Micro-isolation and differential encryption method, system and medium based on industrial protocol perception

Abstract

The application provides a micro-isolation and differential encryption method and system based on industrial protocol awareness, a storage medium, and first acquires a first communication message to be analyzed by performing static filtering on original traffic through a preset port; then analyzes the message behavior mode using a time sequence feature analysis model to extract semantic tags containing function codes, data point addresses and data values; if the data values exceed a safety threshold, real-time blocking and warning are performed; otherwise, a dynamic communication strategy is generated based on the function codes and data point addresses; when a micro-isolation rule is triggered, the access permission of the equipment is dynamically limited; when a differential encryption rule is triggered, an encryption algorithm is selected according to the data sensitivity, and an algorithm acceleration module is called to execute. The application realizes micro-isolation through protocol semantic analysis to prevent illegal function code injection; adopts a differential encryption mechanism to reduce encryption overhead while meeting the real-time requirements of industrial scenarios; in addition, the encryption strength is dynamically adjusted in combination with channel quality to ensure operation reliability under extreme working conditions.

Description

Technical Field

[0001] This invention relates to the field of industrial protocols, and more specifically, to a method, system, and storage medium for micro-segmentation and differential encryption based on industrial protocol awareness. Background Technology

[0002] Industrial networks widely employ proprietary protocols such as Modbus TCP, PROFINET, DNP3, IEC 104, and OPC UA to transmit control commands and sensor data. Traditional firewall solutions often operate at the IP / port level, failing to understand protocol semantics and thus unable to block protocol-layer attacks such as unauthorized function code injection and unauthorized write operations. Traditional encryption strategies typically employ full-traffic encryption, leading to increased latency and failing to meet the millisecond-level real-time requirements of motion control. Furthermore, enforced encryption under poor channel conditions exacerbates data loss and latency; and rigid encryption communication strategies cannot dynamically adjust security strength based on channel conditions.

[0003] Therefore, existing solutions have systemic shortcomings in terms of protocol-level attack defense, real-time performance assurance, and resource optimization, and there is an urgent need for an industrial protocol communication technology that breaks through semantic awareness and dynamic adaptation. Summary of the Invention

[0004] In view of the above problems, the purpose of this invention is to provide a method, system, and storage medium for micro-segmentation and differential encryption based on industrial protocol awareness. This method accurately extracts protocol semantic tags through static port filtering, timing behavior analysis, and syntax tree parsing, achieving precise blocking of attacks such as illegal function code injection. It implements instruction-level micro-segmentation and encryption decisions based on a predefined communication strategy library using multi-dimensional vector matching. Micro-segmentation dynamically generates protocol-aware ACL rules, and differential encryption is executed hierarchically according to data sensitivity, meeting industrial-grade real-time requirements. Encryption strength is dynamically downgraded or restored based on channel quality to ensure operational reliability in harsh environments, forming a secure closed-loop structure.

[0005] The first aspect of this invention provides a micro-segmentation and differential encryption method based on industrial protocol awareness, the method comprising:

[0006] The first communication message is obtained based on static filtering of the preset port.

[0007] Based on a preset time-series feature analysis model, semantic tags are parsed from the first communication message;

[0008] Based on the semantic tags, the channel quality, function code, data point address, and data value are obtained;

[0009] The data value is determined to exceed a preset security data threshold;

[0010] If so, a blocking warning will be triggered;

[0011] If not, a communication strategy is generated based on the function code and the data point address;

[0012] When a micro-segmentation rule is triggered according to the communication strategy, access permissions are dynamically restricted according to the semantic tags.

[0013] When a differentiated encryption rule is triggered according to the communication strategy, the encryption algorithm is adjusted and the algorithm acceleration module is invoked according to the semantic tags.

[0014] In this scheme, the step of parsing semantic tags based on the first communication message using a preset time-series feature analysis model further includes:

[0015] The static filtering layer filters the raw traffic based on the preset port number, identifies the industrial protocol type, and outputs the first communication message.

[0016] The first communication message is input into the behavior analysis layer to obtain the timing pattern characteristics of the message, including periodic transmission characteristics or burst transmission characteristics.

[0017] Based on the timing pattern characteristics, perform syntax tree parsing on the first communication message to extract key semantic tags from the protocol structure;

[0018] If the syntax tree parsing fails, the machine learning auxiliary layer is activated to perform real-time clustering analysis on the message, dynamically update the protocol feature library, and reclassify it.

[0019] In this solution, generating a communication strategy based on the function code and the data point address specifically includes:

[0020] Construct a multi-dimensional decision vector based on protocol type, function code, data point address, and data value index;

[0021] The multidimensional decision vector is matched with a predefined policy library, which includes at least sensitive operation judgment rules, encryption strength mapping relationship and access permission whitelist.

[0022] If the function code corresponds to an emergency shutdown command or a critical equipment control command, then a first encryption strategy is generated and bound to the list of authorized device addresses;

[0023] If the data point address belongs to a non-sensitive area and the data value is within the security threshold, a second encryption strategy is generated and a time strategy constraint is superimposed.

[0024] In this scheme, the triggering micro-segmentation rule specifically includes:

[0025] Based on the semantic tags, the source device address, the target device address, and the protocol operation type are obtained;

[0026] Dynamically create protocol-aware access control rules, where rule elements include source device address range, target device address, protocol type, function code operation type, and accessible data point address range;

[0027] The access control rules are distributed to the source and target devices to perform real-time traffic filtering based on the protocol context.

[0028] When an unauthorized access request is detected, the current session is interrupted and a security audit log is generated;

[0029] When a communication session ends, dynamically generated micro-segmentation rules are automatically cleared.

