A dispatching and scheduling system for power safety strategy

Abstract

The present invention relates to the field of cyberspace security technology, and in particular to a scheduling and orchestration system for electric power safety strategies, the system comprising: an initial unit, for abstracting communication primitives and communication attributes of a communication protocol, and binding the communication primitives to a communication interface; a component unit, for serializing the communication primitives without programming language characteristics to generate serialized data, registering the serialized data with a communication framework to generate a communication object, and combining different communication objects into a number of communication components; an editing unit, for registering, deregistering or retrieving communication components; a deserialization unit, for deserializing communication primitives and communication attributes; and a running unit, for building a general API list. The units of the present invention are processed collaboratively to solve the real-time nature of the security strategy and the incompatibility of communication, and further improve the security and timeliness of the scheduling and orchestration system for the electric power safety strategy.

Description

Technical Field

[0001] The present invention relates to the field of cyberspace security technology, and in particular to a scheduling and orchestration system for electric power safety strategies. Background Art

[0002] Due to the significant differences between the current power system-specific network architecture and traditional IT networks, the power system is a critical infrastructure that requires high-availability and low-latency network security strategies, equipment diversity and heterogeneity, etc., which are different from other industries to ensure the effectiveness of real-time monitoring and control. The current power system's network security technology system integration and security response are generally achieved by establishing a security operation center and using manual processing and automated scripts after manual verification. However, it has the defects of limited response speed, possible delays caused by manual intervention, and is not suitable for large-scale rapid response needs.

[0003] The Chinese patent application publication number: CN112415959A, discloses an edge-cloud collaborative industrial information-physical system active security response method and architecture, which belongs to the field of security defense. The architecture includes cloud layer, network layer and field layer. The cloud layer adopts service chain orchestration technology for strategy The network security service chain and the field security service chain are obtained by mapping the services. The orchestrated network security service chain is parsed to obtain the flow control command, which is sent to the network layer to ensure the communication security between the cloud and the edge. The network layer uses the elastic mechanism to improve the reliability of the service chain, receives the field security service chain sent by the cloud layer and sends it to the field layer; the field layer uses the task evaluation model to coordinate the conflicts between the edge and cloud strategies, obtains the edge task scheduling table, and schedules the protection tasks of the field layer. This method combines the characteristics of industrial information-physical systems in cloud environments, and uses the edge-cloud collaborative protection mechanism to perform active security collaborative protection on the network layer and the field layer respectively, so as to meet the real-time performance of the system while improving the system security.

[0004] Chinese patent application publication number: CN115426272A, discloses a future network test facility architecture system that supports large-scale cloud-network integration. The invention discloses a future network test facility architecture system that supports large-scale cloud-network integration, which is based on cross-regional cloud data centers and edge networks, takes network virtualization and software definition as technical routes, builds a resource virtualization layer to realize virtualization management and scheduling of network, computing and storage resources; uses network virtualization technology to build a virtual network environment with independent resources; uses software definition technology to realize customization and flexible expansion of network and IT capabilities in the virtual network environment; uses an orchestrator that integrates network and service orchestration to realize the reorganization and orchestration of network and IT capabilities; builds a test portal for the user service layer to enable users to flexibly and independently carry out future network tests; the invention constructs a large-scale, virtualized, programmable, scalable, open, testable and controllable test verification environment that provides different test users with resource isolation, flexible resource scheduling, and redefinable functions, and is independent of specific future network implementation technical solutions.

[0005] However, the above method has the following problems: it does not solve the effectiveness, real-time performance, and communication incompatibility of security policies when transmitting commands through different architecture layers, and does not solve the security between different virtual networks. Summary of the invention

[0006] To this end, the present invention provides a scheduling and orchestration system for electric power safety policies to overcome the problems in the prior art of not solving the effectiveness, real-time performance, and communication incompatibility of safety policies when transmitting commands through different architecture layers, and not solving the problem of security between different virtual networks.

[0007] To achieve the above object, the present invention provides a scheduling and scheduling system for power safety strategies, comprising: An initialization unit, which is used to obtain the communication primitives and communication properties of the communication protocol through abstraction, and to perform binding processing on the communication primitives and the communication interface; A component unit connected to the initial unit, used for registering the serialized data with the communication framework to generate a communication object, and combining different communication objects into a plurality of communication components; wherein the serialized data is generated by serializing the communication primitive without programming language characteristics; An editing unit connected to the component unit, used to register, deregister or search and discover the communication component, and determine the optimal component through a load response priority strategy during the search and discovery process, wherein the load response priority strategy is to determine the optimal component according to the association value and the response time; A deserialization unit, which is connected to the initialization unit and the editing unit respectively, and is used to perform deserialization processing on the communication primitive and the communication attribute; The running unit is connected to the deserialization unit and is used to build a common API list for communication interaction.

[0008] Furthermore, the initial unit comprises: An extraction subunit, which is used to sort a number of communication primitives identified according to the communication protocol to construct a primitive execution model, wherein the communication primitives are continuous communication segments during the execution of the communication protocol; An attribute subunit, which is used to identify data attributes, connection attributes and transmission attributes of the communication protocol; The binding subunit is connected to the extraction subunit and is used to complete the binding configuration of the communication primitive to the communication interface.

