A system and method for defending against pseudo-link layer protocol attacks in power communication networks

Abstract

This invention discloses a system and method for resisting pseudo-link layer protocol attacks in power communication networks, relating to the field of communication technology. The system includes: a switching unit for receiving all data frames received from the Ethernet port; a data identification module for parsing the protocol type and destination address of the data frames, forwarding them to the service processing unit or discarding them directly; a buffer module for setting independent buffers for each link layer protocol, and dynamically adjusting the buffer size based on protocol characteristic weights and device memory resources through a configuration unit; a buffer management module for real-time monitoring of the buffer status and triggering data discarding operations when the buffer is full; and a data extraction module for extracting data frames from the buffer at set time intervals and parsing and forwarding them based on priority rules. This invention can dynamically adjust the buffer size and time interval, improve resource utilization efficiency, effectively resist pseudo-link layer protocol attacks, and ensure the security and real-time performance of the power communication network.

Description

Technical Field

[0001] This invention relates to the field of communication technology, and in particular to a system and method for resisting pseudo link layer protocol attacks in power communication networks. Background Technology

[0002] Link-layer protocols (such as RSTP, LLDP, GMRP, and PTP) are widely used in power communication networks, playing a crucial role in the efficient operation and secure stability of these networks. For example, RSTP uses path redundancy to protect the network, preventing data proliferation and infinite loops in the network; LLDP provides a standard link-layer discovery method, storing device management addresses, device identifiers, and other information in a standard format for querying by the network management system; GMRP primarily implements the limited diffusion function of Layer 2 multicast; and PTP uses multicast technology to achieve sub-microsecond synchronization of terminal device clocks. These protocols run on Ethernet switches, supporting the reliability and efficiency of the communication network and serving upload management applications.

[0003] However, existing link-layer protocols suffer from numerous problems when facing pseudo-protocol attacks. Pseudo-protocol attacks inject large amounts of fake traffic into the target network by forging multicast addresses or protocol data frames of link-layer protocols, severely consuming the CPU resources of switching equipment and potentially causing system crashes. Furthermore, existing Ethernet switching equipment generally lacks dynamic buffer adjustment mechanisms, failing to flexibly allocate resources based on real-time traffic changes, leading to resource shortages during traffic surges and resource waste during traffic decreases. Existing technologies also lack resource optimization mechanisms, failing to intelligently allocate and dynamically reclaim resources based on the real-time and integrity requirements of protocols and historical traffic characteristics. More seriously, existing solutions struggle to effectively distinguish the importance and priority of protocols, failing to guarantee the real-time performance and integrity of critical link-layer protocols (such as the PTP protocol), significantly impacting the security and stability of power communication networks.

[0004] Therefore, there is an urgent need for a technical solution that can dynamically adjust the buffer size, optimize resource allocation, and effectively defend against pseudo-protocol attacks by combining protocol priority, so as to improve the stability and resource utilization efficiency of power communication networks. Summary of the Invention

[0005] The purpose of this invention is to provide a system and method for resisting pseudo-link layer protocol attacks in power communication networks, addressing the problems of lack of dynamic buffer adjustment mechanisms, unreasonable resource allocation, and inability to effectively distinguish protocol priorities in existing technologies. This invention effectively reduces the impact of pseudo-protocol traffic on system resources by dynamically adjusting buffer size and data extraction time intervals through real-time monitoring of link layer protocol traffic characteristics, and optimizing allocation in conjunction with protocol priority rules. This ensures the data transmission performance of high-priority protocols and significantly improves the security, real-time performance, and resource utilization efficiency of power communication networks.

[0006] To achieve the above objectives, the present invention employs the following technical solution:

[0007] A system for defending against pseudo-link layer protocol attacks in a power communication network includes:

[0008] The switching unit is used to receive all data frames coming from the Ethernet port and forward them to the data identification module;

[0009] The data identification module is used to receive the data frame and identify the protocol type and destination address of the data frame, wherein:

[0010] If the destination address of a data frame matches the multicast address of a link layer protocol, it is allocated to the corresponding buffer as a link layer protocol data frame.

[0011] If a match cannot be found, the data frame is forwarded to the service processing unit as a non-link layer protocol data frame or discarded directly.

[0012] The buffer module is used to set up independent buffers for each link layer protocol to temporarily store data frames allocated by the data identification module; the size of the buffer is dynamically adjusted by the configuration unit based on protocol characteristic weights and switching device memory resources.

[0013] The buffer management module is used to monitor the storage status of the buffer module in real time and transmit status information such as whether the buffer is full or the storage space is being released; when the buffer is detected to be full, a data frame discard operation is triggered.

[0014] The data extraction module is used to extract data frames from the buffer at set time intervals, and to parse and forward the extracted data frames.

[0015] As a preferred embodiment of the present invention, the data recognition module includes:

[0016] The protocol address matching unit is used to match the destination address of the data frame with the multicast address of the link layer protocol, calculate the hash value of the destination address through a hash algorithm, and divide the link layer protocol data frame into different categories according to a preset matching rule;

[0017] The classification and allocation unit is used to allocate the divided link layer protocol data frames to the corresponding buffers in the buffer module.

