Network converter communication protocol adaptation method and system

Abstract

The embodiment of the invention provides a network converter communication protocol adaptation method and system, and relates to the field of communication technologies and network technologies, and the method comprises the steps: obtaining uplink information and a downlink instruction; verifying the uplink information according to preset first reference information to obtain a content integrity judgment result and a source reliability judgment result of the uplink information; verifying the downlink instruction according to preset second reference information to obtain a source authorization judgment result of the downlink instruction and a content integrity judgment result of the downlink instruction; and according to the content integrity judgment result of the uplink information, the source reliability judgment result of the uplink information, the source authorization judgment result of the downlink instruction and the content integrity judgment result of the downlink instruction, performing adaptation processing on the uplink information and / or the downlink instruction according to a preset protocol. According to the embodiment of the invention, multiple verification is carried out on the uplink information and the downlink instruction, and protocol adaptation processing is carried out according to the verification result, so that the security of the network converter is enhanced.

Description

Technical Field

[0001] The present application relates to the field of communication technology and network technology, and in particular to a method and system for adapting a communication protocol of a network converter. Background Art

[0002] In the related art, the primary design goal of traditional network converters is to ensure the correct conversion of data formats between different protocols and the smooth integration of communication processes. Verifying the semantic authenticity of input data is generally considered the responsibility of the source device or upper-layer application system, and the converter itself often only performs syntactic parsing and mapping.

[0003] For example, after a fire emergency plan is activated, the platform needs to send a command to the access controller on a specific floor via a network converter, requesting it to unlock the doors to all escape routes. If the network converter receives this IP command from the platform and converts it into a Wiegand signal or serial command that the access controller can understand, and if key parameters of the command (such as the target access point number and the operation type "unlock") are maliciously modified during the process (e.g., the target access point number or the operation type "unlock"), or if an attacker directly sends an unauthorized door-opening command to the access controller through the controlled converter, the building's security system will be seriously compromised.

[0004] Therefore, in building automation systems, while network converters undertake protocol adaptation tasks, when the data streams they process are directly related to high-security applications such as fire safety, personnel evacuation, and access control of critical areas, how to ensure the authenticity and integrity of this critical information during the conversion process and the authorization of instruction execution to prevent serious consequences caused by the conversion link becoming a security shortcoming is a technical challenge that needs to be addressed urgently. Summary of the Invention

[0005] The present application aims to solve at least one of the technical problems existing in the prior art. To this end, the present application proposes a network switch communication protocol adaptation method and system, which aims to enhance the security of the network switch.

[0006] In a first aspect, an embodiment of the present application provides a method for adapting a communication protocol of a network converter, comprising:

[0007] Acquire uplink information and downlink instructions, wherein the uplink information includes static content and actual communication behavior of the uplink information, and the downlink instructions include instruction authentication information;

[0008] Verifying the static content of the uplink information and the actual communication behavior of the uplink information based on preset first reference information to obtain a content integrity judgment result of the uplink information and a source reliability judgment result of the uplink information, wherein the first reference information includes a verification benchmark for key static characteristics of the field device and a verification benchmark for communication behavior characteristics of the field device;

[0009] Verifying the downlink instruction according to preset second reference information to obtain a source authorization judgment result of the downlink instruction and a content integrity judgment result of the downlink instruction, wherein the second reference information includes shared confidential information;

[0010] Based on the content integrity judgment result of the uplink information, the source reliability judgment result of the uplink information, the source authorization judgment result of the downlink instruction and the content integrity judgment result of the downlink instruction, the uplink information and / or the downlink instruction are adapted and processed according to the preset protocol.

[0011] According to some embodiments of the present application, verifying the static content of the uplink information and the actual communication behavior of the uplink information according to the preset first reference information to obtain a content integrity judgment result of the uplink information and a source reliability judgment result of the uplink information includes:

[0012] Parsing the static content in the uplink information according to a preset text structure template to obtain at least one key positioning field and at least one auxiliary description field;

[0013] Comparing at least one of the key positioning fields with a key positioning field reference value of the field device in the first reference information to obtain the key positioning field comparison result;

[0014] Performing a text similarity comparison on at least one of the auxiliary description fields and a corresponding auxiliary description field reference value of the field device in the first reference information to obtain an auxiliary description field text similarity comparison result;

[0015] A content integrity judgment result of the uplink information is obtained according to the comparison result of the key positioning field and the text similarity comparison result of the auxiliary description field.

[0016] According to some embodiments of the present application, performing text similarity comparison on at least one of the auxiliary description fields with a corresponding auxiliary description field reference value of the field device in the first reference information to obtain an auxiliary description field text similarity comparison result includes:

[0017] obtaining a preset type or a preset importance level of the field device associated with at least one of the auxiliary description fields;

[0018] Obtaining a determination threshold for determining text similarity of the auxiliary description field according to the preset type or the preset importance level;

[0019] Performing text similarity calculation on at least one of the auxiliary description fields and a reference value of a corresponding auxiliary description field of the field device in the first reference information to obtain a quantized text similarity value;

[0020] The text similarity quantization value is compared with the determination threshold to obtain the auxiliary description field text similarity comparison result.