[0030] In this scheme, the triggering of differentiated encryption rules specifically includes:

[0031] Based on a preset data sensitivity classification, a corresponding encryption algorithm is selected, including at least the first encryption algorithm being called for critical control instructions and the second encryption algorithm being called for non-sensitive data.

[0032] According to the encryption algorithm, when identifying an encrypted stream that requires hardware acceleration, the encryption operation is handed over to the corresponding hardware algorithm circuit for execution;

[0033] For low-latency sensitive data, field-level selective encryption is enabled, encrypting only key field data;

[0034] When channel quality deteriorates, non-critical data streams are transmitted in plaintext and switched to short frame transmission mode.

[0035] Once the channel quality is restored, full encryption is initiated based on a preset first delay.

[0036] This plan also includes:

[0037] Monitor the communication status after the communication strategy is executed;

[0038] If the execution delay of the communication state exceeds the preset security delay threshold, it will roll back to the default encryption level.

[0039] If the channel bit error rate of the communication state exceeds the preset security bit error rate threshold, then the redundant parameters of the error correction algorithm are reduced.

[0040] If semantic tag parsing fails, the protocol feature library of the temporal feature analysis model is updated based on the current temporal pattern features.

[0041] A second aspect of the present invention provides an industry protocol-aware micro-segmentation and differential encryption system, including an industry protocol-aware micro-segmentation and differential encryption method program, wherein the industry protocol-aware micro-segmentation and differential encryption method program, when executed by the processor, implements the following steps:

[0042] The first communication message is obtained based on static filtering of the preset port.

[0043] Based on a preset time-series feature analysis model, semantic tags are parsed from the first communication message;

[0044] Based on the semantic tags, the channel quality, function code, data point address, and data value are obtained;

[0045] The data value is determined to exceed a preset security data threshold;

[0046] If so, a blocking warning will be triggered;

[0047] If not, a communication strategy is generated based on the function code and the data point address;

[0048] When a micro-segmentation rule is triggered according to the communication strategy, access permissions are dynamically restricted according to the semantic tags.

[0049] When a differentiated encryption rule is triggered according to the communication strategy, the encryption algorithm is adjusted and the algorithm acceleration module is invoked according to the semantic tags.

[0050] In this scheme, the step of parsing semantic tags based on the first communication message using a preset time-series feature analysis model further includes:

[0051] The static filtering layer filters the raw traffic based on the preset port number, identifies the industrial protocol type, and outputs the first communication message.

[0052] The first communication message is input into the behavior analysis layer to obtain the timing pattern characteristics of the message, including periodic transmission characteristics or burst transmission characteristics.

[0053] Based on the timing pattern characteristics, perform syntax tree parsing on the first communication message to extract key semantic tags from the protocol structure;

[0054] If the syntax tree parsing fails, the machine learning auxiliary layer is activated to perform real-time clustering analysis on the message, dynamically update the protocol feature library, and reclassify it.

[0055] In this solution, generating a communication strategy based on the function code and the data point address specifically includes:

[0056] Construct a multi-dimensional decision vector based on protocol type, function code, data point address, and data value index;

[0057] The multidimensional decision vector is matched with a predefined policy library, which includes at least sensitive operation judgment rules, encryption strength mapping relationship and access permission whitelist.

[0058] If the function code corresponds to an emergency shutdown command or a critical equipment control command, then a first encryption strategy is generated and bound to the list of authorized device addresses;

[0059] If the data point address belongs to a non-sensitive area and the data value is within the security threshold, a second encryption strategy is generated and a time strategy constraint is superimposed.

[0060] A third aspect of the present invention provides a computer-readable storage medium comprising an industry protocol-aware micro-segmentation and differential encryption method program, wherein when the industry protocol-aware micro-segmentation and differential encryption method program is executed by a processor, it implements the steps of the industry protocol-aware micro-segmentation and differential encryption method as described in any of the preceding claims.

[0061] This invention provides a micro-segmentation and differential encryption method, system, and storage medium based on industrial protocol awareness. First, raw traffic is statically filtered through a preset port to obtain the first communication packet to be parsed. Then, a time-series feature analysis model is used to analyze the packet behavior pattern, extracting semantic tags containing function codes, data point addresses, and data values. If the data value exceeds a security threshold, real-time blocking and alarm are triggered; otherwise, a dynamic communication strategy is generated based on the function code and data point address. When a micro-segmentation rule is triggered, device access permissions are dynamically restricted. When a differential encryption rule is triggered, an encryption algorithm is selected based on data sensitivity, and an algorithm acceleration module is invoked for execution. This invention achieves micro-segmentation through protocol semantic parsing, protecting against unauthorized function code injection; it employs a differential encryption mechanism to reduce encryption overhead while meeting the real-time requirements of industrial scenarios; furthermore, it dynamically adjusts the encryption strength based on channel quality to ensure operational reliability under extreme conditions. Attached Figure Description

[0062] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly described below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope.

[0063] Figure 1 A flowchart of a micro-segmentation and differential encryption method based on industrial protocol awareness according to the present invention is shown;

[0064] Figure 2 The diagram illustrates a semantic tag parsing flowchart provided by an embodiment of the present invention;

[0065] Figure 3 A flowchart illustrating the generation process of a communication strategy according to an embodiment of the present invention is shown;

[0066] Figure 4 A block diagram of an industrial protocol-aware micro-segmentation and differential encryption system based on the present invention is shown. Detailed Implementation

[0067] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0068] Unless otherwise defined, all terms (including technical and scientific terms) used in embodiments of this invention shall have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. It should also be understood that terms such as those defined in a common dictionary shall be interpreted as having a meaning consistent with their meaning in the context of the relevant art, and not as being interpreted in an idealized or highly formalized sense, unless expressly defined in this embodiment of the invention.

