Based on promoting the network security protection system of secondary network equipment

Abstract

The application relates to the technical field of power system network security, and discloses a network security protection system based on promotion of secondary network-involved equipment, which comprises an end-side telemetry agent module, a network-side protocol analysis engine module, a central decision control unit module and a policy execution unit. The system is deployed in a power double-plane redundant network environment, the end-side module establishes a host behavior baseline through a dynamic hook and a process signature, the network-side module analyzes power protocols and tracks session states, the central decision module performs end-to-network behavior atomicity verification and cross-plane business logic consistency comparison, and the policy execution unit executes dynamic access control and physical micro-isolation according to the judgment result. By constructing a physical cause-effect mapping of host process calling and network traffic transmission, cross-plane logic conflicts are identified in real time, and by combining event-driven hook life cycle management, normal operation and malicious injection can be effectively distinguished, so that the full-path trusted transmission of secondary network-involved equipment control instructions is ensured.

Description

Technical Field

[0001] This invention relates to the field of power system network security technology, specifically to a network security protection system for enhancing secondary network-connected equipment. Background Technology

[0002] Power monitoring systems typically employ strict zone management and dual-network redundancy architectures to ensure the reliability of production operations. Traditional protection strategies mainly rely on boundary isolation facilities deployed between different security domains and intrusion detection methods targeting network traffic. Conventional protection measures focus on compliance analysis of network packet formats and payload content based on communication protocols. However, single-dimensional traffic detection mechanisms struggle to verify the legitimacy of command generation sources. When faced with malicious code on the endpoint using legitimate system tools to construct compliant commands, or when attackers intercept historical traffic for replay attacks, network monitoring devices often misjudge such unauthorized operations as normal business behavior.

[0003] For the dual-plane redundant network architecture commonly used in core control areas, existing monitoring mechanisms typically treat the two network planes as independent detection objects. Security analysis strategies lack the ability to verify the consistency of business logic between parallel planes in real time. When attackers inject data or disrupt links in a single network channel, the controlled device often receives instructions based on a first-come, first-served principle, causing abnormal data on one side of the plane to bypass integrity checks. The lack of cross-plane correlation analysis makes it difficult for the system to detect logical conflicts and data tampering behaviors lurking within a single redundant channel.

[0004] Host-level security typically employs resident antivirus software and host intrusion detection agents. These agents often utilize persistent kernel-level hooking techniques to monitor system call behavior. For industrial control servers with extremely high stability requirements during continuous operation, long-term resident kernel interception mechanisms introduce system instability and resource contention risks. Conventional threat response measures rely on updating firewall policies to block internet protocol addresses when anomalies are detected. This logical-level blocking method cannot achieve physical isolation of compromised terminals, leaving the controlled host vulnerable to lateral movement within the same broadcast domain using underlying protocols not controlled by the firewall. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides a network security protection system for enhanced secondary network-connected devices. It solves the problems of existing single-dimensional traffic detection mechanisms being unable to verify the legality and physical causal timing of control command source processes, the lack of real-time verification of cross-channel business logic consistency in dual-plane redundant network architecture leading to one-sided abnormal data bypassing protection, and the impact of traditional resident host monitoring mechanisms on system operational stability and the difficulty of logic blocking strategies in preventing physical layer lateral penetration.

[0006] To achieve the above objectives, the present invention provides the following technical solution:

[0007] This invention provides a network security protection system for secondary network-connected devices. The system is deployed in the production control area of ​​a power monitoring system. The environment adopts a dual-plane redundant structure in terms of physical topology, consisting of a first network plane and a second network plane that are physically isolated and independent of each other.

[0008] The network security protection system for enhanced secondary network-connected devices includes an end-side telemetry agent module, a network-side protocol parsing engine module, a central decision control unit module, and a policy execution unit.

[0009] The endpoint telemetry agent module is installed and runs on the operating system kernel and application layers of the secure zone I server. This module includes a kernel-level hook management unit and a process signature verification unit, used to establish a behavioral baseline on the host side. The kernel-level hook management unit employs a dynamic hook generation and destruction mechanism. Only upon receiving a specific trigger instruction, it registers a temporary interrupt hook at the entry point of a critical sending function in the network communication protocol stack using memory overwrite technology. After the business operation is completed, it performs hook destruction and resource release to reduce the continuous impact on the host system. The process signature verification unit, upon intercepting a function call event, reads the process identifier and memory image of the calling process, extracts the runtime signature digest, compares it with a pre-set whitelist of legitimate processes, and generates an endpoint event report containing the process's legitimacy status and a precise call timestamp. Furthermore, this module also captures interrupt signals from the input / output hardware through a human-machine interaction monitoring unit to verify the manual confirmation attribute of the operation.

[0010] The network-side protocol parsing engine module is connected to the traffic mirroring ports of the first and second network planes, respectively, for full-traffic capture of inbound and outbound data packets in both planes. This module possesses deep packet inspection capabilities for power-specific communication protocols, used to parse packet payload structures and extract application-layer service data units. The module incorporates a second probe unit, which constructs a deterministic finite automaton model based on the atomic operation characteristics of power control protocols. This model identifies control sessions as discrete logical states including idle, locked and awaiting verification, and execution termination, and drives state transitions based on packet type and transmission reason fields, thereby identifying the logical stage of the control command.

[0011] The central decision control unit module is deployed in Security Zone II. It receives data from both the endpoint and network sides via a reverse isolation device and performs logical aggregation and adjudication of multi-source heterogeneous data. This module performs time-axis normalization on all input data using a clock synchronization alignment unit and runs endpoint-network atomic mapping analysis logic. This logic, based on time window constraints, physical causal timing constraints, and process identity constraints, constructs an atomicity verification system to verify whether control commands captured by the network side are generated by authorized legitimate processes on the host side within the specified time window and conform to the first-select-then-execute timing logic. This determines whether traffic replay, man-in-the-middle forgery, or malicious code injection occurs.

[0012] The central decision control unit module also runs dual-plane consistency verification logic to perform real-time comparison of service data between the first and second network planes. This module maps service packets to feature vectors by removing non-essentially different fields from the network and transport layers, and calculates the cryptographic hash digest of the application layer payload. Based on the protocol type, this module automatically adapts to either dual-network dual-transmission verification mode or primary / backup redundancy verification mode. By comparing whether the feature vectors of the two planes are identical or mutually exclusive, it identifies cross-plane logical conflicts, single-plane injection, or link hijacking attacks.

