Cloud management side and side end security collaborative protection and event efficient reporting method

Abstract

The invention discloses a cloud management side and edge security collaborative protection and event efficient reporting method, which relates to the technical field of network security, and comprises the following steps: a cloud management platform generates a basic security policy and a policy decision logic containing different network state adaptation rules of edge nodes; the edge node receives and stores the strategy and logic, synchronizes strategy update data according to a preset period during networking, and autonomously generates and executes a temporary strategy according to the strategy decision logic and local security event characteristics during network disconnection; and after the edge node restores networking after network disconnection, the temporary strategy and the execution log during network disconnection are reported, the cloud management platform generates a calibration instruction by evaluating the matching degree of the temporary strategy and the current basic strategy, and the edge node updates the local strategy according to the calibration instruction. According to the invention, cloud side security dynamic collaboration is realized, protection is ensured not to be interrupted when the network is disconnected, strategies are accurately aligned after networking, and the protection reliability and the event reporting efficiency are improved.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a method for collaborative security protection between cloud management and edge devices, and efficient event reporting. Background Technology

[0002] With the widespread application of 5G, IoT, and smart terminals, data processing in new power systems is spreading from centralized cloud to edge, forming a three-tiered "cloud-edge-device" architecture. For example, in the power IoT, edge nodes need to process sensor data in real time and make collaborative decisions with the cloud.

[0003] However, its security risks are becoming increasingly complex, manifested in the expansion of the attack surface. Edge devices such as smart cameras and industrial gateways are vulnerable to attacks due to limited resources, and cross-cloud-edge network communication faces the risk of eavesdropping and tampering. Moreover, the protection capabilities are fragmented, and traditional single-point defense technologies such as firewalls and intrusion detection systems (IDS) cannot cope with distributed attacks. It is necessary to build a collaborative defense system of "cloud analysis + edge blocking".

[0004] Moreover, there is a significant demand for real-time performance and privacy. In industrial scenarios, such as autonomous driving, the response time to safety incidents must be less than 50ms, which traditional centralized cloud processing cannot meet. Industries such as healthcare and finance need to complete data anonymization at the edge to avoid cross-domain transmission of raw data.

[0005] Organizations such as the Edge Computing Consortium (ECC) are promoting the development of cloud-edge collaboration security standards, but compatibility between devices from different vendors still requires technological breakthroughs.

[0006] Therefore, there is an urgent need for a collaborative protection method for cloud-management-edge security and an efficient event reporting method. However, the collaborative mechanism is inadequate, including policy synchronization delays, the reliance of cloud-management-edge security policy updates on network transmission, and the tendency for edge nodes to become isolated protection islands in network outage scenarios. Threat intelligence sharing is also inefficient, with inconsistent threat intelligence formats across vendors and platforms, leading to delayed response. Summary of the Invention

[0007] To address the aforementioned technical issues, this paper provides a method for collaborative security protection between the cloud management side and the edge, as well as efficient event reporting. This technical solution resolves the shortcomings of the aforementioned collaborative mechanism.

[0008] To achieve the above objectives, the technical solution adopted by the present invention is as follows: A method for collaborative security protection and efficient event reporting between cloud management and edge devices includes: The cloud management platform generates basic security policies and corresponding policy decision logic, the policy decision logic including policy adaptation rules for edge nodes under different network states; Edge nodes receive and store the basic security policies and policy decision logic. When connected to the network, they synchronize policy update data with the cloud management platform at a preset period. When disconnected from the network, they autonomously generate and execute temporary policies based on the policy decision logic and local security event characteristics. When an edge node reconnects from a network outage, it reports the temporary policy and execution logs from the outage period to the cloud management platform. The cloud management platform generates a policy calibration instruction based on the matching degree between the temporary policy and the current basic security policy and sends it to the edge node. The edge node updates its local policy based on the calibration instruction.

[0009] Preferably, the cloud management platform generates basic security policies that specifically include: Network status identification rules are used to clarify the criteria for edge nodes to judge their own network status, including online status determination, which is determined by heartbeat interaction with the cloud management platform and network layer link detection. Offline status is classified into three levels: short-term offline is defined as a heartbeat interruption of less than or equal to the predetermined duration and the detection of temporary network link jitter, which is determined as a temporary network outage; long-term offline is defined as a heartbeat interruption of greater than or equal to the predetermined duration and the network link is continuously unavailable, which is determined as a continuous network outage. Weak network status is determined when the network bandwidth is less than a preset threshold, the communication delay is greater than a predetermined duration, and the duration is greater than the predetermined duration. In such cases, the network is considered to be in a low-quality network state.

[0010] Preferably, the policy decision logic includes policy adaptation rules for edge nodes under different network states, specifically including: For the different network states mentioned above, define the logic for edge nodes to execute, adjust, and generate security policies; In network-connected mode, the basic security policies issued in real time by the cloud management platform are given the highest priority, and historical policies stored locally on the edge nodes are automatically invalidated. When the cloud management platform updates the basic policies, the edge nodes complete the update through the incremental synchronization interface. Local caching automatically caches the minimum execution set of the basic policies during synchronization, including core defense rules and threat signature database summaries, as the initial reference basis when the network is disconnected. In short-term offline states, policy adaptation directly uses the minimum execution set of the basic security policy from the last synchronization to ensure that core defense capabilities are not interrupted; locally generated security events are cached in a preset format to an encrypted partition and reported first upon reconnection; For long-term offline states, the strategy adaptation is based on pre-stored strategy decision logic to automatically generate adaptive strategies, including risk level adaptation. If the risk level of a local event is greater than or equal to a preset threshold, the enhanced rules are automatically activated. For different device types, predefined type-specific rules are invoked. Through a local lightweight AI model, the event characteristics during offline periods are analyzed to generate temporary supplementary rules. The temporary strategies are configured with a preset validity period by default, and automatically fall back to the minimum execution set of the basic strategy after expiration. In weak network conditions, policies are adapted by prioritizing the synchronization of high-priority policies and delaying the synchronization of low-priority content; unnecessary real-time reporting functions are disabled, and reporting is only triggered when a high-risk event is detected.