[0018] The filtering unit is used to judge non-link layer protocol data frames and perform the following operations:

[0019] When the protocol type is identifiable, the data frame is forwarded to the service processing unit;

[0020] If the protocol type cannot be recognized, the data frame is discarded directly.

[0021] As a preferred embodiment of the present invention, the service processing unit includes:

[0022] The protocol parsing unit is used to extract frame type and priority information from the frame header fields of non-link layer protocol data frames, and determine the priority of the data frames according to the following rules:

[0023] Protocol type priority rules: Based on the importance and real-time performance of the protocols, initial priorities are assigned to different link layer protocols, with the priorities from high to low as follows: PTP protocol, LLDP protocol, RSTP protocol and GMRP protocol;

[0024] Traffic characteristic priority rules: Based on the protocol type priority rules, the protocol parsing unit dynamically adjusts the priority according to the real-time changes in protocol data traffic, assigning higher priority to protocols with high traffic and lower priority to protocols with low traffic.

[0025] System load priority rule: When the system load exceeds the preset threshold, the protocol parsing unit dynamically adjusts the transmission time interval according to the system load, giving priority to the transmission of data frames of high-priority protocols, while discarding data frames of low-priority protocols.

[0026] The data filtering unit performs the following operations on non-link layer protocol data frames based on the data frame priority determined by the protocol parsing unit:

[0027] When the priority of a data frame is higher than or equal to the preset priority threshold, the data frame is retained and allocated to the subsequent processing flow;

[0028] When the priority of a data frame is lower than the preset priority threshold, the data frame is discarded directly.

[0029] The business execution unit is used to perform the following business operations on the data frames retained by the data filtering unit: record, modify, or trigger preset business processes.

[0030] In a preferred embodiment of the present invention, the buffer module includes a configuration unit for dynamically adjusting the buffer size, and achieves dynamic adjustment and optimized resource allocation of the buffer through the following steps:

[0031] (1) Initialize buffer resources

[0032] Obtain the total memory resources M of the switching device total_mem It also monitors memory usage in real time, including the memory used by the operating system. os_mem The memory occupied by the business module (M) service_mem ;

[0033] Calculate the initial available memory M of the buffer. buffer_avail The formula is as follows:

[0034] M buffer_avail =M total_mem -(M os_mem +M service_mem +M safety_reserve )

[0035] Where: M safety_reserve To securely reserve memory for handling sudden traffic surges;

[0036] (2) Protocol feature weight calculation and buffer allocation

[0037] According to each link layer protocol P1, P2, ..., P n The following characteristics are used to calculate the weight W j The calculation formula is:

[0038] W j =α×R proto,j +β×I proto,j +γ×F proto,j

[0039] Where: α, β, γ are weighting coefficients, ranging from 0 to 1, and satisfying α + β + γ = 1; R proto,j Indicates the real-time nature of the protocol, used to measure the protocol's sensitivity to latency; I proto,j For protocol integrity requirements, used to represent the protocol's requirements for data integrity; F proto,j Historical peak traffic is used to reflect the protocol's historical maximum traffic characteristic value;

[0040] Based on weight W j Allocate buffer sizes M for each link layer protocol buffer,j The formula is as follows:

[0041]

[0042] in: The sum of the weights of all link-layer protocols; n is the total number of link-layer protocols; j is the index number of the link-layer protocol, representing the j-th link-layer protocol;

[0043] (3) Dynamically adjust the buffer size

[0044] Real-time monitoring of current traffic for each link layer protocol C current,j and buffer usage U buffer,j The formula is as follows:

[0045]

[0046] When the buffer utilization rate U buffer,j Exceeding the extended threshold T buffer,j When this occurs, buffer expansion is triggered, adding an additional buffer memory amount ΔM. buffer,j for:

[0047] ΔM buffer,j =k adjust ×(C current,j -T buffer,j ×M buffer,j )

[0048] Where, k adjust This is an adjustment factor, with a value range of 0 ≤ k. adjust ≤1, used to control the expansion speed;

[0049] k adjust The specific value is determined based on the current system load and historical peak values, as shown in the following formula:

[0050]

[0051] Wherein: H current H represents the current system load. peak This represents the historical peak load.

[0052] When the buffer utilization rate is lower than the reduction threshold L buffer,j When excess memory is reclaimed, the reduced buffer size is:

[0053] M buffer_new,j =M buffer_old,j -ΔM buffer,j

[0054] Where: M buffer_old,j Indicates the buffer size before reduction; ΔM buffer,j Indicates the amount of memory reclaimed; M buffer_new,j Indicates the size of the reduced buffer;

[0055] (4) Peak protection mechanism

[0056] Collect historical peak traffic H for each protocol peak,j And calculate the protected memory M protect,j The formula is as follows:

[0057] Mprotect,j =θ×H peak,j

[0058] Where: θ is the protection proportional coefficient, and its value ranges from 0 to 1;

[0059] Final buffer size M final_buffer,j This involves parsing and forwarding the extracted data frames.