[0013] The policy execution unit performs dynamic network boundary control based on a comprehensive judgment of the end-to-end atomicity verification results and the dual-plane consistency verification results. When the comprehensive judgment result is normal, the unit sends a session persistence instruction to the switching device; when a security threat is detected, the unit executes a multi-level blocking response according to the anomaly type. For network-side anomalies, access control list rules are issued to discard data frames flowing in specific directions; for end-to-end process anomalies, virtual LAN change instructions are issued to allocate the involved server port to an isolation zone at the physical link layer, achieving micro-isolation protection based on software-defined boundaries. The system ensures independent transmission of synchronization clock signals and security verification data among the above modules through an out-of-band management network channel.

[0014] This invention provides a network security protection system for secondary network-connected devices. It has the following beneficial effects: 1. This invention establishes a physical causal mapping between host process behavior and network traffic transmission by temporally associating the interception of kernel-level function calls on the endpoint with deep packet inspection on the network side. It verifies whether control commands originate from authorized process calls and conform to temporal logic, thereby distinguishing normal business operations from malicious code injection and traffic replay attacks. This makes up for the inadequacy of single network boundary protection in verifying the legitimacy of command sources and ensures the credibility of control commands throughout the entire path from generation to transmission.

[0015] 2. This invention utilizes a dual-plane physical redundancy architecture to perform real-time feature vector comparison of transmitted service data. It adapts dual-network dual-transmission equality verification and primary / backup channel mutual exclusion verification modes according to service type. Without relying on the decrypted payload content, it identifies cross-plane logical conflicts, detects data tampering and bypass injection behaviors within a single plane, prevents covert attacks implemented by using redundant channel monitoring blind spots, and ensures the consistency of core service data during transmission.

[0016] 3. This invention employs an event-driven dynamic hook lifecycle management mechanism and a software-defined boundary-based micro-isolation response strategy. It activates kernel monitoring only during the business operation window and forcibly destroys it after the operation ends, maintaining the long-term stability of the host operating system. When an anomaly is detected, it links the switching device to issue a port-level virtual LAN change command, which physically cuts off the connection between the infected host and the business network, thus blocking the lateral spread of threats within the production control area. Attached Figure Description

[0017] Figure 1 This is a schematic diagram of the network security protection system architecture for secondary network-connected devices based on the present invention; Figure 2 This is a schematic diagram of the logical functional component architecture of the present invention; Figure 3 This is a schematic diagram of the protocol state analysis and core verification algorithm logic of the present invention; Figure 4 This is a schematic diagram of the dynamic hook management and integrated decision response logic of the present invention; Figure 5 This is a schematic diagram illustrating the comprehensive decision-making strategy and timing scenario of the present invention; Figure 6 This is a timing diagram illustrating an abnormal attack scenario of the present invention.

[0018] Among them, 101, Security Zone I; 102, Security Zone II; 110, First Network Plane; 111, First Plane Router; 112, First Plane Real-Time Encryption Device; 113, First Plane Real-Time Switch; 120, Second Network Plane; 121, Second Plane Router; 122, Second Plane Real-Time Encryption Device; 123, Second Plane Real-Time Switch; 130, Zone I Server; 140, Zone II Server; 141, Aggregation Switch; 150, Forward Isolation Device; 151, Reverse Isolation Device. Off-device; 200, End-side telemetry agent module; 201, Kernel-level hook management unit; 202, Process signature verification unit; 203, Human-computer interaction monitoring unit; 300, Network-side protocol parsing engine module; 301, First probe unit; 302, Second probe unit; 400, Central decision control unit module; 401, Clock synchronization and alignment unit; 402, End-to-end network atomicity analysis unit; 403, Dual-plane consistency verification unit; 404, Policy execution unit; 500, Out-of-band management network channel. Detailed Implementation

[0019] The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0020] See attached document Figure 1 This invention provides a network security protection system for secondary network-connected devices, which is deployed within the production control area of ​​a power monitoring system.

[0021] The enhanced network security protection system for secondary network-connected equipment includes a production control area network architecture and security protection components superimposed on it. Logically, the production control area network architecture is divided into Security Zone I (101) and Security Zone II (102). Physically, the production control area network architecture adopts a dual-plane redundancy structure, consisting of a first network plane (110) and a second network plane (120). The first network plane (110) and the second network plane (120) are physically isolated and are independent data transmission channels.

[0022] The first network plane 110 includes a first plane router 111, a first plane real-time encryption device 112, and a first plane real-time switch 113. The first plane router 111 is connected to the remote dispatch master station system via a wide area network communication link. The first plane real-time encryption device 112 is connected between the first plane router 111 and the first plane real-time switch 113, and is used to perform encryption and decryption operations on the vertically transmitted data.

[0023] The second network plane 120 includes a second plane router 121, a second plane real-time encryption device 122, and a second plane real-time switch 123. The second plane router 121 is connected to the remote dispatch master station system via a wide area network communication link independent of the first network plane 110. The second plane real-time encryption device 122 is connected between the second plane router 121 and the second plane real-time switch 123, and is used to perform encryption and decryption operations on the vertically transmitted data.

[0024] The network security protection system for enhanced secondary network-connected devices includes a Zone I server 130. Zone I server 130 is deployed within security Zone I 101. Zone I server 130 is equipped with a first network interface card and a second network interface card. Zone I server 130 is connected to a first-plane real-time switch 113 via the first network interface card, and to a second-plane real-time switch 123 via the second network interface card. Zone I server 130 is used to run monitoring and data acquisition applications and process control commands from the first network plane 110 and the second network plane 120.

[0025] To enhance network security protection for secondary network-connected devices, a Zone II server 140 and an aggregation switch 141 are deployed within Security Zone II 102. The Zone II server 140 is connected to the aggregation switch 141. Boundary protection between Security Zone I 101 and Security Zone II 102 is achieved through a forward isolation device 150 and a reverse isolation device 151. The forward isolation device 150 is used for unidirectional data transmission from Security Zone I 101 to Security Zone II 102. The reverse isolation device 151 is used for unidirectional data transmission from Security Zone II 102 back to Security Zone I 101.

[0026] The enhanced network security protection system for secondary network-connected devices includes an end-side telemetry proxy module 200. The end-side telemetry proxy module 200 is installed and runs at the operating system kernel layer and application layer of the I-zone server 130. The end-side telemetry proxy module 200 is used to monitor in real time the process behavior, application programming interface call sequences, and human-computer interaction input events in the memory of the I-zone server 130. The end-side telemetry proxy module 200 has the ability to perform encrypted communication with other components within the enhanced network security protection system for secondary network-connected devices.

