System and method for resisting pseudo link layer protocol attack in power communication network

Abstract

The invention discloses a system and a method for resisting a pseudo link layer protocol attack in an electric power communication network, and relates to the technical field of communication. The system comprises: a switching unit, which is used for receiving all data frames transmitted from an Ethernet port; the data identification module analyzes the protocol type and the destination address of the data frame, and forwards the data frame to the service processing unit or directly discards the data frame; the buffer area module sets an independent buffer area for each link layer protocol, and dynamically adjusts the size of the buffer area based on the protocol characteristic weight and the equipment memory resource through the configuration unit; the buffer area management module monitors the state of a buffer area in real time and triggers data discarding operation when the buffer area is fully loaded; and the data extraction module extracts the data frames from the buffer area according to a set time interval and analyzes and forwards the data frames in combination with a priority rule. According to the method, the size and the time interval of the buffer area can be dynamically adjusted, the resource utilization efficiency is improved, the pseudo link layer protocol attack is effectively resisted, and the security and the real-time performance of an electric power communication network are guaranteed.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a system and method for resisting pseudo link layer protocol attacks in a power communication network. Background Art

[0002] Link layer protocols (such as RSTP, LLDP, GMRP, PTP, etc.) are widely used in power communication networks. These protocols play an important role in the efficient operation, security and stability of communication networks. For example, the RSTP protocol implements network protection through path redundancy to avoid data proliferation and infinite loops in the loop network; the LLDP protocol provides a standard link layer discovery method to store the management address, device identification and other information of the device in a standard format for query by the network management system; the GMRP protocol mainly implements the restricted diffusion function of the second-layer multicast; the PTP protocol implements sub-microsecond synchronization of the terminal device clock through multicast technology. These protocols run on Ethernet switches, support the reliability and efficiency of the communication network, and serve the upload management application.

[0003] However, the link layer protocol in the prior art has many problems when facing pseudo-protocol attacks. Pseudo-protocol attacks inject a large amount of false traffic into the target network by forging the multicast address or protocol data frame of the link layer protocol, which greatly consumes the CPU resources of the switching equipment and may even cause the system to crash. In addition, the existing Ethernet switching equipment generally lacks a dynamic buffer adjustment mechanism and cannot flexibly allocate resources according to real-time traffic changes, resulting in insufficient resources when traffic surges and waste of resources when traffic decreases. The prior art also lacks a resource optimization mechanism and cannot perform intelligent allocation and dynamic recovery based on the real-time and integrity requirements of the protocol and historical traffic characteristics. What is more serious is that the existing schemes are difficult to effectively distinguish the importance and priority of the protocol, and cannot guarantee the real-time and integrity of key link layer protocols (such as the PTP protocol), which greatly affects the security and stability of the power communication network.

[0004] Therefore, there is an urgent need for a technical solution that can dynamically adjust the buffer size, optimize resource allocation, and combine protocol priority to effectively defend against pseudo-protocol attacks, so as to improve the stability and resource utilization efficiency of the power communication network. Summary of the invention

[0005] The purpose of the present invention is to provide a system and method for resisting pseudo link layer protocol attacks in an electric power communication network, so as to solve the problems of lack of dynamic buffer adjustment mechanism, unreasonable resource allocation and inability to effectively distinguish protocol priorities in the prior art. The present invention monitors the link layer protocol flow characteristics in real time, dynamically adjusts the buffer size and data extraction time interval, and optimizes the allocation in combination with the protocol priority rules, effectively reducing the impact of pseudo protocol flow on system resources, ensuring the data transmission performance of high priority protocols, and greatly improving the security, real-time performance and resource utilization efficiency of the electric power communication network.

[0006] In order to achieve the above object, the present invention is implemented by the following technical solutions:

[0007] A system for resisting pseudo link layer protocol attacks in a power communication network, comprising:

[0008] The switching unit is used to receive all data frames incoming from the Ethernet port and forward them to the data identification module;

[0009] A data identification module is used to receive the data frame and identify the protocol type and destination address of the data frame, wherein:

[0010] If the destination address of the data frame can match the multicast address of the link layer protocol, it is allocated to the corresponding buffer as a link layer protocol data frame;

[0011] If no match is found, it is forwarded to the service processing unit as a non-link layer protocol data frame or directly discarded;

[0012] A buffer module is used to set an independent buffer for each link layer protocol to temporarily store the data frames allocated by the data identification module; the size of the buffer is dynamically adjusted by the configuration unit based on the protocol characteristic weight and the memory resources of the switching device;

[0013] The buffer management module is used to monitor the storage status of the buffer module in real time and transmit the status information of the buffer being full or releasing the storage space; when it is detected that the buffer is full, the data frame discarding operation is triggered;

[0014] The data extraction module is used to extract data frames from the buffer at set time intervals, and to parse and forward the extracted data frames.

[0015] As a preferred solution of the present invention, the data identification module includes:

[0016] A protocol address matching unit, used to match the destination address of the data frame with the multicast address of the link layer protocol, calculate the hash value of the destination address by a hash algorithm, and divide the link layer protocol data frame into different categories according to a preset matching rule;

[0017] A classification allocation unit, used for allocating the divided link layer protocol data frames to corresponding buffers in the buffer module;

[0018] The filtering unit is used to judge the non-link layer protocol data frame and perform the following operations:

[0019] When the protocol type is identifiable, the data frame is forwarded to the service processing unit;

[0020] When the protocol type cannot be identified, the data frame is directly discarded.