[0021] According to some embodiments of the present application, the verifying the static content of the uplink information and the actual communication behavior of the uplink information according to the preset first reference information to obtain a content integrity judgment result of the uplink information and a source reliability judgment result of the uplink information further includes:

[0022] Acquiring historical communication behavior characteristic data, wherein the historical communication behavior characteristic data includes actual communication behavior characteristics of the uplink information;

[0023] Obtaining a change pattern of the communication behavior of the field device based on the historical communication behavior characteristic data;

[0024] Determining the change mode according to a preset drift determination condition;

[0025] When the change pattern satisfies the preset drift determination condition, the calibration benchmark of the communication behavior characteristic of the field device in the first reference information is adjusted according to the change pattern to obtain an adjusted communication behavior characteristic calibration benchmark.

[0026] According to some embodiments of the present application, the preset drift determination condition is obtained by the following steps:

[0027] Acquiring preset attributes of the field device associated with the change pattern, a current operating state identifier, and a preset drift determination condition, wherein the preset attributes include a device type of the field device or a device importance level of the field device;

[0028] Adjusting the determination parameters in the preset drift determination condition according to the preset attribute and the operating state identifier to obtain adjusted determination parameters;

[0029] A preset drift determination condition is obtained according to the preset attribute of the field device, the operating state identifier and the adjusted determination parameter.

[0030] According to some embodiments of the present application, adjusting the determination parameter in the preset drift determination condition according to the preset attribute and the operating state identifier to obtain the adjusted determination parameter includes:

[0031] Obtaining an adjustment factor or an adjustment function according to the preset attribute and the operating state identifier;

[0032] The determination parameter in the preset drift determination condition is adjusted according to the adjustment factor or the adjustment function to obtain the adjusted determination parameter.

[0033] According to some embodiments of the present application, obtaining the adjustment factor or adjustment function according to the preset attribute and the operating state identifier includes:

[0034] The preset attributes and the operating status identifier are used as input information and input into a preset mapping database, and an adjustment factor or adjustment function corresponding to the input information is obtained according to the preset mapping database, wherein the mapping database contains a preset correspondence between a combination of the preset attributes of the field device and the operating status identifier and the adjustment factor or adjustment function.

[0035] According to some embodiments of the present application, obtaining a change pattern of the communication behavior of the field device based on the historical communication behavior characteristic data includes:

[0036] Calculating a statistic of the historical communication behavior characteristic data within a preset time window, wherein the statistic represents a degree of deviation or trend of the communication behavior characteristic of the field device relative to the calibration benchmark;

[0037] Comparing the statistic with a preset calibration benchmark calculation threshold to obtain a comparison result;

[0038] According to the comparison result, a change pattern of the communication behavior of the field device is obtained.

[0039] According to some embodiments of the present application, obtaining historical communication behavior feature data includes:

[0040] Collecting the uplink information at a first frequency within a preset initial collection time window to obtain the actual communication behavior characteristics;

[0041] The historical communication behavior feature data is obtained according to the actual communication behavior feature.

[0042] In a second aspect, an embodiment of the present application provides a network converter communication protocol adaptation system, the system comprising:

[0043] An acquisition module, configured to acquire uplink information and downlink instructions, wherein the uplink information includes static content and actual communication behavior of the uplink information, and the downlink instructions include instruction authentication information;

[0044] a first verification module, configured to verify the static content of the uplink information and the actual communication behavior of the uplink information based on preset first reference information, to obtain a content integrity judgment result of the uplink information and a source reliability judgment result of the uplink information, wherein the first reference information includes a verification benchmark for key static characteristics of the field device and a verification benchmark for communication behavior characteristics of the field device;

[0045] a second verification module, configured to verify the downlink instruction according to preset second reference information to obtain a source authorization judgment result of the downlink instruction and a content integrity judgment result of the downlink instruction, wherein the second reference information includes shared confidential information;

[0046] A processing module is used to adapt the uplink information and / or the downlink instruction according to a preset protocol based on the content integrity judgment result of the uplink information, the source reliability judgment result of the uplink information, the source authorization judgment result of the downlink instruction and the content integrity judgment result of the downlink instruction.

[0047] According to the technical solution of the embodiment of the present application, there are at least the following beneficial effects: the embodiment of the present invention first obtains uplink information and downlink instructions, wherein the uplink information includes static content and the actual communication behavior of the uplink information, and the downlink instruction includes instruction authentication information; the static content of the uplink information and the actual communication behavior of the uplink information are verified according to the preset first reference information to obtain the content integrity judgment result of the uplink information and the source reliability judgment result of the uplink information, wherein the first reference information includes the verification benchmark of the key static characteristics of the field equipment and the verification benchmark of the communication behavior characteristics of the field equipment; the downlink instruction is verified according to the preset second reference information to obtain the source authorization judgment result of the downlink instruction and the content integrity judgment result of the downlink instruction, wherein the second reference information includes shared confidential information; according to the content integrity judgment result of the uplink information, the source reliability judgment result of the uplink information, the source authorization judgment result of the downlink instruction and the content integrity judgment result of the downlink instruction, the uplink information and / or the downlink instruction are adapted and processed according to the preset protocol. The embodiment of the present application enhances the security of the network switch by performing multiple checks on uplink information and downlink instructions and performing protocol adaptation processing according to the check results.

[0048] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become obvious from the description below, or will be learned through practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] The accompanying drawings are used to provide a further understanding of the technical solution of the present application and constitute a part of the specification. Together with the embodiments of the present application, they are used to explain the technical solution of the present application and do not constitute a limitation on the technical solution of the present application.