[0027] The network security protection system for secondary network-connected devices includes a network-side protocol parsing engine module 300. The network-side protocol parsing engine module 300 includes a first probe unit 301 and a second probe unit 302. The first probe unit 301 is physically connected to the traffic mirroring port of the first plane real-time switch 113, and is used to capture and parse all inbound and outbound data packets of the first network plane 110. The second probe unit 302 is physically connected to the traffic mirroring port of the second plane real-time switch 123, and is used to capture and parse all inbound and outbound data packets of the second network plane 120. The network-side protocol parsing engine module 300 is configured with deep packet inspection functionality, used to parse the packet payload structure of the IEC61850 and IEC104 communication protocols.

[0028] The network security protection system for secondary network-connected devices includes a central decision control unit module 400. The central decision control unit module 400 is deployed in Security Zone II 102 and physically connected to the aggregation switch 141. The central decision control unit module 400 receives end-side monitoring data from the end-side telemetry agent module 200 via a reverse isolation device 151. The central decision control unit module 400 also receives network-side traffic parsing data from the network-side protocol parsing engine module 300 via the reverse isolation device 151. The central decision control unit module 400 is equipped with a computing processor and memory to run the end-to-end atomic mapping analysis algorithm and the dual-plane consistency verification algorithm, and to generate access control policy instructions for the first-plane real-time switch 113 and the second-plane real-time switch 123.

[0029] The network security protection system for secondary network-connected devices includes an out-of-band management network channel 500. This out-of-band management network channel 500 is independent of the service data channels of the first network plane 110 and the second network plane 120. The end-side telemetry agent module 200, the network-side protocol parsing engine module 300, and the central decision control unit module 400 exchange synchronization clock signals and security verification data through the out-of-band management network channel 500. The out-of-band management network channel 500 is used to ensure the independence and anti-interference capability of security monitoring data transmission.

[0030] See attached document Figure 2 This invention provides a network security protection system for secondary network-connected devices, whose logical functional architecture is built on the physical network topology and achieves proactive defense through the collaborative processing of various functional modules.

[0031] The end-side telemetry agent module 200 includes a kernel-level hook management unit 201 and a process signature verification unit 202. The kernel-level hook management unit 201 resides in the operating system kernel space of the I-zone server 130 and is configured with dynamic interception logic for the system call table. The kernel-level hook management unit 201 receives locking instructions from the central decision control unit module 400 and registers temporary interrupt hooks at the network socket sending function entry point according to the locking instructions. The process signature verification unit 202 is connected to the operating system's process control block linked list and is used to read the process identifier and memory image hash value of the calling process when the kernel-level hook management unit 201 captures a function call event. The process signature verification unit 202 compares the extracted process features with a pre-set legitimate process whitelist database and generates an end-side event report containing the process's legitimacy status.

[0032] The edge telemetry agent module 200 also includes a human-machine interaction monitoring unit 203. The human-machine interaction monitoring unit 203 is physically mapped to the input / output hardware interrupt request line of the I-zone server 130. The human-machine interaction monitoring unit 203 is used to capture hardware interrupt signals for mouse click events and keyboard input events. The human-machine interaction monitoring unit 203 records the timestamp of the hardware interrupt and uses this timestamp as physical proof of manual confirmation, merging it into the edge event report.

[0033] The network-side protocol parsing engine module 300 includes a first probe unit 301 and a second probe unit 302. The first probe unit 301 is configured with syntax tree parsing rules for the IEC 61850 and IEC 104 communication standards. The first probe unit 301 is used to fragment and reassemble the raw binary traffic data captured by the first probe unit 301 and the second probe unit 302, and to strip the protocol layer to extract application layer service data units. The second probe unit 302 is connected to the first probe unit 301 and maintains a protocol state machine table for each active TCP session or associated protocol. The second probe unit 302 identifies the logical stage of the control command based on the type identifier field in the application layer service data unit. The logical stages include a selection stage, a preset stage, and an execution stage.

[0034] The central decision control unit module 400 includes a clock synchronization and alignment unit 401, an end-to-end atomicity analysis unit 402, and a dual-plane consistency verification unit 403. The clock synchronization and alignment unit 401 maintains microsecond-level time synchronization with the end-side telemetry agent module 200 and the network-side protocol parsing engine module 300 via a precise time protocol. The clock synchronization and alignment unit 401 is used to perform timeline normalization processing on received end-side event reports and network-side traffic logs.

[0035] The dual-plane consistency verification unit 403 is used to perform real-time comparison of service data from the first network plane 110 and the second network plane 120. The dual-plane consistency verification unit 403 internally defines feature extraction logic for calculating the consistency of data at any given time. Network session feature vector eigenvectors The calculation logic is as follows: ; In the formula, Defined as a 32-bit unsigned integer representation of the source Internet Protocol address; Defined as a 32-bit unsigned integer representation of the destination Internet Protocol address; An enumeration value defined as an application layer communication protocol type; Defined as a business logic sequence number; Defined as a cryptographic hash digest value for application layer business data.

[0036] The dual-plane consistency verification unit 403 compares the feature vectors of the first network plane 110. With the feature vector of the second network plane 120 To determine if they are equal, output a plane-consistent Boolean signal.

[0037] The central decision control unit module 400 includes a policy execution unit 404. The policy execution unit 404 is connected to the outputs of the end-to-end atomicity analysis unit 402 and the dual-plane consistency verification unit 403. The policy execution unit 404 stores a network device management protocol library. Upon receiving an anomaly detection signal, the policy execution unit 404 issues access control list rules to the first-plane real-time switch 113 and the second-plane real-time switch 123 via a simple network management protocol or a network configuration protocol, and issues a virtual LAN change command to the access port corresponding to the I-zone server 130.

[0038] See attached document Figure 3 This invention provides a network security protection system for secondary network-connected devices, wherein the second probe unit 302 in the system constructs a deterministic finite automaton model based on the atomic operation characteristics of the power control protocol.

[0039] For each monitored network-side TCP session instance, the second probe unit 302 initializes an independent protocol state machine instance. The protocol state machine instance is used to maintain the logical phases of the current control session. The second probe unit 302 defines power system control operations as three discrete states: idle state, locked pending verification state, and execution terminated state. The idle state indicates that there is no active control command sequence within the current session channel. The locked pending verification state indicates that the network-side protocol parsing engine module 300 has captured a selection-type message but has not yet captured an execution-type message. The execution terminated state indicates that the network-side protocol parsing engine module 300 has captured either an execution-type message or a cancellation-type message.

[0040] The second probe unit 302, in accordance with the IEC 61850 Manufacturing Message Specification Communication Standard, maps the Confirmed-Request-PDU service primitive in the application layer service data unit to input events for state transitions. When the second probe unit 302 detects a message with a service type of Select or SelectWithValue, it marks the input event as... When the second probe unit 302 detects a message with a service type of Operate, it marks the input event as... When the second probe unit 302 detects a message with a service type of Cancel, it marks the input event as... .