[0021] As a preferred solution of the present invention, the service processing unit includes:

[0022] The protocol parsing unit is used to extract the frame type and priority information based on the frame header field of the non-link layer protocol data frame, and determine the priority of the data frame according to the following rules:

[0023] Protocol type priority rule: According to the importance and real-time nature of the protocol, the initial priority is assigned to different link layer protocols. The priority from high to low is: PTP protocol, LLDP protocol, RSTP protocol and GMRP protocol;

[0024] Traffic characteristic priority rules: Based on the protocol type priority rules, the protocol parsing unit dynamically adjusts the priority according to the real-time changes in protocol data traffic, assigning high priority to protocols with large traffic, and lowering the priority otherwise;

[0025] System load priority rule: When the system load exceeds the preset threshold, the protocol parsing unit dynamically adjusts the sending time interval according to the system load, giving priority to the transmission of data frames of high-priority protocols, while discarding data frames of low-priority protocols;

[0026] The data screening unit is used to perform the following operations on the non-link layer protocol data frame according to the data frame priority determined by the protocol parsing unit:

[0027] When the data frame priority is higher than or equal to the preset priority threshold, the data frame is retained and allocated to a subsequent processing flow;

[0028] When the data frame priority is lower than the preset priority threshold, the data frame is directly discarded;

[0029] The business execution unit is used to perform the following business operations on the data frames retained by the data screening unit: record, modify or trigger a preset business process.

[0030] As a preferred solution of the present invention, the buffer module includes a configuration unit for dynamically adjusting the size of the buffer, and the dynamic adjustment of the buffer and the optimal allocation of resources are achieved through the following steps:

[0031] (1) Initialize buffer resources

[0032] Get the total memory resource M of the swap device total_mem , and monitor memory usage in real time, including the memory M occupied by the operating system os_mem and the memory occupied by the business module M service_mem ;

[0033] Calculate the initial available memory M of the buffer buffer_avail , the formula is as follows:

[0034] M buffer_avail =M total_mem -(M os_mem +M service_mem +M safety_reserve )

[0035] Where: M safety_reserve Memory is reserved for security purposes to cope with traffic burst scenarios;

[0036] (2) Protocol feature weight calculation and buffer allocation

[0037] According to each link layer protocol P 1 ,P 2 ,...,P n The following characteristics calculate the weight W j , the calculation formula is:

[0038] W j =α×R proto,j +β×I proto,j +γ×F proto,j

[0039] Among them: α, β, γ are weight coefficients, ranging from 0 to 1, and satisfying α+β+γ=1; R proto,j Indicates the real-time performance of the protocol, which is used to measure the sensitivity of the protocol to delay; I proto,j F is the protocol integrity requirement, which is used to indicate the protocol's requirement for data integrity. proto,j The historical peak flow rate is used to reflect the historical maximum flow characteristic value of the protocol;

[0040] According to the weight W j Allocate the buffer size M for each link layer protocol buffer,j , the formula is as follows:

[0041]

[0042] in: is the sum of the weights of all link layer protocols; n is the total number of link layer protocols; j is the index number of the link layer protocol, indicating the jth link layer protocol;

[0043] (3) Dynamically adjust the buffer size

[0044] Real-time monitoring of the current traffic of each link layer protocol C current,j and buffer usage U buffer,j , the formula is as follows:

[0045]

[0046] When the buffer usage U buffer,j Exceeding the expansion threshold T buffer,j When the buffer is expanded, the buffer memory is increased by ΔM buffer,j for:

[0047] ΔM buffer,j =k adjust ×(C current,j -T buffer,j ×M buffer,j )

[0048] Among them, k adjust is the adjustment factor, the value range is 0≤k adjust ≤1, used to control the expansion speed;

[0049] k adjust The specific value is determined based on the current system load and historical peak value. The formula is as follows:

[0050]

[0051] Where: H current is the current system load, H peak is the historical load peak value;

[0052] When the buffer usage is lower than the reduction threshold L buffer,j When the excess memory is reclaimed, the reduced buffer size is:

[0053] M buffer_new,j =M buffer_old,j -ΔM buffer,j

[0054] Where: M buffer_old,j Indicates the buffer size before reduction; ΔM buffer,j Indicates the amount of memory that has been reclaimed; M buffer_new,j Indicates the reduced buffer size;

[0055] (4) Peak protection mechanism

[0056] Collect the historical peak traffic H of each protocol peak,j , and calculate the protection memory M protect,j , the formula is as follows:

[0057] M protect,j =θ×H peak,j

[0058] Where: θ is the protection proportional coefficient, ranging from 0 to 1;

[0059] Final buffer size M final_buffer,j The method comprises: performing parsing and forwarding operations on the extracted data frames and performing parsing and forwarding operations on the extracted data frames and performing parsing and forwarding operations on the extracted data frames;

[0060] M final_buffer,j =M buffer,j +M protect,j

[0061] (5) Global optimization and memory recycling

[0062] Periodically calculate the redundant memory of the buffer:

[0063]

[0064] Among them: U actual,j is the actual usage rate of the protocol buffer;

[0065] Reallocate the reclaimed memory to high priority protocols or to the extended buffer pool.