[0009] Furthermore, the component unit comprises: A sequence subunit, connected to the bundling subunit, for performing a serialization operation on the communication primitive in a manner not based on specific programming language characteristics to generate serialized data, and registering the serialized data with a communication framework to generate the communication object; The container subunit is connected to the sequence subunit and is used to integrate the communication objects to form a plurality of communication components.

[0010] Furthermore, the editing unit includes: A registration subunit is connected to the container subunit and is used to send a registration request to a registration center using the registration information collected in the communication component, and to receive a registration result returned by the registration center, and to perform subsequent component registration or re-registration or record an error log based on the registration result.

[0011] Furthermore, the editing unit also includes: an anti-registration subunit, which is connected to the container subunit and the registration subunit respectively, and is used to send anti-registration information to the registration subunit, set identification information in the communication component according to the received authorization information, and confirm whether the communication component is to be anti-registered based on the anti-registration result returned by the registration center; The deregistration information includes an application for deregistering the communication component, and the authorization information includes confirmation of deregistering the communication component or stopping deregistering the communication component.

[0012] Furthermore, the editing unit also includes: A retrieval subunit is connected to the container subunit, and is used to edit the retrieval request of the communication component and send it to the registration center, and receive the retrieval component list returned by the registration center, and determine the optimal component according to the retrieval component list and the load response priority strategy.

[0013] Furthermore, the deserialization unit uses a deserialization tool to perform deserialization processing on the communication primitives and the communication attributes, and captures and processes errors in the deserialization process.

[0014] Furthermore, the registration subunit, upon receiving the anti-registration information, compares the anti-registration information with the registration result, and issues the authorization information according to the comparison result, wherein: Counting the overlap between the anti-registration information and the keywords in the registration result, if the overlap is greater than or equal to a preset overlap, the authorization information is a confirmation anti-registration communication component; If the overlap is less than the preset overlap, the authorization information is to stop the anti-registration communication component; The preset overlap degree is positively correlated with the total number of characters in the communication component corresponding to the anti-registration information.

[0015] Furthermore, the operation unit sends a heartbeat packet to each device, performs a heartbeat detection on each device according to a response, and receives and stores status data returned by each device.

[0016] Further, the load response priority strategy of the retrieval subunit includes comparing the association value calculated using the priority weight with the preset association value, arranging the priority components according to the comparison result, and selecting the priority component corresponding to the minimum response time as the optimal component; The priority weight is set according to the priority standard of the retrieval component, the response time is obtained by sequentially allocating the retrieval request to each of the priority components, and the preset association value is positively correlated with the number of priority standards of the retrieval component.

[0017] Compared with the prior art, the beneficial effect of the present invention is that the system of the present invention generates serialized data by serializing communication primitives without programming language characteristics, so that data interaction can be achieved between systems developed in different programming languages, and information can be exchanged by serialized data, breaking down language barriers and improving development flexibility, so that developers can choose appropriate languages ​​according to functional requirements, and conveniently integrate new and old technologies. Through serialized data transmission without programming language characteristics, old system functions can be reused, reducing overall development costs. When the system is migrated to different platforms, there is no need to change the serialized data processing logic, ensuring stable data communication, and the communication primitive data in the memory can be serialized and stored in files and data Persistent storage such as libraries, such as serializing and saving key configuration information transmitted over the network, can accurately restore the data status when the system restarts or recovers from a fault, providing convenience for data backup and recovery. By regularly storing serialized data, the system can quickly recover to a specific state when a problem occurs, ensuring business continuity. Complex data structures can be converted into compact serialized formats, reducing data volume, improving network transmission efficiency, and reducing bandwidth costs. Serialized data with programming language characteristics provides a clear interface, making communication between different modules or different systems of the system clearer, reducing coupling, facilitating maintenance and upgrades, and effectively improving the safety and timeliness of the scheduling and orchestration system of the power safety strategy.

[0018] Furthermore, the present invention performs serialization operations on communication primitives in a manner that adopts non-specific programming language characteristics to generate serialized data. The serialized data of non-specific programming languages ​​can be conveniently stored in various storage media, such as file systems, databases, etc. For example, after the data is serialized into JSON, it can be directly saved as a JSON file, or stored in a database that supports the JSON format (such as MongoDB). This method makes the storage of data independent of a specific programming language or system, thereby improving the portability of the data. When data migration is required, it is only necessary to copy the serialized data file or database record to a new environment to easily restore the data. Different operating systems and hardware platforms may have different ways of storing and processing data. The non-specific language serialization method can shield these differences and ensure the compatibility of data between different platforms. For example, using ProtocolBuffer sSerialized data can be transmitted and stored on different operating systems such as Windows, Linux, macOS, etc., and can be parsed and used on hardware devices of different architectures (such as x86, ARM, etc.), which facilitates the deployment and operation of software between different platforms. The serialization method with non-specific programming language characteristics is adopted to separate the serialization and deserialization logic of the data from the specific business code. In this way, when the serialization method or data structure needs to be modified, it will not have much impact on the business code, reducing the coupling degree of the code and improving the maintainability of the code. With the development of the business, the data structure may change. The serialization method of non-specific language usually has good scalability and can adapt to the evolution of data structure. The serialization method of non-specific language is usually optimized and has a faster serialization and deserialization speed, which further improves the security and timeliness of the scheduling and orchestration system of the power safety strategy.