[0041] The second probe unit 302 parses the transmission reason field in the application layer protocol data unit according to the IEC104 telemetry protocol standard. When the second probe unit 302 detects that the transmission reason field is active and the transmission reason is 6, it marks the input event as... The second probe unit 302 identifies that the transmission reason field is active and the transmission reason is 6. Simultaneously, when the qualifier in the application protocol data unit contains an execution confirmation flag, it marks the input event as... .

[0042] The second probe unit 302 calculates the state value at the next moment using a state transition function. The state transition function is defined as follows: ; In the formula, Defined as the state value of the protocol state machine instance at the current moment, the value range includes the idle state. Locked pending verification status ; Defined as the state value of the protocol state machine instance at the next moment; Defined as the input event type of the currently captured network packet, the set of values ​​includes , and ; Defined as the time period that has elapsed since the last state change.

[0043] The specific state transition logic executed by the second probe unit 302 is as follows: When for And the input event is hour, Change to Simultaneously, the second probe unit 302 triggers the action of sending a lock command to the central decision control unit module 400. for And the input event is At that time, the second probe unit 302 determines that the current instruction sequence conforms to the protocol specification, triggers the atomicity verification process, and then... Reset to .

[0044] The second probe unit 302 introduces a timeout reset mechanism to prevent state deadlock. When In Status, and time period Exceeding the preset maximum protocol waiting time limit At that time, regardless of the type of input event, the state transition function Forced Change to The second probe unit 302 generates and records a state machine timeout exception log when performing a timeout reset operation. Maximum protocol wait time limit. The value is set according to the remote control operation timeout time specified in the power industry standard.

[0045] See attached document Figure 4 This invention provides a network security protection system for secondary network-connected devices, wherein the system performs event-driven hook lifecycle management through the end-side telemetry agent module 200.

[0046] After receiving the lock trigger signal from the network-side protocol parsing engine module 300, the central decision control unit module 400 sends an atomic lock generation command to the I-zone server 130 through the out-of-band management network channel 500. The atomic lock generation command includes the target protocol port number and the expected response time window parameter. The kernel-level hook management unit 201 in the end-side telemetry agent module 200 receives the atomic lock generation command and initiates the hook injection process.

[0047] The kernel-level hook management unit 201 locates the addresses of critical sending functions in the operating system's network communication protocol stack. For the Windows-based I-zone server 130, the critical sending functions include the `send` and `WSASend` functions from the Winsock library. For the Linux-based I-zone server 130, the critical sending function includes the `socket_send` function from the libc library. The kernel-level hook management unit 201 uses memory overwriting technology to modify the entry address of the critical sending functions to a preset jump address, thus completing the hook registration operation.

[0048] After hook registration is complete, the system enters a waiting state. When any process within the I-zone server 130 calls the hooked critical send function, the program execution flow is redirected to the interception logic of the kernel-level hook management unit 201. The kernel-level hook management unit 201 temporarily suspends the calling process thread and triggers the process signature verification unit 202.

[0049] Process signature verification unit 202 reads the process control block information of the calling process and extracts the process identifier. The process signature verification unit 202 performs a hash operation on the memory image file of the process executable file to generate a runtime signature digest. The process signature verification unit 202 will generate a runtime signature digest. The set of legal processes stored locally Compare them.

[0050] The kernel-level hook management unit 201 generates a hook state vector based on the comparison results. Hook state vector The definition is as follows: ; In the formula, Defined as a hook consumption status flag, this value is set to 1 when a function call is intercepted, and 0 otherwise; Defined as the system's absolute timestamp at the time the interception occurred; Defined as the result of process validity verification, when Belongs to set The value is set to 1 if the condition is met, and 0 otherwise.

[0051] The end-side telemetry agent module 200 will generate the hook state vector After encapsulation, the data is sent to the central decision control unit module 400. Subsequently, the kernel-level hook management unit 201 performs a hook destruction operation. The hook destruction operation includes restoring the entry address of the critical sending function to its original system address and releasing the relevant memory resources.

[0052] If no function call is detected within the time specified by the expected response time window parameter, the kernel-level hook management unit 201 receives a timeout cleanup command from the central decision control unit module 400. The kernel-level hook management unit 201 forcibly executes the hook destruction operation and resets the hook state vector. In Setting it to 0 indicates that the hook has not been consumed. This mechanism ensures that the host operating system remains in a clean state without hooks residing during periods of no business operation, avoiding the system stability risks caused by long-term hooking.

[0053] See attached document Figure 3 Furthermore, this system utilizes the end-to-end atomicity analysis unit 402 to perform logical adjudication on the integrity and legality of control commands.

[0054] The end-to-end atomicity analysis unit 402 is located within the central decision-making and control unit module 400. The end-to-end atomicity analysis unit 402 is configured with a data receiving interface for receiving protocol status event data containing network packet timestamps from the network-side protocol parsing engine module 300, and for receiving hook status vectors containing hook trigger timestamps and process verification results from the end-to-end telemetry agent module 200. The end-to-end atomicity analysis unit 402 performs timing normalization processing, mapping all input timestamp data to the same system reference time axis.

[0055] The terminal network atomicity analysis unit 402 analyzes each control command to be verified. Construct an atomicity verification function This function performs Boolean operations based on time window constraints, physical causal timing constraints, and process identity constraints. (Atomicity verification function) The expression is as follows: ; In the formula, Defined as the absolute timestamp of the selection class message captured by the network-side protocol parsing engine module 300 on one or two planes; Defined as the absolute timestamp of the subsequent execution-type message captured by the network-side protocol parsing engine module 300; Defined as the absolute timestamp when the end-side telemetry agent module 200 detects that the host's critical transmission function has been called; Defined as the preset maximum allowable delay threshold for protocol operation, which is set according to the communication protocol of the power monitoring system; Defined as a process legitimacy flag, its value is derived from the legitimacy verification result field in the aforementioned hook state vector.

[0056] Terminal network atomicity analysis unit 402 based on The calculation result outputs a verification signal. When the calculation result is 1, the terminal network atomicity analysis unit 402 outputs a legality confirmation signal, indicating that the control command was triggered by a legal selection message and that the corresponding network transmission behavior was generated by an authorized host process within a specified time, and that the physical timing conforms to causal logic.

[0057] When the calculation result is 0, the terminal network atomicity analysis unit 402 outputs an abnormal alarm signal and further determines the attack type based on parameter characteristics. If the conditions are met... and However, within the time range There is no corresponding one inside. The data, analyzed by the end-to-end atomicity analysis unit 402, indicates that the behavior constitutes a traffic replay attack or a man-in-the-middle forgery attack. This determination is based on the physical fact that the generation of network traffic depends on function calls in the host's memory. If there is only network traffic without any host call records, then the traffic was not originally sent by the host.