[0066] As a preferred solution of the present invention, the buffer module includes a time control unit for dynamically setting the time interval, and the time control unit monitors the data flow change of the protocol in real time during the operation of the device, and dynamically adjusts the time interval according to the following rules:

[0067] When the protocol traffic increases, the corresponding time interval is dynamically shortened;

[0068] When the protocol traffic decreases, the corresponding time interval is dynamically extended;

[0069] The time interval is adjusted based on a dynamic threshold of the protocol data flow, and the dynamic threshold is determined jointly by historical flow statistical analysis and real-time flow monitoring results.

[0070] As a preferred solution of the present invention, the data extraction module includes:

[0071] An interface unit, used for extracting a link layer protocol data frame from a buffer in the buffer module;

[0072] A transmission unit, used for transmitting the data frame extracted by the link layer protocol to the protocol processing unit;

[0073] The protocol processing unit is used to parse, process and forward link layer protocol data frames, including adding priority tags, reallocating bandwidth and dynamic routing selection.

[0074] A method for resisting pseudo link layer protocol attacks in a power communication network comprises the following steps:

[0075] S1. Allocate a buffer for each link layer protocol and set the initial buffer size of each protocol through weight calculation according to the real-time and integrity requirements of the protocol and the memory size of the switching device;

[0076] S2. Receive all data frames incoming from the Ethernet port, and match the data frame's protocol type and destination address with the link layer protocol multicast address table; if the match is successful, the data frame is stored in the buffer of the corresponding link layer protocol; if the match fails, the data frame is forwarded to the service processing unit as a non-link layer protocol data frame or directly discarded;

[0077] S3. Monitor the real-time traffic characteristics of the link layer protocol, determine the current traffic and historical peak traffic of each protocol, and dynamically adjust the size of the corresponding buffer according to the monitoring results;

[0078] S4. Real-time monitoring of dynamic changes in protocol data traffic, adjusting the time interval for extracting data frames from the buffer according to traffic changes, ensuring that protocols with real-time traffic exceeding a preset threshold can extract data frames faster and pass them to the protocol parsing unit in combination with priority tags;

[0079] S5. When the usage rate of the buffer reaches a preset threshold, stop receiving subsequent data frames and trigger an early warning or discard low-priority data frames to release buffer resources.

[0080] As a preferred solution of the present invention, the dynamic adjustment of the buffer size comprises the following steps:

[0081] When the protocol traffic exceeds the preset traffic threshold, the buffer size of the protocol is increased;

[0082] When the protocol traffic is lower than the preset traffic threshold, the buffer memory of the protocol is reclaimed and the reclaimed memory is used for buffer resource optimization.

[0083] As a preferred solution of the present invention, the time interval adjustment comprises the following steps:

[0084] Monitor the dynamic changes of protocol data traffic in real time and adjust the time interval according to the traffic changes;

[0085] When protocol traffic increases, shorten the time interval;

[0086] When the protocol traffic decreases, the time interval is extended;

[0087] The adjustment of the dynamic threshold is determined by combining the historical traffic analysis of the link layer protocol and the current traffic monitoring results.

[0088] Compared with the prior art, the beneficial effects of the present invention are as follows: the switching unit of the system of the present invention can efficiently receive all data frames transmitted from the Ethernet port and forward them to the data identification module, providing efficient and stable basic support for subsequent data processing; the data identification module allocates data frames that comply with the link layer protocol multicast address to the corresponding buffer by identifying the protocol type and destination address of the data frame, and forwards the non-compliant data frames to the business processing unit or directly discards them, thereby realizing accurate classification and management of data streams, effectively intercepting pseudo-protocol data frames, reducing the load of pseudo-data traffic on subsequent processing modules, and ensuring efficient forwarding of legitimate protocol data frames; the buffer module realizes classified storage and management of data frames by setting an independent buffer for each link layer protocol, and the size of the buffer is configured by the configuration unit based on the protocol The characteristic weights and switching device memory resources are dynamically adjusted, and resources are flexibly allocated according to real-time traffic requirements, which improves the efficiency of buffer resource utilization, reduces resource waste, and ensures the data transmission requirements of high-priority protocols; the buffer management module monitors the buffer storage status in real time and triggers the discard operation when the buffer is full, which can effectively avoid the buffer from overloading and causing the system to crash. At the same time, by discarding low-priority data frames, the storage and processing of high-priority protocol data frames are guaranteed, and the reliability and stability of the system are improved; the data extraction module extracts data frames from the buffer at set time intervals, and parses and forwards them in combination with priority tags, which effectively improves the data frame processing efficiency, can improve the real-time performance of data transmission during the peak period of protocol traffic, and reduce system resource occupancy during the trough period of traffic, thereby optimizing the overall performance. Through the organic combination of various modules, the present invention accurately realizes the classification, efficient storage, dynamic adjustment and priority guarantee of link layer protocol data, effectively resists pseudo-link layer protocol attacks, reduces the consumption of system resources by pseudo-protocol traffic, greatly improves the security, real-time performance and resource utilization efficiency of the power communication network, and has good application prospects. BRIEF DESCRIPTION OF THE DRAWINGS

[0089] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative labor.

