Secure gateway protection system for job data

Abstract

The application relates to the technical field of Internet of Things security gateways, and discloses a security gateway protection system for job data, which comprises a message outbound transceiving module, a time budget calculation module, a matching topology clipping module and a limited feature comparison module. The time budget calculation module matches a delay tolerance threshold according to an inbound message service quality identification bit. The sampling message outbound transceiving module hardware queue depth determines a dynamic queuing delay and calculates a comparison time budget. The matching topology clipping module shields secondary node sets to reconstruct an active matching path when the comparison time budget is lower than a predicted search time consumption. The limited feature comparison module compares load features in the active matching path. The application uses bottom-layer physical queuing back pressure to reversely regulate and control matching depth, ensures that job data forwarding meets the determined delay requirement, and eliminates the control out-of-step risk caused by detection random fluctuation.

Description

Technical Field

[0001] This invention belongs to the field of Internet of Things (IoT) security gateway technology, and particularly relates to a security gateway protection system for operational data. Background Technology

[0002] With the deep integration of industrialization and informatization, industrial internet gateways, as key nodes in heterogeneous network interconnection, are crucial for the reliable transmission of production operation data. Industrial internet gateways widely integrate anti-virus engines and deep packet inspection mechanisms to parse received packet payloads, identify and intercept potential malicious code, and ensure the boundary security of industrial control systems. Industrial control scenarios have stringent requirements for deterministic communication latency. The effectiveness of servo control commands and high-frequency sampled data depends on whether they arrive within a preset hard real-time period. However, security filtering logic is a computationally intensive task, and its processing time fluctuates randomly depending on the characteristic distribution of packet payloads and the state machine matching path. There is a fundamental constraint between the randomness of this computational overhead and the deterministic latency requirements of industrial flows.

[0003] Common solutions attempt to reduce the average processing time per detection by increasing hardware computing power or optimizing algorithm paths. However, when transient micro-burst congestion occurs on the physical egress link, or when the packet payload triggers long-path backtracking of a deterministic finite automaton, the gateway forwarding plane still experiences significant processing latency jitter. Increasing the computing frequency or expanding the parallel matching units may increase the total throughput, but it cannot eliminate the variance in single-packet processing time caused by differences in payload content at the mechanism level. When the security detection time encroaches on the packet's dwell margin within the gateway, even if the packet is ultimately determined to be secure, it will lose its physical control significance due to timeout. Not only can simply increasing hardware computing power not fundamentally eliminate latency jitter, but existing deep detection mechanisms that focus on packet feature parsing at the software layer also have fundamental shortcomings. For example, Chinese invention patent CN101296227B discloses an IPsec method based on packet offset matching. The VPN protocol deep detection method uses the offset characteristics of SA negotiation response messages to perform protocol parsing and extract VPN key algorithm information from non-standard or forged format messages. However, it implicitly relies on environments with unlimited computing resources or ample dwell time, resulting in a rigid characteristic of the network's preset security filtering depth. This completely decouples it from the linkage mechanism of instantaneous congestion status of the underlying physical channel. Under actual severe working conditions such as micro-burst congestion in industrial control networks, rigid feature matching will inevitably continue to squeeze the message dwell margin. Because it cannot perceive the back pressure of the physical exit queue, it forces a full traversal of matching nodes, ultimately causing long path delays to be directly amplified by physical congestion, resulting in the timeout failure of hard real-time control commands for operational data.

[0004] Therefore, the technical problem to be solved by this invention is how to dynamically calculate and allocate the time budget for security detection based on the real-time congestion status of the physical channel and the message protocol attributes, so as to ensure that the forwarding delay meets the deterministic requirements while ensuring the security of the operation data. Summary of the Invention

[0005] This invention aims to solve the problem of uncertain data forwarding delay caused by random fluctuations in detection time during the security protection process of industrial internet gateways.

[0006] In this technical solution, a security gateway protection system for operational data includes a message outbound transmission and reception module, a time budget calculation module, a matching topology pruning module, and a restricted feature comparison module. The time budget calculation module is used to obtain the service quality identifier bit of the inbound message and match the latency tolerance threshold corresponding to the service quality identifier bit from the pre-stored protocol tolerance mapping matrix. The time budget calculation module collects the inbound time of the inbound message and samples the hardware transmission queue register of the message outbound transceiver module to determine the dynamic queuing delay. Then, it combines the current global clock time, the inbound time and the dynamic queuing delay to calculate the comparison time budget of the inbound message. The matching topology pruning module internally maintains an automaton composed of hierarchical feature nodes. The hierarchical feature nodes are divided into core node sets and secondary node sets according to threat level, and each matching branch in the automaton is associated with the predicted retrieval time. The matching topology pruning module is used to receive the comparison time budget, and when the comparison time budget is lower than the predicted retrieval time of the secondary node set, it generates a topology truncation instruction to block the secondary node set and reconstruct the active matching path of the inbound packet in the current period. The restricted feature comparison module is used to compare the payload features of inbound packets within the active matching path, and output the comparison results and allow the inbound packets to pass before the comparison time budget is exhausted.

