Large factory 5G private network communication method and system based on zero trust

Abstract

The invention relates to the technical field of industrial internet communication, and discloses a zero-trust-based large-scale factory 5G private network communication method and system, and the method comprises the steps: constructing a hardware fingerprint; the firmware is subjected to Hash verification by using the national cipher SM4; an equipment activity area is delimited through GPS and UWB fusion positioning, and trust deduction is triggered when equipment crosses a boundary; constructing an equipment behavior baseline based on a Markov chain and historical data, and judging that the equipment behavior is abnormal when the equipment behavior baseline deviates from a threshold value; establishing a dynamic trust evaluation model, and calculating a trust value; the minimum bandwidth of the 5G slice is reduced to 10 Mbps, and the SDN controller completes scheduling within 100 ms; using an LSTM model to predict idle resources; slice isolation is realized through the NFV, the VLAN and the VXLAN; the equipment is accessed by an X.509 certificate and a work order ID, and the unrecorded equipment triggers a stealth strategy; performing session re-authentication and dynamically adjusting the authority; constructing a threat perception engine by using an IDS and a sandbox; and implementing three-level response on the equipment with the trust score less than 40. The network security and the resource utilization rate can be improved.

Description

Technical Field

[0001] This invention relates to the field of industrial internet communication technology, specifically to a large-scale factory private network communication technology that integrates zero-trust architecture and 5G slicing technology. Background Technology

[0002] In the transformation of large factories towards intelligent manufacturing, the types of industrial IoT devices are diverse. Traditional communication adopts a static authorization model of "one-time authentication and lifelong trust," which cannot cope with dynamic threats such as physical tampering of devices and firmware vulnerabilities. IT and OT networks have long been disconnected, and edge devices and cloud applications lack dynamic trust transfer mechanisms. Cross-network data transmission relies on manual copying, with a delay of more than 30 minutes. Moreover, OT networks lack effective micro-segmentation, making them susceptible to lateral attacks. Existing 5G communication relies on hard slicing technology to achieve service isolation. The core is to meet the communication needs of different scenarios by dividing fixed bandwidth resources. It is widely used in smart cities, telemedicine, industrial internet and other fields. Its advantages are high bandwidth and low latency. However, the smallest bandwidth granularity of traditional 5G hard slicing is 5Gbps, and resource scheduling requires manual configuration. Currently, when large factories introduce 5G communication, they directly adopt traditional 5G hard slicing technology, resulting in severe resource mismatch. For example, low-bandwidth scenarios such as AGV control (4-10Mbps) and environmental sensor data transmission (1-2Mbps) are forced to occupy 5Gbps slices, with resource utilization rate of less than 5%. During production switchover, the bandwidth demand of equipment increases sharply, and the response time for traditional slice adjustment is as long as 2 hours, which can easily cause production delays. During peak periods, multiple production lines compete for slice resources, often resulting in network congestion problems. Furthermore, without coordination with equipment trust assessment, access security cannot be guaranteed. While existing technologies isolate service data through dual-plane communication, they fail to address the coordination issues between dynamic device identity verification and real-time slicing resource scheduling, making it difficult to meet the dual demands of large factories for communication security and resource efficiency. Therefore, there is an urgent need for a new private network communication method and system that integrates zero-trust dynamic verification and 5G elastic slicing. Summary of the Invention

[0003] The present invention aims to provide a 5G private network communication method and system for large factories based on zero trust, in order to solve the problems of dynamic risks in equipment access in large factories, waste of 5G slicing resources and response lag, lack of security in cross-domain access of IT / OT, and disconnect between trust assessment and resource scheduling.

[0004] To solve the above problems, the present invention adopts the following technical solution: Option 1: A zero-trust-based 5G private network communication method for large factories, comprising: S1, Collect device hardware information to construct a hardware fingerprint; S2 uses the national cryptographic SM4 hash to verify the firmware. The hash value is compared every 10 minutes. If the deviation is greater than 5%, the device is marked as abnormal. S3 uses GPS and UWB fusion positioning with an accuracy of ±25cm to delineate the device's activity area, and triggers a trust deduction when the device crosses the boundary; S4, based on Markov chains and historical 30-day data, constructs a baseline for device behavior and determines abnormal device behavior when it deviates from the threshold. S5. Establish a dynamic trust assessment model and calculate the trust value according to the formula, where λ is 0.95, historical trust value accounts for 40%, and real-time assessment value accounts for 60%. S6 reduces the minimum bandwidth of 5G slices to 10Mbps, and the SDN controller completes scheduling within 100ms, reserving 10% redundant bandwidth for critical slices; S7 uses an LSTM model to predict idle resources, with a prediction error of less than 2% within half an hour; S8 achieves slice isolation with VXLAN through NFV and VLAN, and cross-slice traffic is transmitted through IPSec tunnel and encrypted using the SM4 algorithm; S9 devices connect using X.509 certificates and work order IDs; unregistered devices trigger stealth policies. S10 performs session re-authentication every 10 minutes and dynamically adjusts permissions; S11 uses IDS and sandbox to build a threat awareness engine; S12 implements a three-level response for devices with a trust score of less than 40, and the attack event is synchronized to the blockchain for evidence storage and traceability.