[0050] Figure 1 A flowchart of a method for adapting a communication protocol of a network converter provided in one embodiment of the present application;

[0051] Figure 2 A schematic diagram of a process for obtaining a judgment result provided in one embodiment of the present application;

[0052] Figure 3 A schematic diagram of a process for obtaining text similarity comparison results of auxiliary description fields provided in one embodiment of the present application;

[0053] Figure 4 A schematic diagram of a subsequent process of obtaining a judgment result provided in one embodiment of the present application;

[0054] Figure 5 A schematic diagram of a flow chart for obtaining a preset drift determination condition provided in one embodiment of the present application;

[0055] Figure 6 A schematic diagram of a process for obtaining adjusted determination parameters according to an embodiment of the present application;

[0056] Figure 7 A schematic diagram of a process for obtaining a corresponding relationship provided in one embodiment of the present application;

[0057] Figure 8 A schematic diagram of a flow chart for obtaining a change pattern of communication behavior of a field device according to an embodiment of the present application;

[0058] Figure 9 A schematic diagram of a process for obtaining historical communication behavior feature data provided by one embodiment of the present application;

[0059] Figure 10 A schematic diagram of a network converter communication protocol adaptation system provided by one embodiment of the present application. DETAILED DESCRIPTION

[0060] In order to make the purpose, technical methods and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0061] It should be noted that the term "multiple" (or multiple) in the description of the embodiments of this application means more than two, and "greater than," "less than," and "exceed" are understood to exclude the number itself, while "above," "below," and "within" are understood to include the number itself. The terms "first," "second," and so on are used solely for the purpose of distinguishing technical features and are not to be construed as indicating or implying relative importance, or implicitly indicating the number of the indicated technical features, or implicitly indicating the order of the indicated technical features.

[0062] In the embodiments of the present application, "at least one" refers to one or more, and "more" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent the situation where A exists alone, A and B exist at the same time, or B exists alone. Among them, A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following" and similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b and c can mean: a exists alone, b exists alone, c exists alone, a and b exist at the same time, a and c exist at the same time, b and c exist at the same time, or a, b and c exist at the same time, wherein a, b, c can be single or multiple.

[0063] In the description of this application, unless otherwise clearly defined, terms such as setting, installing, and connecting should be understood in a broad sense, and technicians in the relevant technical field can reasonably determine the specific meanings of the above terms in this application based on the specific content of the technical solution.

[0064] Based on the above situation, the present application proposes a network converter communication protocol adaptation method and system, aiming to enhance the security of the network converter.

[0065] The network converter communication protocol adaptation method provided in the embodiments of the present application can be applied to a terminal, a server, or software running on a terminal or a server. In some embodiments, the terminal can be a smartphone, a tablet, a laptop, a desktop computer, etc.; the server can be configured as an independent physical server, or as a server cluster or distributed system consisting of multiple physical servers, or as a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms; the software can be an application that implements the network converter communication protocol adaptation method, etc., but is not limited to the above forms.

[0066] Embodiments of the present application can be used in a wide variety of general-purpose or specialized computer system environments or configurations. For example, personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronic devices, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above, and the like. The present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, and the like that perform specific tasks or implement specific abstract data types. The present application can also be practiced in distributed computing environments, where tasks are performed by remote processing devices connected via a communications network. In distributed computing environments, program modules can be located in local and remote computer storage media, including storage devices. It should be noted that in various embodiments of the present invention, when data related to the characteristics of an object (e.g., a user) is processed based on attribute information or attribute information sets, permission or consent from the corresponding object will be obtained first, and the collection, use, and processing of such data will comply with relevant laws and standards. In addition, when the embodiment of the present invention needs to obtain the attribute information of an object, it will obtain the separate permission or separate consent of the corresponding object through a pop-up window or jump to a confirmation page. After clearly obtaining the separate permission or separate consent of the corresponding object, it will obtain the relevant data of the object necessary to enable the normal operation of the embodiment of the present invention.

[0067] See also Figure 1 , Figure 1 A flowchart of a method for adapting a communication protocol of a network converter provided in one embodiment of the present application is provided. The method for adapting a communication protocol of a network converter provided in one embodiment of the present application includes but is not limited to steps S110 to S140, and each step is described in sequence below.

[0068] Step S110: Acquire uplink information and downlink instructions, wherein the uplink information includes static content and actual communication behavior of the uplink information, and the downlink instruction includes instruction authentication information;

[0069] Step S120: Verify the static content of the uplink information and the actual communication behavior of the uplink information based on preset first reference information to obtain a content integrity judgment result of the uplink information and a source reliability judgment result of the uplink information, wherein the first reference information includes a verification benchmark for key static characteristics of the field device and a verification benchmark for communication behavior characteristics of the field device;

[0070] Step S130: Verify the downlink instruction according to preset second reference information to obtain a source authorization judgment result and a content integrity judgment result of the downlink instruction, wherein the second reference information includes shared confidential information;

[0071] Step S140: Adapt the uplink information and / or downlink instruction according to the preset protocol based on the content integrity judgment result of the uplink information, the source reliability judgment result of the uplink information, the source authorization judgment result of the downlink instruction, and the content integrity judgment result of the downlink instruction.

