Time service protection isolation method and system for Beidou high-precision time synchronization

Abstract

The embodiment of the invention provides a Beidou high-precision time synchronization time service protection isolation method and system, and belongs to the technical field of power system time synchronization. According to the invention, the Beidou time service module is integrated; configuring a time synchronization service according to the Beidou time service module; creating a communication domain; according to the communication domain, setting integrity check; and performing time synchronization monitoring according to the integrity check and the time synchronization service to complete time service protection isolation. The method can be suitable for complex distributed system environments with high requirements on time synchronization, such as a smart grid, improves the operation efficiency and reliability of a power system, and provides important technical support for the development of the smart grid.

Description

Technical Field

[0001] The present application relates to the technical field of time synchronization of power systems, and in particular to a timing protection isolation method and system for Beidou high-precision time synchronization. Background Art

[0002] The Electric Power Hongmeng operating system is a new type of distributed operating system specially designed for the power system and industrial control field. It has the characteristics of distributed soft bus and microkernel architecture. In the field of power system and industrial control, high-precision time synchronization is crucial to the stability and reliability of system operation. With the rapid development of smart grids, the requirements for time synchronization accuracy, reliability and security are constantly increasing. However, the distributed architecture of the Electric Power Hongmeng operating system may have compatibility issues with the time synchronization mechanism of the Beidou satellite navigation system.

[0003] In a distributed environment, network delay and jitter will directly affect the accuracy of time synchronization. Although the BeiDou system can provide high-precision time signals, if there is a delay in the data transmission process, it will still lead to a decrease in synchronization accuracy.

[0004] In complex industrial environments, the detection and handling of time synchronization anomalies is crucial. Existing systems may lack effective anomaly detection and recovery mechanisms, resulting in an inability to respond and recover quickly when failures occur, thus affecting the stable operation of the system. Summary of the invention

[0005] The main purpose of the embodiments of the present application is to provide a timing protection isolation method and system for Beidou high-precision time synchronization.

[0006] The technical solution adopted by the present invention is:

[0007] On the one hand, an embodiment of the present invention provides a timing protection isolation method for Beidou high-precision time synchronization, the method comprising the following steps:

[0008] Integrated Beidou timing module;

[0009] According to the Beidou timing module, configure the time synchronization service;

[0010] Create a communication domain;

[0011] According to the communication domain, set integrity check;

[0012] Based on the integrity check and the time synchronization service, time synchronization monitoring is performed to complete timing protection isolation.

[0013] Furthermore, the integrated Beidou timing module comprises the following steps:

[0014] Integrate the Beidou timing module into the Dianhong operating system, configure the driver and standardized communication interface, and complete the integration of the Beidou timing module.

[0015] Further, configuring the time synchronization service according to the Beidou timing module comprises the following steps:

[0016] Setting the Beidou timing module as a time source;

[0017] According to the time source, obtaining system time data;

[0018] Use the device discovery function of the distributed soft bus to establish communication links between devices;

[0019] A time synchronization service is configured based on the communication link and the system time data.

[0020] Furthermore, the creation of a communication domain comprises the following steps:

[0021] Configure the timing service virtual LAN;

[0022] Define access control mechanisms;

[0023] The communication domain is created according to the timing service virtual local area network and the access control mechanism.

[0024] Further, the setting of integrity check according to the communication domain comprises the following steps:

[0025] According to the communication domain, digitally sign the timing service related software modules and establish a software module whitelist;

[0026] Checksum calculations are performed on the key memory areas of the timing service, and the check frequency and range are set;

[0027] According to the software module whitelist and the inspection frequency and scope, an access control list is used to protect timing-related files, and access and modification behaviors to key files are recorded to complete integrity verification.

[0028] Furthermore, the timing protection isolation method of Beidou high-precision time synchronization also includes the following steps:

[0029] Configure anomaly detection algorithms, use the exponentially weighted moving average method to monitor and analyze time synchronization data, and calculate the mean and standard deviation of time deviations.

[0030] Furthermore, the timing protection isolation method of Beidou high-precision time synchronization also includes the following steps:

[0031] Set up an alternate time source;

[0032] When the Beidou timing module fails, switch to the backup time source.

[0033] On the other hand, an embodiment of the present invention also provides a Beidou high-precision time synchronization timing protection isolation system, the system comprising:

[0034] The first module is used to integrate the Beidou timing module;

[0035] The second module is used to configure the time synchronization service according to the Beidou timing module;

[0036] The third module is used to create a communication domain;

[0037] The fourth module is used to set integrity check according to the communication domain;

[0038] The fifth module is used to perform time synchronization monitoring based on the integrity check and the time synchronization service to complete timing protection isolation.

[0039] On the other hand, an embodiment of the present invention also provides a Beidou high-precision time synchronization timing protection isolation device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the Beidou high-precision time synchronization timing protection isolation method as described above is implemented.