[0058] If satisfied and The terminal network atomicity analysis unit 402 determines that the behavior belongs to malicious code injection attack or unauthorized process operation. The physical fact on which this determination logic is based is that although the network sending behavior is generated by the host, the process fingerprint that triggered the behavior is not within the system's allowed whitelist.

[0059] The end-to-end atomicity analysis unit 402 sends the verification signal and attack type determination result to the policy execution unit 404 as the basis for subsequent blocking or allowing policy decisions. The end-to-end atomicity analysis unit 402 also sends the triplet data of the abnormal event. Write to the immutable audit log storage area.

[0060] See attached document Figure 4 The system further utilizes the dual-plane consistency verification unit 403 to perform real-time feature vectorization processing on the service packets transmitted in the first network plane 110 and the second network plane 120.

[0061] The dual-plane consistency verification unit 403 is connected to the data output port of the network-side protocol parsing engine module 300. The dual-plane consistency verification unit 403 is equipped with a feature extractor, which processes first-plane traffic data from the first probe unit 301 and second-plane traffic data from the second probe unit 302 in parallel. The feature extractor discretizes the continuous network bit stream into independent protocol data units, and for each protocol data unit, strips the physical layer frame header and link layer frame header, retaining the network layer header, transport layer header, and application layer payload.

[0062] The dual-plane consistency verification unit 403, based on a preset fingerprint extraction algorithm, verifies any protocol data unit. Mapped to a fixed-length feature vector This mapping process aims to transform variable-length business messages into a set of values ​​that can be used for mathematical comparison, while ignoring changes in non-business fields caused by differences in network paths. Feature Vector The calculation formula is defined as follows: ; In the formula, Defined as a 32-bit unsigned integer representation of the source Internet Protocol address, used to identify the host device sending control commands; Defined as a 32-bit unsigned integer representation of the destination Internet Protocol address, used to identify the controlled device receiving the instruction; This enumeration value is defined as the type of application layer communication protocol. The system classifies this value into MMS protocol, GOOSE protocol or IEC104 protocol based on the port number and message header characteristics. Defined as a business logic sequence number.

[0063] For MMS messages carried by the Transmission Control Protocol, The value is a combination of the sequence number field value in the TCP header and the InvokeID field value in the MMS application layer. This applies to GOOSE packets directly encapsulated in Ethernet. The value is taken from the sqNum status sequence number field in the application protocol data unit. Used to uniquely identify the logical order of the instruction on the timeline, it is a key parameter for determining the synchronization of dual-plane transmission.

[0064] Defined as the cryptographic hash digest value of application layer business data. The dual-plane consistency verification unit 403 uses a secure hash algorithm to verify the complete binary sequence of the application layer service data unit. Perform the calculation. The logical expression for calculating the digest value is as follows: ; In the formula, This represents the standard SHA-256 hash function; The system contains specific parameters for the control command, including the reference address of the operand, the type of control action, and setpoint parameters. By calculating a hash digest, the dual-plane consistency verification unit 403 compresses a business command of arbitrary length into a fixed-length 256-bit string. This process ensures that even if the routing paths and time-to-live fields of the two network planes are different, as long as the business logic content they carry is consistent, the calculated hash digest will still be valid. The values ​​must be strictly equal.

[0065] The dual-plane consistency verification unit 403 performs protocol field filtering during the extraction process. The feature extractor ignores the Time-to-Live (TTL) and Type of Service (CTS) fields in the network layer header, and the checksum field in the transport layer header, and does not include them in the feature vector. The calculation range. This filtering operation eliminates the non-essential differences between the first network plane 110 and the second network plane 120 caused by differences in network device hop counts or processing latency, ensuring the feature vector It only represents the consistency of core business logic.

[0066] See attached document Figure 4 This system utilizes a dual-plane consistency verification unit 403 to perform logical integrity judgment based on a network redundancy architecture.

[0067] The dual-plane consistency verification unit 403 is connected to the network-side protocol parsing engine module 300. The dual-plane consistency verification unit 403 has a built-in time-aligned buffer queue. Due to slight differences in the physical link lengths and switching equipment processing delays between the first network plane 110 and the second network plane 120, the absolute times at which the same service command arrives at the first probe unit 301 and the second probe unit 302 are different. The dual-plane consistency verification unit 403 sets a time sliding window. The dual-plane consistency check unit 403 operates within a time sliding window. Within the scope, retrieve and match feature vectors that have the same source Internet Protocol address and the same business logic sequence number.

[0068] Dual-plane consistency verification unit 403 according to application layer communication protocol type The verification modes are divided into dual-network dual-transmission verification mode and primary / backup redundancy verification mode. The dual-plane consistency verification unit 403 reads the protocol type identifier from the feature vector. When the protocol type identifier is GOOSE or SV sampled value protocol, the dual-plane consistency verification unit 403 activates the dual-network dual-transmission verification mode. When the protocol type identifier is MMS manufacturing message specification protocol, the dual-plane consistency verification unit 403 activates the primary / backup redundancy verification mode.

[0069] In the dual-network dual-transmission verification mode, the dual-plane consistency verification unit 403 performs equality verification. This mode is based on the principle of power system parallel redundancy protocol, that is, the sender simultaneously sends identical messages on two physical planes. The dual-plane consistency verification unit 403 compares the feature vectors of the first network plane 110. With the feature vector of the second network plane 120 If all components of two vectors are exactly equal, the physical transmission path is considered reliable. If the two vectors differ, including inconsistent payload hash values ​​or data loss in a certain plane, it is considered a link hijacking or single-plane injection attack.

[0070] In the primary / standby redundancy verification mode, the dual-plane consistency verification unit 403 performs mutual exclusion verification. This mode is based on the primary / standby channel switching principle of the power monitoring system, meaning that only one network plane carries active control services at any given time. The dual-plane consistency verification unit 403 monitors the traffic of the standby plane, which is currently inactive. If the primary plane transmits a feature vector containing control commands... Meanwhile, the backup plane simultaneously exhibits feature vectors containing control semantics. The system determined this to be an abnormal double-shot or replay attack.

[0071] The dual-plane consistency check unit 403 utilizes the plane consistency function A unified mathematical description and calculation are performed for the two modes described above. Planar consistency function. The definition is as follows: ; In the formula, Defined as a verification mode identifier; This represents a dual-network, dual-transmission verification mode; This represents the primary / standby redundancy verification mode; Defined as a sliding window in time The non-empty feature vector extracted from the first network plane 110; Defined as a sliding window at the same time Feature vectors extracted from the second network plane 120; symbol This indicates that all corresponding elements of two vectors have the same value; (symbol) This indicates a zero vector or an invalid payload vector containing only link maintenance heartbeat messages.