[0005] Beneficial effects: This method covers the entire process of device access, resource scheduling, and risk management. The combination of hardware fingerprinting and SM4 hash verification can accurately identify device identity and firmware tampering, preventing unauthorized device access. GPS and UWB fusion positioning can monitor device location in real time, preventing security risks caused by devices crossing boundaries. The behavioral baseline and dynamic trust assessment model built by Markov chain can update the device trust status in real time, providing a basis for resource allocation. The combination of 5G small-granular slicing and SDN fast scheduling solves the problem of resource waste in traditional slicing, and LSTM prediction model further improves resource utilization. Slice isolation and encrypted transmission ensure data security, stealth strategy and three-level response can block risks in a timely manner, and blockchain evidence storage facilitates traceability. It comprehensively balances communication security and resource efficiency, solving the core problem of the imbalance between security and efficiency in traditional solutions.

[0006] Preferably, the abnormal device behavior determination in S4 also includes counting the number of times the data value exceeds the 3σ range within a unit of time. When the temperature sensor exceeds the ±3℃ fluctuation range, a count is made, and the count result is included in the abnormal determination criteria.

[0007] Beneficial Effects: Building upon the Markov chain behavior baseline, the addition of counting criteria for data values ​​exceeding the 3σ range further enriches the dimensions for judging abnormal equipment behavior. Traditional methods relying solely on behavioral states are prone to misjudgments due to single-dimensional biases. However, by incorporating data fluctuation range statistics, abnormal behavior can be verified from the perspective of actual equipment operating data. For example, a temperature sensor fluctuation exceeding ±3℃ may indicate equipment failure or data tampering. Timely counting and inclusion in the judgment allows for earlier detection of potential problems. This multi-dimensional judgment method significantly reduces the false judgment rate, improves the reliability of equipment operating status monitoring, provides a more accurate basis for subsequent trust assessment and risk management, and ensures the authenticity and stability of equipment data during factory production.

[0008] Preferably, the SDN controller scheduling process in S6 is as follows: the AGV scheduling system sends a bandwidth adjustment request, the controller queries the bandwidth usage of the slice resource pool, completes the bandwidth adjustment by issuing a flow table through the OpenFlow protocol, and then feeds back the adjustment result to the AGV scheduling system, forming a complete scheduling closed loop.

[0009] Beneficial effects: A clear SDN controller scheduling closed-loop process ensures that bandwidth adjustment requests are controllable from initiation to completion. The AGV scheduling system sends requests directly, reducing intermediate latency. The controller can accurately grasp the current bandwidth usage status by querying the resource pool, avoiding resource conflicts caused by blind allocation. The OpenFlow protocol quickly distributes flow tables, combined with an adjustment speed of less than 100ms, enabling timely responses to bandwidth demands of AGVs due to task changes in logistics transportation. For example, when the AGV's transportation volume increases, bandwidth can be quickly increased to prevent transportation delays caused by insufficient bandwidth. The feedback results after adjustment allow the AGV scheduling system to adapt to resource changes in a timely manner, avoiding production coordination problems caused by information asymmetry, effectively reducing the risk of production interruptions, and improving the communication stability and efficiency of factory logistics.

[0010] Preferably, the stealth strategy in S9 is as follows: the zero-trust gateway rejects all communication requests from unregistered devices and does not return any response information to unregistered devices, making unregistered devices undetectable in the factory network.

[0011] Beneficial Effects: Compared to the traditional "deny access and return a prompt" protection method, the stealth strategy fundamentally prevents unregistered devices from obtaining network information by refusing requests and not returning a response. Unregistered devices cannot determine network protection rules through gateway responses, significantly reducing the possibility of them launching attacks by probing vulnerabilities. Simultaneously, refusing all communication requests directly blocks any data interaction between unregistered devices and the factory network, preventing them from stealing production data or implanting malicious programs. This protection method is more thorough and can effectively resist external unauthorized access attacks against the factory network, ensuring the independence and security of the factory's core production network and building a solid first line of defense for subsequent device authentication and data transmission.

[0012] Preferably, the dynamic adjustment of permissions in S10 specifically includes: when the device operation log shows that an unauthorized instruction has been executed, restricting the range of data uploaded by the device, allowing the device to upload only basic operating status data, and prohibiting the device from uploading core production data.

[0013] Beneficial Effects: For situations where equipment executes unauthorized commands, fine-grained permission adjustments can ensure basic equipment monitoring needs while preventing the leakage of core data. Allowing the upload of basic operational status data allows administrators to monitor the current equipment status in real time, assess the impact of unauthorized commands, and avoid monitoring gaps caused by complete disconnection. Prohibiting the upload of core production data directly blocks potential data theft or tampering caused by unauthorized commands, such as preventing the equipment from transmitting sensitive data like production process parameters and order information. This dynamic permission control method achieves "precise restriction" when potential risks arise, rather than a "one-size-fits-all" disconnection, balancing equipment operation monitoring and core data security, and reducing the impact on production caused by improper permission control.

[0014] Preferably, the triggering conditions for the three-level response in S12 are as follows: a warning response is triggered when the device trust score is between 30 and 40; a rate limiting response is triggered when the trust score is between 20 and 30, limiting the device bandwidth to 1 / 10 of the original bandwidth; and a disconnection response is triggered when the trust score is less than 20, triggering the SDP stealth policy to disconnect the device network connection.

[0015] Beneficial Effects: By quantifying trust scores and classifying response trigger conditions into three levels, risk management becomes more targeted and operable. Devices with trust scores of 30 to 40 are considered low-risk; a simple warning is sufficient to alert management and prevent over-management from disrupting normal production. Devices with trust scores of 20 to 30 represent an increased risk; limiting bandwidth to 1 / 10 restricts their data transmission capacity, slowing the spread of risk while preserving basic communication for troubleshooting. Devices with trust scores below 20 are considered high-risk; disconnection responses promptly isolate threats and prevent attacks from spreading to other devices. This tiered approach avoids the limitations of a single approach and precisely matches response measures to risk levels, improving risk management efficiency and reducing production losses and safety hazards caused by improper handling.