[0040] On the other hand, an embodiment of the present invention further provides a computer-readable storage medium, which stores computer-executable instructions, and the computer-executable instructions are used to enable a computer to execute the timing protection isolation method for Beidou high-precision time synchronization as described above.

[0041] The embodiments of the present application include at least the following beneficial effects: The present application provides a timing protection isolation method and system for Beidou high-precision time synchronization. The present invention integrates a Beidou timing module; configures a time synchronization service according to the Beidou timing module; creates a communication domain; sets an integrity check according to the communication domain; performs time synchronization monitoring according to the integrity check and the time synchronization service, and completes timing protection isolation. The present invention can be applied to complex distributed system environments such as smart grids that have high requirements for time synchronization, improve the operating efficiency and reliability of the power system, and provide important technical support for the development of smart grids. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 It is a flow chart of a timing protection isolation method for Beidou high-precision time synchronization provided by an embodiment of the present invention;

[0043] Figure 2 is a flow chart of a system method provided by an embodiment of the present invention;

[0044] Figure 3 This is a diagram of the distributed time synchronization service implementation architecture provided by an embodiment of the present invention;

[0045] Figure 4 is a schematic diagram of a multi-level security isolation mechanism provided by an embodiment of the present invention;

[0046] Figure 5 is a software integrity protection cycle diagram provided by an embodiment of the present invention;

[0047] Figure 6 It is a flow chart of time synchronization anomaly detection and processing provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0048] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application is further described in detail below in conjunction with the accompanying drawings and examples. It should be understood that the specific embodiments described herein are only used to explain the present application and are not intended to limit the present application. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the embodiments of the present application. They are only examples of devices and methods consistent with some aspects of the embodiments of the present application as detailed in the attached claims.

[0049] It is understood that the terms "first", "second", etc. used in this application can be used to describe various concepts in this article, but unless otherwise specified, these concepts are not limited by these terms. These terms are only used to distinguish one concept from another concept. For example, without departing from the scope of the embodiment of the present application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the words "if" and "if" as used herein can be interpreted as "at the time of" or "when" or "in response to determination".

[0050] The terms "at least one", "multiple", "each", "any", etc. used in this application, at least one includes one, two or more, multiple includes two or more, each refers to each of the corresponding multiple, and any refers to any one of the multiple.

[0051] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0052] Before describing the embodiments of the present application in detail, some nouns and terms involved in the embodiments of the present application are first described. The nouns and terms involved in the embodiments of the present application are subject to the following explanations.

[0053] 1) RBAC (Role-Based Access Control) is an access control mechanism.

[0054] 2) IEEE 1588-2019, also known as the Precision Time Protocol (PTP), is a standard for network synchronization.

[0055] 3) UDP (User Datagram Protocol) is a communication protocol used in computer networks and belongs to the transport layer protocol.

[0056] 4) DTLS (Datagram Transport Layer Security) is a security protocol based on the TLS (Transport Layer Security) protocol, specifically designed for connectionless datagram transmission.

[0057] 5) Access Control List (ACL) is a security mechanism used to manage and control access rights to computer systems, network devices, files, databases and other resources.

[0058] 6) Exponentially Weighted Moving Average (EWMA) is a statistical method used for time series data analysis, commonly used in signal processing, financial analysis, quality control and other fields.

[0059] 7) 3-sigma (3σ) is an important concept in statistics and is often used to describe the data distribution characteristics in normal distribution (or approximate normal distribution).

[0060] 8)PPS, in the field of hardware and electronic equipment, PPS refers to "Programmable Power Supply".

[0061] 9) RS232 serial port is a widely used serial communication protocol and interface standard, mainly used for serial data transmission between computers and external devices.

[0062] 10) NMEA-0183 is a standard data format for marine navigation and communications, widely used for information exchange between Global Positioning System (GPS) devices and other marine electronic equipment.

[0063] 11) Remote Procedure Call (RPC) is a communication protocol that allows programs to call methods or functions of programs on different computers.

[0064] 12) Protocol Buffers, often abbreviated as Protobuf, is a data serialization format developed by Google.

[0065] 13)PTP (Precision Time Protocol) is a protocol used to achieve high-precision time synchronization in computer networks.

[0066] 14) AES-256 (Advanced Encryption Standard 256-bit) is a symmetric encryption algorithm and a part of AES (Advanced Encryption Standard).

[0067] 15) HMAC (Hash-based Message Authentication Code) is a message authentication code based on a hash function, used to ensure the integrity and authenticity of the message.

[0068] The present invention takes into account that the distributed soft bus technology of the Hongmeng operating system facilitates cross-device communication, which creates conditions for achieving efficient time synchronization in a distributed environment. However, how to make full use of this feature to build a reliable distributed time synchronization service framework requires further research and exploration.