[0007] Preferably, it also includes a high-frequency feature migration module, which is used to count the hierarchical feature nodes hit by the restricted feature comparison module within a preset period; when the comparison time budget is lower than the first preset alarm threshold, the high-frequency feature migration module injects the feature hash values ​​of the core node set with a hit frequency exceeding the second preset threshold into the fast forwarding table of the underlying processor, and uses the hardware pipeline to synchronously compare the feature hash values.

[0008] Preferably, it also includes an asynchronous compensation audit module, which is used to copy the payload image of the inbound packet that triggers the topology truncation command; when the system computing load is lower than a preset idle threshold, the asynchronous compensation audit module compares the full features in the payload image, and updates the reputation constraint rules for the source node identifier of the inbound packet when an abnormal feature is hit.

[0009] Preferably, when the time budget calculation module calculates and compares the time budget, it is also used to retrieve reputation constraint rules; if the inbound message matches the reputation constraint rules, the time budget calculation module applies a preset proportional compression factor to the time budget to reduce the time occupied by computing resources.

[0010] Preferably, when determining the dynamic queuing delay, the time budget calculation module includes the following steps: querying the hardware transmission queue register of the message outgoing transceiver module at a preset frequency to read the total number of bytes in the outgoing queue; converting the total number of bytes in the outgoing queue into a baseline queuing time based on the negotiated rate of the physical port of the message outgoing transceiver module; and adding a back pressure compensation factor to the baseline queuing time based on the queue depth increment within the current sampling period to obtain the dynamic queuing delay.

[0011] Preferably, when reconstructing active matching paths, the matching topology pruning module is used to: retain the retrieval branches in the core node set that are fatally destructive to the preset communication protocol; at the same time, according to the remaining proportion of the comparison time budget, shield the secondary node sets at each level from deep to shallow until the predicted retrieval time of the automaton is lower than the comparison time budget.

[0012] Preferably, it also includes a node time-consuming mapping module, which is used to associate and map each logical node in the automaton with the corresponding number of hardware instruction cycles and store them in the retrieval time-consuming lookup table; the matching topology pruning module determines the predicted retrieval time by querying the retrieval time-consuming lookup table.

[0013] Preferably, when the restricted feature comparison module detects a virus feature, it performs tiered processing: if the detected virus feature belongs to the core node set, it blocks the inbound message and generates a fatal alarm signal; if the detected virus feature originates from the secondary node set, it allows the inbound message while sending an abnormal traffic marker to the audit interface.

[0014] Preferably, it also includes a protocol reconstructing and conversion module, which is connected to the output end of the restricted feature comparison module. After outputting the comparison result, it reconstructs the protocol checksum for the inbound message and pushes the inbound message into the sending queue of the message outbound transceiver module.

[0015] Compared with existing technologies, the security gateway protection system for operational data of this invention has the following advantages: 1. In the security gateway protection of operational data, the budget awareness unit, in conjunction with the state machine pruning unit, establishes a computing resource scheduling mechanism based on the latency tolerance characteristics of industrial protocols. By extracting the quality of service flag bit in the packet protocol header, the abstract protocol priority is transformed into a quantified maximum allowed dwell time. Combined with the gateway entry timestamp and the current global clock, the remaining lifecycle of a single packet in the forwarding pipeline is locked in real time. This method makes the computational depth of the security detection engine physically constrained by the effective time of the packet. When the detection time approaches the preset time budget threshold, the system actively truncates the secondary feature node branches in the deterministic finite automaton, ensuring that the operational data can still maintain a deterministic forwarding latency of nanoseconds to milliseconds under the security protection strategy, eliminating the risk of control command failure caused by long path matching backtracking in traditional antivirus logic.

[0016] 2. The budget awareness unit introduces periodic sampling of the hardware queue depth of the egress network card, constructing a negative feedback backpressure logic between physical transmission load and application layer detection depth. The system dynamically estimates the queuing delay of the physical channel by monitoring the instantaneous byte accumulation in the egress queue register, and injects it as a penalty factor into the time budget calculation model. This cross-level dynamic linkage enables the gateway to compensate for the queuing overhead of the physical link by narrowing the automaton search range when facing micro-burst congestion at the network egress, ensuring that core control messages still have outbound priority under adverse channel conditions, thereby solving the channel congestion amplification effect caused by the constant security detection overhead of existing gateways.

