Method and system for security control of a communication link

Abstract

The application discloses a kind of security control method and system of communication link, applied to electric power network security field, including monitoring the current physical state of controllable switch in series in communication link;When according to current physical state, it is identified that controllable switch appears abnormal, disconnect controllable switch and lock link;When receiving external device access request and link is not locked, the identity characteristic information of external device is acquired;During the operation of equipment, the current physical state of controllable switch is continuously monitored, and state change information is generated when identifiable change occurs;Fusion check information is obtained by fusing state change information with identity characteristic information, and compared with pre-generated reference check data;When comparison fails, different security response operations are executed according to whether state change information is generated.The security control method of communication link provided by the application effectively solves the security response lag, false alarm and missing report problem caused by the split of physical layer protection and identity verification.

Description

Technical Field

[0001] This invention relates to the field of power network security technology, and in particular to a security control method and system for communication links. Background Technology

[0002] In critical infrastructure sectors such as power monitoring systems, smart substations, and distribution automation, operation and maintenance communication links are responsible for data exchange between field equipment and control systems. To ensure link security, high-security scenarios typically require physical layer isolation and control of the communication links.

[0003] Current technologies often employ physical port blocking or software access control lists (MAC lists) to manage communication links. Physical blocking methods cannot detect real-time changes in link status, while software MAC lists fail to trigger timely security responses after link damage. If a communication link is subjected to physical damage such as forced disassembly or slow prying, existing protection measures cannot proactively detect these status changes, preventing the system from issuing timely warnings before link damage occurs. Furthermore, when access devices change, existing methods cannot distinguish between compliant and malicious replacements. This may trigger alarms or block compliant operations, while failing to identify illegal operations and thus missing warnings. Ultimately, these issues lead to delayed security responses, false alarms, or missed warnings. Summary of the Invention

[0004] This invention provides a security control method and system for communication links to solve the technical problem of being unable to perform hierarchical control based on the physical state of the link and the identity of the access device, so as to achieve the effect of performing hierarchical security response on the communication link.

[0005] To address the aforementioned technical problems, embodiments of the present invention provide a... Monitor the current physical state of the controllable switch connected in series in the target communication link; When the controllable switch is identified as malfunctioning based on the current physical state, the controllable switch is disconnected and the target communication link is locked. When an external device access request is received, if the target communication link is not locked, the identity feature information of the external device is obtained; During the operation of the external device, the current physical state of the controllable switch is continuously monitored; When the current physical state undergoes a identifiable change relative to the initial physical state, state change information of the controllable switch is generated, wherein the initial physical state is the physical state when the controllable switch is connected to the target communication link; The state change information is fused with the identity feature information to obtain fused verification information; The fusion verification information is compared with the benchmark verification data, which is determined based on the initial physical state of the controllable switch and the identity feature information of the external device. When the current physical state has not undergone the identifiable change relative to the initial physical state, the identity feature information is compared with the benchmark verification data; When the comparison fails, different security response operations are performed depending on whether the state change information is generated.

[0006] As one preferred embodiment, the controllable switch is a bidirectional non-polarized analog switch, and the monitoring of the current physical state of the controllable switch connected in series in the target communication link includes: Obtain the initial distance between the lock body of the controllable switch and its fixed mounting surface; During the monitoring process, the current distance between the lock body and the mounting surface is collected at a preset sampling frequency; The initial distance value is compared with the current distance value, and the current physical state is obtained based on the comparison result.

[0007] As one preferred embodiment, the step of generating state change information of the controllable switch when the current physical state undergoes a identifiable change relative to the initial physical state includes: When the difference between the current distance value corresponding to the current physical state and the initial distance value exceeds the second safety threshold, it is determined that the controllable switch has undergone the identifiable change; The state change information is generated, and the state change information is used to indicate that the controllable switch has been displaced.

[0008] As one preferred embodiment, the second security threshold is smaller than the first security threshold.

[0009] As one preferred embodiment, when an external device access request is received, if the target communication link is not locked, obtaining the identity feature information of the external device includes: When the status flag is detected to be absent, it is determined that the target communication link is not locked. The identity feature information of the external device is determined, and the identity feature information is extracted from the protocol data sent by the external device.