[0019] Furthermore, the present invention adopts microservice technology and microservice architecture to split the system into multiple independent small services. Each service can be independently horizontally expanded according to its own business needs. Through the automated scaling mechanism, microservices can dynamically adjust resources according to real-time business loads. Microservices communicate with each other through lightweight interfaces. Each service has an independent code base and data storage, and the dependencies between them are loose, which makes it easier to maintain, update and upgrade a single service without causing a chain reaction on other services. Since microservices run independently, when a microservice fails, a new instance can be quickly started to replace the failed instance to restore the normal operation of the service. At the same time, the cause of the failure can be quickly located through the monitoring and logging system, and targeted repairs can be performed to reduce the impact time of the failure on the business, further improving the security and timeliness of the scheduling and orchestration system of the power safety strategy.

[0020] Furthermore, the present invention sets an editing unit to register, deregister and search for communication components, allowing new communication components to be easily added to the system, just like plug-and-play devices. Newly developed message queue communication components can quickly work with other components through registration, without the need for complex system reconstruction, thereby enhancing the overall function of the system. The editing unit grasps the information of registered communication components to facilitate resource allocation. For example, in a cloud computing environment, network bandwidth, memory and other resources are reasonably allocated according to the needs of network communication components registered on each virtual machine, thereby avoiding resource competition and improving resource utilization. Component registration forms a system component directory, allowing developers to clearly understand the composition of communication components in the system, facilitating maintenance and troubleshooting. For example, when troubleshooting network communication failures, related components can be quickly located from the registration information to shorten the fault repair time. When a communication component is no longer in use, deregistration can release its occupied space. Resources, timely unregister to prevent resource leakage, ensure long-term stable operation of the system. If the communication component does not release resources correctly after use, system resources will be exhausted after multiple operations, causing the system to crash. The unregistration mechanism can effectively avoid such problems, disable communication components with security vulnerabilities and unregister them, and prevent malicious use of vulnerabilities to attack the system. For example, if a communication component is found to have a remote code execution vulnerability, timely unregistration can prevent hackers from exploiting the vulnerability to invade the system and ensure system security. Developers or system modules can quickly find the required communication components through retrieval and discovery methods, and obtain real-time status information of communication components through retrieval and discovery functions, such as operating status, resource usage, etc. For example, in data center network management, network communication component performance indicators can be quickly retrieved and discovered, performance bottlenecks and potential faults can be discovered in a timely manner, further improving the safety and timeliness of the scheduling and orchestration system of the power safety strategy.

[0021] Furthermore, the present invention constructs the general API list by setting up the running unit. When developers are developing projects, they do not need to search for the required APIs one by one in numerous documents or code libraries. Through the general API list, they can quickly locate the APIs that meet specific functional requirements, just like selecting tools in a comprehensive tool library, which greatly reduces the time cost of finding APIs and improves the development speed. When developers find that there are already APIs in the list that meet some functional requirements, they can call them directly without rewriting the code to implement the same function, which not only saves development time but also reduces the possibility of code errors. The general API list provides unified standards and specifications for different APIs, which enables APIs developed from different sources and different technology stacks to coexist in one system. The general API list constructed by the running unit can be adapted and optimized for different platforms. Developers can select the corresponding API according to the target platform to ensure that the system can run normally on different platforms. The general API list makes the system architecture clearer, and developers can clearly understand which APIs are used in the system and their functions and calling relationships, which is very helpful for system maintenance and upgrades, and further improves the security and timeliness of the scheduling and orchestration system of the power safety strategy.

[0022] Furthermore, the present invention sets an editing unit to determine the optimal component through a load response priority strategy according to a retrieval component list. The editing unit can select the most suitable component from the retrieval component list according to the current specific needs of the system. By comprehensively evaluating each component in the retrieval component list, the editing unit can avoid selecting components that may become system performance bottlenecks. The editing unit can eliminate such potential bottleneck components by analyzing the interaction relationship and performance indicators between components to ensure the stability and efficiency of the overall performance of the system. Different business scenarios have very different requirements for components. The editing unit can select the optimal component for a specific scenario based on the retrieval component list. The selection of the optimal component can also consider its fault-tolerant coordination capability with other components. The editing unit will select components that can jointly cope with various abnormal situations when working with other components to enhance the overall fault-tolerant capability of the system, thereby further improving the safety and timeliness of the scheduling and orchestration system of the power safety strategy. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 It is a structural schematic diagram of the dispatching and scheduling system of the power safety strategy of the present invention; Figure 2 It is a structural schematic diagram of an initial unit according to an embodiment of the present invention; Figure 3 A schematic diagram of a scheduling and arranging method according to an embodiment of the present invention; Figure 4 A schematic diagram of automatic arrangement of power-oriented security policies according to an embodiment of the present invention. DETAILED DESCRIPTION

[0024] In order to make the objects and advantages of the present invention more clearly understood, the present invention is further described below in conjunction with embodiments; it should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0025] The preferred embodiments of the present invention are described below with reference to the accompanying drawings. It should be understood by those skilled in the art that these embodiments are only used to explain the technical principles of the present invention and are not intended to limit the protection scope of the present invention.

