility and adaptability of the system, so that it can efficiently parse multiple industrial communication protocols and optimize according to real-time network conditions.

[0117] The protocol identification engine is the core part of the industrial protocol parsing module, responsible for automatically identifying unknown industrial protocols. Its implementation includes analyzing the header information of the data packet and determining the specific protocol type used by the data packet by comparing it with the preset protocol feature library. The protocol identification engine uses advanced pattern matching algorithms and can handle various complex protocol features. For example, when a data packet arrives, the protocol identification engine extracts the key fields of the data packet, such as protocol version, identifier, etc., and compares these fields with the known protocols in the feature library. In this way, the system can quickly identify the protocol type to which the data packet belongs. Even if it is a new protocol type or one that is not recorded in the feature library, the protocol identification engine can infer and annotate it through machine learning algorithms, thereby realizing the identification of unknown protocols.

[0118] The design of the dynamic loading unit makes the industrial protocol parsing module extremely flexible and scalable. The dynamic loading unit can hot-load new protocol parsing plug-ins without interrupting the system operation. The implementation of this function relies on the modular design concept. The parser of each protocol is encapsulated as an independent plug-in, and these plug-ins can be dynamically loaded or unloaded as needed when the system is running. In the specific implementation process, the dynamic loading unit will first obtain the resource location of the relevant plug-in from the central processing unit module when receiving a new protocol parsing requirement, and then pass the security authentication and integrity verification to ensure the legitimacy and security of the plug-in. After passing the authentication, the dynamic loading unit uses memory management technology to load the plug-in into the specified memory area and call the initialization function to start the plug-in. This design not only greatly improves the adaptability of the system, but also reduces the downtime caused by system restart or update.

[0119] The protocol optimizer is responsible for automatically adjusting the protocol parsing strategy according to the real-time network traffic characteristics to improve the parsing efficiency. The protocol optimizer continuously monitors the network traffic, collects the characteristic information of various data packets, such as packet size, transmission frequency, protocol distribution, etc., and uses this information to adjust the parsing strategy. For example, when a significant increase in the packet traffic of a certain protocol is detected, the protocol optimizer can adjust the resource allocation of the parsing engine to give priority to the packets of this protocol, thereby ensuring the parsing efficiency of the system. The protocol optimizer can also pre-configure and optimize the parsing strategy based on historical data and prediction algorithms to ensure that the system can still operate efficiently during peak traffic. In addition, the protocol optimizer also has self-learning capabilities. By continuously analyzing and summarizing network traffic characteristics, optimizing parsing algorithms and strategies, the system can adapt to the changing network environment.

[0120] Furthermore, the implementation process of the protocol identification engine includes:

[0121] First, the characteristic vector of the protocol in the data packet is obtained by formula (1): :

[0122] ;

[0123] in: Indicates These basic characteristics include:

[0124] Header field length: The byte length of each field in the packet header.

[0125] Protocol version: The field value in the protocol header that indicates the protocol version.

[0126] Message Type: The value of the field in the protocol that indicates the message type.

[0127] Timestamp: The time when the packet is sent or received.

[0128] Indicates These complex features include:

[0129] Entropy value of the data packet : Calculated based on the frequency of occurrence of each byte value in the data packet.

[0130] Byte frequency distribution : Calculated based on the uniformity of the frequency of occurrence of each byte value.

[0131] Standard deviation of packet length : Indicates the variation of the data packet length.

[0132] Correlation between header fields : Indicates the differences between the field values ​​in the packet header.

[0133] Distribution characteristics of serial numbers : Indicates the incremental change of the data packet sequence number.

[0134] The specific calculation method is as follows:

[0135] Entropy value of the data packet Calculate according to the following formula (2):

[0136] ;

[0137] in, For the The frequency of occurrence of the byte value, that is, The number of times the byte value appears in the packet divided by the total number of bytes in the packet. The total number of possible byte values, usually 256 (ie, byte values ​​from 0 to 255).

[0138] Byte frequency distribution Calculate according to the following formula (3):

[0139] ;

[0140] in, For the The frequency of occurrence of byte values; Ideally, the byte values ​​have uniform frequency distribution.

[0141] Standard deviation of packet length Calculate according to the following formula (4):

[0142] ;

[0143] in, For the The length of the data packet. is the average value of the packet length, and the calculation formula is:

[0144] ;

[0145] The total number of packets.

[0146] Correlation between header fields It is obtained by calculating the difference between the values ​​of each field in the packet header. The specific formula is as follows (5):

[0147] ;

[0148] in, is the number of basic features, and Respectively and The value of a basic feature (which can be a header field of a basic feature);

[0149] Distribution characteristics of serial numbers Calculate according to the following formula (6):

[0150] ;

[0151] in, For the The sequence number of the packet. For the The sequence number of the packet. The total number of packets.

[0152] After obtaining the feature vector Then, protocol matching is performed according to the following formula (7):

[0153] ;

[0154] in, Represents the current data packet feature vector Compared with the protocol feature vector in the known protocol feature library The weighted Euclidean distance of . is the number of basic features. is the number of complex features. For the The weight of a basic feature reflects the importance of the feature in the matching process. For the The weight of a complex feature reflects the importance of the feature in the matching process. and They are the current data packet and the first The value of the basic feature. and They are the current data packet and the first The value of a complex feature.

[0155] When calculated Less than the preset threshold , it is determined to be a known protocol; otherwise, it is marked as an unknown protocol, and the dynamic loading unit is notified to hot load a new protocol parsing plug-in.

[0156] The dynamic loading unit is specifically used to implement the hot loading process of the new protocol parsing plug-in. This process includes several key steps, registering the new protocol parsing plug-in through the centralized management interface module, mapping the new protocol parsing plug-in to the system memory, and executing the hot loading command under the coordination of the central processing unit module.

[0157] First, when a new protocol parsing plug-in needs to be introduced, the plug-in must first be registered through the centralized management interface module. The centralized management interface module is a bridge for the system to interact with the upper management platform. Through this module, the system administrator can upload the new protocol parsing plug-in and perform necessary preliminary verification. During the registration process, the administrator needs to provide relevant information about the plug-in, such as the plug-in name, version number, developer information, and function description. This information will be stored in the system's plug-in management database for subsequent management and call.

