Deterministic communication network security guarantee method for industrial internet

Abstract

The invention belongs to the technical field of network communication, and discloses a deterministic communication network security guarantee method for an industrial internet, which comprises the following steps: acquiring a time delay demand parameter and a security identifier level of a data stream to be transmitted in the industrial internet; constructing a layered time delay budget model based on the data stream to be transmitted, performing multi-dimensional decomposition on a preset end-to-end time delay budget to obtain a transmission time delay quota, a queuing time delay quota and an encryption processing time delay quota, setting a time delay constraint strategy for the encryption processing time delay quota, and performing security domain division on the corresponding data stream to be transmitted to obtain a differential encryption segmentation strategy; performing encryption processing in combination with the constructed time slot key binding table to obtain an encrypted data stream, transmitting the corresponding encrypted data stream through a deterministic network, and executing corresponding segmentation decryption verification at a receiving end; according to the invention, the reliable communication guarantee capability of the industrial internet is obviously improved.

Description

Technical Field

[0001] This invention relates to the field of network communication technology, and more specifically, to a method for ensuring the security of deterministic communication networks in the industrial internet. Background Technology

[0002] As a core infrastructure for the digital transformation of the manufacturing industry, the Industrial Internet holds significant strategic value in intelligent manufacturing, industrial control, and production optimization. Traditional industrial network communication primarily protects data through simple encryption strategies or plaintext transmission. However, these methods lack latency protection mechanisms and cause control delays and system instability in industrial scenarios with high real-time requirements. With the development of cybersecurity technologies, security solutions such as end-to-end encryption and virtual private networks have emerged. However, these methods generally suffer from latency uncertainties, excessive resource consumption, and insufficient real-time guarantees.

[0003] Deterministic networking, as a time-sensitive networking technology, has gained widespread attention in the field of industrial communication in recent years. Through time slot scheduling and path reservation mechanisms, deterministic networking can provide deterministic latency and bandwidth guarantees for data streams. Research shows that different types of industrial data, due to differences in service priorities, exhibit significant differences in security requirements and latency sensitivity between control commands and monitoring data during transmission. While these differences are subtle, they can lead to performance bottlenecks and uneven security risks in the practical application of unified encryption strategies.

[0004] Existing technologies struggle to effectively balance the conflict between security and deterministic latency in industrial networks. Traditional encryption schemes suffer from high processing latency, severely impacting the response performance of real-time control systems. Critical data in industrial control environments, such as emergency stop commands and real-time sensor data, are extremely sensitive to latency, requiring end-to-end latency control at the millisecond level. However, existing encryption technologies lack differentiated processing capabilities for different data types. In complex industrial network topologies, factors such as multi-hop forwarding, load fluctuations, and device heterogeneity further exacerbate latency uncertainty, making encryption processing a bottleneck for system performance. Existing technologies also cannot effectively address the impact of dynamic load changes on encryption latency, especially in high-concurrency data transmission scenarios where competition for encryption resources can easily lead to sudden increases in latency. The lack of adaptive encryption strategy adjustment mechanisms and refined latency budget management prevents existing technologies from meeting the stringent dual requirements of security and real-time performance in the Industrial Internet.

[0005] In view of this, the present invention proposes a deterministic communication network security assurance method for the Industrial Internet to solve the above problems. Summary of the Invention

[0006] To overcome the aforementioned deficiencies of the prior art and to achieve the above objectives, the present invention provides the following technical solution: A deterministic communication network security assurance method for the Industrial Internet includes: Step S1: Obtain the latency requirement parameters and security identification level of the data stream to be transmitted within the Industrial Internet; Step S2: Construct a hierarchical delay budget model based on delay requirement parameters, and decompose the preset end-to-end delay budget in multiple dimensions through the hierarchical delay budget model to obtain transmission delay quota, queuing delay quota and encryption processing delay quota, and set a delay constraint strategy for the encryption processing delay quota. Step S3: Divide the corresponding data stream to be transmitted into security domains according to the encryption latency quota and security identification level to obtain a differentiated encryption segmentation strategy; Step S4: Construct a time slot key binding table, and combine it with a differentiated encryption segmentation strategy to encrypt the data stream to be transmitted. During the encryption process, check in real time whether the encryption time exceeds the encryption processing latency quota. When the latency exceeds the limit, trigger the encryption strategy downgrade. Step S5: Once encryption is complete, an encrypted data stream is obtained. The corresponding encrypted data stream is then transmitted through a deterministic network, and the receiving end performs the corresponding segmented decryption verification.

[0007] Furthermore, the latency requirement parameters include latency upper limit, latency jitter tolerance, and service cycle characteristics.

[0008] Furthermore, the process of multidimensionally decomposing the preset end-to-end latency budget includes: Construct the total end-to-end latency budget based on the latency upper limit in the latency requirement parameters; set a reserve margin for the total end-to-end latency budget to obtain the allocable latency budget; Based on the obtained allocable delay budget, a hierarchical structure design is carried out to construct a hierarchical delay budget model with the transport layer, scheduling layer and processing layer as the framework; Based on the constructed hierarchical latency budget model, the allocable latency budget is mapped to the latency quota of each processing stage according to the latency limit between the end and end, including the transmission latency quota, queuing latency quota and encryption processing latency quota.

[0009] Furthermore, the process of setting a latency constraint strategy for the encryption processing latency quota includes: Delay constraints are set on the encryption processing delay allocation value to obtain the upper bound parameter of the encryption operation delay, and the encryption processing delay quota is bounded based on the parameter to obtain the encryption delay quota with deterministic guarantee. A latency constraint strategy for generating encryption latency quotas with deterministic guarantees is adopted; the latency constraint strategy includes encryption algorithm selection constraints, encryption data length constraints, and encryption parallelism constraints.