[0060] M final_buffer,j =M buffer,j +M protect,j

[0061] (5) Global optimization and memory reclamation

[0062] Periodically calculate redundant memory in the buffer:

[0063]

[0064] Among them: U actual,j This represents the actual utilization rate of the protocol buffer.

[0065] The reclaimed memory is reallocated to high-priority protocols or extended buffer pools.

[0066] In a preferred embodiment of the present invention, the buffer module includes a time control unit for dynamically setting the time interval. The time control unit monitors changes in protocol data traffic in real time during device operation and dynamically adjusts the time interval according to the following rules:

[0067] When protocol traffic increases, the corresponding time interval is dynamically shortened;

[0068] When protocol traffic decreases, the corresponding time interval is dynamically extended;

[0069] The time interval is adjusted based on a dynamic threshold of protocol data traffic, which is determined jointly by historical traffic statistical analysis and real-time traffic monitoring results.

[0070] As a preferred embodiment of the present invention, the data extraction module includes:

[0071] The interface unit is used to extract link layer protocol data frames from the buffer in the buffer module;

[0072] The transmission unit is used to transmit the data frames extracted by the link layer protocol to the protocol processing unit.

[0073] The protocol processing unit is used to parse, process, and forward link layer protocol data frames, specifically including adding priority markers, reallocating bandwidth, and dynamic routing selection.

[0074] A method for defending against pseudo-link layer protocol attacks in power communication networks includes the following steps:

[0075] S1. Allocate buffers for each link layer protocol, and set the initial buffer size for each protocol based on the real-time and integrity requirements of the protocol and the memory size of the switching equipment through weight calculation;

[0076] S2. Receive all data frames from the Ethernet port and match them with the multicast address table of the link layer protocol according to the protocol type and destination address of the data frame; if the match is successful, store the data frame in the buffer of the corresponding link layer protocol; if the match is unsuccessful, forward the data frame as a non-link layer protocol data frame to the service processing unit or discard it directly.

[0077] S3. Monitor the real-time traffic characteristics of link layer protocols, determine the current traffic and historical peak traffic of each protocol, and dynamically adjust the size of the corresponding buffer based on the monitoring results;

[0078] S4. Monitor the dynamic changes of protocol data traffic in real time, adjust the time interval for extracting data frames from the buffer according to the traffic changes, and ensure that protocols with real-time traffic exceeding the preset threshold can extract data frames faster, and pass them to the protocol parsing unit in combination with priority flags.

[0079] S5. When the usage rate of the buffer reaches the preset threshold, stop receiving subsequent data frames and trigger an alert or discard low-priority data frames to release buffer resources.

[0080] As a preferred embodiment of the present invention, the dynamic adjustment of the buffer size includes the following steps:

[0081] When the protocol traffic exceeds the preset traffic threshold, increase the protocol buffer size;

[0082] When the protocol traffic falls below a preset traffic threshold, the protocol's buffer memory is reclaimed, and the reclaimed memory is used for buffer resource optimization.

[0083] As a preferred embodiment of the present invention, the time interval adjustment includes the following steps:

[0084] Monitor the dynamic changes in protocol data traffic in real time and adjust the time interval according to the traffic changes;

[0085] When protocol traffic increases, shorten the time interval;

[0086] Extend the time interval when protocol traffic decreases;

[0087] The dynamic threshold adjustment is determined by combining historical traffic analysis of the link layer protocol with current traffic monitoring results.

[0088] Compared with existing technologies, the advantages of this invention are as follows: The switching unit of this invention can efficiently receive all data frames from the Ethernet port and forward them to the data identification module, providing efficient and stable basic support for subsequent data processing; the data identification module identifies the protocol type and destination address of the data frames, allocates data frames that conform to the multicast address of the link layer protocol to the corresponding buffer, and forwards non-conforming data frames to the service processing unit or discards them directly, thereby achieving accurate classification and management of data streams, effectively intercepting pseudo-protocol data frames, reducing the load of pseudo-data traffic on subsequent processing modules, and ensuring efficient forwarding of legitimate protocol data frames; the buffer module sets up independent buffers for each link layer protocol, realizing the classified storage and management of data frames, and the size of the buffer is configured by the configuration unit based on the protocol. The system dynamically adjusts feature weights and switching device memory resources, flexibly allocating resources according to real-time traffic demands. This improves buffer resource utilization efficiency, reduces resource waste, and ensures the data transmission needs of high-priority protocols. The buffer management module monitors the buffer storage status in real time and triggers a discard operation when the buffer is full, effectively preventing system crashes due to buffer overload. It also ensures the storage and processing of high-priority protocol data frames by discarding low-priority data frames, improving system reliability and stability. The data extraction module extracts data frames from the buffer at set time intervals and parses and forwards them using priority tags, effectively improving data frame processing efficiency. This enhances real-time data transmission during peak protocol traffic periods and reduces system resource consumption during off-peak periods, thus optimizing overall performance. This invention, through the organic integration of these modules, accurately achieves the classification, efficient storage, dynamic adjustment, and priority protection of link-layer protocol data. It effectively resists pseudo-link-layer protocol attacks, reduces the consumption of system resources by pseudo-protocol traffic, and significantly improves the security, real-time performance, and resource utilization efficiency of power communication networks, demonstrating promising application prospects. Attached Figure Description

[0089] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0090] in:

[0091] Figure 1 This is a schematic diagram of the modular structure of the system of the present invention;

[0092] Figure 2 This is a schematic diagram of buffer data flow in an embodiment of the present invention;

[0093] Figure 3 This is a flowchart of the method of the present invention. Detailed Implementation

[0094] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the described embodiments of the present invention are within the scope of protection of the present invention.