[0158] After registration is complete, the next step of the dynamic loading unit is to map the new protocol parsing plug-in to the system memory. To ensure the safety and stability of this process, the dynamic loading unit first performs an integrity check and security scan on the new plug-in to confirm that the plug-in has not been tampered with and does not contain malicious code. After passing these checks, the dynamic loading unit allocates memory space for the plug-in and loads the plug-in's code and data into the allocated memory area. This process involves memory management techniques, including address space allocation, memory mapping, and page locking, to ensure that the plug-in can run stably and be accessed by other parts of the system.

[0159] After the memory mapping is completed, the dynamic loading unit needs to activate the new plug-in by executing the hot loading command under the coordination of the CPU module. The key to this step is to use a specific system command `LoadPlugin(PluginID)`, where `PluginID` is the unique identifier of the new protocol parsing plug-in. In the system, `PluginID` is used to uniquely identify each plug-in to avoid conflicts and confusion. When the dynamic loading unit receives the load command, it will look up the corresponding plug-in information according to `PluginID` and execute the plug-in initialization process.

[0160] During the initialization process, the dynamic loading unit calls the initialization function of the plug-in, passing the necessary parameters and environment variables so that the plug-in can correctly set up its own operating environment. The initialization function usually includes operations such as loading dependent libraries, setting internal states, and registering callback functions. Through these operations, the plug-in can establish a connection with the rest of the system and is ready to handle the actual protocol parsing tasks.

[0161] The entire hot loading process is monitored and coordinated by the CPU module. The CPU module is responsible for scheduling system resources, handling exceptions, and providing necessary support to ensure the smooth progress of the hot loading process. If any errors occur during the loading process, the CPU module will record the error log and try to perform a rollback operation to restore the system to a stable state. At the same time, the CPU module will also perform a series of health checks after the loading is completed to ensure that the new plug-in functions normally, and send the loading results and status reports to the upper management platform.

[0162] Through the above detailed steps, the function of the dynamic loading unit can be implemented to ensure the safe and efficient hot loading of new protocol parsing plug-ins without interrupting system operation. This not only improves the flexibility and scalability of the system, but also enhances the system's responsiveness to emerging protocols and security threats.

[0163] Furthermore, the protocol optimizer is specifically used for:

[0164] First, the protocol optimizer records the number of packets for each protocol while monitoring network traffic in real time. and flow rate .in:

[0165] Indicates a specific protocol The number of packets received during the monitoring period that belong to the protocol The total number of packets.

[0166] Indicates a specific protocol The traffic volume of the protocol received during the monitoring period The total number of bytes in all packets.

[0167] Then, the protocol optimizer calculates the priority of each protocol according to the following formula (8): :

[0168] ;

[0169] In this formula:

[0170] Indicates a specific protocol priority.

[0171] , and The weight coefficient is used to adjust the impact of the number of protocols and traffic volume on the priority. These coefficients are set by the system administrator according to actual needs to ensure the reasonable weight of different factors.

[0172] is the sum of the number of packets of all protocols, that is, the total number of all packets in the monitoring period. q is the sequence number of the protocol packet, is the number of packets of protocol q.

[0173] It is the sum of the traffic sizes of all protocols, that is, the total number of bytes of all data packets during the monitoring period. is the traffic size of protocol q.

[0174] is the total number of protocols.

[0175] Through the above formula, the protocol optimizer can comprehensively consider the number of packets and traffic size of each protocol and calculate the relative priority. The specific calculation process is as follows:

[0176] Part I Indicates a specific protocol The proportion of the number of packets of all protocols to the total number of packets of all protocols. This part reflects the protocol Importance in terms of number of packets.

[0177] Part 2 Indicates a specific protocol The proportion of the traffic size of all protocols to the total traffic size of all protocols. This part reflects the protocol Importance of traffic volume.

[0178] Part 3 Indicates a specific protocol The ratio of the product of the number of packets and the traffic size of the protocol to the total product of the number of packets and the traffic size of all protocols. This part reflects the The combined importance of the number of packets and the size of the traffic.

[0179] Based on the calculated priority , the protocol optimizer can dynamically adjust the protocol parsing order and resource allocation. For example, the system can increase the parsing frequency of high-priority protocols and allocate more computing resources to ensure that the data packets of these protocols can be parsed in time. At the same time, for protocols with lower priority, the system can appropriately reduce their parsing frequency or delay their parsing time to ensure the optimal configuration and efficient use of overall system resources.

[0180] The anomaly detection module 103 is a key component of the present invention. It is responsible for receiving data from the industrial protocol analysis module 102, and detecting abnormalities in network traffic and device behavior in real time based on these data, and transmitting the detection results to the central processing unit module. The implementation of the anomaly detection module is based on the edge computing architecture, and works in conjunction with the central processing unit module to localize and analyze the massive industrial data transmitted from the industrial protocol analysis module. This enables it to efficiently process and analyze massive industrial data, ensuring rapid response and localized processing.

[0181] The module first includes a data receiving unit, which receives structured data and meta-information from the industrial protocol parsing module. These data include the parsed industrial protocol data packet, the timestamp of the data packet, the source address, etc. The data receiving unit adopts an efficient caching mechanism to ensure that the data can be transmitted to the subsequent processing unit in real time without delay.

[0182] After receiving the data, the anomaly detection module will pass the data to the preprocessing unit. The preprocessing unit is responsible for preliminary screening and cleaning of the data, such as removing noise data and filling missing values. This process uses a series of preprocessing algorithms, including mean substitution and median filtering, to ensure the quality of data input to the anomaly detection model.

[0183] After preprocessing, the data enters the feature extraction unit. The feature extraction unit uses a variety of algorithms to perform feature analysis on the data and extract key features for anomaly detection. These features include statistical characteristics of the data packet (such as mean value, standard deviation), timing characteristics (such as packet interval time) and content characteristics (such as the frequency distribution of specific fields). The feature extraction unit uses sliding window technology to divide the real-time data into multiple time slices, and the features extracted in each time slice are used for subsequent anomaly detection.