[0072] The dual-plane consistency check unit 403 outputs a logic level signal based on the calculation result. When When the calculation result is 1, it indicates that the current service transmission conforms to the expected behavior specification of the dual-plane physical architecture, and the dual-plane consistency verification unit 403 sends a cooperative verification pass signal to the policy execution unit 404. When the calculation result is 0, it indicates that a cross-plane logical conflict has been detected, and the dual-plane consistency verification unit 403 generates a plane abnormal interruption request.

[0073] against and In case of an anomaly, the dual-plane consistency verification unit 403 further initiates out-of-band active probing logic. The dual-plane consistency verification unit 403 sends a very low-priority status read message to the target device through the second network plane 120, and uses the protocol stack response latency of the target device to help determine whether the abnormal traffic on the backup plane originates from a real physical device or a simulated response from a man-in-the-middle attack tool. This active probing result serves as... The auxiliary verification parameters of the calculation results are stored in the security audit database.

[0074] See attached document Figure 5 This invention provides a network security protection system for secondary network-connected devices. The system utilizes a central decision control unit module 400 to logically aggregate and make final decisions on multi-source heterogeneous security verification data.

[0075] The central decision control unit module 400 is equipped with a logic processor. The logic processor is connected to the output registers of the end-to-end atomicity analysis unit 402 and the dual-plane consistency verification unit 403, respectively. The logic processor is used to synchronously read the end-to-end atomicity verification results and the dual-plane consistency verification results during the lifecycle of each control instruction.

[0076] The logic processor constructs a comprehensive admission decision function based on the principles of a zero-trust security model. This function uses Boolean logic operations to forcibly associate the process behavior characteristics of the physical world with the traffic transmission characteristics of the network world. (Comprehensive Admission Decision Function) The mathematical expression for is defined as follows: ; In the formula, Defined for control commands The set of values ​​for the end-to-end atomicity verification result variable is as follows: The variables in the terminal network atomicity verification result are derived from the output values ​​calculated by the terminal network atomicity analysis unit 402 based on the time window constraints and process signature constraints. Defined as for the same control command The set of values ​​for the biplane consistency verification result variable is as follows: This variable originates from the output value calculated by the dual-plane consistency verification unit 403 based on the feature vector comparison logic; symbol Defined as the logical AND operator.

[0077] The central decision control unit module 400 is based on the comprehensive access decision function. The calculation results generate the final system defense status signal. Only when... and When both are 1, The calculation result is 1. At this time, the central decision control unit module 400 determines that the current control command is a legal operation, which has both legal process authorization on the host side and dual-plane physical integrity on the network side.

[0078] when 0 or When it is 0, The calculation result is 0. At this point, the central decision control unit module 400 determines that a security threat exists. The status register inside the central decision control unit module 400 classifies and marks the threat type according to different combinations of input sources.

[0079] when and When this occurs, the status register is marked as an abnormal process or timing violation on the client side, indicating that the attack source is malicious code injection or illegal operation of automated scripts inside the host. and When this occurs, the status register is marked as a network-side link anomaly, indicating that the attack source is a man-in-the-middle attack or traffic spoofing targeting a specific network plane.

[0080] The central decision control unit module 400 will calculate the... The threat classification flags in the numerical and status registers are transmitted to the policy execution unit 404 in real time. The policy execution unit 404 will... This comprehensive decision-making mechanism serves as the sole logical basis for triggering network blocking actions or allowing trusted traffic. It ensures that the system can avoid missed or false alarms due to blind spots in a single detection dimension when facing complex network attacks.

[0081] See attached document Figure 5 This system utilizes the policy execution unit 404 to perform dynamic network boundary control and host micro-isolation operations based on the comprehensive judgment results.

[0082] The policy execution unit 404 is connected to the logic processing processor of the central decision control unit module 400. The policy execution unit 404 maintains a dynamic access control policy table, which maps to the hardware forwarding table entries of the first plane real-time switch 113 and the second plane real-time switch 123. The policy execution unit 404 reads the comprehensive admission decision function in a polling manner. The numerical status and accompanying threat classification markers.

[0083] When read When the value is 1, the policy execution unit 404 determines that the current control command sequence is a legitimate service. The policy execution unit 404 sends session persistence instructions to the first plane real-time switch 113 and the second plane real-time switch 123. The session persistence instructions are used to refresh the aging time counter in the flow table of the switches to ensure that the parameter configuration messages and execution confirmation messages following the control command can be forwarded normally within the preset session lifecycle.

[0084] When read When the value is 0, the policy execution unit 404 immediately initiates a multi-level blocking response process. The policy execution unit 404 first extracts the source Internet Protocol address from the exception control command. and destination Internet Protocol address The policy enforcement unit 404 constructs access control list update request packets for the first-plane real-time switch 113 and the second-plane real-time switch 123 according to the standard format of Simple Network Management Protocol version 3. The access control list update request packet contains a high-priority drop rule, which instructs the switch to directly drop packets with the source address specified in the physical layer port. And the destination address is All inbound data frames.

[0085] After issuing the access control list, policy enforcement unit 404 further checks the threat classification flags. If the threat classification flags indicate an anomaly type of endpoint process anomaly or timing violation, policy enforcement unit 404 performs port-based micro-segmentation. Policy enforcement unit 404 queries the network topology database to retrieve the source Internet Protocol address. The physical port number of the switch to which the associated Zone I server 130 is connected.

[0086] The policy enforcement unit 404 sends a virtual LAN configuration change command to the corresponding access switch. The configuration change command modifies the default virtual LAN identifier of the target physical port to a preset isolation zone identifier. Through this operation, the policy enforcement unit 404 isolates the involved zone I server 130 from the business network plane of the production control zone at the physical link layer, preventing its traffic from reaching any other business host or monitoring and control device, thereby achieving micro-isolation of the controlled host.

[0087] While performing the aforementioned blocking and isolation operations, the policy execution unit 404 generates a security event audit report. The audit report includes the timestamp of the event, the logical basis for triggering the blocking, the address information of the attack source, and the physical location information of the isolated host. The policy execution unit 404 sends the audit report to the upper-level security management platform through the out-of-band management network channel 500, and simultaneously triggers the control interface of the local audible and visual alarm device.

[0088] See attached document Figure 5 and appendix Figure 6 This invention provides an application scenario based on improving the network security protection system for secondary network-connected devices, which is set in the physical environment of Security Zone I 101 in the production control area.