[0069] The terms "first," "second," and similar words used in the embodiments of this invention do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Terms such as "an," "a," or "the" do not indicate a quantity limitation, but rather indicate the presence of at least one. Similarly, terms such as "including" or "comprising" mean that the element or object preceding the word encompasses the elements or objects listed after the word and their equivalents, without excluding other elements or objects. Terms such as "connected" or "linked" are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. The steps preceding or following the steps in the method of the embodiments of this invention are not necessarily performed precisely in sequence. Instead, various steps can be processed in reverse order or simultaneously. Furthermore, other operations can be added to these processes, or one or more steps can be removed from these processes.

[0070] In addition, the functional modules in the various embodiments of the present invention can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0071] Figure 1 A flowchart of an industrial protocol-aware micro-segmentation and differential encryption method based on the present invention is shown.

[0072] like Figure 1 As shown, the first aspect of this invention discloses a micro-segmentation and differential encryption method based on industrial protocol awareness, the method comprising:

[0073] S102, Based on static filtering of the preset port, the first communication message is obtained;

[0074] S104, based on the preset time-series feature analysis model, the semantic tags are parsed from the first communication message;

[0075] S106, Based on the semantic tags, obtain the channel quality, function code, data point address and data value;

[0076] S108, determine that the data value exceeds a preset safe data threshold;

[0077] S110, if so, trigger a blocking warning;

[0078] S112, if not, then generate a communication strategy based on the function code and the data point address;

[0079] S114, When the micro-segmentation rule is triggered according to the communication strategy, access permissions are dynamically restricted according to the semantic tags;

[0080] S116, When the differentiated encryption rule is triggered according to the communication strategy, the encryption algorithm is adjusted according to the semantic tag and the algorithm acceleration module is called.

[0081] It should be noted that in this embodiment, firstly, the raw traffic of the industrial network is statically filtered based on a preset port to obtain a first communication packet with preliminary classification. Then, through a preset time-series feature analysis model, the behavioral pattern characteristics of the packet are analyzed, including periodic or bursty transmission characteristics, thereby extracting protocol semantic tags containing key fields such as function code type, data point address, and data value, which are then combined with real-time channel quality indicators. If the detected data value exceeds a preset safety threshold, such as a temperature setpoint exceeding the device's safety range, a blocking warning is immediately triggered and the current operation is terminated. If the data value does not exceed the limit, a dynamic communication policy is generated based on the function code and data point address. When the communication policy triggers a micro-segmentation rule, access permissions are dynamically restricted according to the source and target device addresses in the semantic tag and the operation type. As one implementation, only specific HMI devices are allowed to access registers 0x3001-0x3010 during a specified time period. When the communication policy triggers a differentiated encryption rule, the corresponding encryption algorithm is called according to the data sensitivity; as one implementation, key instructions use hardware-accelerated high-strength encryption, while non-sensitive data uses a lightweight algorithm. Furthermore, the linkage algorithm acceleration module performs encryption operations, achieving a precise balance between security protection and resource consumption, thereby solving the problem of over-encryption. This embodiment dynamically adjusts the security strategy based on protocol semantics, enhancing the proactive defense capabilities of the industrial control system by blocking unauthorized operations in real time.

[0082] Figure 2 The diagram illustrates a semantic tag parsing flowchart provided by an embodiment of the present invention.

[0083] According to embodiments of the present invention, such as Figure 2 As shown, the step of parsing semantic tags based on the first communication message using a preset time-series feature analysis model further includes:

[0084] S202 filters raw traffic based on preset port numbers through a static filtering layer, identifies industrial protocol types, and outputs the first communication message.

[0085] S204, input the first communication message into the behavior analysis layer to obtain the timing pattern characteristics of the message, including periodic transmission characteristics or burst transmission characteristics;

[0086] S206, Based on the timing pattern characteristics, perform syntax tree parsing on the first communication message to extract key semantic tags in the protocol structure;

[0087] S208 If the syntax tree parsing fails, the machine learning auxiliary layer is activated to perform real-time clustering analysis on the message, dynamically update the protocol feature library and reclassify it.

[0088] It should be noted that in this embodiment, firstly, a static filtering layer filters the raw traffic based on predefined port numbers; this is used to initially identify the industrial protocol type and output the first communication message. Subsequently, the first communication message is input into a behavior analysis layer, which analyzes its transmission behavior pattern based on a time-series feature model, such as the fixed period of the PROFINET protocol or the burst traffic of the IEC 104 protocol. Then, a syntax tree parsing layer deeply extracts key semantic tags from the protocol structure. As one implementation, Modbus function code 0x03 represents a read operation, 0x06 represents a write operation, and there is also the OPC UA object identifier. If syntax tree parsing fails, a machine learning auxiliary layer is activated to perform real-time clustering analysis on the message, dynamically updating the protocol feature library and reclassifying it. Finally, a structured semantic tag set containing protocol type, function code operation type, data point physical address, and data value range is output, forming a high-precision protocol awareness foundation. This embodiment employs multi-level collaborative parsing to improve the accuracy of protocol identification; it also supports the expansion of unknown protocols through dynamic updates to the protocol library, adapting to the diversity of industrial environments.

[0089] Figure 3 A flowchart illustrating the generation process of a communication strategy according to an embodiment of the present invention is shown.

[0090] According to embodiments of the present invention, such as Figure 3 As shown, the step of generating a communication strategy based on the function code and the data point address specifically includes:

[0091] S302, construct a multi-dimensional decision vector based on protocol type, function code, data point address and data value index;

[0092] S304, Match the multidimensional decision vector with a predefined policy library, wherein the policy library includes at least sensitive operation judgment rules, encryption strength mapping relationship and access permission whitelist;

[0093] S306, if the function code corresponds to an emergency stop command or a critical equipment control command, then generate the first encryption strategy and bind it to the list of authorized device addresses;

[0094] S308, if the data point address belongs to a non-sensitive area and the data value is within the security threshold, then a second encryption strategy is generated and a time strategy constraint is superimposed.

