Time service system software and hardware security protection method and device based on multiple verification

Abstract

The invention discloses a time service system software and hardware security protection method and device based on multiple verification, and the method comprises the steps: carrying out the feature coding of the legality of a time service request, the time service behavior features and the time service environment state through building a three-layer verification architecture of a basic verification layer, a behavior verification layer and a context verification layer; generating verification data by obtaining a timestamp, a feature value, a context identifier and a behavior feature code and performing Hash operation; and executing a time service response strategy of authorization, re-request or rejection based on the deviation degree of the verification data. The technical problems that a single verification mode in an existing time service system is easy to break through, and complex attack scenes are difficult to deal with are solved. The technical scheme of multi-verification and multi-dimensional feature coding is adopted, all-around security protection of the time service request is achieved, the security and reliability of the time service system are remarkably improved, and security threats such as cheating attacks and identity forgery are effectively prevented.

Description

Technical Field

[0001] The present invention relates to the technical field of security protection of a timing system, and in particular to a method and a device for protecting the software and hardware security of a timing system based on a multiple verification mechanism. Background Art

[0002] With the rapid development of information technology, accurate time synchronization and timing services have become the core requirements of key infrastructure such as financial transactions, industrial control, power dispatching and communication networks. At present, the timing system mainly provides high-precision timing services through time sources such as GNSS (Global Navigation Satellite System). However, since the timing system is directly related to the safe operation of infrastructure, its own security protection has also become a focus of attention in the industry.

[0003] The existing security protection technologies of timing systems mainly include cryptographic-based identity authentication, data encryption transmission, and simple anomaly detection mechanisms. These technologies have the following prominent problems in practical applications:

[0004] 1. Single verification mechanism and insufficient protection measures. Existing timing systems generally use a single verification method, such as relying only on cryptographic signatures or simple identity authentication. Once this single protection mechanism is breached, the security of the entire system cannot be guaranteed. Especially in the face of diverse security threats such as GNSS signal spoofing, man-in-the-middle attacks, and replay attacks, the limitations of existing protection mechanisms are more obvious.

[0005] 2. Lack of a systematic security protection architecture. The current security design of the timing system is often fragmented and unsystematic, and a unified security protection framework has not been established. This makes it impossible to conduct comprehensive verification and linkage protection from multiple dimensions such as request legitimacy, behavioral characteristics, and environmental status. The overall protection capability of the system is insufficient, and security vulnerabilities are prone to occur. In addition, software and hardware protection measures are often separated and lack an effective coordination mechanism.

[0006] 3. The verification mechanism is rigid and has high performance overhead. The existing verification mechanism generally adopts static verification methods and fixed threshold standards, which cannot be adjusted intelligently according to the actual application scenario, system load and threat level. This rigid verification mechanism not only causes unnecessary system overhead and reduces the efficiency of timing services, but also easily leads to problems of over-protection or under-protection. Especially in scenarios with high concurrency and low latency requirements, excessive verification overhead will seriously affect system performance.

[0007] Therefore, it is urgent to design a timing system security protection solution with multiple verification mechanisms, software and hardware collaboration, and dynamic adaptive characteristics to effectively solve the above technical problems and improve the overall security protection capabilities of the timing system. This is not only of great significance to ensuring the security and reliability of timing services, but also an inevitable requirement for improving the security protection level of key infrastructure. Summary of the invention

[0008] In order to solve the technical problems of the existing timing system, such as the single verification dimension, insufficient feature extraction, and decentralized security protection structure, the present invention proposes a timing system software and hardware security protection method and device based on multiple verifications. The scheme provides a comprehensive timing system security protection solution by establishing a three-layer verification architecture, constructing multi-dimensional verification data, and realizing software and hardware collaborative protection.