[0010] As one preferred embodiment, the step of fusing the state change information with the identity feature information to obtain fused verification information includes: The state change information is concatenated with the identity feature information; A hash operation is performed on the concatenated data to obtain the fusion verification information.

[0011] As one preferred embodiment, the process of determining the benchmark verification data includes: Obtain the initial physical state of the controllable switch and the identity feature information of the external device; The initial physical state and the identity feature information are concatenated, and a hash operation is performed on the concatenated information to generate the benchmark verification data.

[0012] As one preferred embodiment, when the comparison fails, different security response operations are performed depending on whether the state change information has been generated, including: When the comparison fails and the state change information is generated, the controllable switch is disconnected; When the comparison fails and the status change information is not generated, the corresponding security operation is performed based on the port status of the upstream network device of the target communication link and the on / off status of the controllable switch. The security operation includes alarm or verification confirmation.

[0013] Another embodiment of the present invention provides a security control system for a communication link, comprising: The physical status monitoring module is used to monitor the current physical status of the controllable switch connected in series in the target communication link; An anomaly identification and link locking module is used to disconnect the controllable switch and lock the target communication link when the current physical state indicates that the controllable switch is malfunctioning. The access request processing module is used to obtain the identity feature information of the external device when it receives an access request from an external device, if the target communication link is not locked. The operation status monitoring module is used to continuously monitor the current physical state of the controllable switch during the operation of the external device; The state change detection module is used to generate state change information of the controllable switch when the current physical state undergoes an identifiable change relative to the initial physical state, wherein the initial physical state is the physical state when the controllable switch is connected to the target communication link; The information fusion module is used to fuse the state change information with the identity feature information to obtain fused verification information; The first comparison module is used to compare the fusion verification information with the benchmark verification data, wherein the benchmark verification data is determined based on the initial physical state of the controllable switch and the identity feature information of the external device. The second comparison module is used to compare the identity feature information with the benchmark verification data when the current physical state has not undergone the identifiable change relative to the initial physical state. The security response execution module is used to perform different security response operations depending on whether the status change information is generated when the comparison fails.

[0014] Compared with the prior art, the beneficial effects of the embodiments of the present invention are at least one of the following: (1) This invention monitors the current physical state of a controllable switch connected in series in the communication link. When the physical state undergoes a identifiable change relative to the initial physical state, it generates state change information. This state change information is then fused with the identity feature information of the access device to obtain fused verification information. The fused verification information is then compared with the baseline verification data. Different security response operations are executed based on the comparison result and whether state change information has been generated. This invention can link the physical state of the lock body with the identity features of the access device for verification, thereby accurately distinguishing between compliant operations and illegal intrusion when the access device changes. This avoids the response delays, false alarms, or missed alarms caused by the fact that pure physical locks in the prior art can only connect and disconnect the link, cannot perceive their own state, and cannot identify the device identity, thus improving the accuracy and reliability of communication link security control.

[0015] (2) Based on the physical state sensing capability of the controllable switch itself, the present invention monitors the distance change between the lock body and the mounting surface in real time, and triggers different processing logic according to the different degrees of change, thereby transforming physical damage detection from passive acceptance to active sensing. When the distance change exceeds a large threshold, the link is immediately cut off; when the distance change exceeds a small threshold, state change information is generated for identity fusion verification. This hierarchical detection mechanism makes the physical security protection of the link more refined. Attached Figure Description

[0016] Figure 1 This is a flowchart illustrating a security control method for a communication link in one embodiment of the present invention. Figure 2 This is a schematic diagram of a security control system for a communication link in one embodiment of the present invention.

[0017] Figure label: Among them, 11. Physical status monitoring module, 12. Anomaly identification and link locking module, 13. Request access processing module, 14. Operation status monitoring module, 15. Status change detection module, 16. Information fusion module, 17. First comparison module, 18. Second comparison module, 19. Security response execution module. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The purpose of providing these embodiments is to make the disclosure of the present invention more thorough and comprehensive. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0019] In the description of this application, the terms "first," "second," "third," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Therefore, a feature defined with "first," "second," "third," etc., may explicitly or implicitly include one or more of that feature. In the description of this application, unless otherwise stated, "a plurality of" means two or more.