[0017] 3. The feature migration unit and the restricted matching unit work together to realize the sinking of high-risk feature matching actions from the application layer to the underlying forwarding table entries. The system injects the identified hot spot feature hash values ​​into the flow table space of the underlying network processing unit by statistically analyzing the node hit frequency of the restricted matching unit in a continuous calculation cycle. This method enables the filtering action of known deadly viruses and the address resolution process of the media access control layer to occur synchronously within the same hardware clock cycle. Under the premise of low computing power consumption, the time budget of the central processing unit is freed up, allowing it to concentrate on processing more complex heterogeneous load features and improve the gateway's defense resilience against sudden unknown security threats. Attached Figure Description

[0018] Figure 1 This is a schematic diagram of the logical interaction principle of the security gateway protection system module of the present invention; Figure 2 This is a schematic diagram of the hardware and software architecture deployment of the security gateway protection system of this invention. Detailed Implementation

[0019] The technical solutions of the embodiments of this application will be clearly described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of this application are within the scope of protection of this application.

[0020] It should be noted that all directional and positional terms used in this invention, such as: up, down, left, right, front, back, vertical, horizontal, inner, outer, top, bottom, transverse, longitudinal, center, etc., are only used to explain the relative positional relationship and connection between components in a specific state (as shown in the accompanying drawings). They are only for the convenience of describing this invention and do not require that this invention be constructed and operated in a specific orientation. Therefore, they should not be construed as limiting this invention. In addition, the descriptions of "first," "second," etc., in this invention are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated.

[0021] In the description of this invention, unless otherwise explicitly specified and limited, the terms installation, connection, and linking should be interpreted broadly. For example, they can refer to fixed connections, detachable connections, or integral connections; they can refer to mechanical connections; they can refer to direct connections or indirect connections through an intermediate medium; they can refer to the internal connection of two components. For those skilled in the art, the specific meaning of the above terms in this invention can be understood according to the specific circumstances.

[0022] In the description of this specification, references to the terms "an embodiment," "some embodiments," "illustrative embodiments," "examples," "specific examples," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example, and the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0023] A security gateway protection system for job data includes a message outbound transmission and reception module, a time budget calculation module, a matching topology pruning module, and a restricted feature comparison module. The time budget calculation module is used to obtain the service quality identifier bit of the inbound message and match the latency tolerance threshold corresponding to the service quality identifier bit from the pre-stored protocol tolerance mapping matrix. The time budget calculation module collects the inbound time of the inbound message and samples the hardware transmission queue register of the message outbound transceiver module to determine the dynamic queuing delay. Then, it combines the current global clock time, the inbound time and the dynamic queuing delay to calculate the comparison time budget of the inbound message. The matching topology pruning module internally maintains an automaton composed of hierarchical feature nodes. The hierarchical feature nodes are divided into core node sets and secondary node sets according to threat level, and each matching branch in the automaton is associated with the predicted retrieval time. The matching topology pruning module is used to receive the comparison time budget, and when the comparison time budget is lower than the predicted retrieval time of the secondary node set, it generates a topology truncation instruction to block the secondary node set and reconstruct the active matching path of the inbound packet in the current period. The restricted feature comparison module is used to compare the payload features of inbound packets within the active matching path, and output the comparison results and allow the inbound packets to pass before the comparison time budget is exhausted.

[0024] Preferably, it also includes a high-frequency feature migration module, which is used to count the hierarchical feature nodes hit by the restricted feature comparison module within a preset period; when the comparison time budget is lower than the first preset alarm threshold, the high-frequency feature migration module injects the feature hash values ​​of the core node set with a hit frequency exceeding the second preset threshold into the fast forwarding table of the underlying processor, and uses the hardware pipeline to synchronously compare the feature hash values.

[0025] Preferably, it also includes an asynchronous compensation audit module, which is used to copy the payload image of the inbound packet that triggers the topology truncation command; when the system computing load is lower than a preset idle threshold, the asynchronous compensation audit module compares the full features in the payload image, and updates the reputation constraint rules for the source node identifier of the inbound packet when an abnormal feature is hit.

[0026] Preferably, when the time budget calculation module calculates and compares the time budget, it is also used to retrieve reputation constraint rules; if the inbound message matches the reputation constraint rules, the time budget calculation module applies a preset proportional compression factor to the time budget to reduce the time occupied by computing resources.

[0027] Preferably, when determining the dynamic queuing delay, the time budget calculation module includes the following steps: querying the hardware transmission queue register of the message outgoing transceiver module at a preset frequency to read the total number of bytes in the outgoing queue; converting the total number of bytes in the outgoing queue into a baseline queuing time based on the negotiated rate of the physical port of the message outgoing transceiver module; and adding a back pressure compensation factor to the baseline queuing time based on the queue depth increment within the current sampling period to obtain the dynamic queuing delay.