[0016] Option 2: A zero-trust-based 5G private network communication system for large factories, used in the aforementioned zero-trust-based 5G private network communication method for large factories, including a device layer, a network layer, a platform layer, and an application layer; The device layer includes a hardware fingerprint acquisition module, an SM4 encryption module, and a GPS and UWB positioning module; The network layer includes 5G base stations that support subcarrier aggregation, SDN controllers, and zero-trust gateways; The platform layer includes a factory CA server, a blockchain evidence storage module, a threat perception engine integrating IDS and sandbox, and an LSTM resource prediction module. The application layer includes the AGV scheduling system, equipment management system, and production management system; The different levels interact with each other to achieve communication functions.

[0017] Beneficial Effects: This system, through its layered design, clearly defines the functions of each module, achieving collaborative operation across the cloud, network, edge, and terminal layers. The hardware fingerprinting and positioning module at the device layer provides basic data for device identification and location monitoring, while the SM4 encryption module ensures data security at the device level. At the network layer, the 5G base station and SDN controller enable small-granular slicing and rapid scheduling, and the zero-trust gateway controls access security. At the platform layer, the CA server supports certificate authentication, the blockchain evidence storage module ensures data traceability, the threat perception engine identifies attacks in real time, and the LSTM model optimizes resource allocation. The application layer directly connects to production needs, enabling resource scheduling and production collaboration. The close cooperation between these layers forms a complete chain of protection from device access to production applications, meeting the factory's high requirements for communication security while improving production efficiency through resource optimization, thus solving the problems of fragmented layers and limited functionality in traditional systems.

[0018] Preferably, the hardware fingerprint acquisition module at the device layer updates the device's hardware fingerprint information every 10 seconds.

[0019] Beneficial effects: Updating hardware fingerprint information every 10 seconds enables real-time synchronization of device hardware status, avoiding misidentification due to delayed hardware information updates. Traditional static hardware fingerprints are prone to allowing devices to access the network with the original identity even after hardware components are replaced or tampered with. High-frequency updates, however, can promptly detect hardware changes. For example, after a device's network card is replaced, the fingerprint information can be updated within 10 seconds, allowing the gateway to quickly identify and re-authenticate, preventing devices with illegally replaced hardware from gaining unauthorized access. This high-frequency update mechanism significantly improves the timeliness and accuracy of hardware fingerprints, providing a more reliable basis for device authentication, further strengthening device access security, and ensuring the uniqueness and authenticity of device identities within the factory network.

[0020] Preferably, the LSTM resource prediction module of the platform layer updates the input feature data every 5 minutes and outputs the idle resource prediction result every 10 minutes.

[0021] Beneficial Effects: High-frequency updates to input features and output prediction results enable timely capture of dynamic changes in factory production and equipment operation, improving the timeliness and accuracy of resource forecasting. Updating input features every 5 minutes allows for rapid incorporation of new information such as production plan adjustments and equipment status changes. For example, when increased bandwidth demand due to increased early-shift capacity can trigger timely feature data updates. Outputting prediction results every 10 minutes allows for early identification of resources that are about to become idle and triggers their reclamation, preventing prolonged resource idleness. Compared to traditional low-frequency forecasting, this high-frequency forecasting mechanism can more accurately match the dynamic resource needs of the factory, further improving the utilization rate of sliced ​​resources, reducing resource waste or supply shortages caused by forecast lag, and ensuring the stability of resource supply during production.

[0022] Preferably, the zero-trust gateway at the network layer has a logging function, which records the device authentication process, permission adjustment operations, and abnormal event information, and the log is kept for no less than one year.

[0023] Beneficial Effects: The logging function of the zero-trust gateway provides complete traceability for factory network security management. It records the device authentication process in detail, allowing verification of authentication details and identification of vulnerabilities in case of device identity disputes; it records permission adjustment operations, enabling tracing the time, reason, and operator of permission changes to prevent unauthorized permission adjustments; and it records abnormal event information, facilitating post-incident analysis of attack paths and impact scope, and summarizing protection experience. With a retention period of at least one year, it meets the needs of long-term security audits in the factory and can handle potential later security investigations, such as retrieving complete logs when tracing historical attack events. This log management mechanism enhances the transparency and traceability of network security management, providing support for establishing a long-term security protection system for the factory.

[0024] Advantages of this invention: 1. It pioneered a dynamic binding mechanism of "trust level - slice resource", which prioritizes high-trust devices to obtain resources and restricts low-trust devices, thereby achieving synergistic optimization of security and efficiency and solving the problem of disconnect between the two in traditional solutions. 2. Achieve industrial-grade zero-trust adaptation: Develop a lightweight trust assessment algorithm to address the characteristics of weak computing power and diverse protocols in industrial equipment. This algorithm supports multi-protocol fusion authentication and is compatible with embedded devices such as PLCs. 3. Construct a closed-loop trust system covering the entire lifecycle of equipment from network access to operation to decommissioning. During the network access phase, dual binding ensures identity credibility. During the operation phase, permissions are evaluated and adjusted in real time. During the decommissioning phase, certificates are automatically revoked and resources are reclaimed to prevent secondary misuse of equipment. 4. Optimize 5G slice resource scheduling, compress the minimum bandwidth granularity to 10Mbps, support multiple levels, combine LSTM prediction to reclaim idle resources in advance, improve resource utilization to over 90%, and shorten slice adjustment response time to within 100ms.