[0009] To achieve the above purpose, the technical solution adopted by the present invention is as follows:

[0010] A method for protecting the software and hardware security of a timing system based on multiple verifications comprises the following steps:

[0011] S1, establish a three-layer verification architecture and build a verification system for feature coding, including the basic verification layer, the behavior verification layer and the context verification layer, which respectively encode the legitimacy of the timing request, the timing behavior characteristics and the timing environment status;

[0012] S2, constructing verification data, including obtaining a timestamp, a feature value, a context identifier, and a behavior feature code, and performing a hash operation on the timestamp, the feature value, the context identifier, and the behavior feature code to generate the verification data;

[0013] S3, execute timing security control, calculate the Euclidean distance ratio between the current verification data and the historical verification data as the deviation, and execute the timing response strategy of authorization, re-request or rejection based on the comparison result of the deviation with the preset threshold.

[0014] Furthermore, the process of establishing the three-layer verification architecture in S1 includes:

[0015] Determine the input and output data for each layer of verification;

[0016] Define data processing rules for each layer of verification;

[0017] Configure the timing security control parameters, set the first preset threshold and the second preset threshold of the verification data deviation, the first preset threshold is used to determine the trust boundary of the timing request, and the second preset threshold is used to determine the rejection boundary of the timing request;

[0018] Furthermore, the basic verification layer completes the feature encoding of the legitimacy of the timing request, including:

[0019] Verify the integrity of the GNSS timing signal and generate a 4-bit binary eigenvalue based on the verification result;

[0020] Detect the signal transmission channel status and encode the detection result into an 8-bit binary status value;

[0021] Verify the identity information of the requesting node and generate a 4-bit binary identity value;

[0022] The above eigenvalues ​​are combined in order to form a 16-bit binary basic eigenvalue.

[0023] Furthermore, the behavior verification layer completes the encoding of the timing request behavior characteristics, including:

[0024] Calculate the interval characteristics of adjacent timing requests and encode the time interval distribution into an 8-bit binary timing characteristic value;

[0025] Count the frequency characteristics of timing requests and encode the request frequency distribution into an 8-bit binary frequency characteristic value;

[0026] The above-mentioned time series characteristic values ​​and frequency characteristic values ​​are combined in sequence to form a 16-bit binary behavior characteristic code.

[0027] Furthermore, the context verification layer completes the feature encoding of the timing environment status, including:

[0028] Collecting GNSS signal parameters, and encoding the GNSS reception status into a 4-bit binary value;

[0029] Monitor the operating status of the timing service, including the timing accuracy level and the time source switching status, and encode the operating status into an 8-bit binary value;

[0030] Detecting a synchronization state of a backup clock, and encoding the synchronization state into a 4-bit binary value;

[0031] The above codes are combined in sequence to form a 16-bit binary context identifier.

[0032] Furthermore, the step of constructing verification data in S2 includes:

[0033] Generate timestamp information, the timestamp information is a 64-bit binary number, wherein the upper 32 bits are the UTC time value of the GNSS timing signal, and the lower 32 bits are the time source status and accuracy identifier;

[0034] The verification data is generated by constructing a formula using the verification feature value, and the formula is:

[0035] VF=HASH(T+K+C+B)

[0036] Wherein, T is the timestamp information code, K is the basic feature value code, C is the context identifier code, B is the behavior feature code code, HASH is the hash operation function, and "+" is the data concatenation operation;

[0037] Furthermore, the steps of executing timing security control in S3 include:

[0038] Calculate the Euclidean distance between the current VF and the most recent N verification data VF of the requester, and take the ratio of the Euclidean distance to the standard deviation of the most recent N verification data VF as the deviation of the VF;

[0039] When the deviation is less than the first preset threshold, authorizing the current timing request;

[0040] When the deviation is between the first preset threshold and the second preset threshold, requiring the requesting party to re-initiate the timing request;

[0041] When the deviation is greater than the second preset threshold, rejecting the current timing request and recording the abnormal information;

[0042] The present invention also provides a timing system software and hardware security protection device based on multiple verifications, the device comprising a core security area, an interface security area and a monitoring protection area, and a security data bus connecting the three areas;

[0043] Among them, the core security area is provided with a GNSS timing module, and the GNSS timing module is electrically connected to the backup clock unit, the time-space isolated safe operating environment and the verification processing unit, wherein the time-space isolated safe operating environment includes an independent processor and memory space for encrypting and authenticating the transmission channel; the backup clock unit is used for time maintenance when the GNSS signal is interrupted, and the verification processing unit is used for constructing verification data and performing timing security control.