[0089] The scenario is defined as an operator remotely tripping a circuit breaker device in the field via Zone I server 130. Zone I server 130 serves as a human-machine interface terminal and control command initiation node, running a power monitoring system client application. Zone I server 130 is physically connected to the first plane real-time switch 113 via a first network interface card, and physically connected to the second plane real-time switch 123 via a second network interface card.

[0090] In this scenario, the communication between the Zone I server 130 and the field monitoring and control device follows the IEC 61850 manufacturing message specification standard. The control logic follows the SBO (Select-Before-Execution) model defined in the standard. The first network plane 110 is configured as the primary communication channel carrying the MMS protocol, and the second network plane 120 is configured as a redundant backup channel.

[0091] The end-side telemetry agent module 200 resides in the operating system memory of server 130 in zone I and is in an active monitoring state. The end-side telemetry agent module 200 has obtained handle access permissions to the power monitoring system client process and has established monitoring hooks for the underlying network socket functions.

[0092] The network-side protocol parsing engine module 300 is in full-traffic mirroring monitoring mode. The first probe unit 301 continuously receives inbound and outbound data streams from the first plane real-time switch 113. The second probe unit 302 continuously receives inbound and outbound data streams from the second plane real-time switch 123.

[0093] The central decision control unit module 400 maintains a connection with the end-side telemetry agent module 200 and the network-side protocol parsing engine module 300 through the out-of-band management network channel 500. The second probe unit 302 inside the central decision control unit module 400 handles all associated session state variables at the initial moment of the scenario. Initialize to idle state Comprehensive admission decision function The output value is initially set to a logic low level.

[0094] See attached document Figure 5 The invention also demonstrates the normal remote control operation sequence. It provides a network security protection system for secondary network-connected devices, whose workflow under normal business scenarios follows a strict time-series logic.

[0095] The process begins with an operator triggering a selection command on the human-machine interface of the I-zone server 130. The application layer process of the I-zone server 130 generates a Select-Request message conforming to the MMS protocol specification and sends it to the first network plane 110 via the first network interface card. The first plane real-time switch 113 forwards the message to the first probe unit 301. The first probe unit 301 captures the message and marks the capture timestamp. .

[0096] The network-side protocol parsing engine module 300 parses the Select-Request message and identifies its service type. The second probe unit 302 records the current session's state variables. From idle state Change to locked pending verification status The network-side protocol parsing engine module 300 will then contain... The lock trigger signal for the session quintuple information is sent to the central decision control unit module 400.

[0097] Upon receiving the lock trigger signal, the central decision control unit module 400 immediately sends an atomic lock generation command to the end-side telemetry agent module 200 via the out-of-band management network channel 500. The kernel-level hook management unit 201 within the end-side telemetry agent module 200 responds to this command, writing a jump instruction at the Winsock library entry point of the I-zone server 130 to complete hook registration. At this point, the system enters a pre-operation waiting window.

[0098] The operator clicks the execute button on server 130 in zone I. The operating system of server 130 captures the mouse hardware interrupt signal. The human-computer interaction monitoring unit 203 records the timestamp of the interrupt. The application layer process then calls the hooked send function to send an Operate-Request message. The program execution flow triggers the interception logic of the kernel-level hook management unit 201.

[0099] The kernel-level hook management unit 201 records the absolute timestamp of the interception. The process signature verification unit 202 synchronously reads the memory image of the process that initiated the call and calculates the runtime signature digest. And compare it with the whitelist to confirm. The value is 1. The end-side telemetry agent module 200 generates a value containing... , and hook consumption label The hook state vector is then sent to the central decision control unit module 400. Subsequently, the kernel-level hook management unit 201 releases the intercepted execution flow, allows the Operate-Request message to be sent, and immediately performs a hook destruction operation to restore the memory to its original state.

[0100] The first probe unit 301 captures the Operate-Request message on the first network plane 110 and marks the capture timestamp. The network-side protocol parsing engine module 300 reports this event to the central decision control unit module 400.

[0101] The terminal network atomicity analysis unit 402 within the central decision control unit module 400 performs atomicity verification. The terminal network atomicity analysis unit 402 reads timestamp data and verifies the inequality. Established, and the verification time difference Less than the preset threshold At the same time, confirm The value is 1. Based on the aforementioned atomicity verification function, the terminal network atomicity analysis unit 402 obtains... The calculation result is 1.

[0102] Meanwhile, the dual-plane consistency verification unit 403 performs a consistency check. In this MMS master-slave mode scenario, the dual-plane consistency verification unit 403 detects that the first network plane 110 has a valid Operate feature vector. The second network plane 120, acting as a backup plane, did not detect any corresponding control service traffic within the same time window. It is an empty set. Based on the aforementioned plane consistency function, the biplane consistency check unit 403 obtains... The calculation result is 1.

[0103] The logic processor within the central decision control unit module 400 reads the two verification results and executes a comprehensive access decision. Because =1 and =1, comprehensive admission decision function The output value is 1.

[0104] Policy execution unit 404 received Upon receiving the signal, the remote control operation is determined to be a legitimate and secure normal service. The policy execution unit 404 sends a flow table refresh command to the first plane real-time switch 113 to reset the aging time of the session, ensuring that subsequent Operate-Response and Terminator-Request messages can pass smoothly. The central decision control unit module 400 generates a normal audit log, recording the time parameters and verification results of the entire process, completing the closed-loop control of this normal operation process.

[0105] See attached document Figure 6This invention provides an abnormal response process based on improving the network security protection system for secondary network-connected devices. This process demonstrates the system's comprehensive judgment and defense logic when facing host-side malware attacks and network-side traffic replay attacks.

[0106] In the first abnormal scenario, the I-zone server 130 is infected with malware that masquerades as a legitimate control program and attempts to send execution commands to field devices. The malware process directly calls the operating system's network protocol stack's send function without following proper human-machine interaction confirmation steps. At this point, the kernel-level hook management unit 201 within the end-side telemetry proxy module 200 captures this system call event and records the hook trigger timestamp. Subsequently, the process signature verification unit 202 reads the memory image of the malicious process that initiated the call and calculates its hash value. Since the hash value of this malicious process does not exist in the pre-set legitimate process whitelist database, the process signature verification unit 202 verifies the process's legitimacy. Set to 0. The end-side telemetry agent module 200 generates a function containing... The abnormal hook state vector is obtained and sent to the central decision control unit module 400.

[0107] Meanwhile, the Operate-Request message crafted by the malware is sent to the first network plane 110 via the network interface card of the I zone server 130. The first plane real-time switch 113 forwards the message, and the first probe unit 301 captures the message and marks it with a network capture timestamp. The network-side protocol parsing engine module 300 will process the protocol parsing results and... The report is submitted to the central decision-making and control unit module 400. The terminal network atomicity analysis unit 402 executes the atomicity verification function. The calculation. Although the time logic satisfies However, due to the input parameters According to the definition of the atomicity verification function, the calculation result is... It is 0.