[0011] Preferably, the policy decision logic, which includes policy adaptation rules for edge nodes under different network states, further includes: Policy constraints: Temporary policies must not modify the core security baseline preset by the cloud management platform; temporary policies generated by edge nodes must meet local resource thresholds; all temporary policies must contain a unique identifier consisting of the edge node ID and the generation timestamp, and the generation basis must be the associated local event ID, to ensure subsequent auditability; Decision logs require edge nodes to record key information about the policy adaptation process, including network state switching time and triggering reasons; generation parameters of temporary policies; policy execution effect data; logs are stored in a structured format and support integrity verification with the cloud management platform after network outage recovery.

[0012] Preferably, the edge node receiving and storing the basic security policy and policy decision logic specifically includes: Receiving and storage process: When the edge node starts up, it initiates a registration request through the pre-configured cloud management platform address, carrying its own device identifier; After the cloud management platform verifies the identity of the edge node, it issues a basic security policy package including policy ID, effective time, defense rule set, and a policy decision logic package including rule engine script, parameter threshold table, and network status judgment algorithm. After receiving the data packet, the edge node performs integrity verification and signature verification. After successful verification, the basic security policy is stored in the local encrypted partition and indexed according to policy type and priority. The strategy decision logic is stored in a read-only partition, which includes an executable lightweight rule engine and parameter configuration tables; The local maintenance strategy version number format is the cloud management version number and the local revision number. The local revision number is 0 in the initial state. The storage area reserves historical version cache for data comparison after network outage recovery.

[0013] Preferably, the step of updating data with the cloud management platform according to a preset periodic synchronization strategy while connected to the network specifically includes: The system proactively initiates synchronization requests to the cloud management platform at preset intervals, carrying the current local policy version number; when the cloud management platform releases an emergency policy update, it triggers real-time synchronization of edge nodes through push notifications. The cloud management platform compares the current version number of the edge node with the latest version number, generates only the policy change part, packages it into an incremental update package, and uses the LZ77 compression algorithm. After receiving the incremental packet, the edge node verifies its integrity and parses its content. It then updates its local policy library according to the logic of adding, replacing, and deleting, and increments its local revision number by one. After synchronization is complete, a confirmation message is returned to the cloud management platform, including the updated version number and verification hash, to ensure bidirectional consistency. When network bandwidth is detected to be below the threshold, priority synchronization is automatically enabled: high-risk strategies are synchronized first, and low-priority content is synchronized later; if a single synchronization fails, the failure time is recorded, and an exponential backoff algorithm is used to retry.

[0014] Preferably, the step of autonomously generating and executing a temporary policy based on the policy decision logic and local security event characteristics during a network outage specifically includes: Edge nodes determine network outages through a dual detection mechanism, including heartbeat detection: if they have not received a heartbeat response from the cloud management platform for a consecutive number of times and the number of times they have not responded has reached a preset threshold; and link detection: if ICMP ping to the cloud management platform gateway fails and TCP connection attempts time out. After determining that the network is disconnected, the local offline mode is triggered, the start time of the network disconnection is recorded, and the disconnection duration is classified. In the event of a short-term network outage, the core subset of the basic security policy from the last synchronization is directly invoked, i.e., the minimum executable set, to ensure that basic protection is not interrupted; local events are only recorded without proactive decision-making and are cached in a memory queue. For long-term network outages, feature extraction is performed on local security events during the outage period to generate structured fields including event type, timestamp, source IP, behavioral feature hash, and risk level; The local rule engine is invoked to match event characteristics with rules in the strategy decision logic. If the event risk level is greater than or equal to medium risk and a preset rule is matched, a corresponding temporary rule is generated. If the event characteristics are novel and there is no matching rule, a lightweight anomaly detection model is activated. After determining it to be a suspicious event, a temporary observation rule is generated. Each temporary policy contains a unique identifier in the format of offline, device ID, timestamp, and random number. The effective duration is configured with a default base duration and can be extended according to the event risk level, but the maximum duration shall not exceed the preset upper limit. Modification of the core baseline in the basic security policy is prohibited to ensure that the policy boundaries are controllable. Once the temporary policy is generated, it is immediately loaded into the edge node security engine and executed in a priority order over the non-core rules of the basic policy. The policy execution log is recorded synchronously, including: policy ID, generation basis, execution time, interception / allowing result, and resource utilization. The log adopts the W3C extended log format and is stored in local encrypted flash memory.

[0015] Preferably, when an edge node recovers network connectivity from a disconnected state, reporting the temporary policies and execution logs during the network outage to the cloud management platform specifically includes: Edge nodes confirm network recovery through dual link detection, send an ICMP request to the designated gateway of the cloud management platform, and initiate a TCP protocol connection. If both detections pass, the network is determined to be recovered. Immediately initiate identity re-authentication to the cloud management platform, carrying the edge node's unique hardware UUID and the policy version number of the last synchronization before the network outage, and generate an identity signature using the national cryptographic SM2 algorithm; after the cloud management platform verifies the signature, it returns the reporting permission instruction and temporary transmission session key; Edge nodes retrieve data from the local encrypted storage area during the network outage and group it by priority and data type: high priority group, temporary policy list; medium priority group, temporary policy execution log; low priority group, raw security event logs that were not associated with policies during the network outage. Each set of data is processed to reduce its size by using the LZ77 compression algorithm, and a unique hash value is generated for each set of data for cloud integrity verification. If the data volume exceeds the preset threshold, a fragmented transmission mechanism is adopted to split the data into 1MB / fragment and upload them sequentially according to the fragment number in the group. After each fragment is transmitted, a confirmation request for the fragment transmission status is sent to the cloud management platform. The next fragment is transmitted only after receiving feedback from the cloud that the fragment has been received. If transmission is interrupted, the next retransmission will carry a list of sequence numbers of the transmitted fragments, and the cloud will only request the fragments that have not been received. During the transmission process, the progress will be reported to the cloud management platform in real time for cloud monitoring.