[0044] The verification processing unit includes a timestamp generator, a feature data processor and a safety control executor, which are respectively used to generate timestamp information including UTC time value and time source status, complete hash operation of verification data, calculate verification data deviation and execute corresponding timing response strategy;

[0045] The interface security zone is provided with a multi-protocol communication interface and a data buffer supporting TCP / IP, serial port and PTP, wherein the multi-protocol communication interface is electrically connected to the GNSS timing module through the security data bus and is used for request mode analysis, and the data buffer is electrically connected to the multi-protocol communication interface and is used for monitoring access frequency;

[0046] The monitoring protection area is provided with an environment perception module and a fault diagnosis unit, wherein the environment perception module is electrically connected to the GNSS timing module through the safety data bus and is used to collect GNSS signal characteristic data, and the fault diagnosis unit is electrically connected to the environment perception module and is used to evaluate the timing reliability.

[0047] Furthermore, it also includes a physical protection system arranged at the periphery of the entire device, and the physical protection system includes:

[0048] The anti-tampering layer adopts a conductive grid structure and forms a closed loop with the power-off protection circuit to detect and prevent physical intrusion;

[0049] The anti-penetration layer is arranged inside the anti-tampering layer and adopts a multi-layer PCB shielding design to prevent electromagnetic interference.

[0050] Further, the secure data bus includes:

[0051] A main data bus, connecting the GNSS timing module and the isolated execution environment;

[0052] A control bus connecting the multi-modal communication interface and the data buffer;

[0053] A monitoring bus connects the environment perception module and the fault diagnosis unit.

[0054] The present invention has the following beneficial effects:

[0055] (1) The present invention achieves multi-dimensional security protection for the timing system by establishing a three-layer verification architecture. The basic verification layer effectively ensures the legitimacy of the timing request through GNSS signal integrity verification, transmission channel status detection and node identity authentication; the behavior verification layer accurately identifies abnormal access patterns by analyzing the time interval and frequency characteristics of the timing request; the context verification layer comprehensively grasps the system operating environment by monitoring the GNSS reception status, timing accuracy level and clock synchronization status. The organic combination of the three layers of verification significantly improves the security protection capability of the system.

[0056] (2) The present invention innovatively proposes a method for constructing verification data, which combines the 64-bit timestamp information with the three-layer verification features through hash operations, ensuring the integrity and non-tamperability of the verification data. By calculating the Euclidean distance deviation of the verification data and setting a dual-threshold judgment mechanism, the system can accurately grade and verify the timing request, effectively improving the accuracy of anomaly detection.

[0057] (3) The present invention adopts a partition design of core security zone, interface security zone and monitoring protection zone, realizes the coordination between zones through a secure data bus, and establishes a complete software and hardware collaborative protection system. The core security zone ensures the reliability of the timing service through a secure operating environment and backup clock unit isolated in time and space; the interface security zone realizes secure data interaction through a multi-protocol communication interface and a data buffer; the monitoring protection zone provides real-time status monitoring through an environmental perception module and a fault diagnosis unit, so that the system has a complete in-depth defense capability.

[0058] (4) The present invention designs a multi-layer physical protection mechanism at the hardware level, including a conductive grid and power-off protection circuit of the anti-tampering layer, and a multi-layer PCB shielding design of the anti-penetration layer, which provides reliable physical security protection for the timing system. This design effectively prevents physical-level attack threats and improves the overall security of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] In order to more clearly illustrate the implementation of the present invention or the existing technical solutions, the following briefly introduces the drawings required to be used in the embodiments or the description of the prior art.