[0020] In the description of this application, it should be noted that, unless otherwise expressly specified and limited, the terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to fixed connections, detachable connections, or integral connections; they can refer to mechanical connections or electrical connections; they can refer to direct connections or indirect connections through an intermediate medium; and they can refer to the internal communication between two components. The terms "vertical," "horizontal," "left," "right," "upper," "lower," and similar expressions used herein are for illustrative purposes only and do not indicate or imply that the device or component referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as limiting the invention. The term "and / or" as used herein includes any and all combinations of one or more of the associated listed items. Those skilled in the art can understand the specific meaning of the above terms in this application based on the specific circumstances.

[0021] In the description of this application, it should be noted that, unless otherwise defined, all technical and scientific terms used in this invention have the same meaning as commonly understood by one of ordinary skill in the art. The terminology used in this specification is for the purpose of describing specific embodiments only and is not intended to limit the invention. Those skilled in the art can understand the specific meaning of the above terms in this application based on the specific circumstances.

[0022] One embodiment of the present invention provides a security control method for a communication link. For details, please refer to [link to specific documentation]. Figure 1 , Figure 1 The diagram shown is a flowchart of a security control method for a communication link according to one embodiment of the present invention, which includes steps S1 to S9: S1: Monitor the current physical state of the controllable switch connected in series in the target communication link; Step S1 acquires the real-time physical state information of the controllable switch, providing basic data for subsequent anomaly identification, state change detection, and link control. The controllable switch is connected in series in the communication link, and its physical state reflects the relative positional relationship between the lock body and the mounting surface. Only by continuously acquiring this state information can the system determine whether the controllable switch has shifted and to what extent, thereby deciding whether to trigger link disconnection or generate state change information.

[0023] The controllable switch is a hardware device connected in series in the target communication link. Its core function is to control the on / off state of the link. Unlike traditional switches that only have mechanical opening and closing functions, the controllable switch integrates a distance sensor and a control circuit. The distance sensor is used to collect distance data between the lock body and the mounting surface, and the control circuit is used to determine whether to disconnect the link or generate status change information according to preset logic. The controllable switch physically consists of two parts: the lock body and the mounting surface. The lock body is fixed to the mounting surface (such as a cabinet wall or equipment shell) with fasteners, and the distance sensor is installed inside the lock body to monitor the relative position between the lock body and the mounting surface in real time.

[0024] When the lock body is pried or disassembled, the distance between the lock body and the mounting surface changes. This change is captured by the distance sensor and converted into an electrical signal for further processing by the control circuit. In this embodiment, the controllable switch has a bidirectional non-polarized analog switch. This analog switch remains open in the default state, keeping the link physically isolated; upon receiving a conduction command, it switches to the closed state, connecting the link.

[0025] The current physical state is a comprehensive description of the state of the controllable switch at a certain moment. Its core characteristic parameter is the comparison between the current distance value and the initial distance value between the lock body and the mounting surface. The initial distance value is a reference value collected and stored when the controllable switch first connects to the target communication link, representing the position of the lock body in the normal installation state; the current distance value is a value collected in real time at a preset sampling frequency during system operation.

[0026] The current physical state is obtained by comparing the two values ​​mentioned above, and specifically includes three scenarios: First, the normal state, that is, the difference between the current distance value and the initial distance value does not exceed the second safety threshold, indicating that the lock body has not been displaced or the amount of displacement is within the allowable range; Second, the minor displacement state, that is, the difference exceeds the second safety threshold but does not exceed the first safety threshold, indicating that the lock body has undergone identifiable displacement but has not yet reached the level of violence; Third, the major displacement state, that is, the difference exceeds the first safety threshold, indicating that the lock body has undergone violent displacement and is very likely to be subjected to violent dismantling.

[0027] The current physical state classification directly determines what kind of safety response operation the system will perform: under normal conditions, the system maintains the current status of the link; under minor displacement conditions, the system generates state change information for fusion verification; under major displacement conditions, the system immediately disconnects the link and locks it.