[0095] It should be noted that in this embodiment, a multi-dimensional policy vector is constructed by combining protocol type, function code operation type, data point physical address, data value range, and channel quality indicators. This multi-dimensional decision vector is then matched with a predefined policy library, which includes sensitive operation judgment rules, encryption strength mapping relationships, and access permission whitelists. If the function code corresponds to an emergency shutdown or critical equipment control command, the highest-strength encryption policy is generated and bound to an authorized device IP whitelist to restrict access sources. If the data point address belongs to a non-sensitive area and the data value is within a security threshold, a lightweight encryption policy is generated and time-based policy constraints are superimposed; for example, for temperature sensor readings, plaintext transmission is allowed during working hours (8:00-18:00) to reduce CPU load. This embodiment achieves dynamic policy generation based on protocol semantics and environmental state, reducing resource overhead during off-peak hours and optimizing system efficiency.

[0096] According to an embodiment of the present invention, the triggering micro-segmentation rule specifically includes:

[0097] Based on the semantic tags, the source device address, the target device address, and the protocol operation type are obtained;

[0098] Dynamically create protocol-aware access control rules, where rule elements include source device address range, target device address, protocol type, function code operation type, and accessible data point address range;

[0099] The access control rules are distributed to the source and target devices to perform real-time traffic filtering based on the protocol context.

[0100] When an unauthorized access request is detected, the current session is interrupted and a security audit log is generated;

[0101] When a communication session ends, dynamically generated micro-segmentation rules are automatically cleared.

[0102] It should be noted that in this embodiment, the source device address, target device address, and protocol operation type in the semantic tags are first parsed to dynamically create fine-grained access control rules, i.e., fine-grained ACL rules. The elements in each rule include at least the source device address range, target device address, protocol type, function code operation type, and accessible data point address range. The ACL rules are then distributed to network devices via a software-defined network controller to perform real-time traffic filtering based on protocol context; for example, blocking unauthorized writes to PLC register 40001 by an unauthorized IP address. If an unauthorized access request is detected, the current session is immediately interrupted, and a security audit log is generated to record the violation. The dynamically generated micro-segmentation rules are automatically cleared at the end of the communication session to avoid rule bloat leading to excessive device resource consumption and ensure long-term efficient system operation. This embodiment replaces traditional static firewall policies with dynamic ACLs for precise prevention of unauthorized function code injection; furthermore, automatic rule clearing reduces device resource consumption, adapting to high-concurrency industrial scenarios.

[0103] According to an embodiment of the present invention, the triggering of the differentiated encryption rule specifically includes:

[0104] Based on a preset data sensitivity classification, a corresponding encryption algorithm is selected, including at least the first encryption algorithm being called for critical control instructions and the second encryption algorithm being called for non-sensitive data.

[0105] According to the encryption algorithm, when identifying an encrypted stream that requires hardware acceleration, the encryption operation is handed over to the corresponding hardware algorithm circuit for execution;

[0106] For low-latency sensitive data, field-level selective encryption is enabled, encrypting only key field data;

[0107] When channel quality deteriorates, non-critical data streams are transmitted in plaintext and switched to short frame transmission mode.

[0108] Once the channel quality is restored, full encryption is initiated based on a preset first delay.

[0109] It should be noted that in this embodiment, the encryption algorithm is selected based on the data sensitivity level. As one implementation method, high-strength algorithms with hardware acceleration are used for critical control commands; for example, AES is used for valve switching commands. Lightweight stream encryption algorithms are used for non-sensitive data; for example, ChaCha20 is used for ambient temperature readings. When an encryption stream requiring hardware acceleration is identified, the encryption operation is handled by a dedicated FPGA or NPU processor to improve the execution speed of the encryption algorithm. Field-level selective encryption is enabled for low-latency sensitive data, encrypting only critical fields while retaining the plaintext of the message header, reducing transmission latency. Furthermore, when channel quality deteriorates, the encryption module for non-critical data streams is shut down, and a short frame transmission mode is switched to ensure real-time performance. After channel quality recovers, the full encryption process is initiated after a preset delay to prevent system oscillations caused by frequent strategy switching.

[0110] According to an embodiment of the present invention, it further includes:

[0111] Monitor the communication status after the communication strategy is executed;

[0112] If the execution delay of the communication state exceeds the preset security delay threshold, it will roll back to the default encryption level.

[0113] If the channel bit error rate of the communication state exceeds the preset security bit error rate threshold, then the redundant parameters of the error correction algorithm are reduced.

[0114] If semantic tag parsing fails, the protocol feature library of the temporal feature analysis model is updated based on the current temporal pattern features.

[0115] It should be noted that this embodiment provides a closed-loop feedback mechanism. In this embodiment, the communication status after the strategy execution is continuously monitored. If the total latency of decision execution exceeds the industrial real-time requirements, it automatically rolls back to the default encryption strategy to ensure timely delivery of control commands. If the channel bit error rate exceeds the security threshold, the redundant parameters of the forward error correction algorithm are dynamically optimized to adapt to harsh transmission environments. When semantic tag parsing fails, the protocol feature library of the timing feature analysis model is updated based on the timing pattern characteristics of the current message; simultaneously, historical attack pattern data is analyzed to train an anomaly detection model to identify unknown malicious operation sequences, forming a closed-loop feedback mechanism to continuously improve system security and reliability.