[0072] In one embodiment, the uplink information includes static content and actual communication behavior. The static content includes information that is not easy to change, such as device ID and model, and the actual communication behavior includes dynamic information such as data packet size and frequency. The downlink instruction includes instruction authentication information, such as digital signature and key, which is used to verify the legitimacy of the instruction. By distinguishing between static content and actual communication behavior, the reliability of the uplink information can be more comprehensively evaluated.

[0073] In one embodiment, the static content and actual communication behavior of the uplink information are verified according to the preset first reference information to obtain the content integrity judgment result and the source reliability judgment result. The first reference information includes the verification benchmark of the key static characteristics of the on-site equipment and the verification benchmark of the communication behavior characteristics. By comparing the static content of the uplink information with the preset key static feature verification benchmark, it can be determined whether the uplink information has been tampered with. By comparing the actual communication behavior of the uplink information with the preset communication behavior feature verification benchmark, it can be determined whether the source of the uplink information is reliable and whether it conforms to the expected communication mode.

[0074] In one embodiment, the downlink instruction is verified according to the preset second reference information to obtain the source authorization judgment result and the content integrity judgment result. The second reference information includes shared confidential information, such as a pre-shared key or a digital certificate, which is used to verify whether the source of the instruction is authorized. By verifying the authentication information of the downlink instruction, unauthorized instructions can be prevented from being executed. At the same time, verifying the content integrity of the downlink instruction can prevent the instruction from being tampered with during transmission.

[0075] In one embodiment, based on the content integrity and source reliability checks for the uplink information, and the source authorization and content integrity checks for the downlink instructions, the uplink information and / or downlink instructions are processed according to a preset protocol. Only information and instructions that pass all checks are processed properly. Problems at any stage trigger corresponding security mechanisms, such as discarding the information, issuing an alarm, or taking other remedial measures. This ensures that the network switch effectively prevents malicious tampering and unauthorized access during protocol adaptation, thereby improving the overall security of the intelligent building system.

[0076] It is worth noting that when the network converter is performing protocol adaptation, uplink critical alarm information may be maliciously tampered with or forged, and downlink critical control instructions may be unauthorized or tampered with. Through multiple checks, serious security incidents such as response delays or security system failures can be avoided.

[0077] See also Figure 2 , Figure 2 A flowchart for obtaining a judgment result is provided for an embodiment of the present application; regarding the above-mentioned step S120, the static content of the uplink information and the actual communication behavior of the uplink information are verified according to the preset first reference information to obtain the content integrity judgment result of the uplink information and the source reliability judgment result of the uplink information, including but not limited to steps S210 to S240, and each step is introduced in turn below.

[0078] Step S210: Parse the static content in the uplink information according to a preset text structure template to obtain at least one key positioning field and at least one auxiliary description field;

[0079] Step S220: Compare at least one key positioning field with a key positioning field reference value of the field device in the first reference information to obtain a key positioning field comparison result;

[0080] Step S230: performing a text similarity comparison between at least one auxiliary description field and a reference value of a corresponding auxiliary description field of the field device in the first reference information to obtain an auxiliary description field text similarity comparison result;

[0081] Step S240: Obtain a content integrity judgment result of the uplink information based on the comparison result of the key positioning field and the text similarity comparison result of the auxiliary description field.

[0082] It should be noted that the key positioning field usually contains key information such as device ID and sensor type, which is used to determine the source and type of uplink information; the auxiliary description field contains supplementary information such as device status and environmental parameters, which is used to describe the status of the device in more detail.

[0083] In one embodiment, at least one key location field is compared with a key location field reference value for a field device in the first reference information. Because the key location field is crucial for determining the source and type of the uplink information, a rigorous comparison is performed to ensure its accuracy. At least one auxiliary description field is compared for textual similarity with a corresponding auxiliary description field reference value for the field device stored in the first reference information. Because auxiliary description fields may vary within a certain range, a textual similarity comparison is employed, allowing for a certain margin of error, thereby increasing verification flexibility. The content integrity of the uplink information is comprehensively determined based on the key location field comparison results and the auxiliary description field textual similarity comparison results. The content integrity of the uplink information can only be determined if both the key location field and the auxiliary description field pass verification.

[0084] It is worth noting that the embodiments of the present application can more accurately determine the content integrity of the uplink information, thereby effectively preventing malicious tampering or forged uplink information from causing harm to the system, distinguishing between key positioning fields and auxiliary description fields, and adopting different verification strategies, which can improve the accuracy and flexibility of verification, thereby better meeting the needs of actual applications.

[0085] See also Figure 3 , Figure 3 A flowchart illustrating a method for obtaining text similarity comparison results for auxiliary description fields according to one embodiment of the present application is provided. Regarding step S230, calculating the first irreversible change and the second irreversible change to obtain a comprehensive aging index includes but is not limited to steps S310 to S340. Each step is described below.

[0086] Step S310: Acquire a preset type or a preset importance level of a field device associated with at least one auxiliary description field;

[0087] Step S320: obtaining a threshold for determining text similarity of the auxiliary description field according to a preset type or a preset importance level;

[0088] Step S330: Calculate text similarity between at least one auxiliary description field and a reference value of a corresponding auxiliary description field of the field device in the first reference information to obtain a quantized text similarity value;

[0089] Step S340: Compare the text similarity quantization value with the determination threshold to obtain the auxiliary description field text similarity comparison result.