[0025] The differences between this invention and the prior art are as follows: 1. Device Trust Assessment: Existing technologies use static authorization. This invention constructs a dynamic trust assessment model based on multiple factors (hardware fingerprint, firmware verification, location, and behavioral baseline), and combines Markov chains and weighted algorithms to update trust values ​​in real time and accurately identify device risks. 2. 5G Slicing Technology: Existing technologies have a minimum bandwidth granularity of 5Gbps, and manual scheduling response is slow. This invention refines the bandwidth to 10Mbps through subcarrier aggregation, dynamic scheduling by the SDN controller, and prediction of idle resources by LSTM, which greatly improves resource utilization and response speed. 3. Cross-domain security protection: Existing technologies have fragmented IT / OT networks and lack a unified trust mechanism. This invention achieves trusted cross-domain communication through zero-trust gateways, dual isolation, and encrypted transmission, reducing manual data copying and lowering the risk of lateral movement attacks. 4. Risk handling mechanism: Existing technologies mostly rely on single alarms or manual handling. This invention constructs an automated three-level response mechanism, combined with blockchain evidence storage, to achieve real-time risk handling and accountability, thereby enhancing proactive security protection. Attached Figure Description

[0026] Figure 1 The system architecture diagram of this invention shows the cloud-pipe-edge-device layer and the deployment of zero-trust components.

[0027] Figure 2 This is a flowchart of the trust assessment process of the present invention.

[0028] Figure 3 This is a timing diagram for the slice resource scheduling of the present invention. Detailed Implementation

[0029] The following detailed description illustrates the specific implementation method: This invention constructs a zero-trust 5G private network system covering "cloud-pipe-edge-device", and its system architecture is as follows: Figure 1 As shown, the system comprises a platform layer, network layer, and terminal layer, which are transmitted sequentially and adapted to the application layer's interaction requirements. The platform layer includes ZTAC (Zero Trust Access Controller), SOC (Security Operations Center), factory CA server, blockchain evidence storage module, threat perception engine, and LSTM resource prediction module, serving as the core control hub of the system. The network layer is divided into two parts: the first part includes the 5G core network and SDN controller, responsible for resource scheduling decisions; the second part includes switches, macro base stations, micro base stations, zero trust gateways, and IPSec tunnel devices, handling device access and data transmission. The terminal layer consists of industrial equipment with zero trust clients installed, serving as the carrier for business execution and data acquisition. The application layer includes the AGV scheduling system, equipment management system, and production management system, although not explicitly stated in the provided text. Figure 1While the interface is drawn in Chinese, it interacts with the platform and network layers via APIs to drive the implementation of business requirements. Collaborative efforts across all layers ensure communication security and efficient resource utilization throughout the entire process, from device access, resource scheduling, isolation and protection, access control, and risk management, resolving the imbalance between security and efficiency in traditional solutions.

[0030] The present invention provides a zero-trust-based 5G private network communication method for large factories, comprising the following steps: S1, at the device layer, collects the device's network interface card physical address, CPU serial number, and device serial number to construct a hardware fingerprint; the hardware fingerprint acquisition module at the device layer updates the hardware fingerprint information every 10 seconds to ensure consistency with the current device state and prevent unauthorized access after hardware tampering. This hardware fingerprint will be used as... Figure 2 The core input in the "Data Collection" stage of the "Trust Assessment Process" shown provides the foundation for the trustworthiness of device identity; the fingerprint data collected by the industrial equipment at the terminal layer needs to be processed... Figure 1 The data is transmitted from the network layer switches and zero-trust gateways to the platform layer for initial data verification.

[0031] S2, based on the national standard SM4 hash verification, implements firmware verification and encrypted communication. It generates a firmware hash value every 10 minutes and compares it with the factory default value; if the deviation exceeds 5%, the device is marked as faulty. The device layer has a built-in national standard SM4 encryption module; both firmware verification data and communication data are encrypted using this module. Figure 1 The IPSec tunnel device at the network layer uses the national cryptographic SM4 algorithm for encryption and the key is dynamically updated every hour. Anti-replay attack mechanisms are deployed at both ends of the tunnel to ensure the security of data during interaction between the terminal layer, platform layer, and application layer.

[0032] S3 uses GPS+UWB fusion positioning to determine the device's access location with an accuracy of ±25cm. Combined with the factory's electronic fence, it delineates the device's legal activity area, triggering a trust deduction when the device crosses the boundary. The device layer is equipped with GPS and UWB positioning modules, and the collected location data is synchronously incorporated into the system. Figure 2 The "data collection" stage of the "trust assessment process," together with hardware fingerprinting, constitutes a multi-dimensional assessment basis to ensure the credibility of the device's physical location; if the device deviates from its designated area, location anomaly information will be fed back in real time. Figure 1 ZTAC at the platform layer triggers a deduction of trust score.

[0033] S4 constructs a device behavior baseline based on a Markov chain, classifying device behavior into five states: "normal communication," "silent," and "high-frequency requests." A state transition matrix is ​​trained using 30 days of historical data, and device behavior is deemed abnormal when it deviates from a matrix threshold. The abnormal behavior determination also includes calculating a data anomaly rate, counting the number of times device data values ​​exceed the 3σ range per unit time (e.g., a temperature sensor's normal fluctuation is ±3℃; exceeding the range is counted). This data is also input into the system. Figure 2The "data collection" stage of the "trust assessment process". Subsequent steps will be taken through... Figure 2 The "Markov chain behavior baseline prediction" step in the process uses a matrix trained on 30 days of historical data to accurately determine whether the equipment behavior is abnormal, enriches the dimensions of anomaly determination, improves the accuracy of identification, avoids misjudgment in single behavior assessment, and ensures the reliability of equipment operation status monitoring.