[0090] in:

[0091] Figure 1 It is a schematic diagram of the modular structure of the system of the present invention;

[0092] Figure 2 This is a schematic diagram of buffer data flow in an embodiment of the present invention;

[0093] Figure 3 The present invention is a flow chart of the method. DETAILED DESCRIPTION

[0094] In order to make the purpose, technical solution and advantages of the embodiment of the present invention clearer, the technical solution of the embodiment of the present invention will be clearly and completely described below in conjunction with the drawings of the embodiment of the present invention. Obviously, the described embodiment is a part of the embodiment of the present invention, not all of the embodiments. Based on the described embodiment of the present invention, all other embodiments obtained by ordinary technicians in this field belong to the scope of protection of the present invention.

[0095] like Figure 1 As shown, it is an embodiment of the present invention, which provides a system for resisting pseudo link layer protocol attacks in a power communication network, including:

[0096] The switching unit is used to receive all data frames incoming from the Ethernet port and forward them to the data identification module;

[0097] A data identification module is used to receive the data frame and identify the protocol type and destination address of the data frame, wherein:

[0098] If the destination address of the data frame can match the multicast address of the link layer protocol, it is allocated to the corresponding buffer as a link layer protocol data frame;

[0099] If no match is found, it is forwarded to the service processing unit as a non-link layer protocol data frame or directly discarded;

[0100] In this embodiment, the switching unit receives all data frames incoming from the external network through the Ethernet port, and forwards the data frames to the data identification module for parsing. The switching unit can support data frame access of multiple communication protocols, including link layer protocols and non-link layer protocols. To ensure fast forwarding of data frames, hardware forwarding logic is configured inside the switching unit to ensure efficient data reception and distribution.

[0101] Preferably, the data identification module includes:

[0102] A protocol address matching unit, used to match the destination address of the data frame with the multicast address of the link layer protocol, calculate the hash value of the destination address by a hash algorithm, and divide the link layer protocol data frame into different categories according to a preset matching rule;

[0103] A classification allocation unit, used for allocating the divided link layer protocol data frames to corresponding buffers in the buffer module;

[0104] The filtering unit is used to judge the non-link layer protocol data frame and perform the following operations:

[0105] When the protocol type is identifiable, the data frame is forwarded to the service processing unit;

[0106] When the protocol type cannot be identified, the data frame is directly discarded.

[0107] Preferably, the service processing unit includes:

[0108] The protocol parsing unit is used to extract the frame type and priority information based on the frame header field of the non-link layer protocol data frame, and determine the priority of the data frame according to the following rules:

[0109] Protocol type priority rule: According to the importance and real-time nature of the protocol, the initial priority is assigned to different link layer protocols. The priority from high to low is: PTP protocol, LLDP protocol, RSTP protocol and GMRP protocol;

[0110] Traffic characteristic priority rules: Based on the protocol type priority rules, the protocol parsing unit dynamically adjusts the priority according to the real-time changes in protocol data traffic, assigning high priority to protocols with large traffic, and lowering the priority otherwise;

[0111] System load priority rule: When the system load exceeds the preset threshold, the protocol parsing unit dynamically adjusts the sending time interval according to the system load, giving priority to the transmission of data frames of high-priority protocols, while discarding data frames of low-priority protocols;

[0112] The data screening unit is used to perform the following operations on the non-link layer protocol data frame according to the data frame priority determined by the protocol parsing unit:

[0113] When the data frame priority is higher than or equal to the preset priority threshold, the data frame is retained and allocated to a subsequent processing flow;

[0114] When the data frame priority is lower than the preset priority threshold, the data frame is directly discarded;

[0115] The business execution unit is used to perform the following business operations on the data frames retained by the data screening unit: record, modify or trigger a preset business process.

[0116] In this embodiment, the main function of the data identification module is to identify the protocol type and destination address of each frame of data received from the switching unit. The module first parses the protocol header field of the data frame and matches the destination address of the data frame with the multicast address of the link layer protocol. If the destination address of the data frame matches the multicast address of the link layer protocol, the data frame is identified as a link layer protocol data frame; otherwise, the data frame is identified as a non-link layer protocol data frame. For link layer protocol data frames, the module will allocate them to the corresponding buffer for temporary storage; for non-link layer protocol data frames, they will be forwarded to the business processing unit for further processing or directly discarded according to the specific situation.

[0117] Furthermore, a buffer module is used to set an independent buffer corresponding to each link layer protocol to temporarily store the data frames allocated by the data identification module; the size of the buffer is dynamically adjusted by the configuration unit based on the protocol characteristic weight and the memory resources of the switching device;

[0118] Preferably, the buffer module includes a configuration unit for dynamically adjusting the size of the buffer, and the dynamic adjustment of the buffer and the optimal allocation of resources are achieved through the following steps:

[0119] (1) Initialize buffer resources

[0120] Get the total memory resource M of the swap device total_mem , and monitor memory usage in real time, including the memory M occupied by the operating system os_mem and the memory occupied by the business module M service_mem ;

[0121] Calculate the initial available memory M of the buffer buffer_avail , the formula is as follows:

[0122] M buffer_avail =M total_mem -(M os_mem +M service_mem +M safety_reserve )

[0123] Where: M safety_reserve Memory is reserved for security purposes to cope with traffic burst scenarios;