[0028] Preferably, in one embodiment of the present invention, the controllable switch is a bidirectional non-polarized analog switch, and monitoring the current physical state of the controllable switch connected in series in the target communication link includes: Obtain the initial distance between the lock body of the controllable switch and its fixed mounting surface; During the monitoring process, the current distance between the lock body and the mounting surface is collected at a preset sampling frequency; The initial distance value is compared with the current distance value, and the current physical state is obtained based on the comparison result.

[0029] Specifically, firstly, the initial distance between the lock body of the controllable switch and its fixed mounting surface is obtained. When the controllable switch is first connected to the target communication link, the system uses a built-in ranging sensor to collect the absolute distance between the bottom surface of the lock body and the mounting surface, and stores this value as the initial distance value in non-volatile memory. This initial distance value represents the reference position of the controllable switch in its normal installation state.

[0030] During monitoring, the current distance between the lock body and the mounting surface is collected at a preset sampling frequency. After the system enters the operating state, the distance sensor continuously collects the distance between the lock body and the mounting surface at set time intervals. The sampling frequency can be set by maintenance personnel according to the actual application scenario, and the current distance value is obtained after filtering of each collected data.

[0031] The system compares the initial distance value with the current distance value to determine the current physical state. The difference between the current and initial distance values ​​reflects the degree of offset of the controllable switch relative to its initial installation position. Depending on the range of the difference, the current physical state can be classified as normal, slightly displaced, or significantly displaced. After quantifying the comparison result into the current physical state, the system can then execute subsequent anomaly identification or state change detection procedures.

[0032] In step S1, by acquiring and storing the initial distance value as a benchmark, the system establishes a physical reference point for the controllable switch; by periodically acquiring the current distance value and comparing it with the benchmark value, the system can sense the displacement change of the controllable switch in real time; by converting the comparison result into the current physical state, a clear judgment basis is provided for subsequent hierarchical control.

[0033] S2: When an abnormality is detected in the controllable switch based on the current physical state, disconnect the controllable switch and lock the target communication link; When the controllable switch undergoes significant displacement, the communication link is immediately cut off and access capability is locked to prevent unauthorized use of the link after physical damage. In step S1, the system has obtained the current physical state, which reflects the degree of displacement of the controllable switch. When the displacement reaches a significant level, it indicates that the lock body is being forcibly dismantled or has undergone irreversible physical deformation. At this time, the link must be immediately blocked, and subsequent access requests must be locked to prevent attackers from resetting the device and reconnecting after damaging the lock body.

[0034] Preferably, in a real-time example of the present invention, when an abnormality is identified in the controllable switch based on the current physical state, the controllable switch is disconnected and the target communication link is locked, including: When the difference between the current distance value corresponding to the current physical state and the initial distance value exceeds the first safety threshold, it is determined that the controllable switch has malfunctioned. Send a disconnect command to the controllable switch and set a status flag, which is used to indicate that the target communication link is in a locked state.

[0035] In this embodiment, when the controllable switch is identified as malfunctioning based on the current physical state, the process of disconnecting the controllable switch and locking the target communication link is divided into two stages.

[0036] First, it is determined whether the controllable switch is malfunctioning. The system obtains the initial distance value stored in step S1 and compares the current distance value corresponding to the current physical state with the initial distance value, calculating the difference between the two. When this difference exceeds a first safety threshold, it is determined that the controllable switch is malfunctioning. The first safety threshold corresponds to the critical value at which the lock body undergoes significant displacement; exceeding this threshold indicates that the lock body is being forcibly dismantled or has already undergone irreversible physical deformation. The specific value of the first safety threshold is determined based on the mechanical structure of the lock body, the material of the mounting surface, and the security level requirements of the application scenario. For example, a smaller threshold is used in scenarios requiring rapid response, while a larger threshold is used in scenarios requiring avoidance of environmental vibration interference.