[0069] In addition, in complex industrial environments, the security and reliability of time synchronization systems are becoming increasingly important. How to use the characteristics of the power Hongmeng operating system to enhance the security protection of time synchronization services and improve the overall reliability of the system is another challenge currently faced.

[0070] At the same time, as the scale of the system expands and the complexity increases, how to effectively detect and handle time synchronization anomalies to ensure the stable operation of the system has also become an issue worthy of attention.

[0071] Therefore, there is an urgent need for a time synchronization solution that can fully utilize the characteristics of the power Hongmeng operating system and combine it with the Beidou high-precision time source. This solution should be able to provide a reliable security protection mechanism while ensuring high-precision time synchronization, and be able to effectively respond to various challenges in a distributed environment to meet the growing practical needs of power systems and industrial control fields.

[0072] The present invention discloses a timing protection isolation method for Beidou high-precision time synchronization based on the Dianhong operating system. The method includes Beidou timing module integration, time synchronization service configuration, timing service network isolation and secure communication, software integrity protection and time synchronization monitoring steps. The present invention solves the security and reliability issues of high-precision time synchronization in smart grids, and effectively prevents unauthorized access and malicious tampering. The method makes full use of the distributed soft bus technology of the Dianhong operating system to achieve high-precision cross-device time synchronization, provides powerful underlying security protection through a multi-level security isolation mechanism, and uses the EWMA method to achieve an efficient and reliable anomaly detection mechanism. The present invention improves the accuracy, reliability and security of time synchronization, and is suitable for complex large-scale distributed system environments.

[0073] The embodiments of the present invention are further described below in conjunction with the accompanying drawings.

[0074] On the one hand, the embodiment of the present invention provides a timing protection isolation method for Beidou high-precision time synchronization, referring to Figure 1 , the method comprises the following steps:

[0075] S100, integrated Beidou timing module;

[0076] S200, configure the time synchronization service according to the Beidou timing module;

[0077] S300, creating a communication domain;

[0078] S400, setting integrity check according to the communication domain;

[0079] S500: Perform time synchronization monitoring based on integrity check and time synchronization service to complete timing protection isolation.

[0080] As an optional implementation manner, the S100 integrated Beidou timing module of the embodiment of the present invention includes:

[0081] Module access: Integrate the Beidou timing module into the Dianhong operating system and connect it to the system mainboard through a hardware interface (such as a serial port or PPS).

[0082] Driver development: Develop corresponding drivers to realize the reading and parsing of time data.

[0083] Establishment of standardized interfaces: Establish standardized communication interfaces between modules and systems, design a unified time data format, ensure the real-time and continuity of time information, and provide standardized API interfaces for upper-level applications to call.

[0084] S200 of the embodiment of the present invention configures a time synchronization service according to the Beidou timing module, including:

[0085] Service framework definition: Using distributed soft bus technology, define the data structure and communication protocol of the time synchronization service, and establish a high-precision time synchronization service framework.

[0086] Device discovery: The device discovery function of the distributed soft bus is configured to scan the network every 5 seconds to quickly establish a connection.

[0087] Service registration and release: The average time of the registration and release process is controlled within 100 milliseconds to ensure efficient operation of the system.

[0088] Time synchronization interface: defines the service interface and provides the functions of obtaining and setting system time and synchronizing with the Beidou system.

[0089] Cross-device time information transmission: Time information transmission is realized through a distributed soft bus, and time synchronization nodes are automatically identified.

[0090] S300 of the embodiment of the present invention creates a communication domain, including:

[0091] Virtual Local Area Network (VLAN) creation: Create a dedicated VLAN for timing service in the Dianhong operating system to ensure that the timing service traffic is logically separated from other network traffic.

[0092] Security policy configuration: define the types of devices and services allowed to access, set firewall rules and access control lists (ACLs), and restrict unauthorized traffic.

[0093] Role-based access control: Implement RBAC mechanism to define roles for different types of devices and services and assign access rights.

[0094] Data encryption and identity authentication: Implement data encryption, integrity verification and identity authentication to ensure the security of timing services.

[0095] S400 of the embodiment of the present invention sets integrity check according to the communication domain, including:

[0096] Integrity check at startup: Digital signature verification is performed on key software modules related to timing, and a software module whitelist is established.

[0097] Runtime memory check: Perform a memory integrity check every 5 minutes to ensure the security of the system during runtime.

[0098] File system integrity protection: Use access control lists (ACLs) and file system encryption technology to protect the integrity of timing-related files.

[0099] Software update mechanism: Implement a software update mechanism based on digital signatures to ensure that only authenticated update packages can be installed.

[0100] The embodiment of the present invention discloses step S100 of integrating a Beidou timing module, including the following steps:

[0101] S110, integrate the Beidou timing module into the Dianhong operating system, configure the driver and the standardized communication interface, and complete the integration of the Beidou timing module.