[0028] Preferably, when reconstructing active matching paths, the matching topology pruning module is used to: retain the retrieval branches in the core node set that are fatally destructive to the preset communication protocol; at the same time, according to the remaining proportion of the comparison time budget, shield the secondary node sets at each level from deep to shallow until the predicted retrieval time of the automaton is lower than the comparison time budget.

[0029] Preferably, it also includes a node time-consuming mapping module, which is used to associate and map each logical node in the automaton with the corresponding number of hardware instruction cycles and store them in the retrieval time-consuming lookup table; the matching topology pruning module determines the predicted retrieval time by querying the retrieval time-consuming lookup table.

[0030] Preferably, when the restricted feature comparison module detects a virus feature, it performs tiered processing: if the detected virus feature belongs to the core node set, it blocks the inbound message and generates a fatal alarm signal; if the detected virus feature originates from the secondary node set, it allows the inbound message while sending an abnormal traffic marker to the audit interface.

[0031] Preferably, it also includes a protocol reconstructing and conversion module, which is connected to the output end of the restricted feature comparison module. After outputting the comparison result, it reconstructs the protocol checksum for the inbound message and pushes the inbound message into the sending queue of the message outbound transceiver module.

[0032] Example 1: The current security gateway protection system is deployed in a high-speed collaborative robot assembly line environment. It receives inbound packets sent by the underlying programmable logic controller. These inbound packets have a quality of service (QoS) identifier and a latency tolerance threshold in the corresponding protocol tolerance mapping matrix. With a latency of 5ms, the hardware transmission queue register of the outbound message transceiver module experiences data accumulation during the transmission of firmware update packets on the physical channel, resulting in dynamic queuing delay on the egress link. The time budget calculation module reads the inbound message's arrival time. The hardware transmission queue register of the outbound message transceiver module is sampled to determine the dynamic queuing delay. The time budget calculation module calculates and compares the time budget at 3.5ms. The calculation formula is as follows: ,in, To compare time budgets, This is the latency tolerance threshold. This is the current time of the global clock. The arrival time. This is for dynamic queuing delay.

[0033] At the present moment Below, the calculation and comparison time budget The estimated retrieval time is 0.8ms. The matching topology pruning module internally maintains an automaton composed of hierarchical feature nodes. By querying the retrieval time comparison table, the predicted retrieval time for performing full feature matching on the inbound packet payload is determined to be 4.2ms. This predicted retrieval time is greater than the comparison time budget. The matching topology trimming module receives the comparison time budget. By reconstructing the active matching path through the set of secondary nodes in the masked automaton, the prediction retrieval time corresponding to the active matching path is reduced to less than 0.6ms. The restricted feature comparison module compares the inbound packet payload features within the reconstructed active matching path and completes the comparison time budget when it is exhausted. The system outputs the comparison results and allows the inbound message to pass through. The inbound message is pushed into the outbound queue at 4.8ms, which meets the time delay deterministic requirements of the industrial control loop.

[0034] Example 2: The current security gateway protection system is deployed on a physical test platform consisting of a network processing unit, a real-time operating system, and a high-speed industrial Ethernet interface. The test data originates from the physical message flow sequence recorded by the hardware clock. In the test environment, a signal generator actively superimposes Gaussian white noise with a signal-to-noise ratio of 20dB to simulate the electromagnetic environment of the industrial site, and the sampling frequency is set. At that time, the core technical consideration lies in balancing the accuracy of hardware queue depth perception with the system processing load, and the sampling frequency. Based on physical port negotiation rate With average message length The ratio is determined by setting the sampling frequency to be no less than twice the physical link packet forwarding rate to satisfy the sampling theorem. For a data rate of 1Gbps and an average packet length of 128 bytes, the sampling frequency is set as follows: For 2MHz, control group 1 removed the matching topology pruning module; control group 2 removed the sampling logic for the hardware transmission queue register in the time budget calculation module; and control group 3, which exceeded the range, increased the back pressure compensation factor. The back pressure compensation factor was set to 0.4, exceeding the range of the control group four. Set to 3.0.