[0016] Preferably, the cloud management platform generates a policy calibration instruction and sends it to the edge node based on the matching degree between the temporary policy and the current basic security policy, specifically including: After receiving the data, the cloud management platform first decrypts it using the temporary session key, and then verifies the integrity of the data one by one according to the group hash value. If the hash value of a certain group of data does not match, a data retransmission instruction is immediately sent to the edge node, specifying the group that needs to be retransmitted. If the verification passes, the data is stored in the temporary database for network outage recovery data. Perform legality checks on the temporary policy list, verify the policy ID format, and exclude invalid policies with abnormal formats; associate with edge node device files to determine whether the scope of effect of temporary policies exceeds the permission boundaries of the node, and filter out unauthorized policies. The cloud management platform compares temporary policies with the latest basic security policies from three dimensions: global consistency, execution effectiveness, and risk adaptability. Based on the evaluation results, temporary policies are divided into categories such as fully matching, partially effective, conflicting, and invalid. For different categories of temporary policies, corresponding calibration instructions are generated. Each instruction includes instruction type, target policy ID, operation details, and execution basis. Retention instructions are for fully matching policies, optimization instructions are for partially valid policies, deletion instructions are for conflicting / invalid policies, and upgrade instructions are for partially valid but not covered policies. All calibration instructions are encapsulated in JSON structured format, attached with a digital signature from the cloud management platform, and marked with the instruction effective time.

[0017] Preferably, the edge node updating its local policy based on the calibration command specifically includes: After receiving the calibration command, the edge node first verifies the digital signature using the cloud management platform's public key to confirm that the command has not been tampered with; then it parses the effective time and operation type in the command and prioritizes them according to their urgency. After all instructions are executed, the edge node generates an instruction execution report, which includes the number of executed instructions, the number of successful instructions, the number of failed instructions, the execution time, and attaches an execution log fragment of each instruction. The report is then encrypted and uploaded to the cloud management platform. For retained / optimized policies, merge them with the latest basic security policies currently synchronized from the cloud and update the local policy library version number; for deleted policies, archive their execution logs to the historical log area, clean up the corresponding policy files, and release local storage resources. After receiving the instruction execution report, if there are any instructions that failed to execute, the cloud management platform will reissue the corrected instructions; if all instructions are executed successfully, it will send a policy coordination completion confirmation message to the edge node. After receiving the message, the edge node will end the network outage recovery process and return to the normal network synchronization state.

[0018] Compared with the prior art, the beneficial effects of the present invention are as follows: This invention constructs a dynamic collaborative mechanism for security protection between the cloud management side and the edge, effectively solving core problems in traditional distributed architectures such as delayed synchronization of security policies, failure of protection in network outage scenarios, and low efficiency of cross-domain collaboration.

[0019] First, by pre-generating policy decision logic containing network status adaptation rules through the cloud management platform, a unified protection framework and autonomous decision-making basis are provided for edge nodes. This ensures that the policy is aligned with the cloud in real time when connected to the network, and also gives edge nodes the ability to generate policies when the network is disconnected, thus avoiding the phenomenon of protection islands.

[0020] Secondly, by adopting a mechanism that combines incremental synchronization with local caching, network transmission overhead is reduced while basic protection capabilities are preserved for network outage scenarios through caching of a subset of core policies, thus balancing policy consistency and resource utilization efficiency.

[0021] Furthermore, the closed-loop design for policy calibration after network outage recovery achieves intelligent alignment of cloud and edge policies through temporary policy reporting, cloud matching degree evaluation, and precise instruction issuance. This preserves effective autonomous decision-making at the edge while eliminating conflicts with global policies, ensuring the overall integrity of security protection.

[0022] Finally, the entire process is embedded with identity authentication, data encryption, and log traceability mechanisms, which improves collaborative efficiency while ensuring the security of policy transmission and execution, meeting the high reliability protection requirements of industrial, IoT and other scenarios, and has strong practicality and scalability. Attached Figure Description

[0023] Figure 1 This is a flowchart of a method for collaborative security protection between cloud management and edge devices, as well as efficient event reporting. Detailed Implementation

[0024] The following description is intended to disclose the invention and enable those skilled in the art to implement it. The preferred embodiments described below are merely examples, and other obvious variations will occur to those skilled in the art.

[0025] Reference Figure 1 As shown, a method for collaborative security protection and efficient event reporting between cloud management and edge devices includes: The cloud management platform generates basic security policies and corresponding policy decision logic, the policy decision logic including policy adaptation rules for edge nodes under different network states; Edge nodes receive and store the basic security policies and policy decision logic. When connected to the network, they synchronize policy update data with the cloud management platform at a preset period. When disconnected from the network, they autonomously generate and execute temporary policies based on the policy decision logic and local security event characteristics. When an edge node reconnects from a network outage, it reports the temporary policy and execution logs from the outage period to the cloud management platform. The cloud management platform generates a policy calibration instruction based on the matching degree between the temporary policy and the current basic security policy and sends it to the edge node. The edge node updates its local policy based on the calibration instruction.

[0026] It should be noted that the basic security policy defines the protection rules, and the policy decision logic, as an independent intelligent layer, encapsulates the mapping relationship between the network state machine (connected / disconnected / weak network) and local risk factors (event frequency, asset weight). Two-way calibration mechanism: During the network outage phase, edge nodes generate a temporary policy with timestamps based on local event characteristics, forming a draft policy on the edge side; After network connectivity is restored, the cloud management platform uses a policy semantic comparison engine to analyze the compatibility between temporary policies and current basic policies; it then generates an incremental calibration instruction set instead of full coverage.

[0027] The cloud management platform generates basic security policies that specifically include: Network status identification rules are used to clarify the criteria for edge nodes to judge their own network status, including online status determination, which is determined by heartbeat interaction with the cloud management platform and network layer link detection. Offline status is classified into three levels: short-term offline is defined as a heartbeat interruption of less than or equal to the predetermined duration and the detection of temporary network link jitter, which is determined as a temporary network outage; long-term offline is defined as a heartbeat interruption of greater than or equal to the predetermined duration and the network link is continuously unavailable, which is determined as a continuous network outage. Weak network status is determined when the network bandwidth is less than a preset threshold, the communication delay is greater than a predetermined time (e.g., 200ms), and the duration is greater than the predetermined time.