[0037] Then, based on the judgment result, an abnormal response operation is executed. The system sends a disconnect command to the controllable switch, controlling its internal analog switch to switch from a closed state to an open state, thereby cutting off the communication link. Simultaneously, the system sets a status flag, stored in non-volatile memory, to indicate that the target communication link is currently locked. Once the status flag is set, the system will check this flag before processing any subsequent access request; if the flag is valid, access will be directly rejected until the flag is cleared by a remote authorization command or a local physical reset.

[0038] If the difference between the current distance value and the initial distance value does not exceed the first safety threshold, the controllable switch is determined to be normal. In this case, the system does not perform a link disconnection operation, the controllable switch maintains its original on / off state, and the status flag is not set. The system continues to execute subsequent steps, including processing external device access requests and continuous monitoring during operation. This indicates that the first safety threshold serves as the boundary for judging significant displacement; an emergency response is only triggered when the displacement exceeds this boundary. If it does not exceed this boundary, the system considers the physical state of the controllable switch to be within acceptable limits and does not take aggressive safety measures, thereby avoiding false triggering caused by environmental vibration or minor disturbances.

[0039] S3: When an external device access request is received, if the target communication link is not locked, obtain the identity feature information of the external device; In step S2, a status flag has been set to indicate whether the link is locked. The link is only accessible when this flag is absent. This step checks the status flag to confirm the link status and collects the identity information of the external device after confirming that it is not locked.

[0040] Among them, identity feature information refers to the digital fingerprint used to uniquely identify external devices. Its function is to distinguish different devices, enabling the system to determine whether the currently connected device is the same as the previously connected device. This information is extracted by analyzing the communication data naturally generated by the external device during the access process.

[0041] In one specific embodiment, identity information is extracted from protocol data sent by external devices. When an external device connects to a communication link, it sends protocol messages for network discovery, address allocation, or service announcement, such as Link Layer Discovery Protocol (LLDP) messages, Dynamic Host Configuration Protocol (DHCP) messages, Simple Network Management Protocol (SNMP) messages, Hypertext Transfer Protocol (HTTP) messages, Cisco Discovery Protocol (CDP) messages, or Multicast Domain Name System (mDNS) messages. These protocol messages contain fields such as device model, operating system version, network protocol stack characteristics, and vendor information. The combination of these fields can form a highly distinctive device identifier.

[0042] In this embodiment, the specific content of the identity feature information may include, but is not limited to: device model and system description extracted from the LLDP protocol; client identifier and device type identifier extracted from the DHCP protocol; device name and system description extracted from the SNMP protocol; user agent string extracted from the HTTP protocol; device name and hardware platform model extracted from the CDP protocol; and device service name and device type extracted from the mDNS protocol.

[0043] Identity feature information is stored in association with the initial physical state of the controllable switch, together forming the benchmark verification data. The initial physical state of the controllable switch refers to the relative positional relationship between the lock body and the mounting surface when the switch first connects to the communication link. This state is quantified by the initial distance value collected by the ranging sensor and serves as the benchmark reference point for all subsequent displacement judgments. During subsequent device operation, the system again extracts the identity feature information of the currently connected device and compares it with the identity feature portion of the benchmark verification data to determine whether the device has been replaced. Since the identity feature information originates from the device's own communication behavior, it is difficult for attackers to completely forge, thus possessing high anti-spoofing capabilities.

[0044] Preferably, in one embodiment of the present invention, when an external device access request is received, if the target communication link is not locked, the identity feature information of the external device is obtained, including: When the status flag is not detected, it is determined that the target communication link is not locked. The identity characteristics of external devices are determined, and these characteristics are extracted from the protocol data sent by the external devices.

[0045] Specifically, the system reads the status flag set in step S2 and checks whether the flag exists. If the status flag is not detected, it is determined that the target communication link is not locked, which means that no major displacement event has occurred before and the link is in a normal accessible state; if the status flag exists, it indicates that the link has been locked, and the system directly rejects the access request and does not perform the subsequent operations of this step.