[0034] S5 establishes a dynamic trust assessment model. The dynamic trust value calculation formula is: Dynamic Trust Value = λ^t × Historical Trust Value × 40% + Real-time Assessment Value × 60% (λ = 0.95 is the time decay coefficient, t is the assessment interval in hours, historical trust value is the average trust score over the past 7 days, and real-time assessment value is a weighted sum of 30% for the device layer, 25% for the network layer, and 45% for the behavior layer). This model fully complies with... Figure 2 The "Trust Assessment Process" involves several steps: First, the collected hardware, location, and behavioral data undergo "data processing" (standardization and key factor weighting). Then, "MADM Real-Time Trust Calculation" yields a real-time assessment value. Finally, "historical and real-time trust fusion" calculates a dynamic trust value, culminating in the "Trust Level Output." Figure 1 The ZTAC at the platform layer provides a basis for resource scheduling and access control.

[0035] S6 enables small-particle hard slicing technology, via 5G base stations ( Figure 1 Network layer macro and micro base station (MS) subcarrier aggregation compresses the minimum bandwidth granularity from 5Gbps to 10Mbps, supporting multiple tiers of 10Mbps / 20Mbps / 50Mbps, based on an SDN controller ( Figure 1 The network layer core components complete slice resource scheduling. Within 100ms after a service request is triggered, the flow table is issued via the OpenFlow protocol to adjust bandwidth, and 10% redundant bandwidth is reserved for critical slices. The SDN controller scheduling process forms a closed loop: the AGV scheduling system (application layer) sends bandwidth requirements, the controller queries the slice resource pool, adjusts, and returns the result. This process perfectly matches... Figure 3 The core steps of the "slice resource scheduling sequence" shown are from "service request initiation" to "ZTAC trust level verification" (calling the trust level output by S5), "resource demand analysis and prediction", "slice creation / adjustment decision", "slice resource allocation", "allocation determination and feedback", and finally "real-time monitoring and dynamic adjustment" to ensure accurate response to bandwidth demand and reduce the risk of production interruption.

[0036] S7 establishes an LSTM idle resource prediction model, inputting historical 24-hour bandwidth usage, production plans, equipment status, and environmental factors. Trained with 500,000 historical data points, the prediction error is less than 2% within a short half-hour period, identifying idle resources 10 minutes in advance. This model corresponds to... Figure 1The LSTM resource prediction module at the platform layer updates the input feature data every 5 minutes and outputs the prediction results every 10 minutes. Figure 3 The "Resource Demand Analysis and Forecasting" step in "Slice Resource Scheduling Timing" provides data support to improve the efficiency of resource recycling and redistribution and reduce resource idleness.

[0037] S8, based on NFV technology, allocates independent virtual network functions (vFW / vRouter) to each slice, and achieves logical isolation between slices through VLAN+VXLAN. Cross-slice traffic passes through... Figure 1 IPSec tunneling devices at the network layer transmit data. A combination of dual isolation and encryption ensures... Figure 1 Data between different slices is not interfered with or leaked, ensuring secure cross-slice communication.

[0038] S9 devices come pre-installed with an X.509 certificate containing the device serial number and manufacturer signature. The root node of the certificate chain is stored in... Figure 1 The platform layer's factory CA server, when the device connects, sends a request to the zero-trust gateway ( Figure 1 The network layer component sends "certificate + work order ID". After the gateway verifies the certificate, it queries the blockchain evidence storage module. Figure 1 The platform layer establishes a binding relationship between work orders and device serial numbers. Unregistered devices trigger a "stealth policy." Specifically, the zero-trust gateway rejects all requests from unregistered devices and does not return a response, thus preventing them from being detected. Figure 1 The system link is "undetectable," blocking unauthorized access at the source; at the same time, the zero-trust gateway has a logging function to record device authentication, permission adjustment, and abnormal events. The logs are kept for no less than one year, providing a basis for security auditing and problem investigation.

[0039] S10 performs session re-authentication every 5 minutes via a "challenge-response" mechanism: the zero-trust gateway sends a random number, the device encrypts and returns it using its built-in private key, and the gateway decrypts and verifies it using its public key. Simultaneously, it dynamically adjusts permissions based on the device's real-time location and operation logs. If the device executes an unauthorized command, its data upload scope is temporarily restricted (only basic operational data is allowed, core production data is prohibited), achieving fine-grained permission control and balancing device operation and data security. During the re-authentication process, the gateway can call... Figure 1 ZTAC's trust data at the platform layer ensures the validity of authentication.

[0040] S11 integrates IDS and sandbox technology to build a threat perception engine. Figure 1 Platform layer components analyze Modbus protocol anomalies in real time to identify DoS and man-in-the-middle attacks. The engine can monitor in real time. Figure 1 The system monitors the interaction traffic between the network layer and the terminal layer to promptly detect and issue warnings of malicious attacks.

[0041] S12, implement a three-level response for high-risk devices with a trust score <40: trigger a warning when the trust score is 30-40 (send an alert to the application layer device management system); trigger rate limiting when the trust score is 20-30 (the SDN controller reduces the bandwidth to 1 / 10 of the original); trigger disconnection when the trust score is <20 (the zero-trust gateway executes the SDP stealth policy); and synchronize attack events to... Figure 1 The platform-level blockchain-based evidence storage module provides traceability. By using quantitative trust scoring to define response conditions, risk management becomes more targeted, avoiding excessive disruption to production.