[0124] (2) Protocol feature weight calculation and buffer allocation

[0125] According to each link layer protocol P 1 ,P 2 ,...,P n The following characteristics calculate the weight W j , the calculation formula is:

[0126] W j =α×R proto,j+β×I proto,j +γ×F proto,j

[0127] Among them: α, β, γ are weight coefficients, ranging from 0 to 1, and satisfying α+β+γ=1; R proto,j Indicates the real-time performance of the protocol, which is used to measure the sensitivity of the protocol to delay; I proto,j F is the protocol integrity requirement, which is used to indicate the protocol's requirement for data integrity. proto,j The historical peak flow rate is used to reflect the historical maximum flow characteristic value of the protocol;

[0128] According to the weight W j Allocate the buffer size M for each link layer protocol buffer,j , the formula is as follows:

[0129]

[0130] in: is the sum of the weights of all link layer protocols; n is the total number of link layer protocols; j is the index number of the link layer protocol, indicating the jth link layer protocol;

[0131] (3) Dynamically adjust the buffer size

[0132] Real-time monitoring of the current traffic of each link layer protocol C current,j and buffer usage U buffer,j , the formula is as follows:

[0133]

[0134] When the buffer usage U buffer,j Exceeding the expansion threshold T buffer,j When the buffer is expanded, the buffer memory is increased by ΔM buffer,j for:

[0135] ΔM buffer,j =k adjust ×(C current,j -T buffer,j ×M buffer,j )

[0136] Among them, k adjust is the adjustment factor, the value range is 0≤k adjust ≤1, used to control the expansion speed;

[0137] k adjust The specific value is determined based on the current system load and historical peak value. The formula is as follows:

[0138]

[0139] Where: Hcurrent is the current system load, H peak is the historical load peak value;

[0140] When the buffer usage is lower than the reduction threshold L buffer,j When the excess memory is reclaimed, the reduced buffer size is:

[0141] M buffer_new,j =M buffer_old,j -ΔM buffer,j

[0142] Where: M buffer_old,j Indicates the buffer size before reduction; ΔM buffer,j Indicates the amount of memory that has been reclaimed; M buffer_new,j Indicates the reduced buffer size;

[0143] (4) Peak protection mechanism

[0144] Collect the historical peak traffic H of each protocol peak,j , and calculate the protection memory M protect,j , the formula is as follows:

[0145] M protect,j =θ×H peak,j

[0146] Where: θ is the protection proportional coefficient, ranging from 0 to 1;

[0147] Final buffer size M final_buffer,j The method comprises: performing parsing and forwarding operations on the extracted data frames and performing parsing and forwarding operations on the extracted data frames and performing parsing and forwarding operations on the extracted data frames;

[0148] M final_buffer,j =M buffer,j +M protect,j

[0149] (5) Global optimization and memory recycling

[0150] Periodically calculate the redundant memory of the buffer:

[0151]

[0152] Among them: U actual,j is the actual usage rate of the protocol buffer;

[0153] Reallocate the reclaimed memory to high priority protocols or to the extended buffer pool.

[0154] In this embodiment, the buffer module sets an independent buffer for each link layer protocol, which is used to temporarily store the data frames allocated by the data identification module. The buffer module allocates an initial size buffer for each link layer protocol according to the system configuration file. For example, the buffer size of the RSTP protocol is the default value, and the buffers of the LLDP protocol and the PTP protocol are allocated a larger initial buffer space according to their real-time requirements. The adjustment of the buffer size is based on the characteristic weight of the protocol (such as real-time, integrity requirements and historical traffic peaks) and the memory resources of the switching device.

[0155] Furthermore, the buffer management module is used to monitor the storage status of the buffer module in real time and transmit the status information of the buffer being full or releasing the storage space; when it is detected that the buffer is full, the data frame discarding operation is triggered;

[0156] Preferably, the buffer module includes a time control unit for dynamically setting the time interval, and the time control unit monitors the data flow change of the protocol in real time during the operation of the device, and dynamically adjusts the time interval according to the following rules:

[0157] When the protocol traffic increases, the corresponding time interval is dynamically shortened;

[0158] When the protocol traffic decreases, the corresponding time interval is dynamically extended;

[0159] The time interval is adjusted based on a dynamic threshold of the protocol data flow, and the dynamic threshold is determined jointly by historical flow statistical analysis and real-time flow monitoring results.

[0160] In this embodiment, the buffer management module is used to monitor the storage status of each protocol buffer in real time.

[0161] Furthermore, the data extraction module is used to extract data frames from the buffer at set time intervals, and perform parsing and forwarding operations on the extracted data frames.

[0162] Preferably, the data extraction module includes:

[0163] An interface unit, used for extracting a link layer protocol data frame from a buffer in the buffer module;

[0164] A transmission unit, used for transmitting the data frame extracted by the link layer protocol to the protocol processing unit;

[0165] The protocol processing unit is used to parse, process and forward link layer protocol data frames, including adding priority tags, reallocating bandwidth and dynamic routing selection.

[0166] Through the description of the above embodiments, it can be clearly seen how the system provided by the present invention can dynamically adjust the buffer size, monitor traffic changes in real time and effectively defend against pseudo link layer protocol attacks through modular design, thereby significantly improving the resource utilization efficiency and security of the system.