[0102] The embodiment of the present invention discloses that step S200 configures a time synchronization service according to a Beidou timing module, including the following steps:

[0103] S210, setting the Beidou timing module as a time source;

[0104] S220, obtaining system time data according to a time source;

[0105] S230, using the device discovery function of the distributed soft bus to establish a communication link between devices;

[0106] S240: Complete configuration of time synchronization service according to the communication link and system time data.

[0107] The embodiment of the present invention discloses step S300 of creating a communication domain, including the following steps:

[0108] S310, configuring a timing service virtual local area network;

[0109] S320, defining an access control mechanism;

[0110] S330: Complete the creation of the communication domain according to the timing service virtual local area network and access control mechanism.

[0111] The embodiment of the present invention discloses that step S400 sets integrity check according to the communication domain, including the following steps:

[0112] S410, digitally sign the timing service related software modules according to the communication domain and establish a software module whitelist;

[0113] S420, check and calculate the key memory area of ​​the timing service, and set the check frequency and range;

[0114] S430. According to the software module whitelist and the inspection frequency and scope, use the access control list to protect the timing-related files, record the access and modification behavior of key files, and complete the integrity check.

[0115] The timing protection isolation method for Beidou high-precision time synchronization disclosed in an embodiment of the present invention also includes the following steps:

[0116] S600. Configure an anomaly detection algorithm, use an exponentially weighted moving average method to monitor and analyze time synchronization data, and calculate the mean and standard deviation of time deviation.

[0117] As an optional embodiment, the present invention includes:

[0118] Data collection: Collect time synchronization data from multiple nodes and record the deviation between local time and the Beidou timing module.

[0119] Data processing: The collected raw data were preliminarily processed, and the exponentially weighted moving average (EWMA) method was used to analyze the time-synchronized data.

[0120] Dynamic threshold setting: Set dynamic thresholds based on the 3-sigma principle to monitor the statistical characteristics of time deviation in real time.

[0121] Abnormal determination and response: When an abnormality is detected, it automatically switches to the pre-configured backup Beidou time source, records the abnormal event, and sends an alarm message.

[0122] The timing protection isolation method for Beidou high-precision time synchronization disclosed in an embodiment of the present invention also includes the following steps:

[0123] S700, setting a backup time source;

[0124] S800: When the Beidou timing module fails, switch to the backup time source.

[0125] As an optional embodiment, the present invention includes:

[0126] Synchronization speed and accuracy: The effectiveness of the method is tested in a large-scale distributed network to ensure that the entire network time synchronization is completed within 5 seconds, and the reduction in time synchronization accuracy is controlled within 10% when the system load increases by 50%.

[0127] On the other hand, an embodiment of the present invention further provides a Beidou high-precision time synchronization timing protection isolation system, the system comprising:

[0128] The first module is used to integrate the Beidou timing module;

[0129] The second module is used to configure the time synchronization service according to the Beidou timing module;

[0130] The third module is used to create a communication domain;

[0131] The fourth module is used to set integrity check according to the communication domain;

[0132] The fifth module is used to perform time synchronization monitoring based on integrity verification and time synchronization services to complete timing protection isolation.

[0133] As an optional implementation, refer to Figure 2 The present invention discloses a timing protection isolation method for Beidou high-precision time synchronization based on the Dianhong operating system, comprising the following steps:

[0134] Beidou timing module integration steps: Integrate the Beidou timing module into the Dianhong operating system, configure the driver and standardized communication interface;

[0135] Time synchronization service configuration steps: Start the distributed soft bus service, create and register the time synchronization service, and set the Beidou timing module as the main time source;

[0136] Timing service network isolation and secure communication steps: Create a dedicated timing service communication domain, configure security policies and access control mechanisms; implement data encryption, integrity verification and identity authentication within the communication domain;

[0137] Software integrity protection steps: Use cryptography to digitally sign the timing service-related software modules, verify these signatures when the system is running, and configure runtime memory integrity checks;

[0138] Time synchronization monitoring steps: configure and execute anomaly detection algorithm;

[0139] Among them, the integration of the Beidou timing module includes hardware interface configuration, driver development and system-level integration; the creation of a dedicated timing service communication domain realizes network layer isolation of the timing service communication domain by configuring a timing service virtual LAN; the anomaly detection algorithm refers to statistically analyzing the time synchronization data collected from multiple nodes in a distributed network, comprehensively evaluating the overall network status, and identifying possible time drift, jumps or other abnormal situations.

[0140] Furthermore, the time synchronization service configuration step also includes:

[0141] Create a time synchronization service framework and define service interfaces for obtaining time, setting time, and synchronizing time;

[0142] Configure the device discovery function of the distributed soft bus to establish communication links between devices;

[0143] Use the service management capabilities of the distributed soft bus to register and publish time synchronization services;

[0144] The remote procedure call mechanism provided by the distributed soft bus is used to execute time acquisition, setting and synchronization operations across devices.