[0026] It should be noted that, in the description of the present invention, terms such as "up", "down", "left", "right", "inside" and "outside" indicating directions or positional relationships are based on the directions or positional relationships shown in the drawings. This is merely for the convenience of description and does not indicate or imply that the device or element must have a specific orientation, be constructed and operated in a specific orientation. Therefore, it cannot be understood as a limitation on the present invention.

[0027] In addition, it should be noted that in the description of the present invention, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For those skilled in the art, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0028] See also Figure 1 As shown, it is a structural schematic diagram of the scheduling and scheduling system of the power safety strategy of the present invention, a scheduling and scheduling system of the power safety strategy includes: An initialization unit, which is used to obtain the communication primitives and communication properties of the communication protocol through abstraction, and to bind the communication primitives with the communication interface; A component unit connected to the initial unit, for registering serialized data with a communication framework to generate a communication object, and combining different communication objects into a plurality of communication components; wherein the serialized data is generated by serializing the communication primitive without programming language characteristics; An editing unit, which is connected to the component unit, is used to register, deregister or search for the communication component, and to determine the optimal component through a load response priority strategy during the search and discovery process. The load response priority strategy is to determine the optimal component according to the associated value and the response time; A deserialization unit, which is connected to the initialization unit and the editing unit respectively, and is used to deserialize the communication primitives and communication attributes; The running unit is connected to the deserialization unit to build a common API list for communication interaction.

[0029] Specifically, the system of the present invention generates serialized data by serializing communication primitives without programming language characteristics. Data interaction can be achieved between systems developed in different programming languages. Information can be exchanged through serialized data, breaking down language barriers and improving development flexibility. Developers can choose appropriate languages ​​according to functional requirements, facilitating the integration of new and old technologies. Through serialized data transmission without programming language characteristics, old system functions can be reused to reduce overall development costs. When the system is migrated to different platforms, there is no need to change the serialized data processing logic, ensuring stable data communication. The communication primitive data in the memory can be serialized and stored in files, databases and other persistent storages. For example, the key configuration information transmitted over the network can be serialized and saved, and the data status can be accurately restored when the system is restarted or recovered from a fault, which facilitates data backup and recovery. By regularly storing serialized data, the system can be quickly restored to a specific state when a problem occurs, ensuring business continuity. Complex data structures can be converted into a compact serialized format, reducing data volume, improving network transmission efficiency, and reducing bandwidth costs. The serialized data with programming language characteristics provides a clear interface, making communication between different modules or different systems in the system clearer, reducing coupling, facilitating maintenance and upgrades, and effectively improving the safety and timeliness of the scheduling and orchestration system of the power safety strategy.

[0030] See also Figure 2 As shown, it is a schematic diagram of the structure of the initial unit of an embodiment of the present invention. The initial unit includes an extraction subunit, an attribute subunit and a bundling subunit, wherein: An extraction subunit, which is used to sort a number of communication primitives identified according to the communication protocol to construct a primitive execution model, wherein the communication primitive is a continuous communication segment during the execution of the communication protocol; An attribute subunit, which is used to identify data attributes, connection attributes, and transmission attributes of the communication protocol; The binding subunit is connected to the extraction subunit to complete the binding configuration of the communication primitive to the communication interface.

[0031] It can be understood that the process of identifying several communication primitives in a communication protocol is to first collect and study the protocol documents. These documents describe in detail the design goals, functional characteristics, data formats, operating procedures, etc. of the protocol, understand the overall architecture and working principles of the protocol, clarify the communication entities involved in the protocol and the interactions between them, and then determine the protocol hierarchy and scope. Then analyze the flow of data and control information, such as requests and responses for connection establishment, signals for connection closure, etc., and finally analyze its input parameters and output results.

[0032] It is understandable that the dependencies, preconditions and postconditions of several communication primitives and the time sequence of the communication process are analyzed, and the communication primitives are sorted, starting from the starting primitive, and the subsequent primitives are gradually added to ensure that the execution of each primitive is in accordance with the logical and time sequence. For primitives that are executed concurrently or in parallel, their representation in the model should be determined according to the provisions of the protocol and the actual situation. For example, parallel arrows or specific symbols can be used to indicate that these primitives can be executed simultaneously. The constructed primitive execution model is documented, and the function, execution order and relationship between each primitive are described in detail. It can be expressed in a variety of ways such as text description, flow chart, state machine diagram, etc.