[0167] like Figure 2 As shown, the buffer data flow diagram of the present invention shows the operating logic of the system. The switching unit is responsible for receiving all data frames incoming from the Ethernet port and forwarding the data frames to the data type identification module. The data type identification module parses the data frame according to the protocol type and destination address, and matches it with the multicast address table of the link layer protocol:

[0168] If the data frame matches the multicast address of a link layer protocol, the data frame is classified and stored in the corresponding buffer, for example, the buffer corresponding to protocol 1 (such as RSTP protocol), the buffer corresponding to protocol 2 (such as LLDP protocol), and so on until the buffer corresponding to protocol n (such as PTP protocol).

[0169] If the data frame cannot match the multicast address of the link layer protocol, it is identified as a non-link layer protocol data frame and is forwarded to the service processing unit or directly discarded according to the specific situation.

[0170] In the buffer module, data frames are extracted at set time intervals, marked with priority rules, and passed to the CPU processing unit. The CPU processing unit further parses and processes the data frames, including priority scheduling, resource allocation, and subsequent forwarding operations. Through this layered processing, the system can dynamically optimize resource allocation while meeting the real-time requirements of high-priority protocols, thereby improving overall operating efficiency.

[0171] like Figure 3 As shown, another embodiment of the present invention provides a method for resisting pseudo link layer protocol attacks in a power communication network, comprising the following steps:

[0172] S1. Allocate a buffer for each link layer protocol and set the initial buffer size of each protocol through weight calculation according to the real-time and integrity requirements of the protocol and the memory size of the switching device;

[0173] S2. Receive all data frames incoming from the Ethernet port, and match the data frame's protocol type and destination address with the link layer protocol multicast address table; if the match is successful, the data frame is stored in the buffer of the corresponding link layer protocol; if the match fails, the data frame is forwarded to the service processing unit as a non-link layer protocol data frame or directly discarded;

[0174] S3. Monitor the real-time traffic characteristics of the link layer protocol, determine the current traffic and historical peak traffic of each protocol, and dynamically adjust the size of the corresponding buffer according to the monitoring results;

[0175] S4. Real-time monitoring of dynamic changes in protocol data traffic, adjusting the time interval for extracting data frames from the buffer according to traffic changes, ensuring that protocols with real-time traffic exceeding a preset threshold can extract data frames faster and pass them to the protocol parsing unit in combination with priority tags;

[0176] S5. When the usage rate of the buffer reaches a preset threshold, stop receiving subsequent data frames and trigger an early warning or discard low-priority data frames to release buffer resources.

[0177] Preferably, the dynamically adjusting the buffer size comprises the following steps:

[0178] When the protocol traffic exceeds the preset traffic threshold, the buffer size of the protocol is increased;

[0179] When the protocol traffic is lower than the preset traffic threshold, the buffer memory of the protocol is reclaimed and the reclaimed memory is used for buffer resource optimization.

[0180] Preferably, the time interval adjustment comprises the following steps:

[0181] Monitor the dynamic changes of protocol data traffic in real time and adjust the time interval according to the traffic changes;

[0182] When protocol traffic increases, shorten the time interval;

[0183] When the protocol traffic decreases, the time interval is extended;

[0184] The adjustment of the dynamic threshold is determined by combining the historical traffic analysis of the link layer protocol and the current traffic monitoring results.

[0185] In summary, the present invention realizes accurate classification, dynamic adjustment and priority guarantee of link layer protocol data by setting a switching unit, a data identification module, a buffer module, a buffer management module and a data extraction module. Among them, the switching unit is used to receive and forward all data frames in the network, providing a hardware basis for efficient data processing; the data identification module stores the multicast address data frame that conforms to the link layer protocol to the corresponding buffer by parsing the protocol type and destination address of the data frame, and forwards or discards the data frame of the non-link layer protocol, thereby avoiding excessive consumption of system resources by pseudo-protocol traffic; the buffer module sets an independent buffer for each link layer protocol, and dynamically adjusts the buffer size based on the real-time and integrity requirements of the protocol and the memory resources of the switching device, thereby ensuring the reasonable allocation of buffer resources and improving resource utilization efficiency; the buffer management module monitors the storage status of the buffer in real time, and dynamically adjusts the buffer when it reaches the expansion or reduction threshold, and at the same time guarantees the transmission performance of the high priority protocol by discarding the low priority protocol data frame; the data extraction module extracts the data frame from the buffer at a set time interval, and parses and forwards the data in combination with the priority rule, thereby realizing flexible scheduling and resource optimization in high and low traffic scenarios.

[0186] Compared with the prior art, the present invention has the following innovations:

[0187] The present invention proposes a buffer dynamic adjustment mechanism based on link layer protocol characteristics, which can dynamically adjust the buffer size and data extraction time interval according to real-time traffic, historical traffic peaks and protocol priority, breaking through the limitation of static buffer allocation in the prior art that it cannot adapt to traffic changes.

[0188] The present invention accurately classifies and processes data frames through a data identification module, effectively intercepts pseudo-protocol attack data frames, fundamentally reduces the consumption of CPU resources by pseudo-data traffic, and improves the security and stability of the system.