[0035] After the test was started, the hardware transmission queue register of the message outbound transceiver module accumulated under the impact of sudden traffic surges, and the total number of bytes in the outbound queue increased from 1,500 bytes to 12,000 bytes. The sample of this invention samples the value of this register in real time and calculates the dynamic queuing delay. The calculation and comparison time budget was increased from 0.12ms to 0.98ms. The calculation formula is as follows: (Adjusted from 1.52ms to 0.54ms) ;in, To compare time budgets, This is the latency tolerance threshold. The current time of the global clock. The arrival time. To mitigate dynamic queuing latency, the matching topology pruning module outputs a topology truncation command, reducing the detection time of the restricted feature comparison module from 1.32ms to 0.38ms. In control group one, under the same congestion conditions, due to the lack of a state machine pruning mechanism, its forwarding latency fluctuated from 1.45ms to 6.22ms, with 24.4% of packets exceeding the 5ms threshold. Control group two, lacking physical queuing backpressure feedback, had a significantly reduced calculated comparison time budget. Maintaining a static level of 1.48ms eventually led to a forwarding delay of 5.82ms, causing the servo control commands to fail.

[0036] For back pressure compensation factor Boundary validation shows that when using parameter values ​​from the out-of-range control group three, the system's response sensitivity to queuing increments is insufficient, resulting in a lower comparison time budget during the initial stages of traffic fluctuations. The latency remained at 2.15ms, causing 15.2% of the first batch of packets to time out. When using parameter values ​​from the out-of-range control group four, the system overreacted, blocking secondary node sets even with minor queue disturbances, resulting in a drop in the non-lethal virus interception rate from 92.8% to 12.5%. Experimental data showed that when the dynamic queuing latency... When the performance inflection point of 1.25ms was reached, the sample of this invention compensated for the queuing overhead of the physical link by shrinking the automaton search range, thus stabilizing the packet forwarding latency at 1.36ms, confirming the effectiveness of the backpressure compensation factor. Within the range of 0.5 to 2.5, both security protection depth and forwarding latency can be balanced. This experiment demonstrates the effectiveness of using the underlying physical queuing back pressure to reversely adjust the matching depth, eliminating the risk of control loss of synchronization caused by random fluctuations in detection, and achieving a system-level unification of security defense breadth and industrial real-time depth.

[0037] Example 3: This example combines Figures 1 to 2 Description of the security gateway protection system used for operational data, such as Figure 1As shown, inbound packets carrying a quality of service (QoS) identifier are input to the time budget calculation module. This module calculates and compares the time budget by combining the inbound time with the dynamic queuing delay. The associated protocol tolerance mapping matrix stores the delay tolerance threshold. This time budget calculation module is associated with the outbound packet sending and receiving module by a dotted line. The time budget calculation module points to the matching topology pruning module. The matching topology pruning module is based on a hierarchical feature node automaton containing a core node set and a secondary node set. It determines that the budget is lower than the predicted retrieval time and generates a topology truncation instruction to shield the secondary node set. Then, the restricted feature comparison module compares within the reconstructed active matching path and outputs the result and allows the packet to pass before the budget is exhausted. After the packet is released, it points to the outbound packet sending and receiving module. The outbound packet sending and receiving module maintains a hardware transmission queue register and sends the released inbound packet outbound. Finally, it points to the outbound operation data that meets the deterministic delay requirements.

[0038] like Figure 2 As shown, the programmable logic controller of the node industrial field control station points to the industrial Ethernet (inbound message) and inputs it into the physical node industrial Internet gateway device. The physical node is equipped with a deployment security gateway protection software system. This security gateway protection software system includes a message outbound transmission and reception module, a time budget calculation module, a matching topology pruning module, a restricted feature comparison module, and an asynchronous compensation audit module. Under this architecture, the time budget calculation module is connected to the hardware transmission queue register in the underlying processor hardware layer of the execution environment via an arrow marked with queued backpressure sampling. The underlying processor hardware layer is also configured with a fast forwarding table (hardware pipeline), which is output through the physical node to the deterministic delay physical channel (outbound), and finally delivered to the servo control system of the assembly line at the node industrial operation execution end. When performing hotspot feature sinking, the high-frequency feature migration module continuously intercepts the deep payload of inbound packets using a fixed-length sliding window. It then uses a pre-built hardware hash algorithm to converge variable-length feature fragments into fixed-length feature hash values. This module uses the generated feature hash values ​​as matching keys to directly map and write them into the Content Addressable Memory (TCAM) area in the underlying processor hardware pipeline, which is dedicated to user-defined field verification. This transforms the deep payload features, which originally had no fixed offset, into pseudo-header fields with a fixed format, allowing the underlying hardware pipeline to reuse the standard Media Access Control layer parsing mechanism to perform synchronous line-rate bit-by-bit comparisons.