[0060] Figure 1 The present invention is a flowchart of a timing system security protection method based on multiple authentications.

[0061] Figure 2 This is the overall architecture diagram of the timing system. DETAILED DESCRIPTION

[0062] The following is a clear and complete description of the technical solutions in the embodiments of the invention in conjunction with the drawings in the embodiments of the invention. Obviously, the described embodiments are only part of the embodiments of the invention, not all of the embodiments. Based on the embodiments of the invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the invention.

[0063] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0064] Reference Figure 1 The main steps of the timing system software and hardware security protection method based on multiple verification provided by the present invention are as follows:

[0065] (1) Establish a three-layer verification architecture and construct a verification system for feature encoding, including a basic verification layer, a behavior verification layer, and a context verification layer, which respectively encode the legitimacy of the timing request, the timing behavior characteristics, and the timing environment status;

[0066] (2) constructing verification data, including obtaining a timestamp, a feature value, a context identifier, and a behavior feature code, and performing a hash operation on the timestamp, the feature value, the context identifier, and the behavior feature code to generate the verification data;

[0067] (3) Execute timing security control, calculate the Euclidean distance ratio between the current verification data and the historical verification data as the deviation, and execute the timing response strategy of authorization, re-request or rejection based on the comparison result of the deviation with the preset threshold.

[0068] As a preferred implementation scheme of the present invention, in step (1), a three-layer verification architecture is established to construct a verification system for feature coding, including a basic verification layer, a behavior verification layer, and a context verification layer, which respectively encode the legitimacy of the timing request, the timing behavior characteristics, and the timing environment status. The specific implementation process is as follows:

[0069] (1-1) Determine the input data and output data of each layer of verification. For the basic verification layer, its input data includes GNSS timing signals, signal transmission channel status information, and requesting node identity information, and the output data is a 16-bit binary basic feature value. For the behavior verification layer, its input data includes the timing request time interval and request frequency statistics, and the output data is a 16-bit binary behavior feature code. For the context verification layer, its input data includes GNSS signal parameters, timing service operation status, and backup clock synchronization status, and the output data is a 16-bit binary context identifier.

[0070] (1-2) Define the data processing rules for each layer of verification. In the basic verification layer, the GNSS timing signal integrity check is first performed. By checking the signal integrity, a 4-bit binary eigenvalue is generated, where the eigenvalue "1111" indicates that the signal is completely intact, the eigenvalue "0000" indicates that the signal is completely lost, and other values ​​indicate a partially intact state. Then, the signal transmission channel status is detected, and an 8-bit binary status value is generated by monitoring the channel status parameters, where the upper 4 bits represent the channel quality level and the lower 4 bits represent the channel security level. Finally, the request node identity authentication is performed, and a 4-bit binary identity identification value is generated by verifying the node identity information, and the identification value is compared with the preset authorization list.

[0071] (1-3) In the behavior verification layer, the timing request interval characteristics are first calculated, and an 8-bit binary timing characteristic value is generated by counting the time intervals of adjacent requests, where the upper 4 bits represent the interval level and the lower 4 bits represent the degree of fluctuation. Then, the request frequency characteristics are counted, and an 8-bit binary frequency characteristic value is generated by calculating the request frequency per unit time, where the upper 4 bits represent the frequency level and the lower 4 bits represent the frequency change trend.

[0072] (1-4) In the context verification layer, GNSS signal parameters are first collected, including signal strength, number of satellites and other parameters, and a 4-bit binary reception status code is generated, which reflects the signal quality level. Then the timing service operation status is monitored, including the timing accuracy level and the time source switching status, and an 8-bit binary operation status code is generated, in which the upper 4 bits represent the accuracy level and the lower 4 bits represent the time source status. Finally, the backup clock synchronization status is detected, and a 4-bit binary synchronization status code is generated by detecting the synchronization deviation with the main time source. This status code reflects the synchronization accuracy level.