[0095] like Figure 1 As shown, this is an embodiment of the present invention, which provides a system for resisting pseudo-link layer protocol attacks in a power communication network, comprising:

[0096] The switching unit is used to receive all data frames coming from the Ethernet port and forward them to the data identification module;

[0097] The data identification module is used to receive the data frame and identify the protocol type and destination address of the data frame, wherein:

[0098] If the destination address of a data frame matches the multicast address of a link layer protocol, it is allocated to the corresponding buffer as a link layer protocol data frame.

[0099] If a match cannot be found, the data frame is forwarded to the service processing unit as a non-link layer protocol data frame or discarded directly.

[0100] In this embodiment, the switching unit receives all data frames from the external network via the Ethernet port and forwards them to the data identification module for parsing. The switching unit supports data frame access using various communication protocols, including link-layer and non-link-layer protocols. To ensure fast data frame forwarding, the switching unit is configured with internal hardware forwarding logic to ensure efficient data reception and distribution.

[0101] Preferably, the data recognition module includes:

[0102] The protocol address matching unit is used to match the destination address of the data frame with the multicast address of the link layer protocol, calculate the hash value of the destination address through a hash algorithm, and divide the link layer protocol data frame into different categories according to a preset matching rule;

[0103] The classification and allocation unit is used to allocate the divided link layer protocol data frames to the corresponding buffers in the buffer module.

[0104] The filtering unit is used to judge non-link layer protocol data frames and perform the following operations:

[0105] When the protocol type is identifiable, the data frame is forwarded to the service processing unit;

[0106] If the protocol type cannot be recognized, the data frame is discarded directly.

[0107] Preferably, the service processing unit includes:

[0108] The protocol parsing unit is used to extract frame type and priority information from the frame header fields of non-link layer protocol data frames, and determine the priority of the data frames according to the following rules:

[0109] Protocol type priority rules: Based on the importance and real-time performance of the protocols, initial priorities are assigned to different link layer protocols, with the priorities from high to low as follows: PTP protocol, LLDP protocol, RSTP protocol and GMRP protocol;

[0110] Traffic characteristic priority rules: Based on the protocol type priority rules, the protocol parsing unit dynamically adjusts the priority according to the real-time changes in protocol data traffic, assigning higher priority to protocols with high traffic and lower priority to protocols with low traffic.

[0111] System load priority rule: When the system load exceeds the preset threshold, the protocol parsing unit dynamically adjusts the transmission time interval according to the system load, giving priority to the transmission of data frames of high-priority protocols, while discarding data frames of low-priority protocols.

[0112] The data filtering unit performs the following operations on non-link layer protocol data frames based on the data frame priority determined by the protocol parsing unit:

[0113] When the priority of a data frame is higher than or equal to the preset priority threshold, the data frame is retained and allocated to the subsequent processing flow;

[0114] When the priority of a data frame is lower than the preset priority threshold, the data frame is discarded directly.

[0115] The business execution unit is used to perform the following business operations on the data frames retained by the data filtering unit: record, modify, or trigger preset business processes.

[0116] In this embodiment, the main function of the data identification module is to identify the protocol type and destination address of each frame of data received from the switching unit. The module first parses the protocol header field of the data frame and matches the destination address of the data frame with the multicast address of the link layer protocol. If the destination address of the data frame matches the multicast address of the link layer protocol, the data frame is identified as a link layer protocol data frame; otherwise, the data frame is identified as a non-link layer protocol data frame. For link layer protocol data frames, the module allocates them to the corresponding buffer for temporary storage; while for non-link layer protocol data frames, it forwards them to the service processing unit for further processing or discards them directly, depending on the specific circumstances.

[0117] Furthermore, the buffer module is used to set up independent buffers for each link layer protocol to temporarily store data frames allocated by the data identification module; the size of the buffer is dynamically adjusted by the configuration unit based on protocol characteristic weights and switching device memory resources.