[0145] Furthermore, the timing service network isolation and secure communication steps specifically include:

[0146] Create a dedicated timing service virtual LAN in the Dianhong operating system and assign a unique identifier to the timing service virtual LAN;

[0147] Configure the security policy of the timing service communication domain, including defining the types of devices and services allowed to access the timing service virtual LAN;

[0148] Implement a role-based access control (RBAC) mechanism to assign appropriate access rights to authorized devices and services;

[0149] Implement access control logic in the timing service communication interface to filter data transmission requests based on device identity and service type;

[0150] Adopt the BeiDou system-specific secure communication protocol, or support the PTP protocol with IEEE 1588-2019 security extension, or the DTLS protocol for UDP communication;

[0151] Configure the system log function to record all key operations and data exchange behaviors within the timing service communication domain;

[0152] Utilize the resource isolation capability of the Dianhong operating system to allocate independent computing and storage resources for timing services.

[0153] Furthermore, the software integrity protection step specifically includes:

[0154] When the system starts, the digital signature of the key software modules related to the timing service is verified, and a software module whitelist is established to allow only verified modules to be loaded;

[0155] During system operation, periodically check and calculate the key memory areas of the timing service, and set an appropriate check frequency and range to balance security and system performance;

[0156] Use access control lists (ACLs) and file system encryption technology to prevent unauthorized modification of timing-related files. Implement a file operation audit mechanism to record all access and modification operations to key files.

[0157] Implement a software update mechanism based on digital signatures to ensure that only certified update packages can be installed, and design a rollback mechanism to allow recovery to the previous stable version when the update fails.

[0158] Furthermore, the time synchronization monitoring step adopts an exponentially weighted moving average (EWMA) method, including monitoring the time synchronization data within a preset time period, calculating the EWMA mean and standard deviation of the time deviation, and judging whether an abnormality occurs based on a 3-sigma dynamic threshold, wherein the 3-sigma dynamic threshold refers to using 3 times the standard deviation of the EWMA mean as the boundary value for judging time synchronization abnormalities.

[0159] Furthermore, the present invention also includes a backup time source management step, which automatically or manually switches to the backup time source when the main time source (Beidou timing module) fails.

[0160] As an optional implementation, the present invention proposes a timing protection isolation method for Beidou high-precision time synchronization based on the Dianhong operating system. The method is based on distributed soft bus, network partitioning, software integrity protection and other mechanisms. On the basis of the standard time synchronization protocol, it expands and adds security protection measures to establish a reliable time synchronization service framework, thereby improving the accuracy, reliability and security of time synchronization.

[0161] As a preferred embodiment of the present invention, the Beidou timing module integration process mainly includes the following steps:

[0162] Integrate the Beidou timing module as a high-precision time source into the Dianhong operating system, connect the Beidou timing module to the system mainboard through a hardware interface (such as serial port or PPS), and develop the corresponding driver to realize the reading and analysis of time data.

[0163] A standardized communication interface between the module and the system is established, a unified time data format is designed, a data buffer mechanism is implemented, and a standardized API interface is provided. The time data format includes key information such as timestamp, accuracy information, and satellite status. The data buffer mechanism ensures the real-time and continuity of the time information. The standardized API interface is used for upper-layer applications to call and obtain time information. In a preferred embodiment of the present invention, the Beidou timing module is connected to the system mainboard via an RS232 serial port, wherein the serial port baud rate is set to 9600bps. The time data adopts the NMEA-0183 standard format and is updated at a frequency of once per second. To ensure the real-time nature of the time information, the driver uses an interrupt mode to read the data and sets the interrupt priority to the highest level of the system.

[0164] As a preferred embodiment of the present invention, refer to Figure 3 As shown in the figure, the distributed time synchronization service implementation process includes:

[0165] The distributed soft bus technology of the Dianhong operating system is used to implement a high-precision time synchronization service framework across devices, which involves defining the data structure and communication protocol of the time synchronization service, and implementing a time information transmission mechanism based on the distributed soft bus. In a specific embodiment of the present invention, the device discovery function of the distributed soft bus is configured to scan the network once every 5 seconds. When a new device is discovered, the system can complete the connection establishment within 2 seconds. In addition, the average time consumption of the registration and release process of the time synchronization service is controlled within 100 milliseconds to ensure the efficient operation of the system.

[0166] Create a time synchronization service framework and define the service interface. The main functions include obtaining the current time (providing system time with millisecond accuracy), setting the system time (allowing authorized applications to adjust the time), and synchronizing the time with the Beidou system (triggering synchronization operations with the Beidou timing module).

[0167] The distributed soft bus of the Dianhong operating system is used to realize the time information transmission across devices, the time synchronization nodes in the network are automatically identified through the device discovery function, and the service management capability is used to manage the life cycle and status of the time synchronization service.