[0010] Furthermore, the process of obtaining the differentiated encryption segmentation strategy includes: The collected data stream to be transmitted is subjected to protocol parsing and message structure matching to obtain the corresponding message field parsing rules; Based on the message field parsing rules, the data stream to be transmitted is parsed at the field level to obtain the data composed of message fields; Based on the obtained security identification level, the message fields within the corresponding message field composition data are divided into security domains to obtain the security domain division results; Based on the encryption processing latency quota, the corresponding latency constraint policy, and the security domain division results, the encryption policy is allocated to obtain the domain-specific encryption configuration scheme. Encryption latency is estimated based on the domain-based encryption configuration scheme to obtain the estimated total encryption time. The feasibility of the estimated total encryption time and encryption processing latency quota is verified to generate the final differentiated encryption segmentation strategy.

[0011] Furthermore, the process of obtaining the security domain partitioning results includes: Threat scenarios are matched based on security protection levels to obtain potential threat type data; the required encryption strength and authentication methods are evaluated based on the potential threat type data to obtain the security protection strength requirements; Based on the security protection strength requirements, the security value of each message field is assessed to obtain the field security value score; the latency impact of each message field is assessed to obtain the field latency impact coefficient. A two-dimensional security domain partitioning matrix is ​​constructed based on field security value scores and field latency impact coefficients; the partitioning boundaries of latency-sensitive security domains and data-critical security domains are set in the two-dimensional security domain partitioning matrix; Message fields whose security value score is higher than the boundary of the data critical security domain and whose latency impact coefficient is lower than the boundary of the latency sensitive security domain are assigned to the data critical security domain; message fields whose latency impact coefficient is higher than the boundary of the latency sensitive security domain and require low transmission latency are assigned to the latency sensitive security domain; the remaining message fields are assigned to the auxiliary information security domain, thus obtaining the security domain division results.

[0012] Furthermore, the process of constructing the time slot key binding table includes: During the data transmission establishment phase, a key pre-negotiation process is triggered; a session key is generated through the key distribution center to obtain master key data; based on the master key data, key derivation is performed to generate subkeys for different security domains, resulting in a domain-specific key set; Each subkey in the domain key set is encoded with a key identifier to obtain a key identifier; the key identifier is associated with the corresponding security domain type and stored to obtain a key-domain mapping table. Obtain the time slot scheduling table for the deterministic network; extract time slot numbers from the time slot scheduling table to obtain a time slot identifier sequence; determine the allocated transmission time slots from the time slot identifier sequence based on the service cycle characteristics of the data stream to be transmitted, and obtain the time slot allocation result; Bind the time slot identifier in the time slot allocation result to the key identifier in the key-domain mapping table to establish a triplet association relationship between time slot number, key identifier and security domain type, and obtain the time slot key binding table.

[0013] Furthermore, the process of encrypting the data stream to be transmitted and verifying in real time whether the encryption time exceeds the encryption processing latency quota includes: A pipelined encryption processing architecture is constructed based on a time-slot key binding table and a differentiated encryption segmentation strategy; the data stream to be transmitted is divided into multiple data segments according to security domains; and each data segment is encrypted in a pipeline manner. During the encryption process, the encryption start time and encryption completion time of each data segment are collected; the time difference between the encryption completion time and the encryption start time is calculated to obtain the actual encryption processing time; the actual encryption processing time is compared and verified with the encryption processing latency quota in real time; when the actual encryption processing time is less than or equal to the encryption processing latency quota, the current differentiated encryption segmentation strategy continues to be executed; when the actual encryption processing time exceeds the encryption processing latency quota, the encryption strategy degradation mechanism is triggered.

[0014] Furthermore, the encryption strategy downgrade mechanism includes downgrading the encryption algorithm of the critical data security domain to a weaker encryption strategy, using plaintext transmission for the auxiliary information security domain, and keeping the encryption strategy of the latency-sensitive security domain unchanged.

[0015] Furthermore, the process of performing the corresponding segmented decryption verification at the receiving end includes: The encrypted data segments are encapsulated to obtain an encrypted data stream; Retrieve the timeslot number bound to the current data stream to be transmitted from the timeslot key binding table; query the corresponding deterministic transmission path in the deterministic network based on the transmission timeslot number; The encrypted data stream is injected into the deterministic transmission path; deterministic forwarding is performed at each forwarding node of the deterministic transmission path; and the transmission process is monitored for latency to obtain the actual transmission latency data and provide real-time feedback. After receiving the encrypted data stream at the receiving end, the key identifier is extracted from the data; the corresponding subkey is obtained from the locally stored time slot key binding table based on the key identifier; the security domain identifier corresponding to the encrypted data stream is identified, and the security domain to which each data segment belongs is obtained based on it; the decryption strategy corresponding to each data segment is determined based on the differentiated encryption segmentation strategy. Based on the subkey and the corresponding decryption strategy, perform the corresponding decryption operation on each data segment to obtain the decrypted data segment; perform integrity verification on the decrypted data segment to obtain the original decrypted data stream; and perform end-to-end integrity verification.

[0016] The technical effects and advantages of the deterministic communication network security assurance method for the Industrial Internet of Things, as described in this invention, are as follows: This invention achieves precise coordination and unified management of security and deterministic latency requirements in industrial networks. It transforms the previously conflicting encryption processing latency and real-time transmission requirements into a collaboratively optimized systemic solution. It changes the security protection model of the Industrial Internet by incorporating security processing latency into a deterministic network scheduling system, significantly improving the predictability and reliability of network communication. In practical applications, industrial control systems no longer need to compromise between security protection strength and real-time performance, but can configure differentiated security strategies based on business characteristics, achieving precise allocation and efficient utilization of security resources. The adaptive degradation mechanism of this invention fully guarantees the real-time transmission requirements of critical control commands, avoiding the performance bottleneck problems of traditional unified encryption schemes, and providing a solid technical guarantee for the secure and reliable operation of the Industrial Internet. Attached Figure Description

[0017] Figure 1 This is a schematic diagram of a deterministic communication network security assurance method for the industrial internet according to the present invention. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] Example 1 Please see Figure 1 As shown in this embodiment, a deterministic communication network security assurance method for the Industrial Internet includes: Step S1: Obtain the latency requirement parameters and security identification level of the data stream to be transmitted within the Industrial Internet; the latency requirement parameters include the latency upper limit, latency jitter tolerance, and service cycle characteristics; Step S2: Construct a hierarchical delay budget model based on delay requirement parameters, and decompose the preset end-to-end delay budget in multiple dimensions through the hierarchical delay budget model to obtain the transmission delay quota, queuing delay quota and encryption processing delay quota, and set a delay constraint strategy for the encryption processing delay quota. Step S3: Divide the corresponding data stream to be transmitted into security domains according to the encryption latency quota and security identification level to obtain a differentiated encryption segmentation strategy; Step S4: Construct a time slot key binding table, and combine it with a differentiated encryption segmentation strategy to encrypt the data stream to be transmitted. During the encryption process, check in real time whether the encryption time exceeds the encryption processing latency quota. When the latency exceeds the limit, trigger the encryption strategy downgrade. Step S5: Once encryption is complete, an encrypted data stream is obtained. The corresponding encrypted data stream is then transmitted through a deterministic network, and the receiving end performs the corresponding segmented decryption verification.