[0028] The policy decision-making logic includes policy adaptation rules for edge nodes under different network states, specifically including: For the different network states mentioned above, define the logic for edge nodes to execute, adjust, and generate security policies; In network-connected mode, the basic security policies issued in real time by the cloud management platform are given the highest priority, and historical policies stored locally on the edge nodes are automatically invalidated. When the cloud management platform updates the basic policies, the edge nodes complete the update through the incremental synchronization interface. Local caching automatically caches the minimum execution set of the basic policies during synchronization, including core defense rules and threat signature database summaries, as the initial reference basis when the network is disconnected. In short-term offline states, policy adaptation directly uses the minimum execution set of the basic security policy from the last synchronization to ensure that core defense capabilities are not interrupted; locally generated security events are cached in a preset format to an encrypted partition and reported first upon reconnection; For long-term offline states, the strategy adapts itself by generating adaptive strategies based on pre-stored strategy decision logic. This includes risk level adaptation; if the risk level of a local event is greater than or equal to a preset threshold, enhanced rules are automatically activated; predefined type-specific rules are invoked for different device types; and temporary supplementary rules are generated by analyzing event characteristics during offline periods through a local lightweight AI model. Temporary strategies are configured with a preset validity period (e.g., 24 hours) by default, and automatically fall back to the minimum execution set of the basic strategy after expiration. In weak network conditions, policies are adapted by prioritizing the synchronization of high-priority policies and delaying the synchronization of low-priority content; unnecessary real-time reporting functions are disabled, and reporting is only triggered when a high-risk event is detected.

[0029] The policy decision logic includes policy adaptation rules for edge nodes under different network states, and also includes: Policy constraints: Temporary policies must not modify the core security baseline preset by the cloud management platform; temporary policies generated by edge nodes must meet local resource thresholds; all temporary policies must contain a unique identifier consisting of the edge node ID and the generation timestamp, and the generation basis must be the associated local event ID, to ensure subsequent auditability; Decision logs require edge nodes to record key information about the policy adaptation process, including network state switching time and triggering reasons; generation parameters of temporary policies; policy execution effect data; logs are stored in a structured format and support integrity verification with the cloud management platform after network outage recovery.

[0030] It should be noted that the network status identification rule is to obtain hardware-level indicators such as signal strength index (RSSI) and bit error rate (BER) through the network card driver layer to distinguish between physical link interruption and logical interruption. Protocol stack cross-validation, application layer heartbeat packets (HTTP / 3overQUIC) to detect cloud service reachability, and network layer ICMP to detect backbone network connectivity; Dynamic calibration of the time window automatically adjusts the predetermined time length threshold based on historical network quality data, such as daily peak delay patterns (e.g., extending heartbeat timeout tolerance during 20:00-22:00). Fine-grained classification of weak network conditions:

[0031] Depending on the type of service, bandwidth requirements are relaxed for video surveillance scenarios, while latency is strictly controlled for industrial control scenarios.

[0032] Strategic decision-making logic: In long-term offline states, the risk-driven rule-enhancing engine constructs a local event threat graph, linking discrete events (port scanning, abnormal login) into attack chains, such as: port scanning → vulnerability exploitation → lateral movement; Device-specific rule generator: Pre-built device fingerprint library (PLC controller / vehicle ECU / smart camera), load minimum protection baseline by type; Lightweight AI model implementation: The model architecture is a pruned 1D-CNN (parameters <100KB). The input features include an event time series matrix (a three-dimensional tensor of source IP, target port, and protocol type). The output is a temporary rule logic expression, for example: IF src_ipIN[192.168.5.*] AND protocol=TCPTHENDROP; Policy constraints: SGXenclave is used to store policy decision logic, and the temporary policy generation process must be signed by a Trusted Execution Environment (TEE); The resource threshold dynamic adjustment algorithm calculates the maximum resource usage based on real-time load, and reduces the usage by 0.2% for every 1% increase in load above 50%. Audit trails are enhanced by generating causal chains based on related events and storing logs using a Merkle tree structure to ensure that tampering is detectable.

[0033] The edge node receiving and storing the basic security policy and policy decision logic specifically includes: Receiving and storage process: When the edge node starts up, it initiates a registration request through the pre-configured cloud management platform address, carrying its own device identifier; After the cloud management platform verifies the identity of the edge node, it issues a basic security policy package including policy ID, effective time, defense rule set, and a policy decision logic package including rule engine script, parameter threshold table, and network status judgment algorithm. After receiving the data packet, the edge node performs integrity verification and signature verification. After successful verification, the basic security policy is stored in the local encrypted partition and indexed according to policy type and priority. The strategy decision logic is stored in a read-only partition, which includes an executable lightweight rule engine and parameter configuration tables; The local maintenance strategy version number format is the cloud management version number and the local revision number. The local revision number is 0 in the initial state. The storage area reserves historical version cache for data comparison after network outage recovery.

[0034] The specific details of updating data with the cloud management platform according to a preset periodic synchronization strategy while connected to the network include: The system proactively initiates synchronization requests to the cloud management platform at preset intervals, carrying the current local policy version number; when the cloud management platform releases an emergency policy update, it triggers real-time synchronization of edge nodes through push notifications. The cloud management platform compares the current version number of the edge node with the latest version number, generates only the policy change part, packages it into an incremental update package, and uses the LZ77 compression algorithm. After receiving the incremental packet, the edge node verifies its integrity and parses its content. It then updates its local policy library according to the logic of adding, replacing, and deleting, and increments its local revision number by one. After synchronization is complete, a confirmation message is returned to the cloud management platform, including the updated version number and verification hash, to ensure bidirectional consistency. When network bandwidth is detected to be below the threshold, priority synchronization is automatically enabled: high-risk strategies are synchronized first, and low-priority content is synchronized later; if a single synchronization fails, the failure time is recorded, and an exponential backoff algorithm is used to retry.