[0118] Preferably, the buffer module includes a configuration unit for dynamically adjusting the buffer size, and achieves dynamic adjustment and optimized resource allocation of the buffer through the following steps:

[0119] (1) Initialize buffer resources

[0120] Obtain the total memory resources M of the switching device total_mem It also monitors memory usage in real time, including the memory used by the operating system. os_mem The memory occupied by the business module (M) service_mem ;

[0121] Calculate the initial available memory M of the buffer. buffer_avail The formula is as follows:

[0122] M buffer_avail =M total_mem -(M os_mem +M service_mem +M safety_reserve )

[0123] Where: M safety_reserve To securely reserve memory for handling sudden traffic surges;

[0124] (2) Protocol feature weight calculation and buffer allocation

[0125] According to each link layer protocol P1, P2, ..., P n The following characteristics are used to calculate the weight W j The calculation formula is:

[0126] W j =α×R proto,j +β×I proto,j +γ×Fproto,j

[0127] Where: α, β, γ are weighting coefficients, ranging from 0 to 1, and satisfying α + β + γ = 1; R proto,j Indicates the real-time nature of the protocol, used to measure the protocol's sensitivity to latency; I proto,j For protocol integrity requirements, used to represent the protocol's requirements for data integrity; F proto,j Historical peak traffic is used to reflect the protocol's historical maximum traffic characteristic value;

[0128] Based on weight W j Allocate buffer sizes M for each link layer protocol buffer,j The formula is as follows:

[0129]

[0130] in: The sum of the weights of all link-layer protocols; n is the total number of link-layer protocols; j is the index number of the link-layer protocol, representing the j-th link-layer protocol;

[0131] (3) Dynamically adjust the buffer size

[0132] Real-time monitoring of current traffic for each link layer protocol C current,j and buffer usage U buffer,j The formula is as follows:

[0133]

[0134] When the buffer utilization rate U buffer,j Exceeding the extended threshold T buffer,j When this occurs, buffer expansion is triggered, adding an additional buffer memory amount ΔM. buffer,j for:

[0135] ΔM buffer,j =k adjust ×(C current,j -T buffer,j ×M buffer,j )

[0136] Where, k adjust This is an adjustment factor, with a value range of 0 ≤ k. adjust ≤1, used to control the expansion speed;

[0137] k adjust The specific value is determined based on the current system load and historical peak values, as shown in the following formula:

[0138]

[0139] Wherein: H current H represents the current system load.peak This represents the historical peak load.

[0140] When the buffer utilization rate is lower than the reduction threshold L buffer,j When excess memory is reclaimed, the reduced buffer size is:

[0141] M buffer_new,j =M buffer_old,j -ΔM buffer,j

[0142] Where: M buffer_old,j Indicates the buffer size before reduction; ΔM buffer,j Indicates the amount of memory reclaimed; M buffer_new,j Indicates the size of the reduced buffer;

[0143] (4) Peak protection mechanism

[0144] Collect historical peak traffic H for each protocol peak,j And calculate the protected memory M protect,j The formula is as follows:

[0145] M protect,j =θ×H peak,j

[0146] Where: θ is the protection proportional coefficient, and its value ranges from 0 to 1;

[0147] Final buffer size M final_buffer,j This involves parsing and forwarding the extracted data frames.

[0148] M final_buffer,j =M buffer,j +M protect,j

[0149] (5) Global optimization and memory reclamation

[0150] Periodically calculate redundant memory in the buffer:

[0151]

[0152] Among them: U actual,j This represents the actual utilization rate of the protocol buffer.

[0153] The reclaimed memory is reallocated to high-priority protocols or extended buffer pools.

[0154] In this embodiment, the buffer module sets up independent buffers for each link layer protocol to temporarily store data frames allocated by the data identification module. The buffer module allocates an initial buffer size for each link layer protocol according to the system configuration file. For example, the RSTP protocol's buffer size is the default value, while the LLDP and PTP protocols are allocated larger initial buffer spaces based on their real-time requirements. The buffer size is adjusted based on the protocol's characteristic weights (such as real-time performance, integrity requirements, and historical traffic peaks) and the switching device's memory resources.

[0155] Furthermore, the buffer management module is used to monitor the storage status of the buffer module in real time and transmit status information such as whether the buffer is full or the storage space is being released; when the buffer is detected to be full, a data frame discard operation is triggered.

[0156] Preferably, the buffer module includes a time control unit for dynamically setting time intervals. The time control unit monitors changes in protocol data traffic in real time during device operation and dynamically adjusts the time intervals according to the following rules:

[0157] When protocol traffic increases, the corresponding time interval is dynamically shortened;

[0158] When protocol traffic decreases, the corresponding time interval is dynamically extended;

[0159] The time interval is adjusted based on a dynamic threshold of protocol data traffic, which is determined jointly by historical traffic statistical analysis and real-time traffic monitoring results.

[0160] In this embodiment, the buffer management module is used to monitor the storage status of each protocol buffer in real time.

[0161] Furthermore, the data extraction module is used to extract data frames from the buffer at set time intervals, and to parse and forward the extracted data frames.

[0162] Preferably, the data extraction module includes:

[0163] The interface unit is used to extract link layer protocol data frames from the buffer in the buffer module;

[0164] The transmission unit is used to transmit the data frames extracted by the link layer protocol to the protocol processing unit.

[0165] The protocol processing unit is used to parse, process, and forward link layer protocol data frames, specifically including adding priority markers, reallocating bandwidth, and dynamic routing selection.

[0166] Through the description of the above embodiments, it can be clearly seen how the system provided by the present invention can dynamically adjust the buffer size, monitor traffic changes in real time, and effectively defend against pseudo link layer protocol attacks through modular design, which significantly improves the system's resource utilization efficiency and security.