[0090] In one embodiment, first, a preset type or preset importance level of a field device associated with at least one auxiliary description field is obtained as a basis for subsequent dynamic adjustment of the judgment threshold. Field devices of different types or importance levels may have different text similarity requirements for their auxiliary description fields. For devices with higher security requirements, the similarity threshold should also be higher.

[0091] In one embodiment, a determination threshold for determining the text similarity of the auxiliary description field is obtained based on a preset type or a preset importance level, wherein the determination threshold is no longer fixed, but is dynamically adjusted according to the characteristics of the on-site equipment. For equipment with a high importance level, the determination threshold of the equipment will be increased accordingly, thereby more strictly judging its content integrity.

[0092] In one embodiment, the quantized value of the text similarity is compared with the judgment threshold to obtain the text similarity comparison result of the auxiliary description field. By comparing the quantized similarity with the dynamically adjusted judgment threshold, the text similarity of the auxiliary description field can be judged more accurately, thereby improving the accuracy of the judgment of the integrity of the uplink information content.

[0093] It is worth noting that the embodiment of the present application improves the accuracy of the text similarity comparison of the auxiliary description field by taking into account the differences of on-site equipment and dynamically adjusting the judgment threshold of the similarity comparison, thereby improving the reliability of the integrity judgment of the uplink information content.

[0094] See also Figure 4 , Figure 4 A schematic diagram of a subsequent process for obtaining a judgment result is provided for one embodiment of the present application. After the above-mentioned step S120 verifies the static content of the uplink information and the actual communication behavior of the uplink information based on the preset first reference information, and obtains the content integrity judgment result of the uplink information and the source reliability judgment result of the uplink information, including but not limited to steps S410 to S440, each step is introduced in sequence below.

[0095] Step S410: Acquire historical communication behavior characteristic data, wherein the historical communication behavior characteristic data includes actual communication behavior characteristics of uplink information;

[0096] Step S420: Obtain a change pattern of the communication behavior of the field device based on the historical communication behavior characteristic data;

[0097] Step S430: judging the change mode according to the preset drift judgment condition;

[0098] Step S440: When the change pattern satisfies a preset drift determination condition, the calibration benchmark of the communication behavior characteristic of the field device in the first reference information is adjusted according to the change pattern to obtain an adjusted communication behavior characteristic calibration benchmark.

[0099] It should be noted that by obtaining historical communication behavior characteristic data, the actual communication behavior pattern of the field equipment is obtained. Based on the historical communication behavior characteristic data, the change pattern of the communication behavior of the field equipment is analyzed, such as the change trend of communication frequency, data volume, and specific field values.

[0100] In one embodiment, a preset drift determination condition is introduced to judge the change pattern to determine whether significant communication behavior drift has occurred. The drift determination condition can be set according to the actual application scenario and device characteristics. The judgment can be made by setting a threshold. When the change pattern exceeds the threshold, it is determined that drift has occurred.

[0101] In one embodiment, when the change pattern meets the preset drift judgment condition, it indicates that the communication behavior of the field device has changed. At this time, the verification benchmark of the communication behavior characteristics of the field device in the first reference information is adjusted according to the change pattern to obtain the adjusted communication behavior characteristic verification benchmark, so that the verification benchmark can adapt to the drift of the communication behavior of the field device and ensure the accuracy of the verification result. Through the adaptive adjustment mechanism, the accuracy and reliability of the network converter's verification of the uplink information can be improved, the false alarm rate can be reduced, and the overall security of the system can be improved.

[0102] See also Figure 5 , Figure 5 A flowchart of obtaining a preset drift determination condition is provided for one embodiment of the present application. The above step S440 of obtaining the preset drift determination condition includes but is not limited to steps S510 to S530, and each step is described in sequence below.

[0103] Step S510: Acquire preset attributes of the field device associated with the change pattern, a current operating state identifier, and a preset drift determination condition, wherein the preset attributes include a device type of the field device or a device importance level of the field device;

[0104] Step S520: adjusting the determination parameters in the preset drift determination conditions according to the preset attributes and the operating state identifier to obtain adjusted determination parameters;

[0105] Step S530: Obtain a preset drift determination condition according to the preset attributes, operating status identifier, and adjusted determination parameters of the field device.

[0106] It should be noted that the device type (sensor, actuator, controller) of the field equipment determines the inherent characteristics and fault tolerance range of its communication behavior; the device importance level (core equipment, ordinary equipment, backup equipment) reflects the degree of risk that may be brought about by its communication anomalies, and the operating status identification reflects the current environment of the equipment, such as normal operation, maintenance mode, fault status, etc.

[0107] It's important to note that different combinations of preset attributes and operating status indicators correspond to different judgment parameter adjustment strategies. For devices with high importance, the drift detection sensitivity can be increased, meaning that even smaller changes may trigger a drift detection. When the device is in maintenance mode, the drift detection sensitivity can be reduced, allowing for greater fluctuations in communication behavior.

[0108] It is worth noting that the embodiments of the present application can accurately identify communication behavior drifts that actually require adjustment of the verification benchmark, avoiding frequent adjustments due to overly sensitive drift judgments and potential safety risks due to insensitive drift judgments. The dynamic adjustment mechanism improves the adaptability and robustness of the system, enabling it to better adapt to complex and changing field environments.

[0109] See also Figure 6 , Figure 6 A flowchart illustrating how to obtain adjusted judgment parameters is provided for one embodiment of the present application. Regarding step S520, adjusting the judgment parameters in the preset drift judgment condition according to the preset attributes and the operating status identifier to obtain the adjusted judgment parameters, including but not limited to steps S610 to S620, each of which is described below in sequence.