[0020] It should be further explained that, in the specific implementation process, the process of obtaining latency requirement parameters and security identification levels includes: Based on a preset latency measurement probe, business attribute data of the data to be transmitted is obtained from within the Industrial Internet. By employing a multi-protocol adaptation mechanism, it supports mainstream industrial communication protocols such as OPCUA, MQTT, and ModbusTCP. It performs multi-source data collection at three levels within the Industrial Internet: data source nodes, relay gateways, and target terminals, and extracts their metadata information, including fields such as data source identifier, data type, sampling frequency, data priority, timestamp, and latency requirements, forming a set of business attribute data. It should be noted that the latency measurement probe is a dedicated measurement device that integrates high-precision timestamp generation, packet identification tracking, and latency calculation and analysis functions, enabling accurate time recording and latency measurement at critical path nodes in packet transmission. Data stream type identification is performed on business attribute data. Preliminary classification is conducted based on predefined business rules; for example, if the data sampling period is fixed and less than 100 milliseconds, it is preliminarily identified as a periodic control stream; if the data generation exhibits obvious event-triggered characteristics and the arrival interval is irregular, it is identified as an event-triggered stream; if the data is continuously generated at a constant or slowly changing rate, it is identified as a status monitoring stream. Furthermore, based on the preliminary classification results, corresponding data stream type labels are assigned to each data stream to be transmitted. These labels include periodic control stream, event-triggered stream, and status monitoring stream. Based on the identified data flow type, the corresponding latency requirements are extracted, and the parameters are validated for validity. Latency-related fields are extracted from business attribute data. For example, for periodic control flows, the focus is on the end-to-end latency ceiling and latency jitter tolerance; for event-triggered flows, the focus is on response latency and event processing window; for status monitoring flows, latency requirements are relatively lenient. Then, the extracted latency-related fields are validated for validity, checking whether the parameter values ​​are within a reasonable range and removing outliers and missing values ​​to obtain latency requirement parameters. These parameters include the latency ceiling, latency jitter tolerance, and business cycle characteristics. The end-to-end latency ceiling is determined through round-trip time measurement, and the latency jitter tolerance is determined based on the real-time level of the business type. Business cycle characteristics are extracted through frequency domain analysis, using Fast Fourier Transform to identify and extract the main frequency components and harmonic features to obtain the periodic pattern of the data flow.

[0021] Furthermore, when obtaining the security identifier carried by the data stream to be transmitted, the security label is read from the header or metadata field of the data stream. The security identifier usually exists in the form of a numerical code or a string identifier. The security identifier is parsed, and various formats of security identifiers are uniformly converted into standardized security level codes. A preset security level mapping table is queried according to the security level code. This mapping table establishes the correspondence between security level codes and security protection levels. The corresponding security identifier level is obtained by querying the mapping table.

[0022] It should be further explained that, in the specific implementation process, the multi-dimensional decomposition of the preset end-to-end latency budget includes: The total end-to-end latency budget is constructed based on the latency upper limit in the latency requirement parameters. A margin is set for the total end-to-end latency budget to obtain the allocatable latency budget. The latency upper limit threshold is directly read as a hard constraint on the end-to-end latency budget. The total end-to-end latency budget equals the preset latency upper limit threshold, representing the maximum allowed time from data generation to successful reception and verification by the receiver. A margin is set for the total end-to-end latency budget; therefore, the allocatable latency budget Talloc = Ttotal × (1 - margin); where Ttotal represents the total end-to-end latency budget, and margin is the margin coefficient, related to the specific retention ratio of the margin.

[0023] Based on the obtained allocable delay budget, a hierarchical structure design is implemented, constructing a hierarchical delay budget model with a transport layer, scheduling layer, and processing layer as its framework. Transmission delay quotas are allocated at the transport layer, queuing delay quotas at the scheduling layer, and encryption processing delay quotas at the processing layer. First, based on the obtained allocable delay budget, a hierarchical delay budget model is constructed, constructing a hierarchical delay budget model with a transport layer, scheduling layer, and processing layer as its framework. The transport layer is used to allocate transmission delay quotas (including network transmission processes such as serialization, propagation, and forwarding delays); the scheduling layer is used to allocate queuing delay quotas (including the scheduling waiting time in deterministic networks, i.e., the time data waits for allocated transmission slots in the node buffer); and the processing layer is used to allocate encryption processing delay quotas (including data processing processes such as encryption, decryption, encapsulation, and decapsulation). Furthermore, the sum of the transmission delay quota allocated at the transport layer, the queuing delay quota allocated at the scheduling layer, and the encryption processing delay quota allocated at the processing layer does not exceed the allocable delay budget.

[0024] Next, based on the constructed hierarchical latency budget model, the allocable latency budget is mapped to latency quotas for each processing stage according to the end-to-end latency ceiling, including transmission latency quotas, queuing latency quotas, and encryption processing latency quotas. Each layer uses a reverse allocation strategy to determine the latency quotas, with the end-to-end latency ceiling thresholds sequentially constituting the maximum possible latency for each layer, and the remaining latency serving as the base value for the encryption processing latency quota.