[0042] Detailed description of each level of the system of this invention: Equipment layer: This layer includes various industrial equipment within the factory, featuring built-in hardware fingerprint acquisition modules (updated every 10 seconds), SM4 encryption modules, and GPS+UWB positioning modules. It forms the foundation for data acquisition and business execution, collecting hardware, location, and behavioral data. Figure 2 Trust assessment provides core inputs.

[0043] Network layer: Includes 5G base stations (macro and micro), SDN controller, zero-trust gateway, IPSec tunneling equipment, and switches. 5G base stations support subcarrier aggregation, and the SDN controller performs... Figure 3 Slicing scheduling, zero-trust gateways are responsible for authentication and "stealth policies", and IPSec tunnels ensure encrypted transmission, serving as a "communication bridge" connecting the terminal layer and the platform layer.

[0044] Platform layer: Includes ZTAC, SOC, factory CA server, blockchain evidence storage module, threat perception engine, and LSTM resource prediction module. ZTAC is responsible for trust level verification (supporting...). Figure 3 Scheduling), SOC coordinates security incidents, CA server manages certificates, blockchain stores key information, threat perception and attack identification, LSTM module predicts resources (supporting... Figure 3 Prediction is the central control mechanism of the system.

[0045] Application layer: Includes AGV scheduling system, equipment management system, and production management system. It initiates business requests (such as AGV bandwidth requests), receives scheduling results and early warning information, drives system capabilities to adapt to production needs, and deeply collaborates with other layers.

[0046] The specific implementation process is as follows: Example 1 This example illustrates an AGV scheduling scenario.

[0047] A car factory's final assembly workshop has deployed 20 AGVs to handle parts transfer. The logistics channel is 3 meters wide (a deviation of more than 50cm from the channel may cause a collision). The bandwidth requirement fluctuates with the transfer volume: 20Mbps when empty and 50Mbps when fully loaded, with the peak transportation time being from 8:00 to 10:00 AM.

[0048] The details of this embodiment are as follows: Dynamic trust assessment mechanism: Each AGV is manufactured by collecting the network card physical address (e.g., 00:1B:44:11:3A:B7), CPU serial number (SN12345678), and device number (AGV-001 to AGV-020) to generate a hardware fingerprint, which is stored in the factory's CA server. An electronic fence is drawn by GPS+UWB fusion positioning (12 UWB base stations are deployed in the workshop, updating the position every 500ms with an accuracy of ±22cm). When an AGV crosses the boundary by more than 30cm, 5 trust points are deducted per second. A Markov chain behavior baseline is trained based on 30 days of historical data. Under normal conditions, the probability of "high-frequency requests" (more than 5 data uploads per second) is <0.5%. Three consecutive high-frequency requests are considered abnormal and 10 points are deducted.

[0049] Elastic slice scheduling: Using 10Mbps small-granularity slicing, each AGV is initially allocated 20Mbps (2 10Mbps units); the LSTM model is input with the bandwidth curve of the previous 24 hours (average 45Mbps during the morning peak) and production plan (20% increase in capacity for the morning shift), and the parameters are updated at 2:00 AM every day; at 7:50 AM, it is predicted that the bandwidth needs to be increased to 50Mbps after 8:00 AM, and the SDN controller issues the flow table through the OpenFlow protocol at 7:55 AM, completing the bandwidth adjustment of 18 AGVs within 187ms, while reserving 10% redundant bandwidth (5Mbps) for critical equipment.

[0050] Trust-resource synergy effect: AGV-005 crossed the boundary by 40cm (lasting for 2 seconds) due to mechanical failure, and its trust score dropped from 98 to 93 (still high trust), and it was given priority to obtain bandwidth; AGV-012's firmware hash value deviation was 6.2%, and its trust score dropped to 55, and its maximum bandwidth was limited to 30Mbps.

[0051] This embodiment is compared with the comparative example: Comparative Example 1 (Traditional Static Licensing + 5G Hard Slicing): AGVs occupy a fixed 5Gbps slice, and 20 AGVs occupy only 1Gbps of bandwidth during the morning peak, with a resource utilization rate of 3%. When the bandwidth is insufficient, manual adjustment is required, which takes 2 hours and causes 3 production lines to stop.

[0052] Comparative Example 2 (Single Zero Trust + Traditional 5G Slice): Identity authentication is completed only through zero trust, without associating slice resources. When the AGV trust score drops to 50, it still occupies 50Mbps bandwidth. There is no LSTM prediction, and the bandwidth is insufficient during the morning peak, requiring manual adjustment, which takes 90 minutes.

[0053] Example 2 This embodiment describes a temperature sensor data transmission scenario.

[0054] An electronics factory's SMT workshop is equipped with 500 temperature sensors to monitor the temperature of the reflow oven (normal range 220±3℃). The sensors upload 1.2Mbps of data every 30 seconds and need to identify over-temperature anomalies (>223℃ or <217℃) in real time.

[0055] The details of this embodiment are as follows: Multifactor anomaly identification: Every 10 minutes, a sensor firmware SM4 hash value is generated and compared with the factory baseline value. If the deviation is greater than 5% (e.g., a sensor with a deviation of 5.8%), it is marked as abnormal and 20 points are deducted. The 3σ principle (σ=0.8℃) is used to count the number of times the temperature exceeds the limit within 10 minutes. If it exceeds 5 times, an early warning is triggered and 15 points are deducted. The Markov chain model shows that the probability of the sensor being "silent" (no data for more than 5 minutes) under normal conditions is less than 0.1%. If it is silent for 3 minutes, it is judged as abnormal.