[0184] The feature-extracted data is fed into the anomaly detection engine, which is the core of the entire module. The engine is based on a variety of machine learning algorithms and statistical methods, including but not limited to anomaly detection models (such as isolation forests, support vector machines), cluster analysis (such as K-means), and rule-based detection methods (such as logistic regression, decision trees). These algorithms work together to identify potential abnormal behaviors by comparing real-time data features with historical normal data patterns. For example, the isolation forest algorithm isolates abnormal points by building a tree structure, and the K-means clustering algorithm determines anomalies by identifying points that are far away from the center point.

[0185] When the anomaly detection engine identifies an anomaly, an anomaly event is generated and passed to the decision processing unit. The decision processing unit classifies and prioritizes the anomaly events to determine their severity and scope of impact. For high-risk anomalies, the decision processing unit immediately triggers predefined emergency response measures, such as isolating the affected network area, sending alarm notifications, etc. For low-risk anomalies, the system records the event and performs detailed analysis to optimize the detection model and strategy later.

[0186] In addition, the anomaly detection module 103 also includes a learning and updating unit, which improves the detection accuracy and adaptability of the system through continuous learning and model updating. It regularly obtains feedback information and new training data from the central processing unit module 101, updates the existing anomaly detection model and feature extraction algorithm, and ensures that the system can cope with the ever-changing network environment and security threats.

[0187] The implementation of the anomaly detection module is based on the edge computing architecture, which enables it to efficiently process and analyze massive amounts of industrial data, ensuring fast response and localized processing. The core of this architectural design is to sink data processing capabilities to the edge of the network, that is, close to the data source, instead of transmitting all data to a central server for processing.

[0188] In the specific implementation, the anomaly detection module is first deployed on edge devices close to the data generation point. These devices may include sensor nodes in industrial control systems, PLCs (programmable logic controllers), etc. Through this deployment method, data can be processed locally at the moment of generation, reducing the delay of data transmission and improving the response speed.

[0189] After the data is transmitted from the industrial protocol parsing module 102, the anomaly detection module immediately starts preprocessing. This step includes data cleaning, format conversion, and preliminary screening to ensure the accuracy of subsequent analysis. After the preprocessing is completed, the data is sent to the local anomaly detection algorithm for further analysis. Anomaly detection algorithms usually include machine learning models and statistical analysis methods, such as time series analysis, cluster analysis, and classification algorithms. These algorithms have been pre-trained and deployed on edge devices and can perform calculations and judgments immediately when new data is received.

[0190] Due to the edge computing architecture, the anomaly detection module is able to use local computing resources for real-time analysis. Edge devices usually have certain computing capabilities, such as multi-core processors or dedicated acceleration chips, which can process multiple data streams in parallel to improve processing efficiency. During the detection process, the module calculates various key indicators, such as traffic characteristics, operation modes, and device behaviors, and quickly identifies abnormal situations by comparing them with normal patterns.

[0191] Once an anomaly is detected, the anomaly detection module will immediately transmit the result to the central processing unit module 101 and trigger local emergency response measures. These emergency measures may include alarm notification, isolation of suspicious devices or adjustment of network traffic. Through this localized processing method, the system can respond to potential threats in the first place and avoid untimely responses caused by data transmission delays.

[0192] In addition, the edge computing architecture allows the anomaly detection module to dynamically adjust the analysis model and strategy according to environmental changes. The module can regularly obtain the latest model updates and strategy adjustments from the central processor module 101, and continuously improve the accuracy and robustness of detection through local incremental learning and model optimization. In this way, the anomaly detection module can not only adapt to the ever-changing industrial environment, but also continuously improve its performance and efficiency.

[0193] Another advantage of edge computing architecture is data privacy and security. Since most of the data processing is done locally, only the test results and necessary metadata need to be transmitted to the central server, which can greatly reduce the risk of sensitive data being transmitted on the network. In addition, local data processing and storage also make it easier to comply with data privacy protection regulations and ensure the data security of enterprises.

[0194] Furthermore, the anomaly detection module includes:

[0195] The feature extraction unit is used to calculate the feature value and the frequency feature value from the received current data packet, and the feature value is calculated according to the following formula (9):

[0196] ;

[0197] in, Indicates the characteristic value of the current data packet; Indicates that the current The features of the data packet include the data packet size, source IP address, destination IP address and timestamp;

[0198] Packet size: The number of bytes in the packet.

[0199] Source IP address: The source IP address of the data packet, usually converted into numerical form.

[0200] Destination IP address: The destination IP address of the data packet, also converted into numerical form.

[0201] Timestamp: The time when the packet is sent or received.

[0202] Indicates These weight coefficients are pre-set by the system and are used to adjust the importance of each feature in the overall calculation.

[0203] Represents the total number of features in the packet, that is, the number of all features included in the calculation.

[0204] In calculating the eigenvalue After that, the feature extraction unit continues to calculate the frequency feature value :

[0205] ;

[0206] in, Indicates the frequency characteristic value of the current data packet; Indicates that the current data packet is in The frequency characteristics of the current data packet include:

[0207] Number of repetitions of a data packet: the number of times the data packet reappears within a certain time window.

[0208] Occurrence frequency of a protocol type: The frequency with which the protocol type appears within a certain time window.

[0209] Indicates These weights are used to adjust the importance of each frequency feature in the overall calculation.

[0210] Represents the total number of frequency features, that is, the number of all frequency features included in the calculation.

[0211] and To adjust the parameters, the specific values ​​are pre-set by the system to control the degree of nonlinearity in the calculation of the frequency eigenvalues.

[0212] The anomaly scoring unit is used to calculate the anomaly score S of each data packet based on the extracted feature value and frequency feature value, and the anomaly score S is calculated by the following formula (11):

[0213] ;

[0214] in, It indicates the historical mean of the characteristic value of the data packet, which is obtained by statistically calculating the characteristic values ​​of all data packets in the past period of time.

[0215] It indicates the historical mean of the frequency characteristic value of the data packet, which is obtained by statistically calculating the frequency characteristic values ​​of all data packets in the past period of time.