[0189] The priority guarantee mechanism proposed in the present invention can dynamically optimize buffer resource allocation according to the importance and real-time requirements of the protocol, ensuring the data transmission performance of high-priority protocols. Compared with the existing solutions that cannot effectively distinguish the priorities of protocols, it greatly improves the transmission efficiency of key link layer protocols.

[0190] In summary, the present invention realizes accurate classification, efficient storage, dynamic adjustment and priority optimization of link layer protocol data through modular design. It not only effectively resists the threat of pseudo-protocol attacks to the power communication network, but also significantly improves the utilization rate of system resources and the stability of network operation. It has significant technical advantages and broad application prospects.

[0191] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine different embodiments or examples described in this specification and the features of different embodiments or examples, unless they are contradictory.

[0192] Any process or method description in the flow chart or otherwise described herein can be understood to represent a module, fragment or portion of a code including one or more executable instructions for implementing the steps of a specific logical function or process. And the scope of the preferred embodiment of the present application includes other implementations, in which the functions may not be performed in the order shown or discussed, including in a substantially simultaneous manner or in a reverse order according to the functions involved.

[0193] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of various changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A system for resisting pseudo link layer protocol attacks in a power communication network, characterized in that: include: The switching unit is used to receive all data frames incoming from the Ethernet port and forward them to the data identification module; A data identification module is used to receive the data frame and identify the protocol type and destination address of the data frame, wherein: If the destination address of the data frame can match the multicast address of the link layer protocol, it is allocated to the corresponding buffer as a link layer protocol data frame; If no match is found, it is forwarded to the service processing unit as a non-link layer protocol data frame or directly discarded; A buffer module is used to set an independent buffer for each link layer protocol to temporarily store the data frames allocated by the data identification module; the size of the buffer is dynamically adjusted by the configuration unit based on the protocol characteristic weight and the memory resources of the switching device; The buffer management module is used to monitor the storage status of the buffer module in real time and transmit the status information of the buffer being full or releasing the storage space; when it is detected that the buffer is full, the data frame discarding operation is triggered; The data extraction module is used to extract data frames from the buffer at set time intervals, and to parse and forward the extracted data frames.

2. The system for resisting pseudo link layer protocol attacks in a power communication network according to claim 1, characterized in that: The data identification module comprises: The protocol address matching unit is used to match the destination address of the data frame with the multicast address of the link layer protocol, calculate the hash value of the destination address through a hash algorithm, and divide the link layer protocol data frame into different categories according to the preset matching rules; the classification allocation unit is used to allocate the divided link layer protocol data frame to the corresponding buffer in the buffer module; The filtering unit is used to judge the non-link layer protocol data frame and perform the following operations: When the protocol type is identifiable, the data frame is forwarded to the service processing unit; When the protocol type cannot be identified, the data frame is directly discarded.

3. The system for resisting pseudo link layer protocol attacks in a power communication network according to claim 2, characterized in that: The service processing unit includes: The protocol parsing unit is used to extract the frame type and priority information based on the frame header field of the non-link layer protocol data frame, and determine the priority of the data frame according to the following rules: Protocol type priority rule: According to the importance and real-time nature of the protocol, the initial priority is assigned to different link layer protocols. The priority from high to low is: PTP protocol, LLDP protocol, RSTP protocol and GMRP protocol; Traffic characteristic priority rule: Based on the setting of protocol type priority rule, the protocol parsing unit dynamically adjusts the priority according to the real-time changes of protocol data traffic, assigns high priority to protocols with large traffic, and lowers the priority otherwise; System load priority rule: When the system load exceeds the preset threshold, the protocol parsing unit dynamically adjusts the sending time interval according to the system load, giving priority to the sending of data frames of high-priority protocols, while discarding data frames of low-priority protocols; Data screening unit, used to perform the following operations on non-link layer protocol data frames according to the data frame priority determined by the protocol parsing unit: When the data frame priority is higher than or equal to the preset priority threshold, the data frame is retained and allocated to a subsequent processing flow; When the data frame priority is lower than the preset priority threshold, the data frame is directly discarded; The business execution unit is used to perform the following business operations on the data frames retained by the data screening unit: record, modify or trigger a preset business process.