[0035] The process of autonomously generating and executing a temporary policy in the offline state, based on the policy decision logic and local security event characteristics, specifically includes: Edge nodes determine network outages through a dual detection mechanism, including heartbeat detection: if they have not received a heartbeat response from the cloud management platform for a consecutive number of times and the number of times they have not responded has reached a preset threshold (e.g., 3 times); and link detection: if ICMP ping to the cloud management platform gateway fails and TCP connection attempt times out. After determining that the network is disconnected, the local offline mode is triggered, the start time of the network disconnection is recorded, and the disconnection duration is classified. In the event of a short-term network outage, the core subset of the basic security policy from the last synchronization is directly invoked, i.e., the minimum executable set, to ensure that basic protection is not interrupted; local events are only recorded without proactive decision-making and are cached in a memory queue. For long-term network outages, feature extraction is performed on local security events during the outage period to generate structured fields including event type, timestamp, source IP, behavioral feature hash, and risk level; The local rule engine is invoked to match event characteristics with rules in the strategy decision logic. If the event risk level is greater than or equal to medium risk and a preset rule is matched, a corresponding temporary rule is generated. If the event characteristics are novel and there is no matching rule, a lightweight anomaly detection model is activated. After determining it to be a suspicious event, a temporary observation rule is generated. Each temporary policy contains a unique identifier in the format of offline, device ID, timestamp, and random number. The effective duration is configured by default with a preset base duration (e.g., 2 hours), which can be extended according to the event risk level, but the maximum duration shall not exceed the preset upper limit (e.g., 24 hours). Modification of the core baseline in the basic security policy is prohibited to ensure that the policy boundaries are controllable. Once the temporary policy is generated, it is immediately loaded into the edge node security engine and executed in a priority order over the non-core rules of the basic policy. The policy execution log is recorded synchronously, including: policy ID, generation basis, execution time, interception / allowing result, and resource utilization. The log adopts the W3C extended log format and is stored in local encrypted flash memory.

[0036] It should be noted that policy storage and synchronization machines are related as follows: Secure storage is achieved through encrypted partitions, using AES-XTS mode to encrypt policy files (the key is derived from the device's TPM chip), and the index structure uses a B+ tree to optimize query efficiency; Anti-tampering protection for read-only partitions; locking partition write permissions through the eFuse circuit breaker mechanism; rule engine scripts run in the Enclave secure container; Improved reliability of incremental synchronization and enhanced channels for emergency update pushes: Dual-channel redundant transmission, MQTT over TLS 1.3 + LoRaWAN emergency link; Digital signatures use the PQC quantum-resistant algorithm (CRYSTALS-Dilithium). Compression algorithm optimization; LZ77 dictionary dynamically adapts to policy type (access control rules use a 16KB dictionary, threat signature database uses a 4MB dictionary); differential packet generation introduces semantic awareness, transmitting only rule logic changes instead of the full text. Weak network synchronization, bandwidth adaptive transmission protocol, constructing a policy importance matrix:

[0037] Dynamic packet splitting breaks large updates into atomic blocks of less than 50KB (supports resuming interrupted downloads).

[0038] Generation of autonomous network disconnection strategy: Event feature extraction, structured field generation engine, behavioral feature hash calculation: BLAKE3 (raw payload || context metadata); A dynamic risk level assessment model based on attack chain depth scoring; Multi-level decision-making: Event features → Rule matching degree → ≥80%, directly generate predefined rules; 20%~80%, start Bayesian inference engine; <20%, trigger lightweight AI model → decision tree classifier → if suspicious, generate observation rules; The temporary policy is implemented securely, with resource isolation sandbox design, memory isolation, and maximum memory usage limited to ≤50MB via cgroups; CPU quotas are allocated using the CFS scheduler, which allocates 10% of core time slices. A strategy conflict resolution mechanism is established, creating a rule priority pyramid. Level 0: Cloud Management Core Baseline (Cannot be modified); Level 1: High-risk rules generated locally; Level 2: Basic strategies, not core rules; A conflict detection algorithm based on rule-based intersection analysis.

[0039] When an edge node recovers its network connection from a disconnected state, it reports the temporary policies and execution logs for the period of network outage to the cloud management platform, specifically including: Edge nodes confirm network recovery through dual link detection, send an ICMP request to the designated gateway of the cloud management platform, and initiate a TCP protocol connection. If both detections pass, the network is determined to be recovered. Immediately initiate identity re-authentication to the cloud management platform, carrying the edge node's unique hardware UUID and the policy version number of the last synchronization before the network outage, and generate an identity signature using the national cryptographic SM2 algorithm; after the cloud management platform verifies the signature, it returns the reporting permission instruction and temporary transmission session key; Edge nodes retrieve data from the local encrypted storage area during the network outage and group it by priority and data type: high priority group, temporary policy list; medium priority group, temporary policy execution log; low priority group, raw security event logs that were not associated with policies during the network outage. Each set of data is processed to reduce its size by using the LZ77 compression algorithm, and a unique hash value is generated for each set of data for cloud integrity verification. If the data volume exceeds the preset threshold, a segmented transmission mechanism is adopted to split the data into fixed-capacity segments such as 1MB / segment, and upload them sequentially according to the segment number within the group. After each segment is transmitted, a confirmation request for the segment transmission status is sent to the cloud management platform. The next segment is transmitted only after receiving feedback from the cloud that the segment has been received. If transmission is interrupted, the next retransmission will carry a list of sequence numbers of the transmitted fragments, and the cloud will only request the fragments that have not been received. During the transmission process, the progress will be reported to the cloud management platform in real time for cloud monitoring.

