Time synchronization information security examination method and system based on self-timekeeping

Abstract

The invention discloses a time synchronization information security review method and system based on self-timekeeping, and relates to the data processing and password technology, and the method comprises the steps: receiving clock information input of a higher-precision external node, and taking the clock information input as a reference to measure the time difference of a local clock; a time difference model is trained in advance according to historical time difference data; according to the trained time difference model, the measured time difference is examined based on data division and data fitting, so that an examination result is obtained; and updating the local clock according to the review result. According to the embodiment of the invention, training and fitting are carried out on a large amount of historical data at a local clock end, so that a relatively accurate and reliable data change trend on a specific data bit in clock information is obtained, and preliminary prediction and review functions on the specific data bit in the future are realized; the possibility of successful transmission of illegal information and the influence of the illegal information on the time synchronization precision of the system are greatly reduced, and the safety and reliability of the time synchronization system are remarkably improved.

Description

Technical Field

[0001] The present application relates to the fields of data processing and cryptographic technology, and in particular to a time synchronization information security review method and system based on self-timekeeping. Background Art

[0002] Time is a quantity that records the duration of each event and the intervals between them. Time synchronization is to use some technical means to make each device in the same system have the same time reference. Common technical means can be divided into two types according to the transmission method: wireless transmission and wired transmission. The former often includes short / long wave timing and satellite timing, while wired time synchronization based on optical fiber transmission is more widely used because of its mature long-distance and large-capacity optical communication technology and the characteristics of flexible optical network networking.

[0003] In the actual clock information interaction process of the time synchronization system, the common technical means used by attackers is to modify the clock information between two or more nodes to implement replay attacks, integrity attacks, and the transmission of illegal information. Traditional cryptographic technologies such as encryption authentication and key management can protect clock information to a certain extent, but due to the fluctuation of channel transmission delay, system noise, and external temperature and humidity, some specific data bits of the clock information have random changes. By seizing the time synchronization server permissions, attackers can directly add illegal information to the clock information or even tamper with the data. However, the above random changes make it impossible for cryptographic technology to directly and effectively identify the illegal information mixed in it, which is a security risk in the existing time synchronization system. Summary of the invention

[0004] The embodiments of the present application provide a time synchronization information security review method and system based on self-timekeeping, which are used to greatly reduce the possibility of successful illegal information transmission and its impact on the system time synchronization accuracy, and significantly improve the security and reliability of the time synchronization system.

[0005] The present application provides a method for security review of time synchronization information based on self-timekeeping, including:

[0006] Receive clock information input from an external node with higher precision and use it as a reference to measure the time difference of the local clock;

[0007] Pre-training a time difference model based on historical time difference data, wherein the process of training the time difference model is divided into data division and data fitting, wherein the data division is used to divide the historical time difference data into high digits, median digits and low digits according to different data change trends, and the data fitting is used to perform segmented fitting of the time difference according to the divided data digits;

[0008] According to the trained time difference model, the measured time difference is reviewed based on data partitioning and data fitting to obtain review results;

[0009] Update the local clock based on the review results.

[0010] Optionally, receive clock information input from an external node with higher precision and use it as a reference to measure the time difference of the local clock to meet the following requirements:

[0011]

[0012] in, Indicates the time difference of the measured local clock, T indicates the local clock size at this moment, Indicates the clock information of the external node.

[0013] Optionally, pre-training the time difference model based on historical time difference data includes training a high-digit model using the following steps:

[0014] After receiving the clock information at the local clock end, the corresponding time difference is calculated;

[0015] The training model of p-order parameters is constructed based on the data characteristics of the time synchronization system to meet the following requirements:

[0016]

[0017] in, Indicates the high digit of the time difference after the nth time synchronization information exchange; are the training model parameters, Used to indicate right The p-order parameter model means that the prediction of the n-th data requires p historical data for modeling and calculation;

[0018] According to Cramer's law, construct the data matrix ,matrix and the parameter matrix satisfy:

[0019]

[0020]

[0021]

[0022]

[0023] The model parameters are estimated by the following matrix equation:

[0024] .

[0025] Optionally, pre-training the time difference model based on historical time difference data also includes configuring a fluctuation range for the median and discarding low digits.