[0033] It is understandable that for those skilled in the art, identifying data attributes, connection attributes and transmission attributes of a communication protocol is prior art and will not be described in detail herein.

[0034] It is understandable that, for those skilled in the art, completing the binding configuration of the communication primitive to the communication interface is a prior art and will not be described in detail herein.

[0035] Specifically, the component unit includes a sequence subunit and a container subunit, wherein: A sequence subunit, which is connected to the binding subunit, is used to perform serialization operations on communication primitives in a manner that is not specific to a programming language, generate serialized data, and register the serialized data with a communication framework to generate a communication object; The container subunit is connected to the sequence subunit and is used to integrate various communication objects to form a number of communication components.

[0036] Specifically, the present invention performs serialization operations on communication primitives in a manner that adopts non-specific programming language characteristics to generate serialized data. The serialized data of non-specific programming languages ​​can be conveniently stored in various storage media, such as file systems, databases, etc. For example, after the data is serialized into JSON, it can be directly saved as a JSON file, or stored in a database that supports the JSON format (such as MongoDB). This method makes the storage of data independent of a specific programming language or system, and improves the portability of the data. When data migration is required, it is only necessary to copy the serialized data file or database record to a new environment to easily restore the data. Different operating systems and hardware platforms may have different ways of storing and processing data. The non-specific language serialization method can shield these differences and ensure the compatibility of data between different platforms. For example, using ProtocolBuffer sSerialized data can be transmitted and stored on different operating systems such as Windows, Linux, macOS, etc., and can be parsed and used on hardware devices of different architectures (such as x86, ARM, etc.), which facilitates the deployment and operation of software between different platforms. The serialization method with non-specific programming language characteristics is adopted to separate the serialization and deserialization logic of the data from the specific business code. In this way, when the serialization method or data structure needs to be modified, it will not have much impact on the business code, reducing the coupling degree of the code and improving the maintainability of the code. With the development of the business, the data structure may change. The serialization method of non-specific language usually has good scalability and can adapt to the evolution of data structure. The serialization method of non-specific language is usually optimized and has a faster serialization and deserialization speed, which further improves the security and timeliness of the scheduling and orchestration system of the power safety strategy.

[0037] Specifically, the editing units include: The registration subunit is connected to the container subunit and is used to send a registration request to the registration center through the registration information collected in the communication component, and receive the registration result returned by the registration center, and perform subsequent component registration or re-registration or record error logs according to the registration result.

[0038] In a specific embodiment, the process of the registration subunit registering the communication component includes: Collect registration information in the communication component; Select the registration center for the corresponding communication component in the microservice architecture; Send a registration request to the registration center through registration information; The registration center returns the registration result to the editing unit. If the registration request is successful, the editing unit performs subsequent component registration. If the registration request fails, the editing unit re-registers according to the returned registration result, or records an error log.

[0039] Specifically, the present invention adopts microservice technology and microservice architecture to split the system into multiple independent small services. Each service can be independently horizontally expanded according to its own business needs. Through the automated scaling mechanism, microservices can dynamically adjust resources according to real-time business loads. Microservices communicate through lightweight interfaces. Each service has an independent code base and data storage, and the dependencies between them are loose, which makes it easier to maintain, update and upgrade a single service without causing a chain reaction on other services. Since microservices run independently, when a microservice fails, a new instance can be quickly started to replace the failed instance and restore the normal operation of the service. At the same time, the cause of the failure can be quickly located through the monitoring and logging system, and targeted repairs can be performed to reduce the impact time of the failure on the business, further improving the security and timeliness of the scheduling and orchestration system of the power safety strategy.

[0040] Specifically, the editing unit also includes: The deregistration subunit is connected to the container subunit and the registration subunit respectively, and is used to send the deregistration information to the registration subunit, set the identification information in the communication component according to the received authorization information, and confirm whether the communication component is deregistered based on the deregistration result returned by the registration center; The deregistration information includes an application for deregistration of the communication component, and the authorization information includes confirmation of deregistration of the communication component or stopping of deregistration of the communication component.

[0041] In a specific embodiment, the process of the deregistration subunit deregistering the communication component includes: Setting identification information in the communication component; The registration center searches for the corresponding communication component based on the identification information and deletes it.

[0042] Specifically, the editing unit also includes: The retrieval subunit is connected to the container subunit and is used to send the retrieval request of the editing communication component to the registration center, and receive the retrieval component list returned by the registration center, and determine the optimal component according to the retrieval component list and the load response priority strategy.

[0043] In a specific embodiment, the process of searching and discovering the communication component by the retrieval subunit includes: Editing a retrieval request for a communication component; The registration center retrieves relevant components according to the received search request, generates and returns a search component list; The retrieval subunit determines the optimal component according to the retrieval component list through the load response priority strategy.

[0044] It can be understood that the registration center is a storage management center that registers communication components.