[0216] , are adjustment coefficients, which are used to adjust the impact of eigenvalues ​​and frequency eigenvalues ​​on anomaly scores.

[0217] and is the adjustment coefficient, which is used to control the influence of the deviation between the characteristic value and the historical mean.

[0218] The calculated abnormality score S is compared with the preset threshold T. When S exceeds T, an abnormality alarm signal is generated and transmitted to the central processing unit module.

[0219] The security policy execution module 104 plays a crucial role in the present invention. It is responsible for implementing various security policies and control measures based on the output from the anomaly detection module 103 to ensure the security and stability of the system. This module works closely with the central processing unit module 101 to ensure that all security policies can be executed efficiently and respond to network security threats in a timely manner.

[0220] When the anomaly detection module 103 detects anomalies in network traffic or device behavior, it generates corresponding detection results and transmits them to the central processing module 101. After receiving these results, the central processing module triggers the response mechanism of the security policy execution module 104 according to the predefined security policy.

[0221] The security policy execution module 104 first includes a policy parsing unit. After receiving the security policy command from the central processing unit, this unit will parse the command. The parsing unit converts the security policy command into a specific operation instruction through the built-in policy library and rule set. For example, when an abnormal access behavior of a device is detected, the policy parsing unit will generate an instruction to block access to the device.

[0222] Then, these operation instructions are transmitted to the policy execution unit. The policy execution unit is the core part of the security policy execution module 104, which is responsible for actually executing various security measures. According to different security policies, the policy execution unit may take the following measures: blocking specific IP addresses or ports, disconnecting the network connection of a certain device, adjusting firewall rules, limiting data transmission bandwidth, etc. These operation instructions are quickly implemented in various parts of the system through an efficient execution mechanism to ensure that security threats can be dealt with in a timely manner.

[0223] In order to ensure the effectiveness and accuracy of policy execution, the policy execution unit is also equipped with a feedback mechanism. The mechanism monitors the execution of the security policy in real time and feeds back the execution results to the central processor module 101. For example, after blocking an IP address, the feedback mechanism checks whether the IP address is actually blocked successfully and reports the result to the central processor module. If problems are found in the policy execution process, such as the instruction failed to be successfully executed or the execution effect is not ideal, the central processor module will adjust or reissue the instruction based on the feedback information.

[0224] In addition, the security policy execution module 104 also includes a log recording unit. Each time a security policy is executed, the log recording unit will record in detail the time of the operation, the executed policy, the target device or network area, the execution result and other information. These log data are not only used for post-audit and analysis, but also provide valuable data support for system optimization. By analyzing the log records, the central processing unit module and the upper management platform can continuously optimize the security policy and improve the overall security level of the system.

[0225] In order to cope with the ever-changing security environment, the security policy execution module 104 is designed with a dynamic update mechanism. By cooperating with the centralized management interface module 108, the security policy execution module can receive the latest security policy and rule updates from the upper-level security management platform. These updates can be new policy rules, optimized execution methods, or countermeasures against the latest threats. The dynamic update mechanism ensures that the security policy execution module always maintains the best status and can respond to new security threats in a timely manner.

[0226] To summarize, the security policy execution module 104 achieves comprehensive protection of industrial Internet security hardware devices through a series of technical means such as policy analysis, policy execution, feedback mechanism, log recording and dynamic update.

[0227] More specifically, the security policy execution module includes a policy conflict detection unit, which is used to detect and resolve potential conflicts between multiple security policies in real time.

[0228] First, the policy conflict detection unit obtains and loads all currently effective security policy rules from the central processing unit module. These security policy rules include access control, traffic filtering, data encryption and other aspects to ensure the safe operation of all parts of the system. The policy conflict detection unit obtains these policy rules in real time through the communication interface with the central processing unit module, and stores and manages them locally for subsequent conflict detection.

[0229] Next, the policy conflict detection unit needs to define conflict detection rules. These rules are used to identify and determine possible conflicts between security policies. For example, when one policy allows a certain type of data flow to pass through, while another policy prohibits the same type of data flow, there is a conflict. Conflict detection rules compare and analyze different security policies based on predefined logic and conditions to identify potential conflict points.

[0230] During actual operation, the policy conflict detection unit monitors the execution of security policies in real time. It collects and analyzes real-time data from the system, checks each security policy being executed, and matches it with all currently loaded policy rules. Through this rule matching, the detection unit can quickly find potential conflicts. For example, if a policy attempts to open a port for specific traffic, but another policy attempts to close the port at the same time, the detection unit will identify this conflict.

[0231] Once a conflict is detected, the policy conflict detection unit immediately generates a conflict report. This report records in detail the type of conflict, the policies involved, the specific terms of the conflict, and other information, and sends the report to the central processing module through the system interface. After receiving the conflict report, the central processing module can quickly understand the details of the conflict and decide on the next step of handling measures.

[0232] To resolve policy conflicts, the policy conflict detection unit automatically resolves conflicts based on predefined priority rules or manual intervention mechanisms. Priority rules are set in advance by the system administrator to determine which policy should be executed first in case of a conflict. For example, data security policies can be set to take precedence over access control policies, or the priority of policies can be determined based on the security level. Based on these priority rules, the policy conflict detection unit can automatically adjust the execution order of conflicting policies or modify the policy content to eliminate the conflict.

[0233] In some cases, automatic resolution may not be applicable and manual intervention is required. At this time, the policy conflict detection unit will notify the system administrator and provide detailed conflict information and recommended solutions, so that the administrator can make adjustments and decisions based on the actual situation.

[0234] Finally, the policy conflict detection unit updates the security policy rules to reflect the latest status after resolving the conflict. This includes modifying or deleting conflicting policies, adding new policy rules, etc. The updated security policy rules are loaded into the system again to ensure the stability and consistency of subsequent policy execution.

[0235] Furthermore, the security policy execution module includes an emergency response unit. When a high-risk anomaly is detected, the emergency response unit can automatically initiate a preset emergency measure.