[0110] Step S610: Obtain an adjustment factor or an adjustment function according to the preset attribute and the operating state identifier;

[0111] Step S620: Adjust the determination parameters in the preset drift determination conditions according to the adjustment factor or the adjustment function to obtain adjusted determination parameters.

[0112] In one embodiment, different adjustment strategies are adopted for different preset attributes (device type or device importance level of field equipment) and operating status identifiers (normal operation, maintenance mode, fault state). For field equipment with a higher device importance level, a smaller adjustment factor can be set to make the drift judgment condition more stringent, thereby discovering potential abnormal communication behavior earlier; and for field equipment whose operating status is in maintenance mode, a larger adjustment factor can be set to reduce the sensitivity of drift judgment and avoid misjudgment caused by normal maintenance operations.

[0113] It should be noted that the adjustment function can provide a more flexible adjustment method. Different function curves can be used to adjust the judgment parameters according to the device type and operating status identification. By dynamically adjusting the judgment parameters, personalized adjustment of the drift judgment conditions can be achieved.

[0114] In one embodiment, the obtained adjustment factor or adjustment function is applied to a preset drift determination condition to obtain an adjusted determination parameter. When the preset drift determination condition is "the communication behavior deviates from the verification benchmark by more than a threshold value X," the adjustment factor can be used to adjust the threshold value X to obtain a new threshold value X'. The adjusted determination parameter will be used in subsequent drift determination processes, thereby achieving accurate judgment of the change pattern of the communication behavior of the field device, which can effectively improve the accuracy and reliability of the drift judgment and avoid misjudgment or missed judgment caused by the use of a unified drift judgment condition.

[0115] See also Figure 7 , Figure 7 The flowchart of obtaining the corresponding relationship provided by one embodiment of the present application is as follows. Regarding the above step S610, obtaining the adjustment factor or adjustment function according to the preset attribute and the operation state identifier, including but not limited to step S710, the steps are introduced below.

[0116] Step S710: Input the preset attributes and operating status identifiers as input information into a preset mapping database, and obtain an adjustment factor or adjustment function corresponding to the input information based on the preset mapping database, wherein the mapping database contains a preset correspondence between a combination of the preset attributes and operating status identifiers of the field equipment and the adjustment factor or adjustment function.

[0117] In one embodiment, the preset attributes and operating status identifiers of the field equipment are used as input information. Different device attributes and operating statuses require different adjustment strategies. Then, the input information is input into a preset mapping database. The mapping database stores the preset correspondence between the combination of the preset attributes and operating status identifiers of the field equipment and the adjustment factors or adjustment functions. By consulting this database, the adjustment factors or adjustment functions that best match the current device attributes and operating status can be quickly found.

[0118] It is worth noting that the embodiments of the present application provide a structured approach to manage and apply adjustment factors or adjustment functions. The mapping database makes the adjustment process more systematic and maintainable, avoiding the subjectivity and arbitrariness of human judgment. Through the preset correspondence, it can ensure that the most appropriate adjustment strategy is adopted for different device properties and operating states, thereby improving the accuracy and reliability of drift judgment.

[0119] See also Figure 8 , Figure 8A flowchart for obtaining a change pattern of field device communication behavior according to an embodiment of the present application is provided. Regarding the above-mentioned step S420, obtaining a change pattern of field device communication behavior according to historical communication behavior characteristic data includes but is not limited to steps S810 to S830, and each step is described in sequence below.

[0120] Step S810: Calculate the statistics of the historical communication behavior characteristic data within a preset time window, wherein the statistics represent the degree of deviation or trend of the communication behavior characteristics of the field device relative to the calibration benchmark;

[0121] Step S820: Compare the statistic with a preset verification benchmark calculation threshold to obtain a comparison result;

[0122] Step S830: Obtain a change pattern of the communication behavior of the field device according to the comparison result.

[0123] It should be noted that choosing to perform statistics within a preset time window can effectively smooth out short-term, accidental fluctuations and focus on statistically significant changes over a longer period of time. The selection of statistics needs to be able to accurately reflect the characteristics of the device communication behavior. It can be the average, variance, maximum, minimum, etc. The specific choice depends on the specific communication behavior characteristics and application scenarios. By calculating statistics, complex historical communication behavior characteristic data can be converted into concise and easy-to-compare numerical values.

[0124] In one embodiment, a threshold for calculating the verification benchmark is pre-set and used to determine whether a statistic significantly deviates from the normal range. By comparing the statistic with the threshold, it is possible to determine whether the degree of deviation of the device's communication behavior exceeds an acceptable range. The setting of the threshold requires comprehensive consideration of factors such as the device's characteristics, historical operating data, and security requirements. The comparison result can be that the statistic is greater than, less than, or equal to the threshold, or it can be the difference or ratio between the statistic and the threshold.

[0125] In one embodiment, based on the comparison results, it can be determined whether the device communication behavior is tending to be stable, gradually deviating, or undergoing a sudden change. When the statistic is continuously greater than the threshold, it can be determined that the device communication behavior is gradually deviating from the verification benchmark; if the dANGer statistic suddenly and significantly exceeds the threshold, it can be determined that the device communication behavior has undergone a sudden change. The determination of the change pattern provides a basis for subsequent adjustment of the verification benchmark, and different adjustment strategies can be adopted according to different change patterns.