[0073] (1-5) After completing the definition of data processing rules, you need to configure the timing security control parameters. Set the first preset threshold (trusted boundary) of the verification data deviation to 0.3, and the second preset threshold (rejection boundary) to 0.7. At the same time, determine the sample size of historical data and set the value range of the most recent N verification data. The recommended value is N = 10. In addition, you also need to configure the response strategy parameters, including the re-request waiting time (recommended 100ms) and the abnormal record retention period (recommended 30 days).

[0074] (1-6) Encode and integrate the verification data. For the basic feature value encoding, the GNSS signal feature value (4 bits), channel status value (8 bits) and identity value (4 bits) are combined in sequence to form a 16-bit binary basic feature value. For the behavior feature code encoding, the timing feature value (8 bits) and frequency feature value (8 bits) are combined in sequence to form a 16-bit binary behavior feature code. For the context identifier encoding, the receiving status code (4 bits), the running status code (8 bits) and the synchronization status code (4 bits) are combined in sequence to form a 16-bit binary context identifier.

[0075] As a preferred embodiment of the present invention, in step (2), the specific process of constructing the verification data is as follows:

[0076] (2-1) Generate timestamp information, which is represented by a 64-bit binary number, of which the upper 32 bits are used to store the UTC time value of the GNSS timing signal, and the lower 32 bits are used to store the time source status and accuracy identification. The UTC time value is counted in seconds starting from 00:00 on January 1, 1970, with an accuracy of nanoseconds. The time source status bit is used to identify whether the GNSS timing or the backup clock is currently used, and the accuracy identification bit is used to indicate the current timing accuracy level.

[0077] (2-2) Generate verification data by constructing a verification feature value formula. The formula is expressed as: VF = HASH (T + K + C + B), where T is the timestamp information code, K is the basic feature value code, C is the context identifier code, B is the behavior feature code code, HASH is the hash operation function, and "+" represents the data concatenation operation. In the specific implementation, each code is first concatenated in sequence, and the total length of the concatenated data is 112 bits, including 64-bit timestamp information, 16-bit basic feature value, 16-bit context identifier and 16-bit behavior feature code.

[0078] (2-3) As a preferred embodiment of the present invention, SHA-256 is used as the hash operation function, and the spliced ​​112-bit data is input into the SHA-256 algorithm to obtain a 256-bit hash value as the final verification data. The reason for selecting the SHA-256 algorithm is that it has good anti-collision and unidirectional properties, and can effectively ensure the uniqueness and unforgeability of the verification data.

[0079] (2-4) As a preferred embodiment of the present invention, each time verification data is generated, the system will associate the data with the verification data history record of the corresponding requester for storage, for subsequent timing security control. The history record uses a circular queue to store the most recent N verification data. When new verification data is generated, the oldest record will be overwritten. This storage method not only ensures the timeliness of the verification data, but also avoids the continuous growth of storage space.

[0080] As a preferred embodiment of the present invention, in step (3), the specific process of executing the timing security control is as follows:

[0081] (3-1) Calculate the Euclidean distance between the current verification data VF and the requester's most recent N verification data VF. In practical applications, the value of N is usually set to 10, that is, the most recent 10 verification data are considered. When calculating the Euclidean distance, the 256-bit verification data is grouped into 8-bit groups and converted into 32 integer values, which constitute a point in a 32-dimensional space. For any two verification data VF1 and VF2, their Euclidean distance calculation formula is:

[0082]

[0083] Among them, VF1[i] represents the i-th integer value.