[0045] Specifically, the present invention sets an editing unit to register, deregister and search for communication components, allowing new communication components to be easily added to the system, just like plug-and-play devices. The newly developed message queue communication component can quickly work with other components through registration, without the need for complex system reconstruction, thereby enhancing the overall function of the system. The editing unit grasps the information of registered communication components to facilitate resource allocation. For example, in a cloud computing environment, network bandwidth, memory and other resources are reasonably allocated according to the needs of network communication components registered on each virtual machine, thereby avoiding resource competition and improving resource utilization. Component registration forms a system component directory, allowing developers to clearly understand the composition of communication components in the system, facilitating maintenance and troubleshooting. For example, when troubleshooting network communication failures, related components can be quickly located from the registration information to shorten the fault repair time. When a communication component is no longer in use, deregistration can release its occupied space. Resources, timely unregister to prevent resource leakage, ensure long-term stable operation of the system. If the communication component does not release resources correctly after use, system resources will be exhausted after multiple operations, causing the system to crash. The unregistration mechanism can effectively avoid such problems, disable communication components with security vulnerabilities and unregister them, and prevent malicious use of vulnerabilities to attack the system. For example, if a communication component is found to have a remote code execution vulnerability, timely unregistration can prevent hackers from exploiting the vulnerability to invade the system and ensure system security. Developers or system modules can quickly find the required communication components through retrieval and discovery methods, and obtain real-time status information of communication components through retrieval and discovery functions, such as operating status, resource usage, etc. For example, in data center network management, network communication component performance indicators can be quickly retrieved and discovered, performance bottlenecks and potential faults can be discovered in a timely manner, further improving the safety and timeliness of the scheduling and orchestration system of the power safety strategy.

[0046] Specifically, the deserialization unit uses a deserialization tool to deserialize communication primitives and communication properties, and captures and handles errors in the deserialization process.

[0047] In a specific embodiment, the process of the deserialization unit deserializing the communication primitives and the communication attributes includes: Use the deserialization tool to deserialize the communication primitives and communication properties. Catch errors during deserialization and handle them.

[0048] Specifically, the process of running a unit to build a common API manifest includes: Determine the functional scope of the general API list based on demand analysis, Define the operation type and parameter information of the common API list, Defines the corresponding format for the common API manifest.

[0049] Specifically, the present invention constructs a general API list by setting up an operation unit. When developers are developing a project, they do not need to search for the required APIs one by one in numerous documents or code libraries. Through the general API list, they can quickly locate the APIs that meet specific functional requirements, just like selecting tools in a comprehensive tool library, which greatly reduces the time cost of finding APIs and improves the development speed. When developers find that there are already APIs in the list that meet some functional requirements, they can call them directly without rewriting the code to implement the same function, which not only saves development time but also reduces the possibility of code errors. The general API list provides unified standards and specifications for different APIs, which enables APIs developed from different sources and different technology stacks to coexist in one system. The general API list constructed by the operation unit can be adapted and optimized for different platforms. Developers can select the corresponding API according to the target platform to ensure that the system can run normally on different platforms. The general API list makes the system architecture clearer, and developers can clearly understand which APIs are used in the system and their functions and calling relationships, which is very helpful for system maintenance and upgrades, and further improves the security and timeliness of the scheduling and orchestration system of the power safety strategy.

[0050] Specifically, the registration subunit, upon receiving the anti-registration information, compares the anti-registration information with the registration result, and issues authorization information according to the comparison result, wherein: Count the overlap between the keywords in the anti-registration information and the registration result. If the overlap is greater than or equal to the preset overlap, the authorization information is a confirmation anti-registration communication component. If the overlap is less than the preset overlap, the authorization information is to stop the anti-registration communication component.

[0051] In a specific embodiment, the preset overlap is set to 80%. If the overlap is 86% and is greater than the preset overlap, the authorization information is confirmation of the anti-registration communication component; If the overlap is 74% which is less than the preset overlap, the authorization information is to stop the anti-registration communication component.

[0052] Specifically, the preset overlap degree is positively correlated with the total number of characters in the communication component corresponding to the anti-registration information. It can be understood that the more characters contained in the communication component corresponding to the deregistration information, the more corresponding information keywords are stored, the more communication components related to it, and the higher the overlap of the deregistration requirements for the communication component, so the higher the preset overlap.

[0053] Specifically, the operation unit sends a heartbeat packet to each device, performs a heartbeat detection on each device according to the response status, and receives and stores the status data returned by each device.

[0054] In a specific embodiment, the process of the operation unit performing heartbeat detection on each device includes: Send heartbeat packets to each device and determine the operating status of each device based on the response. When the response time is greater than the preset time, the corresponding device is determined to be disconnected; When the number of response characters is less than the preset number of characters, it is determined that the corresponding device is disconnected; Receive and store status data returned by each device.

[0055] In one embodiment, the preset time is set to 2 seconds, the operation unit sends a heartbeat packet to device A, and if the time to receive a response from device A is 5 seconds, which is greater than the preset time, it is determined that device A is disconnected; In one embodiment, the preset number of characters is set to 64 bytes, the operation unit sends a heartbeat packet to the B device, and if the number of characters of the response returned by the B device is 32 bytes, which is less than the preset number of characters, it is determined that the B device is disconnected; Specifically, the preset time is positively correlated with the total number of heartbeat packet characters; It is understandable that the more characters in the heartbeat packet response, the larger the amount of data that needs to be transmitted. Under the same network conditions, the transmission time will theoretically increase accordingly, resulting in a longer response time. A larger total number of characters usually contains more information. The receiver needs to perform more parsing, calculations and other operations when processing this information, which increases the processing time and thus prolongs the response time. Therefore, the preset time is positively correlated with the total number of characters in the heartbeat packet.