[0167] like Figure 2 As shown in the diagram, the buffer data flow diagram of this invention illustrates the system's operating logic. The switching unit is responsible for receiving all data frames incoming from the Ethernet port and forwarding them to the data type identification module. The data type identification module parses the data frames according to their protocol type and destination address, and matches them against the multicast address table of the link layer protocol.

[0168] If a data frame matches the multicast address of a certain link layer protocol, the data frame is classified and stored in the corresponding buffer. For example, the buffer corresponding to protocol 1 (such as RSTP), the buffer corresponding to protocol 2 (such as LLDP), and so on, up to the buffer corresponding to protocol n (such as PTP).

[0169] If a data frame cannot match the multicast address of the link layer protocol, it is identified as a non-link layer protocol data frame and forwarded to the service processing unit or discarded directly, depending on the specific circumstances.

[0170] In the buffer module, data frames are extracted at set time intervals, marked according to priority rules, and then passed to the CPU processing unit. The CPU processing unit further parses and processes the data frames, including priority scheduling, resource allocation, and subsequent forwarding operations. Through this layered processing, the system can dynamically optimize resource allocation and improve overall operating efficiency while meeting the real-time requirements of high-priority protocols.

[0171] like Figure 3 As shown, another embodiment of the present invention provides a method for resisting pseudo-link layer protocol attacks in a power communication network, comprising the following steps:

[0172] S1. Allocate buffers for each link layer protocol, and set the initial buffer size for each protocol based on the real-time and integrity requirements of the protocol and the memory size of the switching equipment through weight calculation;

[0173] S2. Receive all data frames from the Ethernet port and match them with the multicast address table of the link layer protocol according to the protocol type and destination address of the data frame; if the match is successful, store the data frame in the buffer of the corresponding link layer protocol; if the match is unsuccessful, forward the data frame as a non-link layer protocol data frame to the service processing unit or discard it directly.

[0174] S3. Monitor the real-time traffic characteristics of link layer protocols, determine the current traffic and historical peak traffic of each protocol, and dynamically adjust the size of the corresponding buffer based on the monitoring results;

[0175] S4. Monitor the dynamic changes of protocol data traffic in real time, adjust the time interval for extracting data frames from the buffer according to the traffic changes, and ensure that protocols with real-time traffic exceeding the preset threshold can extract data frames faster, and pass them to the protocol parsing unit in combination with priority flags.

[0176] S5. When the usage rate of the buffer reaches the preset threshold, stop receiving subsequent data frames and trigger an alert or discard low-priority data frames to release buffer resources.

[0177] Preferably, the dynamic adjustment of the buffer size includes the following steps:

[0178] When the protocol traffic exceeds the preset traffic threshold, increase the protocol buffer size;

[0179] When the protocol traffic falls below a preset traffic threshold, the protocol's buffer memory is reclaimed, and the reclaimed memory is used for buffer resource optimization.

[0180] Preferably, the time interval adjustment includes the following steps:

[0181] Monitor the dynamic changes in protocol data traffic in real time and adjust the time interval according to the traffic changes;

[0182] When protocol traffic increases, shorten the time interval;

[0183] Extend the time interval when protocol traffic decreases;

[0184] The dynamic threshold adjustment is determined by combining historical traffic analysis of the link layer protocol with current traffic monitoring results.

[0185] In summary, this invention, by setting up a switching unit, a data identification module, a buffer module, a buffer management module, and a data extraction module, achieves accurate classification, dynamic adjustment, and priority protection of link layer protocol data. Specifically, the switching unit receives and forwards all data frames in the network, providing the hardware foundation for efficient data processing; the data identification module parses the protocol type and destination address of data frames, storing multicast address data frames conforming to the link layer protocol in the corresponding buffer, while forwarding or discarding non-link layer protocol data frames, avoiding excessive consumption of system resources by pseudo-protocol traffic; the buffer module sets up independent buffers for each link layer protocol and dynamically adjusts the buffer size based on the real-time and integrity requirements of the protocol and the memory resources of the switching equipment, ensuring reasonable allocation of buffer resources and improving resource utilization efficiency; the buffer management module monitors the storage status of the buffer in real time and dynamically adjusts it when the buffer reaches the expansion or reduction threshold, while discarding low-priority protocol data frames to ensure the transmission performance of high-priority protocols; the data extraction module extracts data frames from the buffer at set time intervals and parses and forwards the data according to priority rules, thereby achieving flexible scheduling and resource optimization in high-traffic and low-traffic scenarios.

[0186] Compared with existing technologies, this invention has the following innovative features:

[0187] This invention proposes a dynamic buffer adjustment mechanism based on the characteristics of link layer protocols, which can dynamically adjust the buffer size and data extraction time interval according to real-time traffic, historical traffic peaks and protocol priorities, overcoming the limitation of static buffer allocation in the prior art that cannot adapt to traffic changes.

[0188] This invention uses a data identification module to accurately classify and process data frames, effectively intercepting fake protocol attack data frames, reducing the consumption of CPU resources by fake data traffic from the source, and improving the security and stability of the system.