[0168] A unified communication interface based on a distributed soft bus realizes the registration, publishing and subscription of time synchronization services. The registration process provides service description and interface information to the system, the publishing process broadcasts service availability to other nodes in the network, and the subscription allows other nodes to receive real-time time updates.

[0169] A remote procedure call (RPC) mechanism based on a distributed soft bus is implemented to support time synchronization operations across devices, including defining an RPC interface, implementing serialization and deserialization of calls, and designing an error handling mechanism. In a preferred embodiment of the present invention, the timeout of the remote procedure call (RPC) mechanism is set to 500 milliseconds, and a maximum of three retries are allowed after a timeout occurs. In order to improve data transmission efficiency, this embodiment uses the Protocol Buffers format for serialization, so that the average serialization and deserialization time can be controlled within 1 millisecond.

[0170] Set the Beidou timing module as the primary time source, including specifying the Beidou timing module as the highest priority time source in the time synchronization service configuration, and implement an automatic synchronization mechanism to ensure that the system time is consistent with the Beidou time.

[0171] As a preferred embodiment of the present invention, the timing service network isolation and secure communication process is as follows: Figure 4 As shown, including:

[0172] A dedicated timing service virtual local area network (VLAN) is created in the Dianhong operating system and a unique identifier is assigned to it, which involves configuring VLAN tags and corresponding network devices to ensure that the timing service traffic is logically separated from other network traffic. In the embodiment of the present invention, the VLAN ID range of the timing service virtual local area network (VLAN) is set between 3000-3999. Firewall rules restrict that only devices in a specific IP address segment (such as 192.168.1.0 / 24) are allowed to access the timing service.

[0173] Configure the security policy of the timing service communication domain, including defining the device types and service types allowed to access the timing service VLAN, and setting firewall rules and access control lists (ACLs) to restrict unauthorized traffic from entering the timing service network.

[0174] Implement a role-based access control (RBAC) mechanism. Define roles for different types of devices and services, and assign corresponding access rights to each role.

[0175] Implement access control logic in the timing service communication interface to filter data transmission requests based on device identity and service type, including authentication and authorization checks at the application layer.

[0176] Implement data encryption, integrity verification, and identity authentication. Depending on specific needs, you can choose a secure communication protocol dedicated to the Beidou system, or a PTP protocol that supports IEEE 1588-2019 security extensions, or a DTLS protocol suitable for UDP communication. These protocols provide data encryption (such as using the AES-256 algorithm), message authentication codes (such as HMAC) for integrity verification, and identity authentication mechanisms based on certificates or pre-shared keys.

[0177] Configure the system log function to record all key operations and data exchange behaviors within the timing service communication domain, including setting up the log server, defining the log format and storage strategy. The log should contain key information such as timestamp, operation type, device identification, access results, etc.

[0178] Leveraging the resource isolation capabilities of the Dianhong operating system, independent computing and storage resources are allocated to the timing service, which involves configuring the system's resource manager to ensure that the timing service has enough dedicated CPU time, memory space, and storage capacity without interference from other services.

[0179] As a preferred embodiment of the present invention, the software integrity protection process is as follows: Figure 5 As shown, including:

[0180] Implement integrity check at startup. Perform digital signature verification on key software modules related to timing at system startup, and establish a software module whitelist, allowing only verified modules to be loaded. In the embodiment of the present invention, the average time for digital signature verification at system startup does not exceed 2 seconds. The runtime memory integrity check is performed every 5 minutes, and each check covers at least 95% of the critical memory area.

[0181] Perform runtime integrity monitoring. During system operation, periodically check and calculate the key memory areas of the timing service, and set an appropriate check frequency and range to balance security and system performance.

[0182] Implement file system integrity protection. Use access control lists (ACLs) and file system encryption technology to prevent unauthorized modification of timing-related files. At the same time, implement a file operation audit mechanism to record all access and modification operations to key files.

[0183] Establish a software update mechanism. Implement a software update mechanism based on digital signatures to ensure that only certified update packages can be installed. At the same time, design a rollback mechanism to allow recovery to the previous stable version when the update fails.

[0184] As a preferred embodiment of the present invention, refer to Figure 6 As shown in Figure 2, the anomaly detection process mainly includes the following steps:

[0185] Collect time synchronization data from multiple nodes in the distributed network. Each node records the deviation between its local time and the Beidou timing module. The system is configured with an appropriate sampling frequency to ensure timely acquisition of the time synchronization status of each node in the network.

[0186] The collected raw data is preliminarily processed to remove obvious outliers and unify the data from different nodes to the same time base.

[0187] The exponentially weighted moving average (EWMA) method is used to analyze the time synchronization data within the preset time period. The calculation formula of EWMA is as follows:

[0188] S t =λ*X t +(1-λ)*S t-1

[0189] Among them, S t is the current EWMA value, X t is the current observation value, S t-1is the previous EWMA value, and λ is the smoothing factor (0<λ≤1). In a specific embodiment of the present invention, the smoothing factor λ in the EWMA method is optimized to be 0.3. The system samples at a frequency of 10 times per second and calculates the EWMA mean and standard deviation once at the end of each minute.