[0108] The logic processor within the central decision control unit module 400 operates based on the comprehensive admission decision function. To perform calculations, because , and thus The system detects the blocking conclusion and marks the threat type as an abnormal end-side process. Policy enforcement unit 404 reads the decision and immediately issues an ACL drop rule for the session to the first-plane real-time switch 113. Simultaneously, based on the micro-segmentation response policy, policy enforcement unit 404 sends a Virtual LAN change command to the first-plane real-time switch 113, assigning the physical port connected to zone I server 130 to an isolated VLAN. This physically disconnects the infected host from the production network, preventing lateral spread of the threat.

[0109] In the second abnormal scenario, the attacker accesses the first network plane 110 and replays intercepted historical normal control messages. The first probe unit 301 captures the replayed message and records the timestamp. At this time, the I zone server 130 is in a silent state, and no process in its memory is calling the network sending function. Therefore, the end-side telemetry agent module 200 will not generate any hook trigger events, nor will it send hook status vectors to the central decision control unit module 400.

[0110] The end-to-end atomicity analysis unit 402 of the central decision control unit module 400 receives the report from the network-side protocol parsing engine module 300. After the data is collected, within the preset time window... Internal search corresponding Data. Since the search results were empty, the terminal network atomicity analysis unit 402 determined that the physical causal time chain was broken, and the atomicity verification function... The calculation result is 0. The logic processor outputs... The threat type is then marked as a network-side link anomaly. Based on this, the policy enforcement unit 404 identifies that the traffic does not originate from the legitimate Zone I server 130, and subsequently issues an instruction to block the transmission path of the replay traffic and generates a high-level security alert log.

Claims

1. A network security protection system for secondary network-connected equipment, wherein the system is deployed in the production control area of ​​a power monitoring system, and the production control area adopts a dual-plane redundant structure composed of a first network plane and a second network plane, characterized in that... include: The server in Zone I is equipped with a first network interface card and a second network interface card, which are respectively connected to the first network plane and the second network plane. The edge telemetry agent module runs on the server in Zone I and is used to monitor memory process behavior, application programming interface call sequence and human-computer interaction input events. The network-side protocol parsing engine module includes a first probe unit and a second probe unit, which are used to capture and parse dual-plane data packets and IEC61850 and IEC104 communication protocol payloads. The central decision control unit module, deployed in Security Zone II, is used to receive end-side monitoring data from the end-side telemetry agent module and network-side traffic parsing data from the network-side protocol parsing engine module through the reverse isolation device, run the end-to-network atomic mapping analysis algorithm and the dual-plane consistency verification algorithm, and generate access control policy instructions.

2. The network security protection system for secondary network-connected devices according to claim 1, characterized in that, The endpoint telemetry agent module includes a kernel-level hook management unit and a process signature verification unit; The kernel-level hook management unit is used to register temporary interrupt hooks at the entry point of the network socket sending function and suspend the process thread that initiated the call when a function call event is captured. The process signature verification unit is used to read the process identifier and memory image hash value of the process that initiated the call, and compare the extracted process features with the legitimate process whitelist database.

3. The network security protection system for secondary network-connected devices according to claim 1, characterized in that, The end-side telemetry agent module also includes a human-computer interaction monitoring unit, which is used to capture hardware interrupt signals of mouse click events and keyboard input events, and record the timestamp of the hardware interruption.

4. The network security protection system for secondary network-connected devices according to claim 1, characterized in that, The network-side protocol parsing engine module also includes a second probe unit, which is used to maintain protocol state machine instances. The protocol state machine instance includes an idle state, a locked-to-verify state, and an execution-terminated state. The second probe unit is used to change to a locked verification state and trigger the sending of a lock command when it is in an idle state and a selection class message is captured, and to trigger an atomic verification process when it is in a locked verification state and an execution class message is captured.

5. The network security protection system for secondary network-connected devices according to claim 1, characterized in that, The central decision control unit module includes an end-to-end atomicity analysis unit, which is used to receive protocol status event data containing network packet timestamps and hook status vectors containing hook trigger timestamps, and perform timing normalization processing. The terminal network atomicity analysis unit is used to verify whether the timestamps of the network side capturing selection class messages, the timestamps of the terminal side detecting the call of the host's critical sending function, and the timestamps of the network side capturing execution class messages conform to the timing order.

6. The network security protection system for secondary network-connected devices according to claim 1, characterized in that, The central decision control unit module includes a dual-plane consistency verification unit, which is used to map protocol data units into feature vectors. The feature vector includes an unsigned integer representation of the source Internet Protocol address, an unsigned integer representation of the destination Internet Protocol address, an enumeration value of the application layer communication protocol type, a business logic sequence number, and a cryptographic hash digest value of the application layer business data. The dual-plane consistency verification unit is used to compare whether the feature vectors of the first network plane and the feature vectors of the second network plane are equal.

7. The network security protection system for secondary network-connected devices according to claim 1, characterized in that, The dual-plane consistency verification unit is used to execute the dual-network dual-transmission verification mode and the primary / standby redundancy verification mode. In the dual-network dual-transmission verification mode, it is verified whether the feature vectors of the two network planes are identical. In the primary / backup redundancy verification mode, it is verified whether the backup plane is in a state of no active control service traffic when the primary plane transmits feature vectors containing control commands.

8. The network security protection system for secondary network-connected devices according to claim 1, characterized in that, The central decision control unit module includes a logic operation processor, which is used to perform a logical AND operation on the end-network atomicity verification result variable and the biplane consistency verification result variable. The central decision control unit module is used to determine that the control command is a legal operation when both the terminal network atomicity verification result variable and the dual-plane consistency verification result variable indicate that they are valid.

9. The network security protection system for secondary network-connected devices according to claim 1, characterized in that, The central decision control unit module includes a policy execution unit, which is used to send a session persistence instruction to the real-time switch when the operation is determined to be legitimate. The policy execution unit is also used to construct an access control list update request packet and send it to the real-time switch when an anomaly is detected, and to send a virtual LAN configuration change instruction to the access switch when the threat classification flag indicates that the end-side process is abnormal.

10. The network security protection system for secondary network-connected devices according to claim 1, characterized in that, The system also includes a forward isolation device and a reverse isolation device connected between Security Zone I and Security Zone II, as well as an out-of-band management network channel independent of the business data channel; The central decision control unit module is used to receive data through the reverse isolation device; The out-of-band management network channel is used to transmit synchronization clock signals and security verification data.

Images