[0189] The priority guarantee mechanism proposed in this invention can dynamically optimize the allocation of buffer resources according to the importance and real-time requirements of the protocol, ensuring the data transmission performance of high-priority protocols. Compared with existing technologies that cannot effectively distinguish protocol priorities, it greatly improves the transmission efficiency of critical link layer protocols.

[0190] In summary, this invention achieves accurate classification, efficient storage, dynamic adjustment, and priority optimization of link layer protocol data through modular design. It not only effectively resists the threat of pseudo-protocol attacks to power communication networks, but also significantly improves the utilization rate of system resources and the stability of network operation, demonstrating significant technical advantages and broad application prospects.

[0191] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of this application. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of those different embodiments or examples.

[0192] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing a particular logical function or process. Furthermore, the scope of the preferred embodiments of this application includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functionality involved.

[0193] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any person skilled in the art can easily conceive of various variations or substitutions within the technical scope disclosed in this application, and these should all be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A system for resisting pseudo-link layer protocol attacks in a power communication network, characterized in that, include: The switching unit is used to receive all data frames coming from the Ethernet port and forward them to the data identification module; The data identification module is used to receive the data frame and identify the protocol type and destination address of the data frame, wherein: If the destination address of a data frame matches the multicast address of a link layer protocol, it is allocated to the corresponding buffer as a link layer protocol data frame. If a match cannot be found, the data frame is forwarded to the service processing unit as a non-link layer protocol data frame or discarded directly. The buffer module is used to set up independent buffers for each link layer protocol to temporarily store data frames allocated by the data identification module; the size of the buffer is dynamically adjusted by the configuration unit based on protocol characteristic weights and switching device memory resources. The buffer management module is used to monitor the storage status of the buffer module in real time and transmit status information such as whether the buffer is full or the storage space is being released; when the buffer is detected to be full, a data frame discard operation is triggered. The buffer module includes a configuration unit for dynamically adjusting the buffer size, and achieves dynamic adjustment and optimized resource allocation of the buffer through the following steps: (1) Initialize buffer resources Obtain the total memory resources M of the switching device total_mem It also monitors memory usage in real time, including the memory used by the operating system. os_mem The memory occupied by the business module (M) service_mem ; Calculate the initial available memory M of the buffer. buffer_avail The formula is as follows: M buffer_avail =M total_mem -(M os_mem +M service_mem +M safety_reserve ) Where: M safety_reserve To preserve memory for handling sudden traffic surges; (2) Protocol feature weight calculation and buffer allocation According to each link layer protocol P1, P2, ..., P n The following characteristics are used to calculate the weight W j The calculation formula is: IN j =α×R proto,j +β×I proto,j +γ×F proto,j Where: α, β, γ are weighting coefficients, ranging from 0 to 1, and satisfying α + β + γ = 1; R proto,j Indicates the real-time nature of the protocol, used to measure the protocol's sensitivity to latency; I proto,j For protocol integrity requirements, used to represent the protocol's requirements for data integrity; F proto,j Historical peak traffic is used to reflect the protocol's historical maximum traffic characteristic value; Based on weight W j Allocate buffer sizes M for each link layer protocol buffer,j The formula is as follows: in: The sum of the weights of all link-layer protocols; n is the total number of link-layer protocols; j is the index number of the link-layer protocol, representing the j-th link-layer protocol; (3) Dynamically adjust the buffer size Real-time monitoring of current traffic for each link layer protocol C current,j and buffer usage U buffer,j The formula is as follows: When the buffer utilization rate U buffer,j Exceeding the extended threshold T buffer,j When this occurs, buffer expansion is triggered, adding an additional buffer memory amount ΔM. buffer,j for: ΔM buffer,j =k adjust ×(C current,j -T buffer,j ×M buffer,j ) Where, k adjust This is an adjustment factor, with a value range of 0 ≤ k. adjust ≤1, used to control the expansion speed; k adjust The specific value is determined based on the current system load and historical peak values, as shown in the following formula: Wherein: H current H represents the current system load. peak This represents the historical peak load. When the buffer utilization rate is lower than the reduction threshold L buffer,j When excess memory is reclaimed, the reduced buffer size is: M buffer_new,j =M buffer_old,j -ΔM buffer,j Where: M buffer_old,j Indicates the buffer size before reduction; ΔM buffer,j Indicates the amount of memory reclaimed; M buffer_new,j Indicates the size of the reduced buffer; (4) Peak protection mechanism Collect historical peak traffic H for each protocol peak,j And calculate the protected memory M protect,j The formula is as follows: M protect,j =θ×H peak,j Where: θ is the protection proportional coefficient, and its value ranges from 0 to 1; Final buffer size M final_buffer,j This involves parsing and forwarding the extracted data frames. M final_buffer,j =M buffer,j +M protect,j (5) Global optimization and memory reclamation Periodically calculate redundant memory in the buffer: Among them: U actual,j This represents the actual utilization rate of the protocol buffer. Reclaimed memory is reallocated to high-priority protocols or expanded buffer pools; The data extraction module is used to extract data frames from the buffer at set time intervals, and to parse and forward the extracted data frames.