[0116] It is worth mentioning that a zero-trust verification mechanism is also included, specifically:

[0117] Obtain the security level score of the source device;

[0118] Match the validity and timing of work order permission operations based on the source device work order number;

[0119] If the security level score is lower than the trust threshold or the work order is invalid, the write operation instruction will be refused.

[0120] If the function code involves critical equipment control instructions and the work order time period is inconsistent, an operation violation alarm will be generated and the session will be terminated.

[0121] It should be noted that this implementation also implements a zero-trust verification mechanism. This involves dynamically obtaining the security level score of the initiating device and verifying the validity of the process work order number bound to the current operation, including the work order execution status and execution time period. If the device's security score is below the trust threshold or the work order number is invalid, write operation instructions are refused, for example, instructions to modify PLC register values ​​are refused. If the function code involves critical equipment control, such as emergency stop control, and the work order time period is inconsistent, an operation violation alarm is generated and the session is terminated. This embodiment achieves operational compliance control by binding process work orders; furthermore, the dynamic scoring mechanism replaces the static IP trust mechanism, meeting the requirements of an industrial zero-trust architecture.

[0122] It is worth mentioning that session integrity verification is also included, specifically:

[0123] Obtain the session key and session state identifier of the industrial communication protocol;

[0124] Based on the session state identifier, it is determined that the communication policy is in the execution phase;

[0125] Perform encryption operations based on the session key;

[0126] Generate an integrity verification token based on the encrypted communication message;

[0127] The target device receives and verifies the integrity verification token; if the verification fails, the message is discarded.

[0128] It should be noted that in this embodiment, during the session integrity verification phase, the session key and session state identifier of the industrial protocol are first extracted. Then, based on the session state identifier, it is determined whether to enter the communication policy execution phase, and encryption is performed based on the session key. Next, an integrity verification token is generated for the encrypted communication message and embedded in the protocol data unit. As one implementation method, the verification token is embedded at the end of the message. When the target device receives the message, it first verifies the token's validity; if the verification fails, it indicates that the message has been tampered with, and it is immediately discarded, ensuring the integrity and immutability of critical command transmission. This embodiment employs a token mechanism to guarantee the reliability of critical command transmission.

[0129] Figure 4 A block diagram of an industrial protocol-aware micro-segmentation and differential encryption system based on the present invention is shown.

[0130] like Figure 4As shown, the second aspect of the present invention discloses a micro-segmentation and differential encryption system 4 based on industrial protocol awareness, including a memory 41 and a processor 42. The memory includes a micro-segmentation and differential encryption method program based on industrial protocol awareness. When the micro-segmentation and differential encryption method program based on industrial protocol awareness is executed by the processor, it performs the following steps:

[0131] The first communication message is obtained based on static filtering of the preset port.

[0132] Based on a preset time-series feature analysis model, semantic tags are parsed from the first communication message;

[0133] Based on the semantic tags, the channel quality, function code, data point address, and data value are obtained;

[0134] The data value is determined to exceed a preset security data threshold;

[0135] If so, a blocking warning will be triggered;

[0136] If not, a communication strategy is generated based on the function code and the data point address;

[0137] When a micro-segmentation rule is triggered according to the communication strategy, access permissions are dynamically restricted according to the semantic tags.

[0138] When a differentiated encryption rule is triggered according to the communication strategy, the encryption algorithm is adjusted and the algorithm acceleration module is invoked according to the semantic tags.

[0139] It should be noted that in this embodiment, firstly, the raw traffic of the industrial network is statically filtered based on a preset port to obtain a first communication packet with preliminary classification. Then, through a preset time-series feature analysis model, the behavioral pattern characteristics of the packet are analyzed, including periodic or bursty transmission characteristics, thereby extracting protocol semantic tags containing key fields such as function code type, data point address, and data value, which are then combined with real-time channel quality indicators. If the detected data value exceeds a preset safety threshold, such as a temperature setpoint exceeding the device's safety range, a blocking warning is immediately triggered and the current operation is terminated. If the data value does not exceed the limit, a dynamic communication policy is generated based on the function code and data point address. When the communication policy triggers a micro-segmentation rule, access permissions are dynamically restricted according to the source and target device addresses in the semantic tag and the operation type. As one implementation, only specific HMI devices are allowed to access registers 0x3001-0x3010 during a specified time period. When the communication policy triggers a differentiated encryption rule, the corresponding encryption algorithm is called according to the data sensitivity; as one implementation, key instructions use hardware-accelerated high-strength encryption, while non-sensitive data uses a lightweight algorithm. Furthermore, the linkage algorithm acceleration module performs encryption operations, achieving a precise balance between security protection and resource consumption, thereby solving the problem of over-encryption. This embodiment dynamically adjusts the security strategy based on protocol semantics, enhancing the proactive defense capabilities of the industrial control system by blocking unauthorized operations in real time.

[0140] Figure 2 The diagram illustrates a semantic tag parsing flowchart provided by an embodiment of the present invention.

[0141] According to embodiments of the present invention, such as Figure 2 As shown, the step of parsing semantic tags based on the first communication message using a preset time-series feature analysis model further includes:

[0142] The static filtering layer filters the raw traffic based on the preset port number, identifies the industrial protocol type, and outputs the first communication message.

[0143] The first communication message is input into the behavior analysis layer to obtain the timing pattern characteristics of the message, including periodic transmission characteristics or burst transmission characteristics.

[0144] Based on the timing pattern characteristics, perform syntax tree parsing on the first communication message to extract key semantic tags from the protocol structure;

[0145] If the syntax tree parsing fails, the machine learning auxiliary layer is activated to perform real-time clustering analysis on the message, dynamically update the protocol feature library, and reclassify it.