[0236] The emergency response unit first works with the anomaly detection module. When the anomaly detection module identifies a high-risk anomaly in the system, such as a major security vulnerability, malicious attack, or other emergency, the anomaly detection module will immediately trigger an emergency response signal. This signal is transmitted to the emergency response unit through the high-speed communication interface inside the system, causing it to immediately enter a response state.

[0237] After receiving the emergency response signal, the emergency response unit will load the corresponding emergency measures from the preset emergency response database. The emergency response database is pre-defined by the system administrator according to different types of high-risk anomalies. Each emergency measure contains detailed operation steps and strategies, such as how to isolate the infected network part, shut down specific services, and prevent the spread of threats.

[0238] After loading the emergency measures, the emergency response unit will automatically execute these measures. Specifically, they include the following aspects:

[0239] 1. Isolate the infected network section: The emergency response unit will isolate the infected network area from other parts by controlling network switches and firewalls to prevent the threat from spreading. For example, disconnect specific ports or isolate infected devices in a separate virtual local area network (VLAN).

[0240] 2. Shut down specific services: To prevent the attack from further expanding, the emergency response unit will shut down specific services and processes according to preset emergency measures. This may include stopping certain network services and shutting down vulnerable applications, thereby reducing system exposure and preventing attackers from further exploiting vulnerabilities to cause damage.

[0241] 3. Start the backup system: In certain high-risk abnormal situations, such as data corruption or service unavailability, the emergency response unit will start the backup system to ensure the continuity of critical business. The startup of the backup system includes restoring data from the pre-defined backup server and switching to the backup hardware facilities to ensure that the system can continue to operate.

[0242] In the process of executing emergency measures, the emergency response unit will record the execution of each step and the current system status in real time. These recorded data are transmitted to the central processing module through the internal interface, and the central processing module analyzes and processes these data and generates a comprehensive status report.

[0243] In addition, the emergency response unit will also send the execution status and status report to the upper-level security management platform simultaneously. In this way, upper-level managers can monitor the progress of emergency response in real time, understand the current security status of the system, and intervene and make decisions when necessary. The status report usually includes detailed information such as the execution steps of emergency measures, the current network and system status, existing problems and follow-up suggestions.

[0244] The encryption communication module 105 is integrated with the security policy execution module, supports the national encryption algorithm, and is used to encrypt and transmit industrial data under the control of the security policy execution module.

[0245] The encryption communication module 105 is one of the key components in the present invention, which is designed to ensure the confidentiality, integrity and non-repudiation of industrial data during transmission. This module is tightly integrated with the security policy execution module 104, and can encrypt industrial data according to the preset security policy, support the national cryptographic algorithm (national cryptographic algorithm), and meet the localization security requirements.

[0246] First, the encryption communication module 105 includes a key management unit, which is responsible for generating, distributing and storing encryption keys. The key management unit uses a secure hardware module (such as TPM or HSM) to protect the security of the key and prevent unauthorized access and leakage. During the key generation process, national secret algorithms such as SM2, SM3, SM4, etc. are used to ensure the strength and security of the key. When the key is distributed, the key is passed to the two communicating parties that need to be encrypted through a secure channel, and the key is replaced regularly to increase security.

[0247] When data needs to be encrypted for transmission, the encryption engine of the encryption communication module 105 will first obtain the corresponding encryption key from the key management unit. The encryption engine uses the national secret algorithm to encrypt the data, for example, using the SM4 algorithm to symmetric encrypt the data. The encryption process includes steps such as data segmentation, encryption operation and data splicing. The encryption engine can process a large amount of data in a short time through hardware acceleration technology, ensuring the efficiency and real-time performance of the encryption process.

[0248] After the data encryption is completed, the encryption communication module 105 will send the encrypted data packet to the communication link. In order to ensure the integrity and non-repudiation of the data, the encryption communication module will attach a hash value generated by the SM3 algorithm to the data packet. This hash value is calculated based on the original data and can be verified at the data receiving party to ensure that the data has not been tampered with during the transmission process. After the receiving party receives the encrypted data, it uses the previously shared key to decrypt it through the corresponding decryption engine and key management unit, and uses the attached hash value to verify the integrity of the data.

[0249] The encryption communication module 105 also includes a security policy control unit, which dynamically adjusts the encryption communication policy according to the instructions of the security policy execution module 104. For example, the control unit can select different encryption algorithms and key lengths according to different security requirements, or immediately switch to a higher level of encryption mode when a potential security threat is detected. The control unit communicates with the central processing unit module 101 in real time to ensure rapid response and effective implementation of security policies.

[0250] In addition, the encryption communication module 105 is highly configurable and flexible. The system administrator can configure and manage the parameters of the encryption communication module through the centralized management interface module 108, including the key update frequency, encryption algorithm selection, encryption strength setting, etc. The centralized management interface module passes these configuration commands to the encryption communication module to ensure that the system can be dynamically adjusted according to actual needs to provide the best security performance.

[0251] In practical applications, the encryption communication module 105 can be used not only for data transmission encryption between devices, but also for protecting data flow within the system, such as communication data between modules, log data transmission, etc. Through comprehensive encryption protection measures, the encryption communication module significantly improves the security of the entire industrial Internet security hardware device and ensures the secure transmission of data in a complex network environment.

[0252] In summary, the encryption communication module 105 achieves comprehensive protection of industrial data through a series of technical means such as key management, data encryption, integrity verification and security policy control.

[0253] The firmware security module 106 is one of the key components in the present invention, which is designed to ensure the security and integrity of the system during startup and operation. This module is closely connected to the central processing unit module 101, and through a series of complex security mechanisms, it realizes the secure startup, integrity verification and continuous monitoring of the firmware.

[0254] When the system starts, the firmware security module 106 first performs a secure boot process. The secure boot process starts with a trusted root, the Root of Trust. This trusted root is usually an immutable code stored in hardware to ensure that the system starts from a secure and tamper-proof state. The firmware security module starts from the trusted root and gradually verifies each firmware component in the boot process. At the beginning of the boot, the firmware security module loads the initial boot code (Bootloader) and verifies its digital signature. The verification process uses a pre-stored public key to ensure that the Bootloader has not been tampered with. After verification, the Bootloader takes over control and continues to load and verify subsequent firmware components, including the operating system kernel and key system services.