4. The system for resisting pseudo link layer protocol attacks in a power communication network according to claim 1, characterized in that: The buffer module includes a configuration unit for dynamically adjusting the size of the buffer, and the dynamic adjustment of the buffer and the optimal allocation of resources are achieved through the following steps: (1) Initialize buffer resources Get the total memory resource M of the swap device total_mem , and monitor memory usage in real time, including the memory M occupied by the operating system os_mem and the memory occupied by the business module M service_mem ; Calculate the initial available memory M of the buffer buffer_avail , the formula is as follows: M buffer_avail =M total_mem -(M os_mem +M service_mem +M safety_reserve ) Where: M safety_reserve Memory is reserved for security purposes to cope with traffic burst scenarios; (2) Protocol feature weight calculation and buffer allocation According to each link layer protocol P1, P2, ..., P n The following characteristics calculate the weight W j , the calculation formula is: IN j =α×R proto,j +β×I proto,j +γ×F proto,j Among them: α, β, γ are weight coefficients, ranging from 0 to 1, and satisfying α+β+γ=1; R proto,j Indicates the real-time performance of the protocol, which is used to measure the sensitivity of the protocol to delay; I proto,j F is the protocol integrity requirement, which is used to indicate the protocol's requirement for data integrity. proto,j The historical peak flow rate is used to reflect the historical maximum flow characteristic value of the protocol; According to the weight W j Allocate the buffer size M for each link layer protocol buffer,j , the formula is as follows: in: is the sum of the weights of all link layer protocols; n is the total number of link layer protocols; j is the index number of the link layer protocol, indicating the jth link layer protocol; (3) Dynamically adjust the buffer size Real-time monitoring of the current traffic of each link layer protocol C current,j and buffer usage U buffer,j , the formula is as follows: When the buffer usage U buffer,j Exceeding the expansion threshold T buffer,j When the buffer is expanded, the buffer memory is increased by ΔM buffer,j for: ΔM buffer,j =k adjust ×(C current,j -T buffer,j ×M buffer,j ) Among them, k adjust is the adjustment factor, the value range is 0≤k adjust ≤1, used to control the expansion speed; k adjust The specific value is determined based on the current system load and historical peak value. The formula is as follows: Where: H current is the current system load, H peak is the historical load peak value; When the buffer usage is lower than the reduction threshold L buffer,j When the excess memory is reclaimed, the reduced buffer size is: M buffer_new,j =M buffer_old,j -ΔM buffer,j Where: M buffer_old,j Indicates the buffer size before reduction; ΔM buffer,j Indicates the amount of memory that has been reclaimed; M buffer_new,j Indicates the reduced buffer size; (4) Peak protection mechanism Collect the historical peak traffic H of each protocol peak,j , and calculate the protection memory M protect,j , the formula is as follows: M protect,j =θ×H peak,j Where: θ is the protection proportional coefficient, ranging from 0 to 1; Final buffer size M final_buffer,j The method comprises: performing parsing and forwarding operations on the extracted data frames and performing parsing and forwarding operations on the extracted data frames and performing parsing and forwarding operations on the extracted data frames; M final_buffer,j =M buffer,j +M protect,j (5) Global optimization and memory recycling Periodically calculate the redundant memory of the buffer: Among them: U actual,j is the actual usage rate of the protocol buffer; Reallocate the reclaimed memory to high priority protocols or to the extended buffer pool.

5. The system for resisting pseudo link layer protocol attacks in a power communication network according to claim 1, characterized in that: The buffer module includes a time control unit for dynamically setting the time interval. The time control unit monitors the data flow changes of the protocol in real time during the operation of the device and dynamically adjusts the time interval according to the following rules: When the protocol traffic increases, the corresponding time interval is dynamically shortened; When the protocol traffic decreases, the corresponding time interval is dynamically extended; The time interval is adjusted based on a dynamic threshold of the protocol data flow, and the dynamic threshold is determined jointly by historical flow statistical analysis and real-time flow monitoring results.

6. The system for resisting pseudo link layer protocol attacks in a power communication network according to claim 1, characterized in that: The data extraction module comprises: An interface unit, used for extracting a link layer protocol data frame from a buffer in the buffer module; A transmission unit, used for transmitting the data frame extracted by the link layer protocol to the protocol processing unit; The protocol processing unit is used to parse, process and forward link layer protocol data frames, including adding priority tags, reallocating bandwidth and dynamic routing selection.

7. A method for resisting pseudo link layer protocol attacks in a power communication network, characterized in that: The following steps are involved: S1. Allocate a buffer for each link layer protocol and set the initial buffer size of each protocol through weight calculation according to the real-time and integrity requirements of the protocol and the memory size of the switching device; S2. Receive all data frames incoming from the Ethernet port, and match the data frame's protocol type and destination address with the link layer protocol multicast address table; if the match is successful, store the data frame in the buffer of the corresponding link layer protocol; If no match is found, the data frame is forwarded to the service processing unit as a non-link layer protocol data frame or directly discarded; S3. Monitor the real-time traffic characteristics of the link layer protocol, determine the current traffic and historical peak traffic of each protocol, and dynamically adjust the size of the corresponding buffer according to the monitoring results; S4. Real-time monitoring of dynamic changes in protocol data traffic, adjusting the time interval for extracting data frames from the buffer according to traffic changes, ensuring that protocols with real-time traffic exceeding a preset threshold can extract data frames faster and pass them to the protocol parsing unit in combination with priority tags; S5. When the usage rate of the buffer reaches a preset threshold, stop receiving subsequent data frames, and trigger an early warning or discard low-priority data frames to release buffer resources.

8. The method for resisting pseudo link layer protocol attacks in a power communication network according to claim 7, characterized in that: The dynamic adjustment of the buffer size comprises the following steps: When the protocol traffic exceeds the preset traffic threshold, the buffer size of the protocol is increased; When the protocol traffic is lower than the preset traffic threshold, the buffer memory of the protocol is reclaimed and the reclaimed memory is used for buffer resource optimization.

9. The method for resisting pseudo link layer protocol attacks in a power communication network according to claim 7, characterized in that: The time interval adjustment comprises the following steps: Monitor the dynamic changes of protocol data traffic in real time and adjust the time interval according to the traffic changes; When protocol traffic increases, shorten the time interval; When the protocol traffic decreases, the time interval is extended; The adjustment of the dynamic threshold is determined by combining the historical traffic analysis of the link layer protocol and the current traffic monitoring results.

Images