[0025] It should be further explained that, in the specific implementation process, the process of setting latency constraint strategies for encryption processing latency quotas includes: Delay constraints are set on the allocated encryption processing delay value to obtain the upper bound parameter for the encryption operation's delay. Based on this upper bound parameter, the encryption processing delay quota is then subject to boundary restrictions to obtain a deterministic encryption delay quota. During the corresponding delay constraint setting process, it is necessary to ensure that the encryption operation can be completed within the allocated delay even in the worst-case scenario. By employing a worst-case execution time analysis method, performance tests are conducted on candidate encryption algorithms. These tests include measuring the encryption time under maximum packet length, highest load, and most unfavorable hardware conditions to obtain the upper bound parameter for the encryption operation's delay. Based on this parameter, boundary restrictions are applied to the encryption processing delay quota, requiring that the worst-case execution time of the encryption algorithm must be less than or equal to the allocated encryption processing delay quota. If this condition is not met, the encryption algorithm selection needs to be adjusted, the encrypted data length reduced, or hardware acceleration capabilities increased. Through the above process, a deterministic encryption delay quota is obtained.

[0026] A latency constraint strategy is generated based on a deterministic encryption latency quota. This strategy includes constraints on encryption algorithm selection, encrypted data length, and encryption parallelism. It guides the selection of encryption algorithms and the design of encryption schemes through quantitative constraints. The latency constraint strategy comprises three aspects: encryption algorithm selection constraints, which select encryption algorithms that meet performance requirements based on the encryption latency quota and exclude high-complexity algorithms whose execution time exceeds the quota; encrypted data length constraints, which calculate the maximum allowed encrypted data length based on the unit data processing time and total latency quota of the encryption algorithm, and transmit the portion exceeding this length in plaintext or with downgraded encryption; and encryption parallelism constraints, which determine the optimal number of parallel processing units and data block size for encryption algorithms that support parallel processing, to fully utilize hardware resources and meet latency requirements.

[0027] It should be further explained that, in the specific implementation process, the process of obtaining the differentiated encryption segmentation strategy includes: The acquired data stream to be transmitted is parsed for protocols and its message structure is matched to obtain the corresponding message field parsing rules. First, the protocol representation field or port number information in the data stream to be transmitted is read to identify and determine the industrial communication protocol used by the data stream. Combined with the message format of the corresponding industrial communication parsing of the data stream to be transmitted, the boundary positions of the message header, control field, data payload and check field are identified. Based on this, the message structure definition of the corresponding protocol is retrieved from the preset message template library to obtain the message field parsing rules, including the starting position, byte length and parsing method of each field. The message structure template describes in detail the field composition, field position, field length and field meaning of the protocol message.

[0028] Based on the message field parsing rules, the data stream to be transmitted is parsed at the field level to obtain the message field composition data. First, the data of each field is extracted from the byte stream of the message according to the message field parsing rules. For fixed-length fields, the data is read directly according to the start position and length. For variable-length fields, the length indicator field is read first, and then the data content is read according to the length value. The parsing process generates message field composition data, which records the name, type, value and position of each field in the original message in a structured format. The message field composition data includes message header fields (such as transaction identifier, protocol identifier, length and other metadata fields), control instruction fields (such as function code, operation command and other control information), process data fields (such as sensor readings, equipment status, control parameters and other core business data), and verification information fields (such as CRC check code, checksum and other integrity protection fields).

[0029] Based on the obtained security identification level, the message fields within the corresponding message field composition data are divided into security domains to obtain the security domain division results. First, based on the obtained security identification level, the main threat types faced by each security level are identified and marked to obtain potential threat type data. Then, based on the identified potential threat type data, the required encryption strength and authentication method are evaluated to obtain the corresponding security protection strength requirements. Subsequently, based on the obtained security protection requirements, security assessments and latency impact assessments are performed on each message field within the message field composition data, and based on the assessment results, the corresponding message fields are divided into security domains to obtain the security domain division results.

[0030] Encryption strategies are allocated based on encryption processing latency quotas, corresponding latency constraint policies, and security domain division results to obtain a domain-specific encryption configuration scheme. Differentiated encryption algorithms are assigned to different security domains: lightweight encryption algorithms, such as ChaCha20, are assigned to latency-sensitive security domains; standard-strength encryption algorithms, such as AES-256, are assigned to data-critical security domains; and optional encryption strategies are assigned to auxiliary information security domains, with encryption determined by the remaining latency quota: if the latency quota is sufficient, lightweight encryption is used; if the latency quota is limited, plaintext transmission or only integrity verification is performed. This differentiated configuration yields a domain-specific encryption configuration scheme, which details the encryption algorithms, key lengths, encryption modes, and authentication methods used in each security domain.

[0031] Encryption latency is estimated based on the domain-based encryption configuration scheme to obtain the estimated total encryption time. The feasibility of the estimated total encryption time and encryption processing latency quota is verified to generate the final differentiated encryption segmentation strategy. The calculation is performed based on the field data volume of each security domain and the processing performance of the corresponding encryption algorithm. For each security domain, the estimated encryption time is equal to the data length of that domain divided by the processing rate of the encryption algorithm. Based on this, the estimated total encryption time is obtained, which is equal to the sum of the estimated encryption times of all security domains. The estimated total encryption time is compared with the encryption processing latency quota. If the estimated total encryption time is less than or equal to the encryption processing latency quota, the configuration scheme is feasible, and the final differentiated encryption segmentation strategy is directly generated. If the estimated total encryption time exceeds the encryption processing latency quota, the configuration scheme needs to be adjusted. Optional adjustment measures include: further reducing the encryption scope of auxiliary information security domains, downgrading some fields of key data security domains to lightweight encryption, enabling hardware encryption acceleration, or adding encryption parallel processing units. After adjustment and verification, the final differentiated encryption segmentation strategy is generated to ensure that the latency budget is not exceeded while meeting security requirements.