[0126] See also Figure 9 , Figure 9The flowchart of obtaining historical communication behavior characteristic data provided by one embodiment of the present application is as follows. The above step S410 of obtaining historical communication behavior characteristic data and obtaining the change pattern of the communication behavior of the field device includes but is not limited to steps S910 to S920. Each step is introduced in sequence below.

[0127] Step S910: Collect uplink information at a first frequency within a preset initial collection time window to obtain actual communication behavior characteristics;

[0128] Step S920: Obtain historical communication behavior characteristic data based on actual communication behavior characteristics.

[0129] In one embodiment, uplink information is collected within a preset initial collection time window to obtain a sufficient amount of raw data to accurately reflect the communication behavior pattern of the field device. The setting of the initial collection time window needs to take into account the communication frequency and data volume of the field device to ensure that the collected data is representative.

[0130] In one embodiment, data is collected at a first frequency to ensure that the collected data can capture the dynamic changes in communication behavior. The selection of the first frequency needs to be adjusted according to the communication characteristics of the field equipment. When the communication behavior changes rapidly, a higher collection frequency can be selected, and vice versa. A lower collection frequency can be selected. By controlling the collection frequency, the data volume and data accuracy can be effectively balanced, thereby improving the efficiency and accuracy of subsequent analysis.

[0131] It should be noted that historical communication behavior characteristic data is obtained based on actual communication behavior characteristics. This is the process of processing and analyzing the original data, so as to extract key information that can reflect the communication behavior pattern of field equipment. Historical communication behavior characteristic data may include communication frequency, data packet size, communication protocol type, etc. These characteristics can be used to establish a communication behavior model of field equipment and serve as a benchmark for subsequent verification, so that the actual communication behavior characteristics can be effectively utilized.

[0132] The present application also provides a network converter communication protocol adaptation system, such as Figure 10 As shown, Figure 10 A schematic diagram of a network converter communication protocol adaptation system provided in one embodiment of the present application, the system comprising:

[0133] An acquisition module 1010 is configured to acquire uplink information and downlink instructions, wherein the uplink information includes static content and actual communication behavior of the uplink information, and the downlink instructions include instruction authentication information;

[0134] A first verification module 1020 is configured to verify the static content of the uplink information and the actual communication behavior of the uplink information based on preset first reference information to obtain a result of determining the content integrity of the uplink information and a result of determining the source reliability of the uplink information, wherein the first reference information includes a verification benchmark for key static characteristics of the field device and a verification benchmark for communication behavior characteristics of the field device;

[0135] A second verification module 1030 is configured to verify the downlink instruction based on preset second reference information to obtain a result of determining the source authorization of the downlink instruction and a result of determining the content integrity of the downlink instruction, wherein the second reference information includes shared confidential information;

[0136] The processing module 1040 is used to adapt the uplink information and / or downlink instructions according to the preset protocol based on the content integrity judgment result of the uplink information, the source reliability judgment result of the uplink information, the source authorization judgment result of the downlink instruction and the content integrity judgment result of the downlink instruction.

[0137] It should be noted that the information interaction, execution process and other contents between the above modules are based on the same concept as the method embodiment of this application. Their specific functions and technical effects can be found in the method embodiment part and will not be repeated here.

[0138] Those skilled in the art will appreciate that all or some of the steps and systems in the method disclosed above can be implemented as software, firmware, hardware, and appropriate combinations thereof. Some physical components or all physical components can be implemented as software executed by a processor, such as a central processing unit, a digital signal processor, or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit. Such software can be distributed on a computer-readable medium, and the computer-readable medium can include computer storage media (or non-transitory media) and communication media (or temporary media). As known to those skilled in the art, the term computer storage media is included in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data) and is volatile and non-volatile, removable, and non-removable. Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory, or other memory technology, CD-ROM, digital versatile disks (DVD), or other optical disk storage, magnetic cassettes, magnetic tapes, disk storage, or other magnetic storage devices, or any other medium that can be used to store desired information and can be accessed by a computer. Furthermore, as is well known to those skilled in the art, communication media typically includes computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0139] The above is a detailed description of the preferred implementation of the present application, but the present application is not limited to the above implementation. Those skilled in the art can make various equivalent modifications or substitutions without violating the spirit of the present application. These equivalent modifications or substitutions are all included in the scope defined by the claims of the present application.

Claims

1. A method for adapting a communication protocol of a network converter, characterized in that: include: Acquire uplink information and downlink instructions, wherein the uplink information includes static content and actual communication behavior of the uplink information, and the downlink instructions include instruction authentication information; Verifying the static content of the uplink information and the actual communication behavior of the uplink information based on preset first reference information to obtain a content integrity judgment result of the uplink information and a source reliability judgment result of the uplink information, wherein the first reference information includes a verification benchmark for key static characteristics of the field device and a verification benchmark for communication behavior characteristics of the field device; Verifying the downlink instruction according to preset second reference information to obtain a source authorization judgment result of the downlink instruction and a content integrity judgment result of the downlink instruction, wherein the second reference information includes shared confidential information; Based on the content integrity judgment result of the uplink information, the source reliability judgment result of the uplink information, the source authorization judgment result of the downlink instruction and the content integrity judgment result of the downlink instruction, the uplink information and / or the downlink instruction are adapted and processed according to the preset protocol.