[0056] Specifically, the number of preset characters is positively correlated with the total number of characters in the heartbeat packet; It can be understood that the more heartbeat packet response characters there are, the larger the amount of data that needs to be transmitted, and the receiver needs to perform more parsing, calculation and other operations when processing this information. The larger the total number of heartbeat packet characters, the larger the number of characters required to respond, so the preset number of characters is positively correlated with the total number of heartbeat packet characters.

[0057] Specifically, the load response priority strategy of the retrieval subunit includes comparing the association value calculated using the priority weight with the preset association value, arranging the priority components according to the comparison result, and selecting the priority component corresponding to the minimum response time as the optimal component; The priority weight is set according to the priority standard of the retrieval component, the response time is obtained by allocating the retrieval request to each priority component in turn, and the preset association value is positively correlated with the number of priority standards of the retrieval component.

[0058] Specifically, the process of the editing unit determining the optimal component through the load response priority strategy according to the retrieved component list includes: Determine the priority criteria for the search components and set priority weights for each priority criterion. The relevance value is calculated based on the priority weights of the priority criteria, Sort the components by priority based on the comparison of their association values ​​with the preset association values, If the correlation value is greater than the preset correlation value, the related component is determined to be a priority component; If the correlation value is less than or equal to the preset correlation value, the related component is determined to be a common component; Distribute the search requests to each priority component in order to obtain the response time. Select the priority component corresponding to the minimum response time as the optimal component. The preset relevance value is positively correlated with the number of priority criteria for the retrieval component.

[0059] In one embodiment, the retrieval component list includes three components: A, B and C. The priority standards of the retrieval components include e, f and g. The preset association value is 0.5, the priority weight of the e standard is 0.5, the priority weight of the f standard is 0.3, and the priority weight of the g standard is 0.2. Component A includes three standards: e, f and g, component B includes two standards: f and g, and component C includes two standards: e and g. The association value of A is 0.5+0.3+0.2=1, the association value of B is 0.3+0.2=0.5, and the association value of C is 0.5+0.2=0.7. Therefore, the priority components are sorted as A and C. The retrieval requests are allocated to each priority component in order, and the response time of component A is 0.5 seconds and the response time of component C is 0.8 seconds. Then, component A corresponding to the minimum response time of 0.5 seconds is selected as the optimal component.

[0060] It can be understood that, the more priority criteria a retrieval component has, the more associated components there are and the more associated items there are with the retrieval component, and therefore, the larger the preset association value is.

[0061] See also Figure 3 As shown, it is a schematic diagram of a scheduling arrangement method according to an embodiment of the present invention. In one embodiment, refer to Figure 3 From left to right, the method of the present invention is described: The first step is to complete the implementation of the underlying library of power communication, and abstract the communication primitives and communication properties of this communication protocol based on the underlying library for json description. The communication primitives include function functions, register addresses, parameters, reference values, etc., and complete the binding of the communication primitives and the communication implementation interface. The communication properties include the power equipment supported by this protocol, real-time properties, etc., and further complete the serialization of the communication primitives without programming language characteristics, and finally register with the communication framework. Finally, complete the componentization or containerization encapsulation of the completed communication objects of this protocol; The second step is to complete the logic of component registration, deregistration, and retrieval and cashback through the microservice mechanism; The third step is to deserialize the communication primitives and communication properties according to the specific programming language; Step 4: Based on the results of step 3, automatically build a general jsonized API list; Please cooperate Figure 3 See also Figure 4 As shown, it is a schematic diagram of automatic arrangement of security policies for power according to an embodiment of the present invention. In one embodiment, Figure 3 Each step in the deployment and configuration can be deployed on different computing nodes of microservices. When providing services to the outside, it can be called by SOAR, security management system, etc. Figure 4 As shown: the API interface layer is used to complete the communication interaction, which can be compatible with the intelligent electronic devices under the power system at the bottom and complete the integration with the automatic orchestration response system at the top. The adaptation method solves the problem of automatic orchestration communication response and further solves the problems of effectiveness, real-time performance and communication incompatibility of security strategies.

[0062] Specifically, the present invention sets an editing unit to determine the optimal component through a load response priority strategy according to a retrieval component list. The editing unit can select the most suitable component from the retrieval component list according to the current specific needs of the system. By comprehensively evaluating each component in the retrieval component list, the editing unit can avoid selecting components that may become system performance bottlenecks. The editing unit can eliminate such potential bottleneck components by analyzing the interaction relationship and performance indicators between components to ensure the stability and efficiency of the overall performance of the system. Different business scenarios have very different requirements for components. The editing unit can select the optimal component for a specific scenario based on the retrieval component list. The selection of the optimal component can also consider its fault-tolerant coordination capability with other components. The editing unit will select components that can jointly cope with various abnormal situations when working with other components to enhance the overall fault-tolerant capability of the system, thereby further improving the safety and timeliness of the scheduling and orchestration system of the power safety strategy.