[0084] (3-2) Calculate the standard deviation of the most recent N validation data VF. The standard deviation calculation is also based on converting the validation data into 32-dimensional space points. For each dimension, calculate the mean and variance of the N data points in that dimension, then average the variances of the 32 dimensions and take the square root to get the standard deviation. The standard deviation reflects the degree of fluctuation of the historical validation data and is used to normalize the Euclidean distance.

[0085] (3-3) Calculate the deviation, that is, divide the Euclidean distance between the current VF and the historical verification data VF by the standard deviation of the historical verification data VF. This calculation method takes into account the volatility of historical data, making the determination of deviation more adaptive. For example, for requesters with large fluctuations in historical data, the system can tolerate a larger Euclidean distance; while for requesters with stable historical data, even a smaller Euclidean distance may result in a higher deviation.

[0086] (3-4) Based on the calculated deviation, the system executes the corresponding timing response strategy. When the deviation is less than the first preset threshold (the default is 0.3), it indicates that the current request is highly consistent with the historical behavior pattern. The system will authorize the current timing request and send the timing data to the requester through a secure channel. The sent timing data includes information such as the current UTC time, timing accuracy level, and time source status.

[0087] (3-5) When the deviation is between the first preset threshold and the second preset threshold (the default value is 0.7), it indicates that there is a certain abnormality in the current request, but it has not yet reached the level of obvious danger. In this case, the system requires the requester to re-initiate the timing request. When re-requesting, the requester is required to initiate after a random delay (the default range is 50ms to 150ms) to avoid potential synchronization attacks. At the same time, the system will record the relevant information of this request for subsequent behavior analysis.

[0088] (3-6) When the deviation is greater than the second preset threshold, it indicates that the current request is obviously abnormal and there may be security risks. At this time, the system will reject the current timing request and record the abnormal information. The abnormal information includes detailed data such as request time, requester identification, verification data, deviation, etc. This information will be saved in the security log, and the default retention period is 30 days. System administrators can analyze these abnormal records to promptly discover and deal with potential security threats.

[0089] Reference Figure 2 The present invention also provides a timing system hardware and software security protection device based on multiple verifications, the overall structure of which includes a core security area, an interface security area, and a monitoring protection area, as well as a security data bus connecting the three areas. The composition and working process of the device are now described in detail in conjunction with a specific implementation method.

[0090] A GNSS timing module is set up in the core security zone, which is connected to the backup clock unit, the time-space isolated safe operation environment and the verification processing unit through electrical connection. The GNSS timing module is responsible for receiving satellite timing signals and analyzing them, and the backup clock unit provides time keeping function when the GNSS signal is interrupted. The time-space isolated safe operation environment contains independent processors and memory space, which are used to encrypt and authenticate the transmission channel, and ensure the security of data transmission through hardware isolation.

[0091] The verification processing unit is a key component of the core security zone, including the timestamp generator, feature data processor and security control actuator. The timestamp generator is responsible for generating timestamp information containing UTC time value and time source status; the feature data processor completes the hash operation of the verification data; and the security control actuator is responsible for calculating the deviation of the verification data and executing the corresponding timing response strategy. These components are closely connected through the internal bus to ensure the real-time and security of data processing.

[0092] Communication interfaces and data buffers that support multiple protocols are set up in the interface security zone. The multi-protocol communication interface supports TCP / IP, serial port and PTP protocols, and is electrically connected to the GNSS timing module through a secure data bus, mainly used for request pattern analysis. The data buffer is electrically connected to the multi-protocol communication interface, responsible for monitoring the access frequency, and preventing access request overload through a buffering mechanism.

[0093] An environmental perception module and a fault diagnosis unit are set up in the monitoring protection area. The environmental perception module is electrically connected to the GNSS timing module through a secure data bus, and is mainly used to collect GNSS signal characteristic data; the fault diagnosis unit is electrically connected to the environmental perception module, and is responsible for evaluating the reliability of timing and promptly discovering abnormal conditions in system operation.