[0039] Example 4: The current security gateway protection system operates in a high-load IoT boundary environment. The node time-consuming mapping module is used to associate the logical nodes of the automaton with the hardware processing cycle. Its calibration process is as follows: The feature matching action in the anti-virus deterministic finite automaton is decomposed into a basic assembly instruction sequence; the average instruction cycle count of the basic assembly instruction sequence in the network processing unit is obtained using the hardware performance counter, and the ratio of the average instruction cycle count to the global clock frequency is determined as the basic time consumption of a single node; finally, for the matching branch of the automaton, the basic time consumption of all nodes on the path is accumulated to generate a retrieval time comparison table. When the matching topology pruning module performs active matching path reconstruction, the preset anti-virus feature library is decomposed into an atomic instruction-level execution sequence, and the processor's internal hardware performance counter H is used to determine the time consumption of a single node. The PC measures the average number of instruction cycles for a single feature node under the current network processor architecture. This is then converted into a single-node base latency by combining the global clock frequency. Through topological traversal of each matching branch in the automaton, the base latency of each path node is accumulated to generate a retrieval latency lookup table. When generating this lookup table, the system forcibly adds a preset percentage of execution safety margin to the total number of instruction cycles obtained for each accumulation. The width of this margin factor completely covers the extreme execution latency variance caused by pipeline branch prediction failures, cache misses, and bus contention in the processor microarchitecture. This mapping protection mechanism ensures that the theoretical retrieval latency estimated through static instruction set accumulation can serve as an insurmountable absolute upper limit to encompass all abnormal losses during the dynamic execution process of the system, comparing the time budget. Under conditions where the time consumption for full feature matching prediction retrieval is less than that for full feature matching, the system initiates a reverse retrieval from the leaf node to the root node, based on... The remaining proportion, from deep to shallow, masks the logic branches of the secondary node set until the product of the total number of instruction cycles and the system clock cycle corresponding to the reconstructed active matching path is less than... This allows the restricted feature comparison module to complete the core feature traversal and output the comparison results within the physical deadline.

[0040] The time budgeting module determines the dynamic queuing delay using the following logic. The system samples the hardware transmission queue register of the outbound transceiver module at a period of 100μs to obtain the total number of bytes in the outbound queue. And calculate the queue depth increment between adjacent sampling periods. The system retrieves a preset backpressure mapping vector, which defines a monotonically increasing relationship between the queue depth increment and the backpressure compensation factor. The specific calculation formula is as follows: ,in, For dynamic queuing delay, This represents the total number of bytes in the exit queue. Negotiate the speed for the physical port. Let be the back pressure compensation factor, and its calculation satisfies the following relationship: ,in, For queue depth increment, The linear superposition formula, based on the linear bounded arrival process model in network calculus theory, is established with a preset congestion trigger threshold. By extracting the ratio of queue depth increment to maximum tolerance buffer capacity, it accurately quantifies the deterioration slope of instantaneous physical congestion. When the queue depth increment approaches zero, the factor returns to a constant of 1, and the system maintains the basic queuing delay to release the full safety calculus budget. As the bottom queue accumulation approaches the congestion trigger threshold, the factor amplifies the dynamic queuing delay proportionally in a positive direction, forcibly reducing the remaining time budget of the application layer for full matching. Thus, in mathematical logic, a control closed loop is established to rigidly yield the upper-layer complex safety matching time to the lower-layer physical congestion queuing time.

[0041] When the system detects dynamic queuing delay The comparison time budget increases for three consecutive sampling periods and is calculated. When the time taken is less than the maximum branch value in the retrieval time comparison table, the matching topology pruning module initiates active matching path reconstruction: the system locks the fatal and destructive feature branches in the core node set as the retained paths; according to The difference between the total time taken and the branch time is used to mark the bypass nodes in the secondary node set from deep to shallow, starting from the leaf nodes of the automaton. Finally, the matching topology pruning module issues a topology truncation instruction to the restricted feature comparison module. The restricted feature comparison module skips the set of secondary nodes marked as bypasses in the current matching cycle and only traverses the nodes in the retained path. During this skipping process, the matching topology pruning module dynamically rewrites the state transition table of the automaton, forcibly redirecting all transition edges that originally pointed to the secondary nodes marked as bypasses to the initial root node of the automaton or the preset default allow state. This redirection mechanism ensures that when the finite automaton processes the input stream and encounters a truncated matching branch, it can immediately undergo a legal state transition without falling into a search dead loop or causing the pipeline to hang due to link breakage. This maintains the continuity of the overall operation of the state machine in terms of physical and computational logic, allowing the remaining core node set to complete the detection task without interference. The above reconstruction process makes the dwell time of inbound packets inside the gateway constrained by the degree of physical channel congestion, and increases with the total number of bytes in the outbound queue. The system increases the back pressure compensation factor. To reduce the comparison time budget The driving matching topology pruning module masks matching branches from deep to shallow, compensating for the time consumed by single packet detection and physical queuing. This linkage between the underlying physical state and the detection logic eliminates the processing time variance caused by differences in load characteristic distribution in the security detection process, ensuring that servo control commands can still meet the latency tolerance threshold under congested conditions. The delay in forwarding ensures the physical synchronization of industrial production lines.