[0056] Small particle slices and abnormal responses: The 500 sensors are divided into 5 groups according to the area, with each group allocated a 10Mbps slice (total usage 50Mbps), and the resource utilization rate is 92%. Cross-slice isolation is achieved through VLAN (ID=101-105) + VXLAN (VNI=1001-1005). Sensor SN327 continuously exceeds the temperature (225℃), and there are 6 abnormalities within 10 minutes. The trust score drops to 38 points (warning is triggered). If it does not recover within 5 minutes, it drops to 28 points (rate is limited to 1Mbps). If it continues to exceed the temperature for 10 minutes, it drops to 15 points (SDP stealth disconnection and blockchain evidence storage).

[0057] This embodiment is compared with the comparative example: Comparative Example 1 (Traditional Static Licensing + 5G Hard Slicing): Each sensor occupies a fixed 5Gbps slice, and 500 sensors occupy a total of 2500Gbps, with a resource utilization rate of 2%; there is no firmware verification, and the over-temperature data of a certain sensor was not uploaded after the firmware was tampered with, and it was only discovered 30 minutes later, resulting in the scrapping of 20 PCB boards.

[0058] Comparative Example 2 (Single Zero Trust + Traditional 5G Slicing): With only zero trust authentication and no behavioral baseline modeling, a certain sensor only alarms after 8 minutes of overheating, with an identification accuracy of 82%; without dynamic current limiting, abnormal sensors continuously occupy bandwidth, causing data lag in normal sensors.

[0059] Example 3 This example illustrates a cross-domain MES system data acquisition scenario.

[0060] A machine factory's MES system is deployed on an IT domain cloud platform. It needs to obtain real-time data from 30 CNC machine tools in the OT domain (1.5Mbps per machine, including spindle speed and feed rate). The transmission latency must be less than 1 second, and unregistered devices are prohibited from accessing the OT domain.

[0061] The implementation details of this invention are as follows: Zero-trust cross-domain access: The CNC machine tool comes pre-installed with an X.509 certificate containing the serial number (CNC-001 to CNC-030). When connecting, it sends "certificate + work order ID" to the zero-trust gateway. The gateway verifies the certificate through the CA server and queries the blockchain to find the binding relationship between the work order and the serial number. Every 5 minutes, it re-authenticates through "challenge-response" (the gateway sends a random number, and the device returns it encrypted with its private key), while checking the location and operation logs.

[0062] Encrypted transmission and protection: Cross-domain traffic is transmitted through an IPSec tunnel, encrypted using the SM4 algorithm (key updated hourly), and anti-replay mechanisms are deployed at both ends of the tunnel; when unregistered devices (such as illegal portable computers) are connected, the gateway implements a "stealth policy" (does not return any response), with a protection rate of 100%; when CNC-015 executes unauthorized G-code, it is temporarily restricted to uploading only basic data and prohibited from uploading process parameters.

[0063] Compared with the comparative example: Comparative Example 1 (Traditional Static Authorization + 5G Hard Slicing): No encrypted tunnel, cross-domain data relies on manual copying every 30 minutes, with a 30-minute delay; the protection rate of unregistered equipment is 70%, and a hacker disguises a CNC machine tool to steal process parameters.

[0064] Comparative Example 2 (Single Zero Trust + Traditional 5G Slicing): Cross-domain access via VPN without SM4 encryption resulted in data tampering, rendering 5 workpieces unusable; unregistered devices returned a "reject response" upon access, achieving a 90% protection rate, making it vulnerable to hacker bypass. As demonstrated by the above examples, the dynamic trust assessment, small-granularity slice scheduling, and zero-trust cross-domain protection features of this invention significantly improve resource utilization, response speed, and security protection accuracy compared to existing technologies that focus on slice authentication or basic zero trust, making them more suitable for the complex needs of large factories.

[0065] Table 1 is obtained by comparing Examples 1, 2, and 3 with Comparative Examples 1 and 2, respectively. Comparative Example 1 is traditional static licensing + 5G hard slicing, and Comparative Example 2 is single zero trust + traditional 5G slicing. The two comparative examples and three examples were run under the same conditions, and the comparison results in Table 1 are obtained. It can be seen from Table 1 that the embodiments of the present invention are superior to the prior art.

[0066] Table 1

[0067] Note: "-" indicates that there is no corresponding dimension requirement for this scenario and it is not included in the comparison; Examples 1-3 are designed for the core requirements of AGV scheduling, sensor monitoring, and cross-domain data acquisition, respectively. The table has been matched with the key comparison dimensions of each scenario to eliminate the contradiction between "cross-domain data" and "unregistered protection" in the original content and Examples 1-2.

[0068] Through a detailed comparison of the three embodiments above and the comprehensive data quantification in Table 1, the following clear conclusions can be drawn: In terms of resource utilization efficiency, this invention achieves an improvement: by reducing the minimum granularity of 5G slices from the Gbps level (5000Mbps) to 10Mbps, and combining it with the LSTM prediction model for intelligent scheduling, the network resource utilization rate is increased from single digits (2%-3%) in traditional solutions to over 90%, solving the core pain points of "unaffordable" and "resource waste" of 5G private networks in industrial scenarios.

[0069] In terms of security protection capabilities, this invention constructs a proactive and adaptive defense-in-depth system: compared to traditional static firewalls or basic zero-trust solutions, this invention innovatively integrates multi-dimensional trust factors such as hardware fingerprinting, national cryptographic encryption, UWB / GPS precise positioning, and Markov chain behavior modeling, achieving all-weather, all-round monitoring of device identity, status, location, and behavior. Furthermore, it dynamically links the assessment results with network resource (bandwidth) permissions, realizing a leap from "passive alerting" to "proactive handling," reducing threat response time from "hours" to "seconds."