[0190] Calculate the statistical characteristics of time deviation, including but not limited to EWMA mean and standard deviation. The standard deviation is calculated as follows:

[0191]

[0192] Where σ is the standard deviation, X i is a single value, μ is the mean, and N is the number of values.

[0193] The dynamic threshold is set based on the 3-sigma principle to determine whether an abnormality occurs. The threshold calculation formula is as follows:

[0194] Upper threshold = μ + 3σ

[0195] Lower threshold = μ-3σ

[0196] Among them, μ is the EWMA mean and σ is the standard deviation. In order to ensure the accuracy and real-time performance of anomaly detection, the calculation period of the 3-sigma dynamic threshold is set to 5 minutes.

[0197] When an abnormality is detected, the corresponding operation is performed. The abnormality judgment conditions are:

[0198] If X t < lower threshold or X t > the upper threshold, it is considered abnormal.

[0199] Among them, X t is the time deviation value of the current observation.

[0200] When an anomaly is detected, the system performs corresponding operations, including but not limited to: automatically switching to a pre-configured backup Beidou time source, recording the abnormal event (including timestamp, abnormal type and related statistical data), and sending alarm information through the message mechanism of the Dianhong operating system. In a specific embodiment of the present invention, when a time synchronization anomaly is detected, the system can complete the switch to the backup time source within 100 milliseconds. The abnormal event record includes key information such as the timestamp accurate to milliseconds, the abnormal type, the current EWMA value and the standard deviation.

[0201] The timing protection isolation method for Beidou high-precision time synchronization based on the Dianhong operating system described in the present invention, in a typical application scenario of the present invention, for a large-scale distributed network containing 100 nodes, this method can complete the time synchronization of the entire network within 5 seconds. Even when the system load increases by 50%, the reduction in time synchronization accuracy is controlled within 10%, which fully demonstrates the efficiency and stability of the method. This method makes full use of the characteristics of the Dianhong operating system and provides a comprehensive solution for the time synchronization needs in distributed systems.

[0202] The beneficial effects of the present invention are as follows:

[0203] (1) The present invention makes full use of the distributed soft bus characteristics of the Dianhong operating system to achieve efficient and reliable cross-device time synchronization. This method significantly improves the time synchronization accuracy and efficiency in a distributed environment.

[0204] (2) The present invention constructs a network partitioning function based on the operating system level, realizing multi-level security isolation of timing services. This innovative isolation scheme provides a strong underlying security guarantee, effectively preventing unauthorized access and malicious tampering.

[0205] (3) The present invention utilizes the software integrity protection feature of the Dianhong operating system to achieve full life cycle security protection of the timing service from startup to operation, greatly enhancing the system's credibility and anti-attack capabilities.

[0206] (4) The present invention adopts the exponentially weighted moving average (EWMA) method for time synchronization monitoring, combined with the distributed characteristics of the Dianhong operating system, to achieve an efficient and reliable anomaly detection mechanism. This method is particularly suitable for complex large-scale distributed system environments and can quickly identify and handle time synchronization anomalies.

[0207] (5) The present invention uses the BeiDou satellite navigation system as a high-precision time source and deeply integrates it with the Dianhong operating system to achieve higher-precision time synchronization and meet the smart grid's growing demand for time synchronization accuracy.

[0208] (6) The present invention designs a backup time source management mechanism, which can automatically or manually switch to the backup time source when the main time source (Beidou timing module) fails, thereby improving the reliability and continuity of the system.

[0209] Through the above innovations, the present invention significantly improves the accuracy, reliability and security of time synchronization in distributed systems. Compared with the prior art, the present invention not only solves the technical problems of high-precision time synchronization, but also provides a comprehensive security protection solution, which is particularly suitable for complex distributed system environments such as smart grids that have high requirements for time synchronization. The implementation of the present invention will greatly improve the operating efficiency and reliability of the power system and provide important technical support for the development of smart grids.

[0210] On the other hand, an embodiment of the present invention also provides a timing protection isolation device for Beidou high-precision time synchronization, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the timing protection isolation method for Beidou high-precision time synchronization as described above.