[0042] Example 5: In the initial deployment scenario of the security gateway protection system, the system performs offline calibration for the latency tolerance characteristics of heterogeneous industrial protocols. This calibration procedure uses a protocol analyzer to capture the communication timing characteristics under stable production line operation. By sequentially applying incremental injection delays to various industrial protocol messages within a controlled test network segment, and monitoring the feedback deviation angle of the servo motor and the response integrity of control commands on the terminal side, when the monitored feedback deviation angle exceeds 0.1 radians or the command response failure rate exceeds 1%, the system records the current injection delay as the critical tolerance value of the protocol. Combined with a 20% safety margin, the latency tolerance threshold corresponding to a specific quality of service (QoS) flag is determined. Finally, the generated correspondence is stored in the protocol tolerance mapping matrix of non-volatile memory as the calculation benchmark of the time budget calculation module.

[0043] When the system faces backpressure perception deviations caused by differences in the hardware characteristics of the egress link, the system implements zero-load baseline verification of the egress network card hardware transmission queue register. This verification procedure includes sampling the hardware queue depth at 1000 sampling points in 10μs steps under no-packet forwarding idle conditions and calculating the arithmetic mean as the static zero bit. Line-speed background traffic conforming to industrial Ethernet standards is injected to simulate a full-load link state. The number of queued bytes when the egress network card experiences physical packet loss is recorded to determine the maximum queueing capacity and the congestion trigger threshold. The value of is determined to be 60% of the maximum queuing capacity, and the back pressure compensation factor is... The value is then established in relation to the queue depth increment. The piecewise linear correspondence is used to determine the dynamic queuing delay. At this time, the gateway egress is in a zero-load state. The hardware transmission queue register value is sampled continuously for 1000 cycles, and the arithmetic mean is set as the static offset zero bit. The rate is negotiated according to the physical port. Rated value, establish the total number of bytes for outbound queuing. Linear mapping relationship with baseline queuing time, back pressure compensation factor Determination method: The signal generator injects background flow in 10% increments, and the queue depth increment is monitored in real time. The curve relating to packet loss rate shows that the queue depth increment is defined as the congestion trigger threshold when the packet loss rate reaches 0.01%. Corresponding back pressure compensation factor Set to 1.5, the time budget calculation module forms a closed-loop queuing delay calculation logic, so that after the system starts up, the time budget calculation module calculates the logic based on the approved benchmark parameter set, maintaining the processing consistency of the protection system on different hardware platforms.

[0044] Example 6: In the operating environment of the security gateway protection system deployed in a smart substation, the asynchronous compensation audit module obtains the inbound packet payload image that triggers the topology truncation command, compares the full characteristics of the payload image, and determines the number of abnormal characteristics found based on the comparison. Cumulative source node reputation score Source node reputation score The initial baseline value is set to 100. If a historical message allowed by the restricted feature comparison module is found to contain a non-fatal signature during asynchronous auditing, the reputation score of the source node will be deducted in increments of 15 points per instance. Time budget calculation module calculates and compares time budgets At that time, the reputation score of the source node for a specific source address is found by retrieving the reputation constraint rules. The warning threshold of below 70 is subsequently adjusted using a proportional compression factor. Comparison of time budget The initial values ​​of the calculation are reduced, and the proportional compression factor is applied. Satisfy the following formula: ,in, This is the proportional compression factor. This is the source node's reputation score.

[0045] When the system encounters a boundary abnormality due to a hardware transfer queue register read failure, the security gateway protection system retrieves the average number of ready tasks from the real-time operating system kernel statistics. This is then used as an input for estimating virtual queuing latency. At this point, the time budgeting module compensates for the missing queue depth increment by monitoring the processor's average load fluctuations within a 10ms window. Specifically, the time budget calculation module extracts the system's average context switching overhead time and multiplies it by the read average number of ready tasks to obtain the estimated total computational latency for processing these concurrent tasks. The system uses the current negotiation rate of the physical port to proportionally convert this estimated total computational latency into an equivalent volume of bytes to be processed. This equivalent volume directly replaces the originally invalidated queue depth increment value, smoothly intervening in subsequent queuing latency calculation logic. If the average number of ready tasks... More than the total number of processor cores The system determines that the current state is one and a half times the back pressure compensation factor, and forcibly adjusts the back pressure compensation factor accordingly. The baseline value is increased by 0.5. Even without direct feedback from the underlying registers, the system still adjusts the active matching path of the automaton through processor saturation. At this point, the dwell time of inbound packets inside the gateway is within the latency tolerance threshold. Within the envelope.