[0070] Regarding business continuity assurance, this invention demonstrates that security and efficiency are not trade-offs but rather synergistic: traditional solutions often sacrifice efficiency for security (e.g., delays caused by manual data copying) or neglect security for efficiency (e.g., resource waste due to fixed bandwidth). This invention, through a dynamic "trust score-resource" binding mechanism, ensures that high-trust devices receive resources first, while low-trust devices are quickly restricted. This guarantees the smooth operation of legitimate production processes while promptly mitigating security risks, ultimately effectively avoiding significant economic losses such as production line shutdowns and product scrapping that might occur in the embodiments, achieving a perfect balance between security and efficiency.

[0071] In summary, the data and details of the embodiments in Table 1 fully demonstrate that the 5G private network communication method and system for large factories based on zero trust described in this invention significantly outperforms existing technical solutions in several key performance indicators such as network resource utilization, response speed, security protection accuracy, and service assurance capabilities, and fully meets the requirements of the Patent Law regarding "inventiveness" and "utility".

[0072] The above descriptions are merely embodiments of the present invention, and common knowledge such as specific technical solutions and / or characteristics are not described in detail here. It should be noted that those skilled in the art can make various modifications and improvements without departing from the technical solutions of the present invention, and these should also be considered within the scope of protection of the present invention. These modifications and improvements will not affect the effectiveness of the implementation of the present invention or the practicality of the patent. The scope of protection claimed in this application should be determined by the content of its claims, and the specific embodiments described in the specification can be used to interpret the content of the claims.

Claims

1. A zero trust-based large factory 5G private network communication method, characterized in that, Comprise: S1, collect device hardware information to construct hardware fingerprint; S2, use SM4 hash check firmware, compare hash values every 10 minutes, and mark device abnormality when deviation is greater than 5%; S3, draw device activity area through GPS and UWB fusion positioning with precision of ±25 cm, and trigger trust deduction when device out of bounds; S4, construct device behavior baseline based on Markov chain and historical 30-day data, and determine device behavior abnormality when deviating from threshold value; S5, establish dynamic trust evaluation model, calculate trust value according to formula, wherein λ is 0.95, historical trust value accounts for 40%, and real-time evaluation value accounts for 60%; S6, reduce 5G slice minimum bandwidth to 10Mbps, and complete scheduling within 100ms by SDN controller, reserve 10% redundant bandwidth for key slice; S7, predict idle resources by LSTM model, and the prediction error is less than 2% within half an hour; S8, realize slice isolation through NFV and VLAN and VXLAN, transmit cross-slice traffic through IPSec tunnel and encrypt by SM4 algorithm; S9, access by X.509 certificate and work order ID, trigger stealth strategy for unrecorded device; S10, re-authenticate session every 10 minutes and dynamically adjust permissions; S11, construct threat perception engine by IDS and sandbox; S12, implement three-level response for device with trust score less than 40, and synchronize attack events to block chain for storage and traceability.

2. The method of claim 1, wherein, The device behavior abnormality determination in S4 further comprises counting the number of data values exceeding the 3σ range within a unit time, counting when the temperature sensor exceeds the ±3℃ fluctuation range, and including the counting result in the abnormality determination basis.

3. The method of claim 1, wherein, The SDN controller scheduling process in S6 is as follows: the AGV scheduling system sends a bandwidth adjustment request, the controller queries the bandwidth usage of the slice resource pool, the flow table is issued to complete bandwidth adjustment through the OpenFlow protocol, and the adjustment result is fed back to the AGV scheduling system to form a complete scheduling closed loop.

4. The method of claim 1, wherein, The stealth strategy in S9 specifically is that the zero-trust gateway rejects all communication requests of unrecorded devices and does not return any response information to unrecorded devices, so that unrecorded devices are in an undetectable state in the factory network.

5. The method of claim 1, wherein, The dynamic adjustment of permissions in S10 specifically includes: when the device operation log shows that unauthorized instructions are executed, the data upload range of the device is limited, only the basic running state data of the device is allowed to be uploaded, and the device is prohibited from uploading core production data.

6. The method of claim 1, wherein, The trigger conditions of the three-level response in S12 are as follows: when the device trust score is between 30 and 40, a warning response is triggered; when the trust score is between 20 and 30, a flow limiting response is triggered, limiting the device bandwidth to 1 / 10 of the original bandwidth; when the trust score is less than 20, a disconnection response is triggered, and the SDP stealth strategy disconnects the device network connection.

7. A zero trust based large factory 5G private network communication system, characterized in that, The zero-trust-based large factory 5G private network communication method of claim 1 comprises a device layer, a network layer, a platform layer and an application layer; The device layer comprises a hardware fingerprint collection module, an SM4 encryption module and a GPS and UWB positioning module; The network layer comprises a 5G base station supporting subcarrier aggregation, an SDN controller and a zero-trust gateway; The platform layer comprises a factory CA server, a blockchain storage module, a threat perception engine integrated with an IDS and a sandbox, and an LSTM resource prediction module. The application layer comprises an AGV scheduling system, a device management system, and a production management system. The layers interact with each other to realize communication functions.

8. The system of claim 7, wherein, The hardware fingerprint collection module of the device layer updates the hardware fingerprint information of the device every 10 seconds.

9. The system of claim 7, wherein, The LSTM resource prediction module of the platform layer updates the input feature data every 5 minutes and outputs the idle resource prediction result every 10 minutes.

10. The system of claim 7, wherein, The zero-trust gateway of the network layer has a log recording function, and the recorded content includes device authentication process, permission adjustment operation, and abnormal event information. The log is saved for no less than 1 year.

Images