[0040] The cloud management platform generates a policy calibration instruction based on the matching degree between the temporary policy and the current basic security policy, and sends it to the edge nodes, specifically including: After receiving the data, the cloud management platform first decrypts it using the temporary session key, and then verifies the integrity of the data one by one according to the group hash value. If the hash value of a certain group of data does not match, a data retransmission instruction is immediately sent to the edge node, specifying the group that needs to be retransmitted. If the verification passes, the data is stored in the temporary database for network outage recovery data. Perform legality checks on the temporary policy list, verify the policy ID format, and exclude invalid policies with abnormal formats; associate with edge node device files to determine whether the scope of effect of temporary policies exceeds the permission boundaries of the node, and filter out unauthorized policies. The cloud management platform compares temporary policies with the latest basic security policies from three dimensions: global consistency, execution effectiveness, and risk adaptability. Based on the evaluation results, temporary policies are divided into categories such as fully matching, partially effective, conflicting, and invalid. For different categories of temporary policies, corresponding calibration instructions are generated. Each instruction includes instruction type, target policy ID, operation details, and execution basis. Retention instructions are for fully matching policies, optimization instructions are for partially valid policies, deletion instructions are for conflicting / invalid policies, and upgrade instructions are for partially valid but not covered policies. All calibration instructions are encapsulated in JSON structured format, attached with a digital signature from the cloud management platform, and marked with the instruction effective time.

[0041] The edge node updates its local policy based on the calibration command, specifically including: After receiving the calibration command, the edge node first verifies the digital signature using the cloud management platform's public key to confirm that the command has not been tampered with; then it parses the effective time and operation type in the command and prioritizes them according to their urgency. After all instructions are executed, the edge node generates an instruction execution report, which includes the number of executed instructions, the number of successful instructions, the number of failed instructions, the execution time, and attaches an execution log fragment of each instruction. The report is then encrypted and uploaded to the cloud management platform. For retained / optimized policies, merge them with the latest basic security policies currently synchronized from the cloud and update the local policy library version number; for deleted policies, archive their execution logs to the historical log area, clean up the corresponding policy files, and release local storage resources. After receiving the instruction execution report, if there are any instructions that failed to execute, the cloud management platform will reissue the corrected instructions; if all instructions are executed successfully, it will send a policy coordination completion confirmation message to the edge node. After receiving the message, the edge node will end the network outage recovery process and return to the normal network synchronization state.

[0042] It should be noted that the network outage recovery reporting mechanism is as follows: Dual link detection and physical layer verification extension: In addition to ICMP / TCP, MAC layer broadcast detection (ARP flood detection) is added to avoid network layer spoofing attacks. Time sensitivity optimization: In weak network environments, the fast handshake protocol (QUIC0-RTT) is enabled, reducing authentication latency from 800ms to 120ms; Hardware UUID is bound to device DNA information to prevent node cloning. Lightweight data processing: Compression technology, the policy list uses rule semantic encoding (RSE) technology to convert text rules into binary instructions (compression rate of 92%); execution log, template-based difference storage (only records changed fields); raw events, apply streaming feature extraction to extract TLSH fuzzy hashes instead of raw packets; The fragmented transmission is designed to resist interference, with the fragment size dynamically adjusted. In weak network conditions, the size is reduced to 512KB / fragment. Fragment verification uses the NanoMD5 algorithm (reducing resource consumption by 70%).

[0043] Cloud-based policy calibration: Policy validity verification, dynamic modeling of permission boundaries, establishment of device capability matrix (CPU / memory / interface), automatic identification of over-limit policies, such as rules requiring gigabit network cards being invalid on 100 Mbps devices; Time validity verification rejects policies whose effective time does not overlap with the network outage period, preventing the falsification of historical policies; The operating principle of four-dimensional strategy evaluation:

[0044] If CR < 0.1, IR > 0.8, and RCV > 1.2, it is an upgrade command; if CR > 0.3 or IR < 0.4, it is a delete command. Calibration instruction generation: Instructions are atomically encapsulated, with each instruction accompanied by a rollback script, such as the DELETE instruction corresponding to ROLLBACK_CREATE; The digital signature is double-bound, with the signature content including the instruction hash and the target device ID to prevent instruction replay attacks.

[0045] Execute calibration instructions at the edge: Instruction execution, distributed transaction design, using an improved two-phase commit (2PC): Edge node → local policy library, PREPARE (instruction set); Local policy library → edge node, READY; Edge node → Cloud management platform; COMMIT_REQUEST; Cloud management platform → edge node; GLOBAL_COMMIT; Edge node → Local policy library; EXECUTE; Execute the isolation sandbox, and test high-risk instructions in the virtualized container.

[0046] Resource release, policy garbage collection mechanism, establishment of policy dependency graph, automatic identification of isolated rules (policies without event triggering), storage release adopts lazy collection, and physical clearing is only performed when actual space is insufficient; Historical logs are categorized by hot and cold status; frequently retrieved logs are stored on NVMe flash memory, while archived logs are transferred to QLCSSD.

[0047] In high-interference industrial environments, the command transmission is designed to resist interference. The retransmission protocol introduces forward error correction (FEC) to tolerate 30% packet loss. Key commands are redundant across three frequencies (2.4G / 5G / LoRa). Enforcement of timeliness is mandatory. Calibration commands carry an industrial timeout flag (e.g., timeout=200ms). If the calibration is not completed within the timeout period, it will be rolled back. In large-scale node concurrency scenarios, cloud batch processing is optimized, policy evaluation is accelerated by GPU (NVIDIA CUDA is used to achieve parallel matching), and instruction issuance adopts multicast technology (one instruction covers a group of devices of the same model). To resolve edge resource contention, the instruction execution scheduler is based on the EDF algorithm (earliest deadline first).

[0048] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the claimed invention. The scope of protection claimed by the appended claims and their equivalents is defined.