[0046] Next, the system determines the identity characteristics of the external device by extracting these characteristics from the protocol data sent by the device. When an external device connects, it generates corresponding communication data containing information fields that identify the device. The system analyzes this protocol data to extract information such as device type, operating system version, and network protocol stack characteristics, combining this information to form the external device's identity characteristics. The determination of these identity characteristics does not depend on whether the external device has any specific software installed; it is entirely based on data naturally generated during communication, making it applicable to various heterogeneous devices.

[0047] S4: Continuously monitor the current physical state of the controllable switch during the operation of external equipment; During the connection and normal operation of the external device, the physical state changes of the controllable switch are continuously tracked to provide real-time data for subsequent minute displacement detection and state change information generation. Currently, step S3 has obtained the external device's identity information, and the system has entered the normal operation phase. However, the physical state of the controllable switch is not static and may undergo minute changes due to environmental vibration, loose installation, or slow prying by an attacker. If detection is only performed once at the moment of device connection, subsequent displacements will not be detected. Therefore, continuous monitoring is required during device operation to ensure that any physical state changes occurring at any time are captured promptly.

[0048] Specifically, the system initiates periodic monitoring tasks after external devices are connected. The monitoring tasks are executed according to a preset sampling frequency, with each monitoring cycle repeating the distance acquisition operation in step S1: the distance sensor acquires the current distance value between the lock body and the mounting surface, and the acquired data is filtered and used as the current distance value at that moment. The sampling frequency can be set by maintenance personnel according to the response speed requirements of the application scenario. For example, a higher frequency can be used in scenarios requiring rapid detection of slow disassembly behavior, while a lower frequency can be used in relatively stable environments to reduce system overhead.

[0049] After each time a current distance value is collected, the system compares it with the initial distance value stored in step S1 and calculates the difference between the two. This difference reflects the cumulative displacement of the controllable switch from the initial moment to the current moment. The system records the result of each comparison and passes the displacement information to subsequent steps for further judgment. This allows the system to capture tiny displacements that accumulate over time. For example, when an attacker is turning a screw at an extremely slow speed, each single sample may not exceed any threshold, but the cumulative displacement of multiple samples will gradually increase, eventually triggering the judgment of the second security threshold.

[0050] Continuous monitoring will not be interrupted by changes in the operating status of external devices. Even if data exchange between external devices and the system temporarily stops, the monitoring task will continue to execute because changes in the physical state of the controllable switch can occur at any time. The monitoring task will only terminate when the external device is disconnected or the system enters a locked state.

[0051] S5: When the current physical state undergoes a identifiable change relative to the initial physical state, generate state change information of the controllable switch. The initial physical state is the physical state when the controllable switch is connected to the target communication link. In step S4, the system continuously monitors the current physical state of the controllable switch and obtains the difference between the current distance value and the initial distance value. However, not all displacements require triggering a link disconnection. Major displacements are handled in step S2, while minor displacements are handled differently. Minor displacements may not pose an urgent threat, but they are objective evidence of lock body displacement and should be recorded and associated with the device identity for verification to prevent attackers from bypassing the brute-force detection threshold by slowly disassembling the device.

[0052] Preferably, in one embodiment of the present invention, when the current physical state undergoes a identifiable change relative to the initial physical state, state change information of the controllable switch is generated, including: When the difference between the current distance value and the initial distance value corresponding to the current physical state exceeds the second safety threshold, it is determined that the controllable switch has undergone a identifiable change; Generate state change information, which is used to indicate the displacement of the controllable switch.

[0053] Specifically, it is determined whether a identifiable change has occurred in the controllable switch. Based on the difference between the current distance value and the initial distance value, this difference is compared to a second safety threshold. The second safety threshold is a preset value smaller than the first safety threshold, corresponding to the critical value at which a small displacement of the lock body occurs. When the difference exceeds the second safety threshold, it is determined that a identifiable change has occurred in the controllable switch. This means that the lock body has significantly shifted relative to its initial installation position, but the degree of shift has not reached the level of forced disassembly. In this embodiment, the specific value of the second safety threshold is determined according to the sensitivity requirements of the lock body's mechanical structure. For example, a smaller threshold is used in scenarios requiring detection of extremely slow disassembly, while a larger threshold is used in scenarios requiring tolerance to environmental vibrations.