[0255] During the entire boot process, the firmware security module 106 uses integrity verification technology based on cryptographic hash functions. Before loading, each firmware component will calculate its hash value and compare it with the pre-stored correct hash value. If the hash value matches, it means that the firmware has not been tampered with and the boot process continues; otherwise, the system will stop booting and generate an alarm message to notify the system administrator to check and repair. Through this step-by-step verification method, the firmware security module ensures that every step of the system boot process is credible and prevents malware or unauthorized code from being loaded into the system.

[0256] During system operation, the firmware security module 106 continuously monitors the integrity of the system. The module periodically performs integrity checks on key system files and key data structures in memory, calculates their hash values ​​and compares them with the initial state. If any inconsistency or anomaly is detected, the firmware security module immediately records the event log and triggers a security response mechanism. The response mechanism may include isolating the affected system part, restarting the system, or notifying the CPU module to take further measures.

[0257] In order to enhance the security of the system, the firmware security module 106 also integrates a real-time monitoring function. This function identifies potential security threats through real-time analysis of system behaviors and events. For example, the firmware security module can monitor behavioral features such as system calls, file access patterns, network traffic, and compare them with predefined security policies and behavioral models to identify abnormal behaviors. When an abnormality is detected, the module will immediately take corresponding security measures, such as blocking suspicious processes, restricting network access, or launching a detailed security audit.

[0258] The firmware security module 106 also supports a secure update mechanism for the firmware. When a firmware update is required, the update package is sent to the system via an encrypted transmission channel and verified by the firmware security module. The integrity and source of the update package are confirmed by a digital signature to ensure that the update package has not been tampered with and comes from a trusted source. After verification, the firmware security module will securely apply the update and restart the boot process to verify the integrity of the updated system.

[0259] Through the above-mentioned detailed implementation steps and security mechanisms, the firmware security module 106 provides strong security protection for the industrial Internet security hardware device of the present invention.

[0260] The physical isolation module 107 is an important part of the present invention, which is designed to dynamically adjust the isolation state of the control network and the information network according to security requirements to ensure the security and stability of the system. This module is controlled by the central processor module 101 and uses advanced network isolation technology to flexibly respond to different security threats and operational requirements.

[0261] During the implementation process, the physical isolation module 107 first implements the basic function of network isolation through a series of hardware and software components. In terms of hardware, the module includes a high-performance network switching chip and multiple network interface cards, which can realize network connection and disconnection at the physical level. The network interface card supports a variety of communication protocols and interface standards, such as Ethernet, Fiber Channel, etc., to adapt to different network environments and equipment requirements.

[0262] In terms of software, the physical isolation module 107 integrates a software-defined network (SDN) controller and a virtual network management platform. The SDN controller monitors and manages network traffic in real time through a centralized control plane, and dynamically adjusts the network topology according to predefined security policies. The virtual network management platform provides network virtualization functions, which can create and manage multiple virtual network isolation areas at the logical level.

[0263] In specific operations, when the CPU module 101 needs to adjust the network isolation state according to the output of the anomaly detection module 103 or the predefined security policy, it will send instructions to the physical isolation module 107. After receiving the instructions, the physical isolation module first analyzes the current network state and traffic characteristics through the SDN controller to determine the network area that needs to be adjusted and the specific isolation measures.

[0264] Subsequently, the physical isolation module 107 will adjust the network connection at the physical level through the network switching chip and the network interface card. For example, the threatened network segment can be disconnected, or security devices such as firewalls can be inserted between networks to limit the flow of unsafe data. At the same time, the virtual network management platform will reconfigure the virtual network isolation area at the logical level to ensure that the logical isolation matches the physical isolation.

[0265] During the adjustment process, the physical isolation module 107 will continuously monitor the network status and obtain network traffic data and connection status information in real time through built-in monitoring sensors and traffic analysis tools. This information is not only used to verify the effectiveness of isolation measures, but also to dynamically adjust and optimize isolation strategies. For example, if an abnormal increase in traffic in an isolated area is detected, it may indicate that there is still a security threat in the area. The physical isolation module can further strengthen the isolation measures, add security equipment or expand the isolation range.

[0266] In addition, the physical isolation module 107 also supports an automated emergency response mechanism. When a serious security threat is detected, the module can automatically execute a predefined emergency isolation strategy without waiting for instructions from the central processor module 101. For example, when a large-scale network attack is detected, the physical isolation module can quickly cut off the attacked network connection to protect the security of other key network areas.

[0267] In order to ensure the manageability and traceability of isolation measures, the physical isolation module 107 integrates log recording and auditing functions. Each adjustment of the network status and isolation operation will be recorded in detail, including time, operation content, execution results, etc. These log data are not only used for post-audit and analysis, but can also be provided to the centralized management interface module 108 to interact with the upper-level security management platform to help system administrators fully understand and manage the network isolation status.

[0268] More specifically, the physical isolation module uses dynamic software-defined isolation technology, including a virtual network slicing unit, which is used to dynamically create and adjust network isolation areas according to security policies to ensure the security and flexibility of the system.

[0269] First, the virtual network slice unit receives the current security policy from the central processor module. The central processor module formulates corresponding security policies based on the system's security requirements and real-time analysis results, and transmits these policies to the virtual network slice unit through a high-speed communication interface. The security policy includes but is not limited to configuration parameters such as IP address range, bandwidth limit, and security rules.

[0270] After receiving the security policies, the virtual network slice unit defines the configuration parameters of the virtual network slice according to these policies. These configuration parameters describe the specific settings of each virtual network slice in detail, including:

[0271] IP address range: Specifies the available IP addresses in the virtual network slice, ensuring that only devices within the specific IP address range can join the network slice.

[0272] Bandwidth limit: defines the maximum bandwidth of the virtual network slice to prevent a single slice from occupying too many network resources and affecting the overall network performance.

[0273] Security rules: including access control lists (ACLs), firewall rules, traffic filtering rules, etc., to ensure that communications within the slice meet security requirements.