[0026] Optionally, the measured time differences are reviewed based on the trained time difference model based on data partitioning and data fitting, respectively, including:

[0027] The time difference obtained at the current The high digits The prediction results of the training model with the corresponding p-order parameters after the rounding operation is completed In the same situation, the review result is normal;

[0028] If they are not the same, a counter M and a judgment threshold N are introduced. Counter M is used to compare whether the high digits of the time difference calculated at the current moment and the previous moment are the same. If they are the same, counter M is incremented. If they are different, the count is reset to zero. When M is greater than or equal to N, the high digit of the time difference is The same value appears at least N times in a row, but it is different from the predicted value. If M is not the same as N, the review result is normal; if M is less than N, the review result is abnormal.

[0029] Optionally, reviewing the measured time difference based on data partitioning and data fitting according to the trained time difference model also includes: when M is less than N, introducing a random integer in the range of 5 to 15 as a determination threshold.

[0030] Optionally, based on the review results, updating the local clock includes:

[0031] If the review result is normal, the current time difference is used directly Update the local clock;

[0032] If the audit result is abnormal, the predicted value obtained by the training model is used Replace the high digit in the time difference , and use the newly obtained time difference data Update the local clock.

[0033] An embodiment of the present application also proposes a time synchronization information security review system based on self-keeping time, including a processor and a memory, wherein a computer program is stored on the memory, and when the computer program is executed by the processor, the steps of the time synchronization information security review method based on self-keeping time as described above are implemented.

[0034] The embodiments of the present application obtain relatively accurate and reliable data change trends on specific data bits in the clock information by training and fitting a large amount of historical data at the local clock end, thereby realizing preliminary prediction and review functions for specific data bits in the future, greatly reducing the possibility of successful illegal information transmission and its impact on the system time synchronization accuracy, and significantly improving the security and reliability of the time synchronization system.

[0035] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present application. Also, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0037] Figure 1 The overall process diagram of the time synchronization information security review method based on self-timekeeping in an embodiment of the present application is shown;

[0038] Figure 2 This is a schematic diagram of the high-bit number training model process of the time synchronization information security review method based on self-timekeeping in an embodiment of the present application;

[0039] Figure 3 The present invention provides an architectural diagram of a time synchronization information security review system based on self-timekeeping according to an embodiment of the present application. DETAILED DESCRIPTION

[0040] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0041] In view of the potential security risks of hidden transmission of illegal information on certain specific data bits of clock information in the time synchronization system, the embodiment of the present application provides a time synchronization information security review method based on self-keeping time. The self-keeping time technology can obtain relatively accurate data change trends on specific data bits of clock information by training and fitting a large amount of historical data at the local clock end, thereby realizing the preliminary prediction and review functions of specific data bits in the future, such as Figure 1 As shown, the method of the embodiment of the present application includes:

[0042] In step S101, a clock information input of an external node with higher precision is received, and the clock information input is used as a reference to measure the time difference of the local clock. In some embodiments, the clock information input of an external node with higher precision is received, and the clock information input of the external node with higher precision is used as a reference to measure the time difference of the local clock to meet the following conditions:

[0043] (1)

[0044] in, Indicates the time difference of the measured local clock, T indicates the local clock size at this moment, Indicates the clock information of the external node. When carrying illegal information, it will be synchronously fed back to the measured time difference The change in time difference can therefore be A security review of the data changes was conducted and it was found Possible illegal information.

[0045] In step S102, the time difference model is trained in advance based on the historical time difference data, and a large amount of time difference data of past moments can be stored and recorded. , , . . ., and ,

[0046] (2)

[0047] Where n represents the past history The number of transmissions.

[0048] The process of training the time difference model is divided into data division and data fitting. The data division is used to divide the historical time difference data into high digits, median digits and low digits according to different data change trends. The data fitting is used to perform segmented fitting of the time difference according to the divided data bits. The combination of the two can obtain a training model that is closer to the real data change trend.

[0049] In step S103, the measured time difference is reviewed based on data partitioning and data fitting according to the trained time difference model to obtain a review result.

[0050] In step S104, the local clock is updated according to the review result.

[0051] The method of the present application is applicable to but not limited to the NTP protocol, the PTP protocol and a dual / unidirectional time synchronization system.

[0052] In some embodiments, Figure 2As shown, pre-training the time difference model based on historical time difference data includes training a high-digit model using the following steps:

[0053] After receiving the clock information at the local clock end, the corresponding time difference is calculated;

[0054] The training model of p-order parameters is constructed based on the data characteristics of the time synchronization system to meet the following requirements:

[0055] (3)

[0056] in, Indicates the high digit of the time difference after the nth time synchronization information exchange; are the training model parameters, Used to indicate right The p-order parameter model means that predicting the n-th data requires p historical data for modeling and calculation. In theory, the larger the order p, the closer the data predicted by the model is to the real data.