[0054] If the difference does not exceed the second safety threshold, it is determined that the controllable switch has not undergone an identifiable change. At this time, the system does not generate state change information and continues to perform continuous monitoring in step S4, waiting for the next sampling.

[0055] When a identifiable change is detected, a state change information is generated. The system creates a state change information message to indicate that the controllable switch has been displaced. The state change information can be a flag, a count value, or a data structure containing the displacement. Its core function is to inform subsequent steps that the physical state of the controllable switch is significantly different from its initial state within the current monitoring period.

[0056] It is important to note that the generation of state change information is unrelated to link disconnection. After generating state change information, the system does not immediately disconnect the link; instead, it maintains the existing connectivity of the link, only recording the displacement event and preparing for fusion verification. Such minor displacements caused by environmental vibrations, thermal expansion and contraction due to temperature changes, or natural loosening of mounting screws are not malicious attacks, and immediately disconnecting the link would cause unnecessary service interruption. By generating state change information and fusing it with identity features for verification, the system can comprehensively determine the cause and risk level of the displacement in subsequent steps, only taking disconnection measures if identity verification also fails.

[0057] S6: Merge the state change information with the identity feature information to obtain the fused verification information; We have already obtained state change information and external device identity information; however, these two pieces of information are independent, reflecting the physical layer and identity layer status respectively. If we only compare the identity information, the system cannot determine whether the lock body has shifted; if we only look at the state change information, the system cannot determine which device is currently connected. By fusing the two, any change in either will lead to a change in the fused verification information, thus achieving mutual verification between the physical state and the device identity.

[0058] Preferably, in one embodiment of the present invention, the state change information and identity feature information are fused to obtain fused verification information, including: The status change information is concatenated with the identity feature information; A hash operation is performed on the concatenated data to obtain the fusion verification information.

[0059] Specifically, the state change information and identity feature information are concatenated. The system obtains the state change information generated in step S5 and the identity feature information obtained in step S3, and combines them into a continuous data sequence in a predetermined order. In this embodiment, the concatenation method can be to append the state change information to the end of the identity feature information, or to insert the state change information into a specific position in the identity feature information, as long as the concatenation rules remain consistent when generating the fusion verification information and subsequent comparisons. The state change information can be a flag bit or a numerical value, and the identity feature information is usually a fixed-length hash value. The two are concatenated to form a new data block.

[0060] Then, a hash operation is performed on the concatenated data to obtain the fusion verification information. The system inputs the concatenated data block into a hash function, and after the hash operation, it outputs a fixed-length hash value, which is the fusion verification information. The hash operation has the following characteristics: any small change in the input data will cause a significant change in the output hash value. Therefore, whether the state information changes (e.g., from nothing to something) or the identity feature information changes (e.g., the device is replaced), the fusion verification information will change accordingly.

[0061] In a specific embodiment of the present invention, the hash operation can use the national cryptographic SM3 algorithm, which outputs a hash value with a length of 256 bits and has a high collision resistance capability.

[0062] It should be noted that the fusion verification information generated in this step is used to compare with the baseline verification data. The baseline verification data is pre-generated and stored in the same way (by concatenating the initial physical state with the identity feature information and then hashing it) when the device is first connected. When the system is running, the fusion verification information is generated again and compared with the baseline verification data to determine whether the current state is consistent with the initial state: if they are consistent, it indicates that the device has not been replaced and the lock body has not been displaced; if they are inconsistent, it indicates that at least one of the device identity or the physical state of the lock body has changed, and subsequent steps will further analyze the cause of the change and decide what response measures to take.

[0063] S7: Compare the fused verification information with the benchmark verification data, which is determined based on the initial physical state of the controllable switch and the identity feature information of the external device. The fusion verification information obtained from step S6 reflects the current physical state of the controllable switch (whether a slight displacement has occurred) and the identity characteristics of the currently accessed device. However, without a reference baseline, the system cannot determine whether the current state is normal. The baseline verification data provides a reference value in the initial state. By comparing the two, the system can draw a conclusion of "consistent" or "inconsistent" and determine the subsequent security response strategy accordingly.