[0146] It should be noted that in this embodiment, firstly, a static filtering layer filters the raw traffic based on predefined port numbers; this is used to initially identify the industrial protocol type and output the first communication message. Subsequently, the first communication message is input into a behavior analysis layer, which analyzes its transmission behavior pattern based on a time-series feature model, such as the fixed period of the PROFINET protocol or the burst traffic of the IEC 104 protocol. Then, a syntax tree parsing layer deeply extracts key semantic tags from the protocol structure. As one implementation, Modbus function code 0x03 represents a read operation, 0x06 represents a write operation, and there is also the OPC UA object identifier. If syntax tree parsing fails, a machine learning auxiliary layer is activated to perform real-time clustering analysis on the message, dynamically updating the protocol feature library and reclassifying it. Finally, a structured semantic tag set containing protocol type, function code operation type, data point physical address, and data value range is output, forming a high-precision protocol awareness foundation. This embodiment employs multi-level collaborative parsing to improve the accuracy of protocol identification; it also supports the expansion of unknown protocols through dynamic updates to the protocol library, adapting to the diversity of industrial environments.

[0147] Figure 3 A flowchart illustrating the generation process of a communication strategy according to an embodiment of the present invention is shown.

[0148] According to embodiments of the present invention, such as Figure 3 As shown, the step of generating a communication strategy based on the function code and the data point address specifically includes:

[0149] Construct a multi-dimensional decision vector based on protocol type, function code, data point address, and data value index;

[0150] The multidimensional decision vector is matched with a predefined policy library, which includes at least sensitive operation judgment rules, encryption strength mapping relationship and access permission whitelist.

[0151] If the function code corresponds to an emergency shutdown command or a critical equipment control command, then a first encryption strategy is generated and bound to the list of authorized device addresses;

[0152] If the data point address belongs to a non-sensitive area and the data value is within the security threshold, a second encryption strategy is generated and a time strategy constraint is superimposed.

[0153] It should be noted that in this embodiment, a multi-dimensional policy vector is constructed by combining protocol type, function code operation type, data point physical address, data value range, and channel quality indicators. This multi-dimensional decision vector is then matched with a predefined policy library, which includes sensitive operation judgment rules, encryption strength mapping relationships, and access permission whitelists. If the function code corresponds to an emergency shutdown or critical equipment control command, the highest-strength encryption policy is generated and bound to an authorized device IP whitelist to restrict access sources. If the data point address belongs to a non-sensitive area and the data value is within a security threshold, a lightweight encryption policy is generated and time-based policy constraints are superimposed; for example, for temperature sensor readings, plaintext transmission is allowed during working hours (8:00-18:00) to reduce CPU load. This embodiment achieves dynamic policy generation based on protocol semantics and environmental state, reducing resource overhead during off-peak hours and optimizing system efficiency.

[0154] According to an embodiment of the present invention, the triggering micro-segmentation rule specifically includes:

[0155] Based on the semantic tags, the source device address, the target device address, and the protocol operation type are obtained;

[0156] Dynamically create protocol-aware access control rules, where rule elements include source device address range, target device address, protocol type, function code operation type, and accessible data point address range;

[0157] The access control rules are distributed to the source and target devices to perform real-time traffic filtering based on the protocol context.

[0158] When an unauthorized access request is detected, the current session is interrupted and a security audit log is generated;

[0159] When a communication session ends, dynamically generated micro-segmentation rules are automatically cleared.

[0160] It should be noted that in this embodiment, the source device address, target device address, and protocol operation type in the semantic tags are first parsed to dynamically create fine-grained access control rules, i.e., fine-grained ACL rules. The elements in each rule include at least the source device address range, target device address, protocol type, function code operation type, and accessible data point address range. The ACL rules are then distributed to network devices via a software-defined network controller to perform real-time traffic filtering based on protocol context; for example, blocking unauthorized writes to PLC register 40001 by an unauthorized IP address. If an unauthorized access request is detected, the current session is immediately interrupted, and a security audit log is generated to record the violation. The dynamically generated micro-segmentation rules are automatically cleared at the end of the communication session to avoid rule bloat leading to excessive device resource consumption and ensure long-term efficient system operation. This embodiment replaces traditional static firewall policies with dynamic ACLs for precise prevention of unauthorized function code injection; furthermore, automatic rule clearing reduces device resource consumption, adapting to high-concurrency industrial scenarios.

[0161] According to an embodiment of the present invention, the triggering of the differentiated encryption rule specifically includes:

[0162] Based on a preset data sensitivity classification, a corresponding encryption algorithm is selected, including at least the first encryption algorithm being called for critical control instructions and the second encryption algorithm being called for non-sensitive data.

[0163] According to the encryption algorithm, when identifying an encrypted stream that requires hardware acceleration, the encryption operation is handed over to the corresponding hardware algorithm circuit for execution;

[0164] For low-latency sensitive data, field-level selective encryption is enabled, encrypting only key field data;

[0165] When channel quality deteriorates, non-critical data streams are transmitted in plaintext and switched to short frame transmission mode.

[0166] Once the channel quality is restored, full encryption is initiated based on a preset first delay.

[0167] It should be noted that in this embodiment, the encryption algorithm is selected based on the data sensitivity level. As one implementation method, high-strength algorithms with hardware acceleration are used for critical control commands; for example, AES is used for valve switching commands. Lightweight stream encryption algorithms are used for non-sensitive data; for example, ChaCha20 is used for ambient temperature readings. When an encryption stream requiring hardware acceleration is identified, the encryption operation is handled by a dedicated FPGA or NPU processor to improve the execution speed of the encryption algorithm. Field-level selective encryption is enabled for low-latency sensitive data, encrypting only critical fields while retaining the plaintext of the message header, reducing transmission latency. Furthermore, when channel quality deteriorates, the encryption module for non-critical data streams is shut down, and a short frame transmission mode is switched to ensure real-time performance. After channel quality recovers, the full encryption process is initiated after a preset delay to prevent system oscillations caused by frequent strategy switching.