[0032] It should be further explained that, in the specific implementation process, the process of obtaining the security domain partitioning results includes: Threat scenarios are matched based on security protection levels to obtain potential threat type data. The required encryption strength and authentication methods are then assessed based on this data to determine the security protection strength requirements. For the basic protection level, the main threats are data mistransmission and non-malicious tampering. For the standard protection level, eavesdropping and replay attacks are added. For the enhanced protection level, protection against man-in-the-middle attacks and protocol vulnerability exploitation is also required. For advanced and highest protection levels, advanced persistent threats (APTs) and targeted attacks need to be addressed. Based on the identified potential threat type data, the required encryption strength and authentication methods are assessed. For example, for low-threat scenarios, CRC32 checksum is sufficient; for extremely high-threat scenarios, SM4 national cryptographic encryption and SM2 digital signatures are used. Through threat assessment and security mechanism selection, the security protection strength requirements are obtained, including specific encryption algorithms, key lengths, authentication methods, and integrity protection mechanisms.

[0033] Security value assessments are performed on each message field based on security protection strength requirements to obtain a field security value score. A comprehensive score is then calculated based on the business importance, sensitivity, and leakage risk of each message field. The security value assessment employs a combination of expert rules and data classification standards. For example, process data fields, especially those involving key process parameters, equipment status, and control commands, are assigned high security value scores; message header fields and protocol metadata fields are assigned medium security value scores; and verification information fields and auxiliary information fields are assigned low security value scores. After obtaining the field security value scores, the security importance level of each message field is labeled. The latency impact of each message field is assessed to obtain the field latency impact coefficient. The degree of impact of each field on the real-time performance of the business is analyzed. The latency impact assessment mainly considers two factors: the timeliness requirements of the field data and the criticality of the field in the business process. For example, the latency impact coefficients for control command fields and real-time feedback data fields are relatively high because the delay of these fields directly affects the control response speed; the latency impact coefficients for historical data fields and configuration parameter fields are relatively low because these fields do not have high real-time requirements. After obtaining the field latency impact coefficients, the latency sensitivity level of each field is labeled.

[0034] A two-dimensional security domain partitioning matrix is ​​constructed based on field security value scores and field latency impact coefficients. Boundaries for latency-sensitive security domains and data-critical security domains are defined within this matrix. Using a coordinate mapping method, all message fields are mapped onto a two-dimensional plane with security value as the horizontal axis and latency impact coefficient as the vertical axis. Each message field corresponds to a point on the plane. Boundaries for latency-sensitive and data-critical security domains are defined within the two-dimensional security domain partitioning matrix. The data-critical security domain boundary is defined as the area where the security value score is greater than a preset threshold; fields within this area have high security value and require strong encryption protection. The latency-sensitive security domain boundary is defined as the area where the latency impact coefficient is greater than a preset latency threshold but the security value score does not exceed the preset threshold; fields within this area are latency-sensitive but have relatively low security value and require fast or selective encryption. The auxiliary information security domain is the remaining area, i.e., the area where the security value score does not exceed the preset threshold and the latency impact coefficient does not exceed the preset latency threshold; fields within this area can be transmitted using lightweight encryption or plaintext.

[0035] Message fields with security value scores higher than the boundary of the critical data security domain and latency impact coefficients lower than the boundary of the latency-sensitive security domain are assigned to the critical data security domain. These fields are typically core business data, such as key process parameters, equipment control commands, and sensitive status information, which have high security value but are not very sensitive to encryption processing latency. Message fields with latency impact coefficients higher than the boundary of the latency-sensitive security domain and requiring low transmission latency are assigned to the latency-sensitive security domain. These fields are typically real-time control signals, emergency commands, and synchronization clocks, requiring extremely low transmission latency, and encryption processing must be very fast. The remaining message fields are assigned to the auxiliary information security domain. These fields include protocol headers, sequence numbers, and auxiliary information, which have relatively low security value and latency sensitivity. This yields the security domain assignment results.

[0036] It should be further explained that, in the specific implementation process, the detailed process of constructing the time slot key binding table includes the following steps: During the data transmission establishment phase, a key pre-negotiation process is triggered; a session key is generated through the key distribution center to obtain master key data; based on the master key data, key derivation is performed to generate subkeys for different security domains, resulting in a set of domain-specific keys. Before the data stream begins transmission, the sending and receiving ends complete key negotiation through a key exchange protocol; a session key is generated through the key distribution center; the key distribution center generates a random master key for the data stream session, the length of which is determined according to security level requirements; after obtaining the master key data, multiple subkeys are generated based on the master key, each corresponding to a security domain; key derivation uses HKDF (HMAC-based key derivation function), with input parameters including the master key, security domain identifier, and derivation counter; through key derivation, delay-sensitive security domain subkeys, data-critical security domain subkeys, and auxiliary information security domain subkeys are generated, resulting in a set of domain-specific keys.

[0037] Each subkey in the domain-specific key set is encoded with a key identifier to obtain a key identifier. The key identifiers are then associated with their corresponding security domain types for storage, resulting in a key-domain mapping table. First, a unique key identifier is assigned to each subkey. This key identifier uses structured encoding and includes fields such as session identifier, security domain type encoding, and key version number. The key identifiers are then associated with their corresponding security domain types for storage, establishing a key-domain mapping table. This table uses the key identifier as an index to store information such as the corresponding subkey value, security domain type, encryption algorithm type, and key lifecycle. Both the sending and receiving ends synchronously maintain the same key-domain mapping table.

[0038] Obtain the time slot scheduling table for the deterministic network; extract time slot numbers from the time slot scheduling table to obtain a time slot identifier sequence; determine the allocated transmission time slots from the time slot identifier sequence based on the service cycle characteristics of the data stream to be transmitted, and obtain the time slot allocation result. First, read the time slot information reserved for the data stream to be transmitted from the network controller; the time slot scheduling table defines the transmission time window of the data stream in the network, ensuring that data is sent and forwarded at specified times to avoid queuing delays; extract time slot numbers from the time slot scheduling table to obtain a time slot identifier sequence, each time slot identifier including parameters such as time slot cycle number, time slot offset, and time slot duration; determine the allocated transmission time slots from the time slot identifier sequence based on the service cycle characteristics of the data stream to be transmitted; for periodic control flows, allocate periodically repeating time slots; for event-triggered flows, reserve emergency time slots or shared time slots. Obtain the time slot allocation result.