2. The system for resisting pseudo-link layer protocol attacks in a power communication network according to claim 1, characterized in that, The data recognition module includes: The protocol address matching unit is used to match the destination address of the data frame with the multicast address of the link layer protocol, calculate the hash value of the destination address through a hash algorithm, and divide the link layer protocol data frames into different categories according to a preset matching rule; The classification and allocation unit is used to allocate the divided link layer protocol data frames to the corresponding buffers in the buffer module. The filtering unit is used to judge non-link layer protocol data frames and perform the following operations: When the protocol type is identifiable, the data frame is forwarded to the service processing unit; If the protocol type cannot be recognized, the data frame is discarded directly.

3. The system for resisting pseudo-link layer protocol attacks in a power communication network according to claim 2, characterized in that, The business processing unit includes: The protocol parsing unit is used to extract frame type and priority information from the frame header fields of non-link layer protocol data frames, and determine the priority of the data frames according to the following rules: Protocol type priority rules: Based on the importance and real-time requirements of the protocols, initial priorities are assigned to different link layer protocols, with the priorities from high to low as follows: PTP protocol, LLDP protocol, RSTP protocol and GMRP protocol; Traffic characteristic priority rules: Based on the protocol type priority rules, the protocol parsing unit dynamically adjusts the priority according to the real-time changes in protocol data traffic, assigning higher priority to protocols with high traffic and lower priority to protocols with low traffic. System load priority rule: When the system load exceeds the preset threshold, the protocol parsing unit dynamically adjusts the transmission time interval according to the system load, giving priority to the transmission of data frames of high-priority protocols, while discarding data frames of low-priority protocols. The data filtering unit performs the following operations on non-link layer protocol data frames based on the data frame priority determined by the protocol parsing unit: When the priority of a data frame is higher than or equal to the preset priority threshold, the data frame is retained and allocated to the subsequent processing flow; When the priority of a data frame is lower than the preset priority threshold, the data frame is discarded directly. The business execution unit is used to perform the following business operations on the data frames retained by the data filtering unit: record, modify, or trigger preset business processes.

4. The system for resisting pseudo-link layer protocol attacks in a power communication network according to claim 1, characterized in that, The buffer module includes a time control unit for dynamically setting time intervals. This time control unit monitors changes in protocol data traffic in real time during device operation and dynamically adjusts the time intervals according to the following rules: When protocol traffic increases, the corresponding time interval is dynamically shortened; When protocol traffic decreases, the corresponding time interval is dynamically extended; The time interval is adjusted based on a dynamic threshold of protocol data traffic, which is determined jointly by historical traffic statistical analysis and real-time traffic monitoring results.

5. The system for resisting pseudo-link layer protocol attacks in a power communication network according to claim 1, characterized in that, The data extraction module includes: The interface unit is used to extract link layer protocol data frames from the buffer in the buffer module; The transmission unit is used to transmit the data frames extracted by the link layer protocol to the protocol processing unit. The protocol processing unit is used to parse, process, and forward link layer protocol data frames, specifically including adding priority markers, reallocating bandwidth, and dynamic routing selection.

6. A method for defending against pseudo-link layer protocol attacks in a power communication network according to claim 1, characterized in that, Includes the following steps: S1. Allocate buffers for each link layer protocol, and set the initial buffer size for each protocol based on the real-time and integrity requirements of the protocol and the memory size of the switching equipment through weight calculation; S2. Receive all data frames from the Ethernet port and match them with the multicast address table of the link layer protocol according to the protocol type and destination address of the data frame; if the match is successful, store the data frame in the buffer of the corresponding link layer protocol. If a match cannot be found, the data frame will be forwarded to the service processing unit as a non-link layer protocol data frame or discarded directly. S3. Monitor the real-time traffic characteristics of link layer protocols, determine the current traffic and historical peak traffic of each protocol, and dynamically adjust the size of the corresponding buffer based on the monitoring results; S4. Monitor the dynamic changes of protocol data traffic in real time, adjust the time interval for extracting data frames from the buffer according to the traffic changes, and ensure that protocols with real-time traffic exceeding the preset threshold can extract data frames faster, and pass them to the protocol parsing unit in combination with priority flags. S5. When the usage rate of the buffer reaches the preset threshold, stop receiving subsequent data frames and trigger an alert or discard low-priority data frames to release buffer resources.

7. The method for resisting pseudo-link layer protocol attacks in a power communication network according to claim 6, characterized in that, The dynamic adjustment of the buffer size includes the following steps: When the protocol traffic exceeds the preset traffic threshold, increase the protocol buffer size; When the protocol traffic falls below a preset traffic threshold, the protocol's buffer memory is reclaimed, and the reclaimed memory is used for buffer resource optimization.

8. The method for resisting pseudo-link layer protocol attacks in a power communication network according to claim 6, characterized in that, The time interval adjustment includes the following steps: Monitor the dynamic changes in protocol data traffic in real time and adjust the time interval according to the traffic changes; When protocol traffic increases, shorten the time interval; Extend the time interval when protocol traffic decreases; The dynamic threshold adjustment is determined by combining historical traffic analysis of the link layer protocol with current traffic monitoring results.

Images