[0168] According to an embodiment of the present invention, it further includes:

[0169] Monitor the communication status after the communication strategy is executed;

[0170] If the execution delay of the communication state exceeds the preset security delay threshold, it will roll back to the default encryption level.

[0171] If the channel bit error rate of the communication state exceeds the preset security bit error rate threshold, then the redundant parameters of the error correction algorithm are reduced.

[0172] If semantic tag parsing fails, the protocol feature library of the temporal feature analysis model is updated based on the current temporal pattern features.

[0173] It should be noted that this embodiment provides a closed-loop feedback mechanism. In this embodiment, the communication status after the strategy execution is continuously monitored. If the total latency of decision execution exceeds the industrial real-time requirements, it automatically rolls back to the default encryption strategy to ensure timely delivery of control commands. If the channel bit error rate exceeds the security threshold, the redundant parameters of the forward error correction algorithm are dynamically optimized to adapt to harsh transmission environments. When semantic tag parsing fails, the protocol feature library of the timing feature analysis model is updated based on the timing pattern characteristics of the current message; simultaneously, historical attack pattern data is analyzed to train an anomaly detection model to identify unknown malicious operation sequences, forming a closed-loop feedback mechanism to continuously improve system security and reliability.

[0174] It is worth mentioning that a zero-trust verification mechanism is also included, specifically:

[0175] Obtain the security level score of the source device;

[0176] Match the validity and timing of work order permission operations based on the source device work order number;

[0177] If the security level score is lower than the trust threshold or the work order is invalid, the write operation instruction will be refused.

[0178] If the function code involves critical equipment control instructions and the work order time period is inconsistent, an operation violation alarm will be generated and the session will be terminated.

[0179] It should be noted that this implementation also implements a zero-trust verification mechanism. This involves dynamically obtaining the security level score of the initiating device and verifying the validity of the process work order number bound to the current operation, including the work order execution status and execution time period. If the device's security score is below the trust threshold or the work order number is invalid, write operation instructions are refused, for example, instructions to modify PLC register values ​​are refused. If the function code involves critical equipment control, such as emergency stop control, and the work order time period is inconsistent, an operation violation alarm is generated and the session is terminated. This embodiment achieves operational compliance control by binding process work orders; furthermore, the dynamic scoring mechanism replaces the static IP trust mechanism, meeting the requirements of an industrial zero-trust architecture.

[0180] It is worth mentioning that session integrity verification is also included, specifically:

[0181] Obtain the session key and session state identifier of the industrial communication protocol;

[0182] Based on the session state identifier, it is determined that the communication policy is in the execution phase;

[0183] Perform encryption operations based on the session key;

[0184] Generate an integrity verification token based on the encrypted communication message;

[0185] The target device receives and verifies the integrity verification token; if the verification fails, the message is discarded.

[0186] It should be noted that in this embodiment, during the session integrity verification phase, the session key and session state identifier of the industrial protocol are first extracted. Then, based on the session state identifier, it is determined whether to enter the communication policy execution phase, and encryption is performed based on the session key. Next, an integrity verification token is generated for the encrypted communication message and embedded in the protocol data unit. As one implementation method, the verification token is embedded at the end of the message. When the target device receives the message, it first verifies the token's validity; if the verification fails, it indicates that the message has been tampered with, and it is immediately discarded, ensuring the integrity and immutability of critical command transmission. This embodiment employs a token mechanism to guarantee the reliability of critical command transmission.

[0187] A third aspect of the present invention provides a computer-readable storage medium comprising an industry protocol-aware micro-segmentation and differential encryption method program, wherein when the industry protocol-aware micro-segmentation and differential encryption method program is executed by a processor, it implements the steps of the industry protocol-aware micro-segmentation and differential encryption method as described in any of the preceding claims.

[0188] In summary, this invention provides a micro-segmentation and differential encryption method, system, and storage medium based on industrial protocol awareness. First, raw traffic is statically filtered through a preset port to obtain the first communication packet to be parsed. Then, a time-series feature analysis model is used to analyze the packet behavior pattern, extracting semantic tags containing function codes, data point addresses, and data values. If the data value exceeds a security threshold, real-time blocking and alarm are triggered; otherwise, a dynamic communication strategy is generated based on the function code and data point address. When a micro-segmentation rule is triggered, device access permissions are dynamically restricted. When a differential encryption rule is triggered, an encryption algorithm is selected based on data sensitivity, and an algorithm acceleration module is invoked for execution. This invention achieves micro-segmentation through protocol semantic parsing, protecting against unauthorized function code injection; it employs a differential encryption mechanism to reduce encryption overhead while meeting the real-time requirements of industrial scenarios; furthermore, it dynamically adjusts the encryption strength based on channel quality to ensure operational reliability under extreme conditions.

[0189] If the aforementioned functions are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0190] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A micro-segmentation and differential encryption method based on industrial protocol awareness, characterized in that, The method includes: The first communication message is obtained based on static filtering of the preset port. Based on a preset time-series feature analysis model, semantic tags are parsed from the first communication message; Based on the semantic tags, the channel quality, function code, data point address, and data value are obtained; The data value is determined to exceed a preset security data threshold; If so, a blocking warning will be triggered; If not, a communication strategy is generated based on the function code and the data point address; When a micro-segmentation rule is triggered according to the communication strategy, access permissions are dynamically restricted according to the semantic tags. When a differentiated encryption rule is triggered according to the communication strategy, the encryption algorithm is adjusted and the algorithm acceleration module is invoked according to the semantic tags.