Claims

1. A cloud management side and edge security collaborative protection and efficient event reporting method, characterized in that, The cloud management platform generates a basic security policy and corresponding policy decision logic, which includes policy adaptation rules of the edge node in different network states. The edge node receives and stores the basic security policy and policy decision logic. In the networking state, the edge node synchronizes policy update data with the cloud management platform at a preset period. In the offline state, the edge node autonomously generates a temporary policy based on the policy decision logic and local security event characteristics and executes the temporary policy. When the edge node recovers from the offline state to the networking state, the edge node reports the temporary policy and execution log during the offline state to the cloud management platform. The cloud management platform generates a policy calibration instruction based on the matching degree of the temporary policy and the current basic security policy and delivers the calibration instruction to the edge node. The edge node updates the local policy based on the calibration instruction. The cloud management platform generates a basic security policy, which specifically includes:

2. The cloud management side and edge security coordination protection and efficient event reporting method according to claim 1, characterized in that, A network state recognition rule for determining the judgment standard of the edge node for its own network state, including online state determination, heartbeat interaction with the cloud management platform, and network layer link detection determination for the networking state. Offline state classification, short-term offline is heartbeat interruption less than or equal to a specified time period, and detection of temporary network link fluctuation, which is determined as temporary offline. Long-term offline is heartbeat interruption greater than or equal to a specified time period and continuous unavailability of the network link, which is determined as continuous offline. Weak network state determination, network bandwidth less than a preset threshold, communication delay greater than a specified time period, and duration greater than a specified time period, which is determined as low-quality networking state. The policy decision logic includes policy adaptation rules of the edge node in different network states, which specifically include:

3. The cloud management side and edge security coordination protection and efficient event reporting method according to claim 2, characterized in that, For the different network states, the execution, adjustment, and generation logic of the edge node for the security policy is defined. The security policy includes a basic policy, an adaptive policy, and a temporary policy. The basic policy is the benchmark rule delivered by the cloud management platform. The adaptive policy is a set of scene adaptation policies, which is the policy combination adapted by the edge node according to the network state and includes the basic policy and the temporary policy. The temporary policy is a short-term supplementary rule generated by the edge node in the offline / weak network scene in the set of scene adaptation policies. In the networking state, the basic security policy delivered by the cloud management platform is the highest priority, and the historical policy stored locally by the edge node is automatically invalidated. When the cloud management platform updates the basic security policy, the edge node updates the policy through an incremental synchronization interface. The local cache automatically caches the minimum execution set of the basic security policy, including core defense rules and threat feature library abstracts, as the initial reference basis in the offline state. In the short-term offline state, the last synchronized basic security policy minimum execution set is directly used, ensuring the uninterrupted core defense capability. The locally generated security events are cached in an encrypted partition in a preset format and are reported after networking. ​ Policy adaptation in long-term offline state, autonomously generate adaptive policy based on pre-stored policy decision logic, including risk level adaptation, if local event risk level is greater than or equal to the preset threshold, automatically enable the reinforcement rules; for different device types, call pre-defined type-specific rules; through the local lightweight AI model, analyze the event characteristics during offline period, generate temporary supplementary rules; the default configuration of temporary policy is preset for a valid period, after expiration, automatically fall back to the minimum execution set of the basic security policy; Policy adaptation in weak network state, preferentially synchronize high-priority policies, delay synchronization of low-priority content; turn off unnecessary real-time reporting functions, and only trigger reporting when high-risk events are detected.

4. The cloud management side and edge security coordination protection and efficient event reporting method according to claim 3, characterized in that, The policy decision logic includes the policy adaptation rules of the edge node in different network states, and the policy adaptation rules further include: Policy constraints, temporary policies cannot modify the core security baseline preset by the cloud management platform; temporary policies generated by the edge node must meet the local resource threshold; all temporary policies must include a unique identifier composed of the edge node ID and the generation timestamp, and the basis for generation, i.e., the associated local event ID, to ensure subsequent auditability; Decision log, the edge node needs to record the key information of the policy adaptation process, including network state switching time and trigger reason; generation parameters of temporary policy; policy execution effect data; the log is stored in a structured format, supporting integrity verification with the cloud management platform after network recovery.

5. The cloud management side and edge security coordination protection and efficient event reporting method according to claim 1, characterized in that, The edge node receives and stores the basic security policy and policy decision logic, specifically including: Receiving and storing process: when the edge node starts, it initiates a registration request through the pre-set cloud management platform address, carrying its own device identifier; After the cloud management platform verifies the identity of the edge node, it issues a basic security policy package including policy ID, effective time, defense rule set, and a policy decision logic package including rule engine script, parameter threshold table, and network state determination algorithm; After receiving, the edge node performs integrity check and signature verification on the basic security policy package; after verification, the basic security policy is stored in the local encrypted storage area, and is indexed according to policy type and priority; The policy decision logic is stored in a read-only partition, including an executable lightweight rule engine and a parameter configuration table; The local maintenance policy version number is in the format of cloud management version number and local revision number, and the initial state of the local revision number is 0; the storage area reserves a history version cache for data comparison after network recovery.

6. The cloud management side and edge security coordination protection and efficient event reporting method according to claim 5, characterized in that, In the networked state, the policy update data is synchronized with the cloud management platform at a preset period, specifically including: Initiatively initiate a synchronization request to the cloud management platform at a preset period, carrying the current local maintenance policy version number; when the cloud management platform issues an emergency policy update, trigger the edge node to synchronize immediately through a push notification; The cloud management platform compares the current version number of the edge node with the latest version number, only generates the policy change part, packages it as an incremental update package, and uses the LZ77 compression algorithm; After receiving the incremental update package, the edge node verifies the integrity and parses the content, updates the local policy library according to the logic of adding, replacing, and deleting, and increments the local revision number by one; After synchronization is completed, a confirmation message is returned to the cloud management platform, including an updated version number and a check hash, to ensure bidirectional consistency; When network bandwidth is detected to be below a threshold, priority synchronization is automatically enabled: high-priority policies are synchronized first, and low-priority content is synchronized later; if a single synchronization fails, the failure time point is recorded, and an exponential backoff algorithm is used for retry.