[0057] According to Cramer's law, construct the data matrix ,matrix and the parameter matrix satisfy:

[0058] (4)

[0059] (5)

[0060] (6)

[0061] (7)

[0062] The model parameters are estimated by the following matrix equation:

[0063] (8).

[0064] In some embodiments, pre-training the time difference model based on historical time difference data also includes configuring a fluctuation range for the median and discarding low digits.

[0065] In a specific example, the median often fluctuates within a range, but the frequency of change is faster than that of the high number, and the self-conserving time technology cannot perform effective fitting review. In some embodiments, a corresponding fluctuation range can be configured, or the information change of the median can be temporarily ignored.

[0066] The randomness of low-bit changes is very large, and it is difficult to accurately represent the data change trend with a fitting curve. However, the impact of low-bit changes on the system synchronization accuracy is relatively limited. In systems that do not require high synchronization accuracy, this part of the data can be directly discarded to ensure the security of the system.

[0067] In some embodiments, Figure 1 As shown, the measured time difference is examined based on data partitioning and data fitting according to the trained time difference model, including:

[0068] The time difference obtained at the current The high digits The prediction results of the training model with the corresponding p-order parameters after the rounding operation is completed In the same case, the review result is normal, for example, the given review result value is 1.

[0069] If they are not the same, it is suspected that there is illegal information in the clock information at this moment. To ensure the safety of the system, it cannot be used immediately. Update the local clock, introduce counter M and judgment threshold N, counter M is used to compare whether the high digits of the time difference calculated at the current moment and the previous moment are the same. If they are the same, counter M increments, if they are different, the count is reset to zero. When M is greater than or equal to N, that is, the high digit of the time difference The same value appears at least N times in a row, but it is different from the predicted value. If the audit result is not the same, the audit result is normal. It can be considered that this situation is caused by the current environment or the change of the local clock. The clock information does not carry illegal information transmission. For example, if the audit result value is 1, the high-bit value at this moment can be directly Time difference Used for local clock update.

[0070] When M is less than N, the review result is abnormal, for example, the given review result value is 0.

[0071] In some embodiments, reviewing the measured time difference based on data partitioning and data fitting according to the trained time difference model also includes: when M is less than N, introducing a random integer in the range of 5 to 15 as a judgment threshold, which can better improve system security.

[0072] In some embodiments, based on the review result, updating the local clock includes:

[0073] If the review result is normal, the current time difference is used directly Update the local clock;

[0074] If the audit result is abnormal, the predicted value obtained by the training model is used Replace the high digit in the time difference , and use the newly obtained time difference data Update the local clock. For example, if the review result is 1, the current time difference is directly used. Update the local clock; if the audit result is 0, use the predicted value obtained by the training model Replace the high digit in the time difference , and use the newly obtained time difference data Update the local clock.

[0075] By processing data using the above method, illegal information in the clock information can be found in time, and the local clock can be updated after being replaced with the high-bit number predicted by the self-time training model. The method of the present application can minimize the loss of system time synchronization accuracy while ensuring system safety and reliability.

[0076] The embodiment of the present application also proposes an implementation case of a time synchronization information security review method based on self-timekeeping. Taking decimal as an example, assuming The resolution can reach picosecond level, that is, 10 -12 seconds, the data can be divided into more than 10 -9 Seconds divided into high digits, 10 -10 Seconds is the median, 10 -11 ~10 -12 Seconds are low-digit numbers, and the third-order high-digit training model shown in formula (9) is obtained in the data fitting. At the same time, in view of the actual situation that the high-digit numbers are all integers, the predicted values ​​will be rounded to integers before review. This may cause the system to have a quantization error of ±1, but it is still within an acceptable range.

[0077] (9)

[0078] Assuming that n is 97, 98, or 99, the corresponding high-digit numbers are 6, 8, and 13. At this time, n is 100, and the random determination threshold N is 10. The time synchronization information security review has the following situations.

[0079] Case 1: Time difference obtained by the time difference measurement module High digits is 8, and the predicted value of the trained model If the time difference is the same, the result of the data review module is 1, and the clock update module directly uses the current time difference Update the local clock.

[0080] Case 2: Time difference obtained by the time difference measurement module High digits is 11, and the predicted value of the trained model If the count value M is 1 and is less than the judgment threshold N, the result of the data review module is 0, and the clock update module needs to use the predicted value Alternative , and use the newly obtained time difference data Perform local clock update; if the count value M is 10, which is equal to the judgment threshold N, the result of the data review module is 1, and the clock update module directly updates the high-bit Time difference Used for local clock update.