[0094] To further enhance safety, a physical protection system is also provided on the periphery of the entire device, and the physical protection system includes an anti-tampering layer and an anti-penetration layer. The anti-tampering layer adopts a high-density conductive grid structure, and the grid adopts a serpentine or maze-like conductive line arrangement to ensure that the shell cannot be opened without damaging the grid. The conductive grid and the power-off protection circuit form a closed loop for continuous detection. When it is detected that the conductive grid is cut, deformed or damaged, the power-off protection circuit is immediately triggered to cut off the power supply of the core safety zone. The power-off protection circuit adopts an independent power supply design to ensure that the protection function can be maintained when the main power supply is cut off.

[0095] The anti-penetration layer is set inside the anti-tampering layer, directly covering the core circuit board, and adopts a multi-layer PCB shielding design. The design includes a ground shielding layer, a multi-layer metal shielding layer, a signal layer and a power layer, and a bottom ground layer structure from the outside to the inside. Special materials are used to fill the interlayers to increase the difficulty of physical penetration. Each conductive layer is interconnected through vias to form a Faraday cage effect, which effectively shields electromagnetic interference. At the same time, the signal line adopts differential routing and grounding design to provide additional EMI protection capabilities.

[0096] The secure data bus includes the main data bus, the control bus, and the monitoring bus. The main data bus connects the GNSS timing module and the isolated execution environment, and is responsible for transmitting the core timing data; the control bus connects the multi-modal communication interface and the data buffer, and is responsible for transmitting control instructions; the monitoring bus connects the environmental perception module and the fault diagnosis unit, and is responsible for transmitting monitoring data. This layered bus architecture ensures the isolated transmission of different types of data, improving the security and reliability of the system.

Claims

1. A method for protecting the software and hardware security of a timing system based on multiple verifications, characterized in that: The steps include: S1, establish a three-layer verification architecture and build a verification system for feature coding, including the basic verification layer, the behavior verification layer and the context verification layer, which respectively encode the legitimacy of the timing request, the timing behavior characteristics and the timing environment status; S2, constructing verification data, including obtaining a timestamp, a feature value, a context identifier, and a behavior feature code, and performing a hash operation on the timestamp, the feature value, the context identifier, and the behavior feature code to generate the verification data; S3, execute timing security control, calculate the Euclidean distance ratio between the current verification data and the historical verification data as the deviation, and execute the timing response strategy of authorization, re-request or rejection based on the comparison result of the deviation with the preset threshold.

2. The method according to claim 1, characterized in that The process of establishing the three-layer verification architecture in S1 includes the following steps in order: Determine the input and output data for each layer of verification; Define data processing rules for each layer of verification; Configure the timing security control parameters, set the first preset threshold and the second preset threshold of the verification data deviation, the first preset threshold is used to determine the trust boundary of the timing request, and the second preset threshold is used to determine the rejection boundary of the timing request.

3. According to claim 2, a method for protecting the hardware and software security of a timing system based on multiple verifications is characterized in that: The basic verification layer completes the feature encoding of the legitimacy of the timing request, including: Verify the integrity of the GNSS timing signal and generate a 4-bit binary eigenvalue based on the verification result; Detect the signal transmission channel status and encode the detection result into an 8-bit binary status value; Verify the identity information of the requesting node and generate a 4-bit binary identity value; The above eigenvalues ​​are combined in order to form a 16-bit binary basic eigenvalue.

4. According to claim 2, a method for protecting the software and hardware security of a timing system based on multiple verifications is characterized in that: The behavior verification layer completes the encoding of the timing request behavior characteristics, including: Calculate the interval characteristics of adjacent timing requests, and encode the time interval distribution into an 8-bit binary timing characteristic value; count the frequency characteristics of timing requests, and encode the request frequency distribution into an 8-bit binary frequency characteristic value; The above-mentioned time series characteristic values ​​and frequency characteristic values ​​are combined in sequence to form a 16-bit binary behavior characteristic code.