[0274] Next, the virtual network slice unit uses network virtualization technology to create the corresponding virtual network slice. Network virtualization technologies include software-defined networking (SDN) and network function virtualization (NFV), which allow dynamic configuration and management of network resources. The virtual network slice unit controls the SDN controller, configures virtual switches and routers, and creates an isolated virtual network environment. Each virtual network slice is assigned independent network resources and security policies to ensure that traffic between different slices is completely isolated to prevent mutual interference.

[0275] After the virtual network slice is created, the virtual network slice unit dynamically adjusts the configuration of the virtual network slice according to the real-time security requirements and network traffic conditions. This includes adding or reducing slices, adjusting the resource allocation of slices, etc. Specifically:

[0276] Increase or decrease slices: Based on the current network load and security requirements, the virtual network slice unit can dynamically create new slices or delete slices that are no longer needed. For example, when a security threat is detected in a certain network area, a new isolated slice can be created immediately and the threatened device can be migrated to that slice.

[0277] Adjusting slice resource allocation: The virtual network slice unit can adjust the bandwidth, computing resources and other configurations of each slice based on the real-time traffic analysis results to ensure the balance of resource usage among slices. For example, when the traffic of a slice suddenly increases, its bandwidth quota can be temporarily increased to cope with the peak traffic.

[0278] Finally, when the security policy changes or some slices are no longer needed, the virtual network slice unit will safely destroy the corresponding virtual network slice to release resources. The destruction process includes releasing the network configuration within the slice, releasing the allocated IP address and bandwidth, deleting related security rules, etc. In this way, the system can flexibly manage network resources, improve resource utilization, and ensure the continuous security of the system.

[0279] The centralized management interface module 108 is a key component in the present invention, which is responsible for configuration interaction and log transmission with the upper security management platform to ensure unified management and coordinated operation of the system. This module is closely connected with the central processor module 101, and realizes efficient and secure data transmission through a variety of communication protocols and interfaces.

[0280] During the implementation process, the centralized management interface module 108 first establishes a connection with the upper-level security management platform through a variety of standard communication protocols (such as SNMP, RESTful API, HTTPS, etc.). These protocols ensure the confidentiality and integrity of data during transmission, and support the interaction of various management commands and data formats. The module has a built-in protocol adapter that can automatically select and switch the appropriate communication protocol according to different management platforms and requirements.

[0281] The centralized management interface module 108 includes a configuration management unit, which is responsible for receiving and processing configuration commands sent from the upper security management platform. Configuration commands may include updating of security policies, adjustment of system parameters, enabling or disabling of module functions, etc. The configuration management unit first verifies and parses the received commands to ensure the legitimacy and integrity of the commands. Then, based on the parsing results, the corresponding configuration instructions are sent to the central processing unit module 101 for execution. In this way, the system administrator can remotely centrally manage and control the entire security hardware device.

[0282] In addition to configuration management, the centralized management interface module 108 is also responsible for the collection and transmission of log data. Each functional module generates a large amount of log data during operation, which records important information such as the system's operating status, security events, and abnormal conditions. The centralized management interface module has a built-in log collector that can collect log data from each module in real time. The log collector uses memory buffers and data compression technology to ensure fast and stable transmission of log data.

[0283] After the log data is collected, the module will pre-process and format the data to make it compatible with the upper management platform. Then, the log data will be transmitted to the upper security management platform through a secure encrypted channel for storage and analysis. In order to improve transmission efficiency, the module uses batch transmission and asynchronous transmission technology, which can minimize transmission delays while ensuring data security.

[0284] The centralized management interface module 108 also supports two-way communication, which can not only upload log data and receive configuration commands, but also obtain feedback information from the upper management platform in real time. These feedback information include system status reports, security threat warnings, optimization suggestions, etc. The module assists the central processor module 101 in policy adjustment and system optimization by analyzing the feedback information, further improving the security performance and operation efficiency of the entire device.

[0285] In order to ensure the security of data transmission and system management, the centralized management interface module 108 integrates a variety of security measures, including data encryption, identity authentication, access control, etc. Data encryption uses national secret algorithms (such as SM2, SM3, SM4, etc.) to ensure the confidentiality and integrity of data during transmission. The identity authentication mechanism uses digital certificates and two-factor authentication to prevent unauthorized access and operation. Access control is based on roles and permissions, strictly limiting the access rights of users at all levels to system resources, ensuring the standardization and security of system management.

[0286] Although the present application is disclosed as above in the form of a preferred embodiment, it is not intended to limit the present application. Any technical personnel in this field may make possible changes and modifications without departing from the spirit and scope of the present application. Therefore, the scope of protection of the present application shall be based on the scope defined by the claims of the present application.

Claims

1. Domestic industrial Internet security hardware device, characterized by: include: The central processing unit module, as the core control unit, is used to coordinate the work of other modules of the device and implement security policies; An industrial protocol parsing module, connected to the central processing unit module, for parsing a variety of industrial communication protocols and transmitting the parsing results to the anomaly detection module; The industrial protocol parsing module adopts a reconfigurable hardware architecture, including: Protocol identification engine for automatic identification of unknown industrial protocols; Dynamic loading unit, used to hot load new protocol parsing plug-ins without interrupting system operation; Protocol optimizer, which is used to automatically adjust the protocol parsing strategy according to the real-time network traffic characteristics to improve the parsing efficiency; An anomaly detection module is used to receive data from the industrial protocol analysis module; based on the received data, it detects network traffic and device behavior anomalies in real time and transmits the detection results to the central processing unit module; the anomaly detection module adopts an edge computing architecture and works in conjunction with the central processing unit module to perform local processing and analysis on the massive industrial data transmitted from the industrial protocol analysis module; The security policy execution module is triggered by the CPU module according to the output of the anomaly detection module to execute corresponding access control and security measures; An encryption communication module, integrated with the security policy execution module, supports the national encryption algorithm, and is used to encrypt and transmit industrial data under the control of the security policy execution module; A firmware security module, connected to the CPU module, is used to perform secure boot and firmware integrity verification at system startup and continuously monitor system integrity; The physical isolation module is controlled by the central processing unit module and is used to dynamically adjust the isolation status of the control network and the information network according to security requirements; The centralized management interface module is connected to the central processing unit module and is used for configuration interaction and log transmission with the upper-level security management platform.