[0039] The time slot identifiers in the time slot allocation results are bound to the key identifiers in the key-domain mapping table, establishing a triplet association between the time slot number, key identifier, and security domain type, thus obtaining the time slot key binding table; the association between time slots and keys is also established. For each allocated transmission time slot, the security domain to which the data transmitted within that time slot belongs is determined, and then the time slot identifier is bound to the key identifier of the corresponding security domain; a triplet association between the time slot number, key identifier, and security domain type is established, resulting in the time slot key binding table. Each record in this binding table contains three fields: time slot identifier, key identifier, and security domain type.

[0040] It should be further explained that, in the specific implementation process, the detailed process of encrypting the data stream to be transmitted and verifying in real time whether the encryption time exceeds the encryption processing latency quota includes the following steps: A pipelined encryption processing architecture is constructed based on a time-slot key binding table and a differentiated encryption segmentation strategy. The data stream to be transmitted is divided into multiple data segments according to security domains, and each data segment is encrypted in parallel using a pipelined approach. A multi-level encryption processing pipeline is designed to support the parallel encryption of multiple data segments. The pipeline architecture includes a data splitting unit, an encryption engine array, and a data reassembly unit. The data splitting unit divides the data stream to be transmitted into multiple data segments according to security domains, with each data segment corresponding to a security domain. The encryption engine array contains multiple independent encryption processing units, each responsible for the encryption task of one security domain. Each data segment is encrypted in parallel using a pipelined approach, meaning that data segments from different security domains can be encrypted simultaneously in different encryption engines, improving encryption throughput and shortening the overall encryption latency.

[0041] During encryption, the encryption start and completion times of each data segment are collected via hardware timestamps. The time difference between the encryption completion time and the encryption start time is calculated to obtain the actual encryption processing time. A high-precision clock (such as a PTP synchronization clock or a CPU cycle counter) is used to record the timestamps, ensuring the accuracy of time measurement. For each data segment, the encryption engine records a start timestamp when the encryption operation begins and a completion timestamp when the encryption operation ends. The time difference between the encryption completion time and the encryption start time is calculated to obtain the actual encryption processing time for that data segment. The maximum value or summation of the encryption times for all data segments (depending on whether parallel or serial processing is used) is taken to obtain the actual encryption processing time for the entire data stream.

[0042] The actual encryption processing time is compared and verified with the encryption processing latency quota in real time. When the actual encryption processing time is less than or equal to the encryption processing latency quota, the current encryption strategy continues to be executed. When the actual encryption processing time exceeds the encryption processing latency quota, the encryption strategy degradation mechanism is triggered. A latency monitoring unit is set up to continuously compare the actual encryption processing time with the encryption processing latency quota. When the actual encryption processing time is less than or equal to the encryption processing latency quota, it means that the current encryption strategy meets the latency requirements, and the current encryption strategy continues to be executed, completing the encryption of all data segments and preparing for transmission. When the actual encryption processing time exceeds the encryption processing latency quota, it means that the encryption processing is too slow, which may lead to end-to-end latency exceeding the limit, triggering the encryption strategy degradation mechanism.

[0043] In the encryption strategy degradation mechanism, a tiered degradation strategy is adopted to protect critical data as much as possible. The encryption algorithm for critical data security domains is downgraded to a less powerful encryption algorithm, such as downgrading from AES-256 to AES-128. Plaintext transmission is used for auxiliary information security domains, completely skipping the encryption step to save latency. The encryption strategy for latency-sensitive security domains remains unchanged because these domains already use the fastest lightweight encryption algorithm; further degradation would lose necessary security protection. After obtaining the downgraded encryption scheme, the system reconfigures the encryption engine, re-executes the encryption process using the downgraded encryption algorithm, and performs latency monitoring and verification again. If a timeout still occurs after degradation, the system can continue to downgrade or trigger an alarm to notify upper-layer applications to adjust business strategies. Through this adaptive degradation mechanism, the system can dynamically balance latency constraints and security requirements, ensuring the real-time performance of critical business operations.

[0044] It should be further explained that, in the specific implementation process, the corresponding segmented decryption verification process at the receiving end includes: The encrypted data segments are encapsulated to obtain an encrypted data stream. When adding encrypted metadata, a metadata header is inserted or appended before each encrypted data segment. The encrypted metadata includes a security field identifier (indicating whether the data segment belongs to a latency-sensitive field, a critical data field, or an auxiliary information field), a key identifier (indicating the key ID used by the data segment, used by the receiver to quickly find the decryption key), and a segment sequence number (indicating the sequential position of the data segment in the original message, used by the receiver to correctly reassemble the message). In addition, the metadata may also include parameters such as the encryption algorithm type, encryption mode, and initialization vector. All encrypted data segments and their metadata are combined and encapsulated to obtain a complete encrypted data stream.

[0045] The time slot number bound to the current data stream to be transmitted is obtained from the time slot key binding table. Based on the transmission time slot number, the corresponding deterministic transmission path is queried in the deterministic network. First, the time slot number corresponding to the data stream to be transmitted is obtained, and then the path configuration table of the network controller is accessed to obtain the forwarding path information associated with that time slot. The deterministic transmission path includes detailed parameters such as the node sequence on the path, the forwarding time of each node, and the output port configuration. This path has reserved bandwidth and latency guarantees, meaning the network ensures sufficient bandwidth for data stream transmission on this path, and the data transmission latency on the path has an upper bound guarantee, satisfying the low latency and low jitter characteristics of the deterministic network.

[0046] The encrypted data stream is injected into a deterministic transmission path; deterministic forwarding is performed at each forwarding node of the deterministic transmission path; and latency is monitored during the transmission process to obtain the actual transmission latency data. First, data transmission is initiated through a time-triggered mechanism. This mechanism relies on precise clock synchronization to ensure that the sender injects data into the network at the precise moment. When the clock reaches the start time of the time slot, the sender immediately sends the encrypted data stream to the network interface, injecting it into the deterministic transmission path. Through this mechanism, the encrypted data stream is sent according to the time slot scheduling table, without conflicting with the time slots of other traffic in the network, thus avoiding transmission collisions and queuing delays.