2. The method according to claim 1, characterized in that The verifying the static content of the uplink information and the actual communication behavior of the uplink information according to the preset first reference information to obtain a content integrity judgment result of the uplink information and a source reliability judgment result of the uplink information includes: Parsing the static content in the uplink information according to a preset text structure template to obtain at least one key positioning field and at least one auxiliary description field; Comparing at least one of the key positioning fields with a key positioning field reference value of the field device in the first reference information to obtain the key positioning field comparison result; Performing a text similarity comparison on at least one of the auxiliary description fields and a corresponding auxiliary description field reference value of the field device in the first reference information to obtain an auxiliary description field text similarity comparison result; A content integrity judgment result of the uplink information is obtained according to the comparison result of the key positioning field and the text similarity comparison result of the auxiliary description field.

3. The method according to claim 2, characterized in that The step of performing text similarity comparison on at least one of the auxiliary description fields and a corresponding auxiliary description field reference value of the field device in the first reference information to obtain an auxiliary description field text similarity comparison result includes: obtaining a preset type or a preset importance level of the field device associated with at least one of the auxiliary description fields; Obtaining a determination threshold for determining text similarity of the auxiliary description field according to the preset type or the preset importance level; Performing text similarity calculation on at least one of the auxiliary description fields and a reference value of a corresponding auxiliary description field of the field device in the first reference information to obtain a quantized text similarity value; The text similarity quantization value is compared with the determination threshold to obtain the auxiliary description field text similarity comparison result.

4. The method according to claim 1, wherein The verifying, based on the preset first reference information, the static content of the uplink information and the actual communication behavior of the uplink information to obtain a result of judging the content integrity of the uplink information and a result of judging the source reliability of the uplink information further includes: Acquiring historical communication behavior characteristic data, wherein the historical communication behavior characteristic data includes actual communication behavior characteristics of the uplink information; Obtaining a change pattern of the communication behavior of the field device based on the historical communication behavior characteristic data; Determining the change mode according to a preset drift determination condition; When the change pattern satisfies the preset drift determination condition, the calibration benchmark of the communication behavior characteristic of the field device in the first reference information is adjusted according to the change pattern to obtain an adjusted communication behavior characteristic calibration benchmark.

5. The method according to claim 4, characterized in that The preset drift determination condition is obtained by the following steps: Acquiring preset attributes of the field device associated with the change pattern, a current operating state identifier, and a preset drift determination condition, wherein the preset attributes include a device type of the field device or a device importance level of the field device; Adjusting the determination parameters in the preset drift determination condition according to the preset attribute and the operating state identifier to obtain adjusted determination parameters; A preset drift determination condition is obtained according to the preset attribute of the field device, the operating state identifier and the adjusted determination parameter.

6. The method according to claim 5, characterized in that The adjusting the determination parameter in the preset drift determination condition according to the preset attribute and the operating state identifier to obtain the adjusted determination parameter includes: Obtaining an adjustment factor or an adjustment function according to the preset attribute and the operating state identifier; The determination parameter in the preset drift determination condition is adjusted according to the adjustment factor or the adjustment function to obtain the adjusted determination parameter.

7. The method according to claim 6, characterized in that The obtaining of the adjustment factor or adjustment function according to the preset attribute and the operating state identifier includes: The preset attributes and the operating status identifier are used as input information and input into a preset mapping database, and an adjustment factor or adjustment function corresponding to the input information is obtained according to the preset mapping database, wherein the mapping database contains a preset correspondence between a combination of the preset attributes of the field device and the operating status identifier and the adjustment factor or adjustment function.

8. The method according to claim 4, characterized in that The obtaining of a change pattern of the communication behavior of the field device according to the historical communication behavior characteristic data includes: Calculating a statistic of the historical communication behavior characteristic data within a preset time window, wherein the statistic represents a degree of deviation or trend of the communication behavior characteristic of the field device relative to the calibration benchmark; Comparing the statistic with a preset calibration benchmark calculation threshold to obtain a comparison result; According to the comparison result, a change pattern of the communication behavior of the field device is obtained.

9. The method according to claim 4, characterized in that The acquiring of historical communication behavior characteristic data includes: Collecting the uplink information at a first frequency within a preset initial collection time window to obtain the actual communication behavior characteristics; The historical communication behavior feature data is obtained according to the actual communication behavior feature.

10. A network converter communication protocol adaptation system, characterized in that: include: An acquisition module, configured to acquire uplink information and downlink instructions, wherein the uplink information includes static content and actual communication behavior of the uplink information, and the downlink instructions include instruction authentication information; a first verification module, configured to verify the static content of the uplink information and the actual communication behavior of the uplink information based on preset first reference information, to obtain a content integrity judgment result of the uplink information and a source reliability judgment result of the uplink information, wherein the first reference information includes a verification benchmark for key static characteristics of the field device and a verification benchmark for communication behavior characteristics of the field device; a second verification module, configured to verify the downlink instruction according to preset second reference information to obtain a source authorization judgment result of the downlink instruction and a content integrity judgment result of the downlink instruction, wherein the second reference information includes shared confidential information; A processing module is used to adapt the uplink information and / or the downlink instruction according to a preset protocol based on the content integrity judgment result of the uplink information, the source reliability judgment result of the uplink information, the source authorization judgment result of the downlink instruction and the content integrity judgment result of the downlink instruction.

Images