[0046] The embodiments of this application have been described above with reference to the accompanying drawings. Unless otherwise specified, the embodiments and features in the embodiments of this application can be combined with each other. This application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit of this application and the scope of protection of this invention, and all of these forms are within the protection scope of this application.

Claims

1. A security gateway protection system for operational data, characterized in that, This includes a message outbound transmission and reception module, a time budget calculation module, a matching topology pruning module, and a restricted feature comparison module: The time budget calculation module is used to obtain the service quality identifier bit of the inbound message and match the latency tolerance threshold corresponding to the service quality identifier bit from the pre-stored protocol tolerance mapping matrix. The time budget calculation module collects the inbound time of the inbound message and samples the hardware transmission queue register of the message outbound transceiver module to determine the dynamic queuing delay. Then, it combines the current global clock time, the inbound time, and the dynamic queuing delay to calculate the comparison time budget of the inbound message. The matching topology pruning module internally maintains an automaton composed of hierarchical feature nodes. The hierarchical feature nodes are divided into core node sets and secondary node sets according to threat level, and each matching branch in the automaton is associated with the predicted retrieval time. The matching topology pruning module is used to receive the comparison time budget, and when the comparison time budget is lower than the predicted retrieval time of the secondary node set, it generates a topology truncation instruction to block the secondary node set and reconstruct the active matching path of the inbound packet in the current period. The restricted feature comparison module is used to compare the payload features of inbound packets within the active matching path, and output the comparison results and allow the inbound packets to pass before the comparison time budget is exhausted.

2. The security gateway protection system for operational data according to claim 1, characterized in that, It also includes a high-frequency feature migration module, which is used to count the hierarchical feature nodes hit by the restricted feature comparison module within a preset period. When the comparison time budget is lower than the first preset alarm threshold, the high-frequency feature migration module injects the feature hash values ​​of the core node set with a hit frequency exceeding the second preset threshold into the fast forwarding table of the underlying processor and uses the hardware pipeline to synchronously compare the feature hash values.

3. The security gateway protection system for operational data according to claim 1, characterized in that, It also includes an asynchronous compensation audit module, which is used to copy the payload image of the inbound packet that triggers the topology truncation command; when the system computing load is lower than the preset idle threshold, the asynchronous compensation audit module compares the full features in the payload image, and updates the reputation constraint rules for the source node identifier of the inbound packet when an abnormal feature is hit.

4. A security gateway protection system for operational data according to claim 3, characterized in that, When calculating and comparing time budgets, the time budget calculation module is also used to retrieve reputation constraint rules. If an inbound message matches a reputation constraint rule, the time budget calculation module applies a preset proportional compression factor to the time budget to reduce the time spent consuming computing resources.

5. A security gateway protection system for operational data according to claim 1, characterized in that, The time budget calculation module determines the dynamic queuing delay. The steps include: querying the hardware transmission queue register of the outbound message transceiver module at a preset frequency and reading the total number of bytes in the outbound queue; Based on the physical port negotiation rate of the message outbound transceiver module, the total number of bytes in the outbound queue is converted into a baseline queue duration; based on the queue depth increment within the current sampling period, a backpressure compensation factor is added to the baseline queue duration to obtain the dynamic queue delay.

6. A security gateway protection system for operational data according to claim 1, characterized in that, When reconstructing active matching paths, the matching topology pruning module is used to: retain the retrieval branches in the core node set that are fatally destructive to the preset communication protocol; at the same time, according to the remaining proportion of the comparison time budget, the secondary node sets at each level are masked from deep to shallow until the predicted retrieval time of the automaton is lower than the comparison time budget.

7. A security gateway protection system for operational data according to claim 1, characterized in that, It also includes a node time-consuming mapping module, which associates and maps each logical node in the automaton with the corresponding number of hardware instruction cycles and stores them in a retrieval time-consuming lookup table; the matching topology pruning module determines the predicted retrieval time by querying the retrieval time-consuming lookup table.

8. A security gateway protection system for operational data according to claim 1, characterized in that, When the restricted feature comparison module matches a virus feature, it performs tiered processing: if the matched virus feature belongs to the core node set, it blocks the inbound message and generates a fatal alarm signal; if the matched virus feature originates from the secondary node set, it allows the inbound message while sending an abnormal traffic flag to the audit interface.

9. A security gateway protection system for operational data according to claim 1, characterized in that, It also includes a protocol reconstructing and conversion module, which is connected to the output of the restricted feature comparison module. After outputting the comparison results, it reconstructs the protocol checksum for the inbound message and pushes the inbound message into the sending queue of the message outbound transceiver module.

Images