2. The micro-segmentation and differential encryption method based on industrial protocol awareness according to claim 1, characterized in that, The semantic tag parsed from the first communication message using the preset time-series feature analysis model further includes: The static filtering layer filters the raw traffic based on the preset port number, identifies the industrial protocol type, and outputs the first communication message. The first communication message is input into the behavior analysis layer to obtain the timing pattern characteristics of the message, including periodic transmission characteristics or burst transmission characteristics. Based on the timing pattern characteristics, perform syntax tree parsing on the first communication message to extract key semantic tags from the protocol structure; If the syntax tree parsing fails, the machine learning auxiliary layer is activated to perform real-time clustering analysis on the message, dynamically update the protocol feature library, and reclassify it.

3. The micro-segmentation and differential encryption method based on industrial protocol awareness according to claim 1, characterized in that, The step of generating a communication strategy based on the function code and the data point address specifically includes: Construct a multi-dimensional decision vector based on protocol type, function code, data point address, and data value index; The multidimensional decision vector is matched with a predefined policy library, which includes at least sensitive operation judgment rules, encryption strength mapping relationship and access permission whitelist. If the function code corresponds to an emergency shutdown command or a critical equipment control command, then a first encryption strategy is generated and bound to the list of authorized device addresses; If the data point address belongs to a non-sensitive area and the data value is within the security threshold, a second encryption strategy is generated and a time strategy constraint is superimposed.

4. The micro-segmentation and differential encryption method based on industrial protocol awareness according to claim 1, characterized in that, The triggering micro-segmentation rules specifically include: Based on the semantic tags, the source device address, the target device address, and the protocol operation type are obtained; Dynamically create protocol-aware access control rules, where rule elements include source device address range, target device address, protocol type, function code operation type, and accessible data point address range; The access control rules are distributed to the source and target devices to perform real-time traffic filtering based on the protocol context. When an unauthorized access request is detected, the current session is interrupted and a security audit log is generated; When a communication session ends, dynamically generated micro-segmentation rules are automatically cleared.

5. The micro-segmentation and differential encryption method based on industrial protocol awareness according to claim 1, characterized in that, The triggering of the differentiated encryption rules specifically includes: Based on a preset data sensitivity classification, a corresponding encryption algorithm is selected, including at least the first encryption algorithm being called for critical control instructions and the second encryption algorithm being called for non-sensitive data. According to the encryption algorithm, when identifying an encrypted stream that requires hardware acceleration, the encryption operation is handed over to the corresponding hardware algorithm circuit for execution; For low-latency sensitive data, field-level selective encryption is enabled, encrypting only key field data; When channel quality deteriorates, non-critical data streams are transmitted in plaintext and switched to short frame transmission mode. Once the channel quality is restored, full encryption is initiated based on a preset first delay.

6. The micro-segmentation and differential encryption method based on industrial protocol awareness according to claim 1, characterized in that, Also includes: Monitor the communication status after the communication strategy is executed; If the execution delay of the communication state exceeds the preset security delay threshold, it will roll back to the default encryption level. If the channel bit error rate of the communication state exceeds the preset security bit error rate threshold, then the redundant parameters of the error correction algorithm are reduced. If semantic tag parsing fails, the protocol feature library of the temporal feature analysis model is updated based on the current temporal pattern features.

7. A micro-segmentation and differential encryption system based on industrial protocol awareness, characterized in that, The system includes a memory and a processor. The memory includes a program for an industry protocol-aware micro-segmentation and differential encryption method. When the processor executes the industry protocol-aware micro-segmentation and differential encryption method program, it performs the following steps: The first communication message is obtained based on static filtering of the preset port. Based on a preset time-series feature analysis model, semantic tags are parsed from the first communication message; Based on the semantic tags, the channel quality, function code, data point address, and data value are obtained; The data value is determined to exceed a preset security data threshold; If so, a blocking warning will be triggered; If not, a communication strategy is generated based on the function code and the data point address; When a micro-segmentation rule is triggered according to the communication strategy, access permissions are dynamically restricted according to the semantic tags. When a differentiated encryption rule is triggered according to the communication strategy, the encryption algorithm is adjusted and the algorithm acceleration module is invoked according to the semantic tags.

8. A micro-segmentation and differential encryption system based on industrial protocol awareness according to claim 7, characterized in that, The semantic tag parsed from the first communication message using the preset time-series feature analysis model further includes: The static filtering layer filters the raw traffic based on the preset port number, identifies the industrial protocol type, and outputs the first communication message. The first communication message is input into the behavior analysis layer to obtain the timing pattern characteristics of the message, including periodic transmission characteristics or burst transmission characteristics. Based on the timing pattern characteristics, perform syntax tree parsing on the first communication message to extract key semantic tags from the protocol structure; If the syntax tree parsing fails, the machine learning auxiliary layer is activated to perform real-time clustering analysis on the message, dynamically update the protocol feature library, and reclassify it.

9. A micro-segmentation and differential encryption system based on industrial protocol awareness according to claim 7, characterized in that, The step of generating a communication strategy based on the function code and the data point address specifically includes: Construct a multi-dimensional decision vector based on protocol type, function code, data point address, and data value index; The multidimensional decision vector is matched with a predefined policy library, which includes at least sensitive operation judgment rules, encryption strength mapping relationship and access permission whitelist. If the function code corresponds to an emergency shutdown command or a critical equipment control command, then a first encryption strategy is generated and bound to the list of authorized device addresses; If the data point address belongs to a non-sensitive area and the data value is within the security threshold, a second encryption strategy is generated and a time strategy constraint is superimposed.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, The computer-readable storage medium includes a micro-segmentation and differential encryption method program based on industry protocol awareness, which, when executed by a processor, implements the steps of the micro-segmentation and differential encryption method based on industry protocol awareness as described in any one of claims 1 to 6.

Images