7. The cloud management side and edge security coordination protection and efficient event reporting method according to claim 6, characterized in that, In the offline state, temporary policies are autonomously generated based on the policy decision logic and local security event features, and specific operations include: The edge node determines disconnection through a double detection mechanism, including heartbeat detection that continuously fails to receive a cloud management platform heartbeat response and a number of non-responses reaching a preset threshold; and link detection that fails to perform ICMP ping on the cloud management platform gateway and TCP connection attempts time out; After disconnection is determined, a local offline mode is triggered, the disconnection start time is recorded, and the disconnection duration is classified; For short-term disconnection, a minimum executable set of the last synchronized basic security policy is directly called, ensuring that basic protection is not interrupted; local security events are only recorded and not actively decided, and are cached to a memory queue; For long-term disconnection, local security events during disconnection are feature-extracted to generate structured fields including event type, timestamp, source IP, behavior feature hash, and risk level; The local rule engine is called to match event features with rules in the policy decision logic; if the event risk level is greater than or equal to a medium risk and a preset rule is matched, a corresponding temporary rule is generated; if the event features are new and no rule is matched, a lightweight anomaly detection model is started, a suspicious event is determined, and a temporary observation rule is generated; Each temporary policy includes a unique identifier, and its format is offline, device ID, timestamp, random number; the effective duration is by default configured to a preset basic duration, is extended according to the event risk level, and does not exceed a preset upper limit of the duration; modification of core baselines in the basic security policy is prohibited to ensure that the policy boundary is controllable; After the temporary policy is generated, it is immediately loaded to the edge node security engine, and the execution order is prior to that of non-core rules of the basic policy; Synchronization records policy execution logs, including policy ID, generation basis, execution time, interception / allowance result, and resource occupancy rate; the logs are stored in a local encrypted flash memory in a W3C extended log format.

8. The cloud management side and edge security coordination protection and efficient event reporting method according to claim 1, characterized in that, When the edge node recovers from the disconnected state to the connected state, the temporary policies and execution logs during disconnection are reported to the cloud management platform, specifically including: The edge node confirms network recovery through double link detection, sends an ICMP request to a specified gateway of the cloud management platform, initiates a TCP protocol connection, and determines that the network has recovered when both detections pass; Identity re-authentication is immediately initiated to the cloud management platform, carrying the edge node unique hardware UUID and the policy version number of the last synchronization before disconnection, and an identity signature is generated using the national standard SM2 algorithm; after the cloud management platform verifies the signature, a reporting permission instruction and a temporary transmission session key are returned; The edge node extracts data during disconnection from a local encrypted storage area, groups them according to priority and data type, and high-priority groups include temporary policy lists; medium-priority groups include temporary policy execution logs; and low-priority groups include original security event logs during disconnection that are not associated with policies. Lightweight processing is performed on each group of data, an LZ77 compression algorithm is used to reduce the data volume, and a unique hash value is generated for each group of data for cloud integrity verification; If the data volume exceeds the preset threshold, a fragmentation transmission mechanism is used, and each fragment is uploaded in sequence according to the fragment sequence number in the group. After each fragment transmission is completed, a confirmation request for the fragment transmission state is initiated to the cloud management platform. After receiving the feedback that the cloud fragment has been received, the next fragment is transmitted; If the transmission is interrupted, the sequence number list of the transmitted fragments is carried when retransmission is performed next time, and the cloud only requests the fragments that have not been received. The progress is reported to the cloud management platform in real time during the transmission process, so as to facilitate the monitoring of the cloud.

9. The cloud management side and edge security coordination protection and efficient event reporting method according to claim 8, characterized in that, The cloud management platform generates a policy calibration instruction according to the matching degree of the temporary policy and the current basic security policy, and delivers the policy calibration instruction to the edge node, and the policy calibration instruction specifically comprises: After the cloud management platform receives the data, the data is first decrypted by using a temporary transmission session key, and then the data integrity is verified one by one according to the grouping hash value: if the hash value of a group of data does not match, a data retransmission instruction is immediately sent to the edge node, and the group that needs to be retransmitted is specified; if the verification is passed, the data is stored in the offline recovery data temporary library; The legality of the temporary policy list is verified, the policy ID format is verified, and invalid policies with abnormal formats are excluded. The edge node device file is associated to determine whether the effective range of the temporary policy exceeds the authority boundary of the edge node, and the over-authorized policy is filtered. The cloud management platform compares the temporary policy with the current latest basic security policy from three dimensions of global consistency, execution effectiveness and risk adaptability: based on the evaluation result, the temporary policy is divided into a complete matching type, a partial effective type, a conflict type and an invalid type; For different classifications of the temporary policy, corresponding calibration instructions are generated, each instruction includes instruction type, target policy ID, operation details and execution basis; the reserved instruction is for the complete matching type, the optimization instruction is for the partial effective type, the deletion instruction is for the conflict type / invalid type, and the upgrade instruction is for the partial effective and non-covered policy; all calibration instructions are packaged in a JSON structured format, attached with a cloud management platform digital signature, and marked with an instruction effective time.

10. The cloud management side and edge security coordination protection and efficient event reporting method according to claim 9, characterized in that, The edge node updates the local policy based on the calibration instruction, and the calibration instruction specifically comprises: After the edge node receives the calibration instruction, the digital signature is verified by using the cloud management platform public key to confirm that the instruction has not been tampered with; then the effective time and operation type in the instruction are analyzed, and the execution priority is sorted according to the emergency degree; After all the instructions are executed, the edge node generates an instruction execution report, which includes the number of executed instructions, the number of successful instructions, the number of failed instructions, the execution time consumption, and the execution log segment of each instruction, and is reported to the cloud management platform after being encrypted; The reserved / optimized policy is combined with the latest basic security policy synchronized from the cloud, and the local policy library version number is updated; the execution log of the deleted policy is archived to the historical log area, and the corresponding policy file is cleaned up to release the local storage resources; After the cloud management platform receives the instruction execution report, if there is an instruction that fails to execute, the corrected instruction is reissued; if all the executions are successful, a policy coordination completion confirmation message is sent to the edge node, and the edge node ends the offline recovery process and returns to the normal networking synchronization state after receiving the message.

Images