[0047] Furthermore, the conversion nodes perform deterministic forwarding according to the time slot scheduling table. Deterministic forwarding means that the nodes forward the data packets from the designated output port at the predetermined time, instead of using the traditional first-come-first-served or priority queue mechanism. This forwarding method avoids queuing delays because the data packets do not need to wait in the queue, but are forwarded immediately at the predetermined time. Through time slot synchronization and strict scheduling control, the network guarantees the determinism of transmission delay, that is, the transmission delay of data packets in the network is predictable and bounded. The system monitors the transmission delay, records the arrival and departure timestamps of data packets at key nodes, calculates the actual transmission delay, and obtains the actual transmission delay data, which is used to verify network performance and optimize scheduling parameters (such as verifying whether the actual transmission delay meets the acquired transmission delay quota).

[0048] After receiving the encrypted data stream, the receiving end extracts the key identifier from the data; based on the key identifier, it retrieves the corresponding subkey from the locally stored time-slot key binding table. First, it parses the data stream's encapsulation structure to extract encrypted metadata; then, it reads the key identifier field from the encrypted metadata, which indicates the key used to encrypt the data segment; finally, it retrieves the corresponding subkey from the locally stored time-slot key binding table based on the key identifier. Since the receiving end has already obtained a set of domain-specific keys and a key-domain mapping table consistent with the sending end through key pre-negotiation during the connection establishment phase, it can quickly find the correct decryption key. This key identifier-based lookup mechanism avoids real-time key negotiation, significantly reducing decryption preparation latency.

[0049] The system identifies the security domain identifier corresponding to the encrypted data stream and obtains the security domain to which each data segment belongs based on it. It then determines the decryption strategy corresponding to each data segment based on a differentiated encryption segmentation strategy. The system reads the security domain identifier field to determine whether the data segment belongs to a latency-sensitive security domain, a data-critical security domain, or an auxiliary information security domain. The receiving end maintains a domain-based encryption configuration scheme consistent with the sending end, allowing it to determine the appropriate decryption strategy based on the security domain type. For example, latency-sensitive domains use ChaCha20 decryption, data-critical domains use AES-256 decryption, and auxiliary information domains are determined based on the encryption status identifier to determine whether decryption is required.

[0050] Based on the subkey and corresponding decryption strategy, each data segment is decrypted; the decrypted data segment is obtained; the integrity of the decrypted data segment is verified to obtain the original decrypted data stream; and end-to-end integrity verification is performed. First, the data segments are sorted according to the segment number in the metadata to ensure processing in the original order. For example, for data segments in latency-sensitive security domains, the corresponding lightweight decryption strategy and subkey are used for decryption; for data segments in data-critical security domains, the standard strength decryption strategy and subkey are used for decryption; for auxiliary information security domains, the encryption status indicator is checked. If the segment is not encrypted (transmitted in plaintext), the data content is directly extracted; if it is encrypted, the corresponding algorithm is used for decryption. The decryption operation can be performed in parallel.

[0051] Then, a Message Authentication Code (MAC) or hash verification method is used to verify whether the data segment has been tampered with. For example, the sender generates a MAC value and appends it to the metadata while encrypting the data segment. The receiver decrypts the data, recalculates the MAC value, and compares it with the received MAC value. If they match, the integrity check passes. If they do not match, it indicates that the data has been tampered with or that there was a transmission error, triggering the error handling process. When reassembling the data segments into a complete message according to the segment position index table, the decrypted data segments are concatenated according to the field order and position of the original message based on the segment sequence number and segment position index information. The segment position index table records the starting offset and length of each data segment in the original message. The message structure can be accurately restored through this table. The decrypted original data stream is obtained, which means the original message content before encryption by the sender is restored.

[0052] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

[0053] All formulas in this manual are dimensionless and calculated numerically. The formulas are derived from software simulations based on a large amount of collected data to obtain the most recent real-world results. The preset parameters and thresholds in the formulas are set by those skilled in the art according to the actual situation.

[0054] Although embodiments of the invention have been shown and described, those skilled in the art will understand that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the claims and their equivalents.

Claims

1. A method for ensuring the security of deterministic communication networks in the Industrial Internet, characterized in that, include: Step S1: Obtain the latency requirement parameters and security identification level of the data stream to be transmitted within the Industrial Internet; Step S2: Construct a hierarchical delay budget model based on delay requirement parameters, and decompose the preset end-to-end delay budget in multiple dimensions through the hierarchical delay budget model to obtain transmission delay quota, queuing delay quota and encryption processing delay quota, and set a delay constraint strategy for the encryption processing delay quota. Step S3: Divide the corresponding data stream to be transmitted into security domains according to the encryption latency quota and security identification level to obtain a differentiated encryption segmentation strategy; Step S4: Construct a time slot key binding table, and combine it with a differentiated encryption segmentation strategy to encrypt the data stream to be transmitted. During the encryption process, check in real time whether the encryption time exceeds the encryption processing latency quota. When the latency exceeds the limit, trigger the encryption strategy downgrade. Step S5: Once encryption is complete, an encrypted data stream is obtained. The corresponding encrypted data stream is then transmitted through a deterministic network, and the receiving end performs the corresponding segmented decryption verification.

2. The deterministic communication network security assurance method for the Industrial Internet according to claim 1, characterized in that, The latency requirement parameters include latency upper limit, latency jitter tolerance, and service cycle characteristics.

3. The deterministic communication network security assurance method for the Industrial Internet according to claim 2, characterized in that, The process of multidimensionally decomposing the preset end-to-end latency budget includes: Construct the total end-to-end latency budget based on the latency upper limit in the latency requirement parameters; set a reserve margin for the total end-to-end latency budget to obtain the allocable latency budget; Based on the obtained allocable delay budget, a hierarchical structure design is carried out to construct a hierarchical delay budget model with the transport layer, scheduling layer and processing layer as the framework; Based on the constructed hierarchical latency budget model, the allocable latency budget is mapped to the latency quota of each processing stage according to the latency limit between the end and end, including the transmission latency quota, queuing latency quota and encryption processing latency quota.