[0063] So far, the technical solutions of the present invention have been described in conjunction with the preferred embodiments shown in the accompanying drawings. However, it is easy for those skilled in the art to understand that the protection scope of the present invention is obviously not limited to these specific embodiments. Without departing from the principle of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will fall within the protection scope of the present invention.

[0064] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A dispatching and scheduling system for power safety strategy, characterized in that: include: An initialization unit, which is used to obtain the communication primitives and communication properties of the communication protocol through abstraction, and to perform binding processing on the communication primitives and the communication interface; A component unit connected to the initial unit, used for registering the serialized data with the communication framework to generate a communication object, and combining different communication objects into a plurality of communication components; wherein the serialized data is generated by serializing the communication primitive without programming language characteristics; An editing unit connected to the component unit, used to register, deregister or search and discover the communication component, and determine the optimal component through a load response priority strategy during the search and discovery process, wherein the load response priority strategy is to determine the optimal component according to the association value and the response time; A deserialization unit, which is connected to the initialization unit and the editing unit respectively, and is used to perform deserialization processing on the communication primitive and the communication attribute; The running unit is connected to the deserialization unit and is used to build a common API list for communication interaction.

2. The power security strategy scheduling and scheduling system according to claim 1 is characterized in that: The initial unit comprises: An extraction subunit, which is used to sort a number of communication primitives identified according to the communication protocol to construct a primitive execution model, wherein the communication primitives are continuous communication segments during the execution of the communication protocol; An attribute subunit, which is used to identify data attributes, connection attributes and transmission attributes of the communication protocol; The binding subunit is connected to the extraction subunit and is used to complete the binding configuration of the communication primitive to the communication interface.

3. The power security strategy scheduling and scheduling system according to claim 2 is characterized in that: The component unit comprises: A sequence subunit, connected to the bundling subunit, for performing a serialization operation on the communication primitive in a manner not based on specific programming language characteristics to generate serialized data, and registering the serialized data with a communication framework to generate the communication object; The container subunit is connected to the sequence subunit and is used to integrate the communication objects to form a plurality of communication components.

4. The power security strategy scheduling and scheduling system according to claim 3 is characterized in that: The editing unit comprises: A registration subunit is connected to the container subunit and is used to send a registration request to a registration center using the registration information collected in the communication component, and to receive a registration result returned by the registration center, and to perform subsequent component registration or re-registration or record an error log based on the registration result.

5. The power security strategy scheduling and scheduling system according to claim 4 is characterized in that: The editing unit also includes: an anti-registration subunit, which is connected to the container subunit and the registration subunit respectively, and is used to send anti-registration information to the registration subunit, set identification information in the communication component according to the received authorization information, and confirm whether the communication component is to be anti-registered based on the anti-registration result returned by the registration center; The deregistration information includes an application for deregistering the communication component, and the authorization information includes confirmation of deregistering the communication component or stopping deregistering the communication component.

6. The power security strategy scheduling and scheduling system according to claim 5 is characterized in that: The editing unit also includes: A retrieval subunit is connected to the container subunit, and is used to edit the retrieval request of the communication component and send it to the registration center, and receive the retrieval component list returned by the registration center, and determine the optimal component according to the retrieval component list and the load response priority strategy.

7. The power security strategy scheduling and scheduling system according to claim 6, characterized in that: The deserialization unit uses a deserialization tool to perform deserialization processing on the communication primitives and the communication attributes, and captures and processes errors in the deserialization process.

8. The power security strategy scheduling and scheduling system according to claim 7, characterized in that: The registration subunit, upon receiving the anti-registration information, compares the anti-registration information with the registration result, and issues the authorization information according to the comparison result, wherein: Counting the overlap between the anti-registration information and the keywords in the registration result, if the overlap is greater than or equal to a preset overlap, the authorization information is a confirmation anti-registration communication component; If the overlap is less than the preset overlap, the authorization information is to stop the anti-registration communication component; The preset overlap degree is positively correlated with the total number of characters in the communication component corresponding to the anti-registration information.

9. The power security strategy scheduling and scheduling system according to claim 8, characterized in that: The operation unit sends a heartbeat packet to each device, performs a heartbeat detection on each device according to a response, and receives and stores status data returned by each device.

10. The power security strategy scheduling and scheduling system according to claim 9, characterized in that: The load response priority strategy of the retrieval subunit includes comparing the association value calculated using the priority weight with the preset association value, arranging the priority components according to the comparison result, and selecting the priority component corresponding to the minimum response time as the optimal component; The priority weight is set according to the priority standard of the retrieval component, the response time is obtained by sequentially allocating the retrieval request to each of the priority components, and the preset association value is positively correlated with the number of priority standards of the retrieval component.

Images