[0211] The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0212] The memory may include various types of storage units, such as system memory, read-only memory (ROM), and permanent storage. Among them, ROM can store static data or instructions required by the processor or other modules of the computer. The permanent storage device may be a readable and writable storage device. The permanent storage device may be a non-volatile storage device that does not lose the stored instructions and data even after the computer is powered off. In some embodiments, the permanent storage device uses a large-capacity storage device (such as a magnetic or optical disk, flash memory) as a permanent storage device. In some other embodiments, the permanent storage device may be a removable storage device (such as a floppy disk, optical drive). The system memory may be a readable and writable storage device or a volatile readable and writable storage device, such as a dynamic random access memory. The system memory may store some or all instructions and data required by the processor at run time. In addition, the memory may include any combination of computer-readable storage media, including various types of semiconductor memory chips (DRAM, SRAM, SDRAM, flash memory, programmable read-only memory), and disks and / or optical disks may also be used. In some embodiments, the memory may include a readable and / or writable removable storage device, such as a laser disc (CD), a read-only digital versatile disc (e.g., DVD-ROM, double-layer DVD-ROM), a read-only Blu-ray disc, an ultra-density optical disc, a flash memory card (e.g., SD card, mini SD card, Micro-SD card, etc.), a magnetic floppy disk, etc. The computer-readable storage medium does not include carrier waves and transient electronic signals transmitted wirelessly or wired.

[0213] The memory stores executable codes, and when the executable codes are processed by the processor, the processor can execute part or all of the methods described above.

[0214] On the other hand, an embodiment of the present invention further provides a computer-readable storage medium, which stores computer-executable instructions, and the computer-executable instructions are used to enable a computer to execute the timing protection isolation method for Beidou high-precision time synchronization as described above.

[0215] It will be appreciated by those skilled in the art that all or some of the steps and systems in the disclosed method above may be implemented as software, firmware, hardware and appropriate combinations thereof. Some physical components or all physical components may be implemented as software executed by a processor, such as a central processing unit, a digital signal processor or a microprocessor, or may be implemented as hardware, or may be implemented as an integrated circuit, such as an application specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer storage medium (or a non-transitory medium) and a communication medium (or a temporary medium). As known to those skilled in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, disk storage or other magnetic storage devices, or any other medium that may be used to store desired information and may be accessed by a computer. Furthermore, it is well known to those skilled in the art that communication media typically embodies computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0216] In the above description of this specification, the description with reference to the terms "one embodiment / example", "another embodiment / example" or "certain embodiments / examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0217] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the claims and their equivalents.

[0218] The above is a specific description of the preferred implementation of the present invention, but the present invention is not limited to the embodiments. Those skilled in the art may make various equivalent modifications or substitutions without violating the spirit of the present invention. These equivalent modifications or substitutions are all included in the scope defined by the claims of this application.

Claims

1. A timing protection isolation method for Beidou high-precision time synchronization, characterized in that: The method comprises the following steps: Integrated Beidou timing module; According to the Beidou timing module, configure the time synchronization service; Create a communication domain; According to the communication domain, set integrity check; Based on the integrity check and the time synchronization service, time synchronization monitoring is performed to complete timing protection isolation.

2. The method according to claim 1, characterized in that The integrated Beidou timing module comprises the following steps: Integrate the Beidou timing module into the Dianhong operating system, configure the driver and standardized communication interface, and complete the integration of the Beidou timing module.

3. The method according to claim 1, characterized in that The configuration of the time synchronization service according to the Beidou timing module comprises the following steps: Setting the Beidou timing module as a time source; According to the time source, obtaining system time data; Use the device discovery function of the distributed soft bus to establish communication links between devices; A time synchronization service is configured based on the communication link and the system time data.

4. The method according to claim 1, characterized in that The creation of a communication domain comprises the following steps: Configure the timing service virtual LAN; Define access control mechanisms; The communication domain is created according to the timing service virtual local area network and the access control mechanism.

5. The method according to claim 1, characterized in that: The step of setting the integrity check according to the communication domain comprises the following steps: According to the communication domain, digitally sign the timing service related software modules and establish a software module whitelist; Checksum calculations are performed on the key memory areas of the timing service, and the check frequency and range are set; According to the software module whitelist and the inspection frequency and scope, an access control list is used to protect timing-related files, and access and modification behaviors to key files are recorded to complete integrity verification.

6. The method according to claim 1, characterized in that The timing protection isolation method of Beidou high-precision time synchronization also includes the following steps: Configure anomaly detection algorithms, use the exponentially weighted moving average method to monitor and analyze time synchronization data, and calculate the mean and standard deviation of time deviations.

7. The method according to claim 1, characterized in that The timing protection isolation method of Beidou high-precision time synchronization also includes the following steps: Set up an alternate time source; When the Beidou timing module fails, switch to the backup time source.

8. Beidou high-precision time synchronization timing protection isolation system, characterized in that: The system comprises: The first module is used to integrate the Beidou timing module; The second module is used to configure the time synchronization service according to the Beidou timing module; The third module is used to create a communication domain; The fourth module is used to set integrity check according to the communication domain; The fifth module is used to perform time synchronization monitoring based on the integrity check and the time synchronization service to complete timing protection isolation.

9. A Beidou high-precision time synchronization timing protection isolation device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the Beidou high-precision time synchronization timing protection isolation method as described in any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to enable a computer to execute the timing protection isolation method for Beidou high-precision time synchronization as described in any one of claims 1 to 7.

Images