4. The deterministic communication network security assurance method for the Industrial Internet according to claim 3, characterized in that, The process of setting a latency constraint strategy for the encryption processing latency quota includes: Delay constraints are set on the encryption processing delay allocation value to obtain the upper bound parameter of the encryption operation delay, and the encryption processing delay quota is bounded based on the parameter to obtain the encryption delay quota with deterministic guarantee. A latency constraint strategy for generating encryption latency quotas with deterministic guarantees is adopted; the latency constraint strategy includes encryption algorithm selection constraints, encryption data length constraints, and encryption parallelism constraints.

5. The deterministic communication network security assurance method for the Industrial Internet according to claim 4, characterized in that, The process of obtaining the differentiated encryption segmentation strategy includes: The collected data stream to be transmitted is subjected to protocol parsing and message structure matching to obtain the corresponding message field parsing rules; Based on the message field parsing rules, the data stream to be transmitted is parsed at the field level to obtain the data composed of message fields; Based on the obtained security identification level, the message fields within the corresponding message field composition data are divided into security domains to obtain the security domain division results; Based on the encryption processing latency quota, the corresponding latency constraint policy, and the security domain division results, the encryption policy is allocated to obtain the domain-specific encryption configuration scheme. Encryption latency is estimated based on the domain-based encryption configuration scheme to obtain the estimated total encryption time. The feasibility of the estimated total encryption time and encryption processing latency quota is verified to generate the final differentiated encryption segmentation strategy.

6. The deterministic communication network security assurance method for the Industrial Internet according to claim 5, characterized in that, The process of obtaining the security domain partitioning results includes: Threat scenarios are matched based on security protection levels to obtain potential threat type data; the required encryption strength and authentication methods are evaluated based on the potential threat type data to obtain the security protection strength requirements; Based on the security protection strength requirements, the security value of each message field is assessed to obtain the field security value score; the latency impact of each message field is assessed to obtain the field latency impact coefficient. A two-dimensional security domain partitioning matrix is ​​constructed based on field security value scores and field latency impact coefficients; the partitioning boundaries of latency-sensitive security domains and data-critical security domains are set in the two-dimensional security domain partitioning matrix; Message fields whose security value score is higher than the boundary of the data critical security domain and whose latency impact coefficient is lower than the boundary of the latency sensitive security domain are assigned to the data critical security domain; message fields whose latency impact coefficient is higher than the boundary of the latency sensitive security domain and require low transmission latency are assigned to the latency sensitive security domain; the remaining message fields are assigned to the auxiliary information security domain, thus obtaining the security domain division results.

7. The deterministic communication network security assurance method for the Industrial Internet according to claim 5, characterized in that, The process of constructing the time slot key binding table includes: During the data transmission establishment phase, a key pre-negotiation process is triggered; a session key is generated through the key distribution center to obtain master key data; based on the master key data, key derivation is performed to generate subkeys for different security domains, resulting in a domain-specific key set; Each subkey in the domain key set is encoded with a key identifier to obtain a key identifier; the key identifier is associated with the corresponding security domain type and stored to obtain a key-domain mapping table. Obtain the time slot scheduling table for the deterministic network; extract time slot numbers from the time slot scheduling table to obtain a time slot identifier sequence; determine the allocated transmission time slots from the time slot identifier sequence based on the service cycle characteristics of the data stream to be transmitted, and obtain the time slot allocation result; Bind the time slot identifier in the time slot allocation result to the key identifier in the key-domain mapping table to establish a triplet association relationship between time slot number, key identifier and security domain type, and obtain the time slot key binding table.

8. The deterministic communication network security assurance method for the Industrial Internet according to claim 7, characterized in that, The process of encrypting the data stream to be transmitted, and verifying in real time whether the encryption time exceeds the encryption latency quota, includes: A pipelined encryption processing architecture is constructed based on a time-slot key binding table and a differentiated encryption segmentation strategy; the data stream to be transmitted is divided into multiple data segments according to security domains; and each data segment is encrypted in a pipeline manner. During the encryption process, the encryption start time and encryption completion time of each data segment are collected; the time difference between the encryption completion time and the encryption start time is calculated to obtain the actual encryption processing time; the actual encryption processing time is compared and verified with the encryption processing latency quota in real time; when the actual encryption processing time is less than or equal to the encryption processing latency quota, the current differentiated encryption segmentation strategy continues to be executed; when the actual encryption processing time exceeds the encryption processing latency quota, the encryption strategy degradation mechanism is triggered.

9. The deterministic communication network security assurance method for the Industrial Internet according to claim 8, characterized in that, The encryption strategy downgrade mechanism includes downgrading the encryption algorithm of the critical data security domain to a weaker encryption strategy, using plaintext transmission for the auxiliary information security domain, and keeping the encryption strategy of the latency-sensitive security domain unchanged.

10. The deterministic communication network security assurance method for the Industrial Internet according to claim 8, characterized in that, The process of performing the corresponding segmented decryption verification at the receiving end includes: The encrypted data segments are encapsulated to obtain an encrypted data stream; Retrieve the timeslot number bound to the current data stream to be transmitted from the timeslot key binding table; query the corresponding deterministic transmission path in the deterministic network based on the transmission timeslot number; The encrypted data stream is injected into the deterministic transmission path; deterministic forwarding is performed at each forwarding node of the deterministic transmission path; and the transmission process is monitored for latency to obtain the actual transmission latency data and provide real-time feedback. Meanwhile, after receiving the encrypted data stream at the receiving end, the key identifier is extracted from the data; the corresponding subkey is obtained from the locally stored time slot key binding table based on the key identifier; the security domain identifier corresponding to the encrypted data stream is identified, and the security domain to which each data segment belongs is obtained based on it; the decryption strategy corresponding to each data segment is determined based on the differentiated encryption segmentation strategy. Based on the subkey and the corresponding decryption strategy, perform the corresponding decryption operation on each data segment to obtain the decrypted data segment; perform integrity verification on the decrypted data segment to obtain the original decrypted data stream; and perform end-to-end integrity verification.

Images