[0081] The embodiment of the present application also proposes a time synchronization information security review system based on self-timekeeping, including a processor and a memory, wherein the memory stores a computer program, and when the computer program is executed by the processor, the steps of the time synchronization information security review method based on self-timekeeping are implemented. Figure 3 As shown, it mainly includes a time difference measurement module, a data storage module, a data training module, a data review module, a clock update module and a local clock.

[0082] The time difference measurement module calculates the difference between the local clock and the external node clock.

[0083] The data storage module needs to save a large amount of time difference data from past moments. , , . . ., and .

[0084] The data training module needs to complete the core function of self-time, that is, to train a time difference model based on a large amount of historical data.

[0085] The data review module needs to complete the review of the nth clock information based on the known training model to detect any illegal information that may exist therein.

[0086] The clock update module will update the local clock according to the review results of the data review module.

[0087] It should be noted that in the various embodiments of the present application, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "includes a ..." does not exclude the presence of other identical elements in the process, method, article or device including the element.

[0088] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0089] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for a terminal (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0090] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.

Claims

1. A time synchronization information security review method based on self-timekeeping, characterized in that: include: Receive clock information input from an external node with higher precision and use it as a reference to measure the time difference of the local clock; Pre-training a time difference model based on historical time difference data, wherein the process of training the time difference model is divided into data division and data fitting, wherein the data division is used to divide the historical time difference data into high digits, median digits and low digits according to different data change trends, and the data fitting is used to perform segmented fitting of the time difference according to the divided data digits; According to the trained time difference model, the measured time difference is reviewed based on data partitioning and data fitting to obtain review results; Update the local clock based on the review results.

2. The time synchronization information security review method based on self-timekeeping as claimed in claim 1, characterized in that: Receive clock information input from an external node with higher precision and use it as a reference to measure the time difference of the local clock to meet the following requirements: in, Indicates the time difference of the measured local clock, T indicates the local clock size at this moment, Indicates the clock information of the external node.

3. The time synchronization information security review method based on self-timekeeping as claimed in claim 1, characterized in that: Pre-training the time difference model based on historical time difference data includes training a high-order model using the following steps: After receiving the clock information at the local clock end, the corresponding time difference is calculated; The training model of p-order parameters is constructed based on the data characteristics of the time synchronization system to meet the following requirements: in, Indicates the high digit of the time difference after the nth time synchronization information exchange; are the training model parameters, Used to indicate right The p-order parameter model means that the prediction of the n-th data requires p historical data for modeling and calculation; According to Cramer's law, construct the data matrix ,matrix and the parameter matrix satisfy: The model parameters are estimated by the following matrix equation: 。 4. The time synchronization information security review method based on self-timekeeping as claimed in claim 3 is characterized in that: Pre-training the time difference model based on historical time difference data also includes configuring a fluctuation range for the median and discarding the low digits.

5. The time synchronization information security review method based on self-timekeeping as claimed in claim 3 is characterized in that: The measured time differences are reviewed based on the trained time difference model based on data partitioning and data fitting, including: The time difference obtained at the current The high digits The prediction results of the training model with the corresponding p-order parameters after the rounding operation is completed In the same situation, the review result is normal; If they are not the same, a counter M and a judgment threshold N are introduced. Counter M is used to compare whether the high digits of the time difference calculated at the current moment and the previous moment are the same. If they are the same, counter M is incremented. If they are different, the count is reset to zero. When M is greater than or equal to N, the high digit of the time difference is The same value appears at least N times in a row, but it is different from the predicted value. If M is not the same as N, the review result is normal; if M is less than N, the review result is abnormal.

6. The time synchronization information security review method based on self-timekeeping as claimed in claim 5, characterized in that: Examining the measured time difference based on data partitioning and data fitting according to the trained time difference model also includes: when M is less than N, introducing a random integer in the range of 5 to 15 as a determination threshold.

7. The time synchronization information security review method based on self-timekeeping as claimed in claim 5, characterized in that: Based on the review results, updating the local clock includes: If the review result is normal, the current time difference is used directly Update the local clock; If the audit result is abnormal, the predicted value obtained by the training model is used Replace the high digit in the time difference , and use the newly obtained time difference data Update the local clock.

8. A time synchronization information security review system based on self-timekeeping, characterized in that: It comprises a processor and a memory, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, the steps of the time synchronization information security review method based on self-timekeeping are implemented as described in any one of claims 1 to 7.

Images