5. The method for protecting the software and hardware security of a timing system based on multiple verifications according to claim 2, characterized in that: The context verification layer completes the feature encoding of the timing environment state, including: Collecting GNSS signal parameters, and encoding the GNSS reception status into a 4-bit binary value; Monitor the operating status of the timing service, including the timing accuracy level and the time source switching status, and encode the operating status into an 8-bit binary value; Detecting a synchronization state of a backup clock, and encoding the synchronization state into a 4-bit binary value; The above codes are combined in sequence to form a 16-bit binary context identifier.

6. The method for protecting the hardware and software security of a timing system based on multiple verifications according to claim 1, characterized in that: The step of constructing verification data in S2 includes: Generate timestamp information, the timestamp information is a 64-bit binary number, wherein the upper 32 bits are the UTC time value of the GNSS timing signal, and the lower 32 bits are the time source status and accuracy identifier; The verification data is generated by constructing a formula using the verification feature value, and the formula is: VF=HASH(T+K+C+B) Among them, T is the timestamp information code, K is the basic feature value code, C is the context identifier code, B is the behavior feature code code, HASH is the hash operation function, and "+" is the data splicing operation.

7. The method for protecting the hardware and software security of a timing system based on multiple verifications according to claim 1, characterized in that: The step of executing timing security control in S3 includes: Calculate the Euclidean distance between the current VF and the most recent N verification data VF of the requester, and take the ratio of the Euclidean distance to the standard deviation of the most recent N verification data VF as the deviation of the VF; When the deviation is less than the first preset threshold, authorizing the current timing request; When the deviation is between the first preset threshold and the second preset threshold, requiring the requesting party to re-initiate the timing request; When the deviation is greater than the second preset threshold, the current timing request is rejected and abnormal information is recorded.

8. A timing system software and hardware security protection device based on multiple verifications, characterized in that: The device includes a core security zone, an interface security zone and a monitoring protection zone, and a security data bus connecting the three zones; The core security zone is provided with a GNSS timing module, which is electrically connected to a backup clock unit, a time-space isolated safe operation environment and a verification processing unit, wherein the time-space isolated safe operation environment includes an independent processor and memory space for encrypting and authenticating the transmission channel; the backup clock unit is used for time maintenance when the GNSS signal is interrupted, and the verification processing unit is used for constructing verification data and performing timing security control; The verification processing unit includes a timestamp generator, a feature data processor and a safety control executor, which are respectively used to generate timestamp information including UTC time value and time source status, complete hash operation of verification data, calculate verification data deviation and execute corresponding timing response strategy; The interface security zone is provided with a multi-protocol communication interface and a data buffer supporting TCP / IP, serial port and PTP, wherein the multi-protocol communication interface is electrically connected to the GNSS timing module through the security data bus and is used for request mode analysis, and the data buffer is electrically connected to the multi-protocol communication interface and is used for monitoring access frequency; The monitoring protection area is provided with an environment perception module and a fault diagnosis unit, wherein the environment perception module is electrically connected to the GNSS timing module through the safety data bus and is used to collect GNSS signal characteristic data, and the fault diagnosis unit is electrically connected to the environment perception module and is used to evaluate the timing reliability.

9. A timing system software and hardware security protection device based on multiple verifications according to claim 8, characterized in that: Also included is a physical protection system disposed around the entire device, the physical protection system comprising: The anti-tampering layer adopts a conductive grid structure and forms a closed loop with the power-off protection circuit to detect and prevent physical intrusion; The anti-penetration layer is arranged inside the anti-tampering layer and adopts a multi-layer PCB shielding design to prevent electromagnetic interference.

10. A timing system software and hardware security protection device based on multiple verifications according to claim 8, characterized in that: The secure data bus comprises: A main data bus, connecting the GNSS timing module and the isolated execution environment; A control bus connecting the multi-modal communication interface and the data buffer; A monitoring bus connects the environment perception module and the fault diagnosis unit.

Images