2. The domestically produced industrial Internet security hardware device according to claim 1 is characterized in that: The central processing unit module includes a multi-core processor architecture, and each core is responsible for executing different types of security policies.

3. The domestically produced industrial Internet security hardware device according to claim 1 is characterized in that: The protocol identification engine is specifically used for: The characteristic vector of the protocol in the data packet is obtained by the following formula (1): : ； in, Indicates basic features, including header field length, protocol version, message type, and timestamp; Indicates complex features, including the entropy value of the data packet , Byte frequency distribution , standard deviation of packet length , Correlation between header fields , Distribution characteristics of serial numbers ; Entropy value of the data packet Calculate according to the following formula (2): ； in, For the The frequency of occurrence of byte values; is the total number of possible byte values; Byte frequency distribution Calculate according to the following formula (3): ； in, For the The frequency of occurrence of byte values; is the total number of possible byte values; Standard deviation of packet length Calculate according to the following formula (4): ； in, For the The length of the data packet; is the average value of the packet length; is the total number of data packets; Correlation between header fields Calculate according to the following formula (5): ； in, is the number of basic features, and Respectively and The value of the basic feature; Distribution characteristics of serial numbers Calculate according to the following formula (6): ； in, For the The sequence number of the data packet; For the The sequence number of the data packet; is the total number of data packets; Protocol matching is performed according to the following formula (7): ； in, Represents the current data packet feature vector Compared with the protocol feature vector in the known protocol feature library The weighted Euclidean distance of ; is the number of basic features; is the number of complex features; For the The weight of the basic features; For the The weight of a complex feature; and They are the current data packet and the first The value of the basic feature, and They are the current data packet and the first The value of a complex feature; When calculated Less than the preset threshold , it is determined to be a known protocol; otherwise, it is marked as an unknown protocol, and the dynamic loading unit is notified to hot load a new protocol parsing plug-in.

4. The domestically produced industrial Internet security hardware device according to claim 1 is characterized in that: The dynamic loading unit is specifically used for: Register new protocol parsing plug-ins through the centralized management interface module; Map the new protocol parsing plugin to system memory; Under the coordination of the CPU module, hot loading is achieved through the following commands: LoadPlugin(PluginID) PluginID is the unique identifier of the new protocol parsing plug-in.

5. The domestically produced industrial Internet security hardware device according to claim 1 is characterized in that: The protocol optimizer is specifically used for: Monitor network traffic in real time and record the number of packets for each protocol and flow rate ; According to the following formula (8), the priority of each protocol is calculated : ； in , and is the weight coefficient, which is used to adjust the impact of the number of protocols and traffic size; is the total number of protocols; is the number of packets of protocol q, is the traffic size of protocol q; Based on the calculated priority Dynamically adjust the protocol parsing order and resource allocation. Specific strategies include: Increase the parsing frequency of high priority protocols; Allocate more computing resources to the parsing tasks of high-priority protocols.

6. The domestically produced industrial Internet security hardware device according to claim 1 is characterized in that: The anomaly detection module comprises: The feature extraction unit is used to calculate the feature value and the frequency feature value from the received current data packet, and the feature value is calculated according to the following formula (9): ； in, Indicates the characteristic value of the current data packet; Indicates that the current The features of the data packet include the data packet size, source IP address, destination IP address and timestamp; Indicates The weight coefficient associated with each feature; The total number of features representing the data packet; The frequency characteristic value is calculated according to the following formula (10): ； in, Indicates the frequency characteristic value of the current data packet; Indicates that the current data packet is in The frequency characteristics of the current data packet include the number of repetitions of the data packet and the frequency of occurrence of the protocol type; Indicates The weights associated with each frequency feature; Represents the total number of frequency features; and To adjust the parameters; The anomaly scoring unit is used to calculate the anomaly score S of each data packet based on the extracted feature value and frequency feature value, and the anomaly score S is calculated by the following formula (11): ； in, Indicates the historical mean of the characteristic value of the data packet; Represents the historical mean of the frequency characteristic value of the data packet; , , and is the adjustment coefficient; The calculated abnormal score S is compared with the preset threshold T. When S exceeds T, an abnormal alarm signal is generated and transmitted to the central processing unit module.

7. The domestically produced industrial Internet security hardware device according to claim 1 is characterized in that: The security policy execution module includes a policy conflict detection unit, which is used to detect and resolve potential conflicts between multiple security policies in real time. The policy conflict detection unit is specifically used to: Obtain and load all currently effective security policy rules from the central processing unit module; Define conflict detection rules; Monitor the execution of policies in real time and detect potential conflicts through rule matching; when a conflict is detected, generate a conflict report and notify the central processing module; Conflicts are automatically resolved based on predefined priority rules or manual intervention mechanisms, and security policy rules are updated.

8. The domestically produced industrial Internet security hardware device according to claim 1 is characterized in that: The security policy execution module includes an emergency response unit, which is used to automatically initiate preset emergency measures when a high-risk anomaly is detected. The emergency response unit is specifically used to: Works with the anomaly detection module to trigger emergency response when high-risk anomalies are detected; Load corresponding emergency measures from the preset emergency response database; Automatically execute emergency response measures, including isolating infected network segments, shutting down specific services, and launching backup systems; Send emergency response execution and status reports to the central processor module and report to the upper-level security management platform.

9. The domestically produced industrial Internet security hardware device according to claim 1 is characterized in that: The physical isolation module adopts dynamic software-defined isolation technology, including a virtual network slicing unit, which is used to dynamically create and adjust the network isolation area according to the security policy. The virtual network slicing unit is specifically used to: receiving a current security policy from the central processing unit module; Define the configuration parameters of the virtual network slice according to the security policy, including IP address range, bandwidth limit, and security rules; Use network virtualization technology to create corresponding virtual network slices; Dynamically adjust the configuration of virtual network slices based on real-time security requirements and network traffic conditions, including adding or reducing slices and adjusting slice resource allocation; When the security policy changes or is no longer needed, the corresponding virtual network slice is safely destroyed to release resources.

Images