[0064] Preferably, in one embodiment of the present invention, the process of determining the benchmark verification data includes: Obtain the initial physical state of the controllable switch and the identity information of the external device; The initial physical state and identity feature information are concatenated, and the concatenated information is hashed to generate benchmark verification data.

[0065] Specifically, the initial physical state of the controllable switch and the identification information of the external device are obtained. The initial physical state of the controllable switch refers to the initial distance value between the lock body and the mounting surface collected upon initial connection; this value represents the reference position of the lock body in its normal installation state. The identification information of the external device refers to the device fingerprint extracted from the device communication data upon initial connection; this information represents the unique identifier of the device. Both of these pieces of information can be obtained in the aforementioned steps.

[0066] The initial physical state and identity feature information are concatenated, and a hash operation is performed on the concatenated information to generate benchmark verification data. The concatenation operation is performed according to the same rules as in step S6, combining the numerical value corresponding to the initial physical state with the hash value corresponding to the identity feature information into a continuous data sequence. The hash operation uses the same hash function as in step S6 (e.g., the national cryptographic SM3 algorithm) to calculate the hash value of the concatenated data sequence, outputting a fixed-length hash value. This hash value is the benchmark verification data, which is stored in non-volatile memory as a reference standard for subsequent comparisons.

[0067] After obtaining the baseline verification data, the system repeats step S6 during each run to generate the current fusion verification information and compares it with the baseline verification data stored in this step. The comparison operation involves comparing whether the two hash values ​​are exactly the same: if they are the same, it indicates that the physical state of the current controllable switch is consistent with the initial state (the lock body has not been displaced), and the identity characteristics of the current access device are consistent with the initial device (the device has not been changed); if they are different, it indicates that at least one of the above two conditions is not met, and the system needs to further determine which one has changed and the reason for the change.

[0068] S8: When the current physical state has not undergone any identifiable change relative to the initial physical state, the identity feature information is compared with the benchmark verification data; Step S5 has already determined whether a identifiable change has occurred, and step S7 has performed a comparison of the fusion verification information. However, when the fusion verification information comparison fails, it is impossible to distinguish whether the failure is due to a change in device identity, displacement of the lock body, or both. When no identifiable change has occurred, the only possibility for the fusion verification information comparison failure is a change in device identity. Therefore, this step, assuming lock body displacement is ruled out, compares the identity feature information separately to confirm whether the device has been replaced.

[0069] Specifically, firstly, it is confirmed that no identifiable changes have occurred. Based on the judgment result of step S5, the system confirms that the difference between the current distance value and the initial distance value does not exceed the second safety threshold, meaning that the controllable switch has not undergone any slight displacement. This means that the physical state of the lock body is basically consistent with the initial state, and there is no perceptible displacement. Under this premise, the root cause of the failure of the fusion verification information comparison can only be that the identity feature information has changed, because the variable of lock body displacement has been excluded.

[0070] The system compares the identity feature information with the benchmark verification data. It obtains the identity feature information of the currently accessed device and compares it with the pre-stored benchmark verification data. It's important to note that the benchmark verification data is a hash value resulting from the fusion of the initial physical state and identity feature information, not simply the identity feature information itself. Therefore, this step does not directly compare the current identity feature information with the benchmark verification data, but rather compares the current identity feature information with the identity-related portion of the benchmark verification data.

[0071] In a specific embodiment of the present invention, the system can combine the known initial physical state to deduce the initial identity feature information from the benchmark verification data, and then compare it with the current identity feature information; alternatively, a decoupled comparison method can be adopted, that is, the benchmark identity feature information and the benchmark physical state information are stored separately, and the benchmark identity feature information is used directly when it is necessary to compare identities separately.

[0072] When the identity feature information matches the baseline identity feature information, it indicates that the device has not been replaced. The reason for the failure of the fusion verification information comparison may be due to other factors (such as data acquisition errors or storage anomalies). The system can record this event but will not trigger an alarm. When the identity feature information does not match the baseline identity feature information, it indicates that the device has been replaced, and the lock body has not been displaced. This means that the device replacement was carried out under compliant operation (such as normal device replacement by maintenance personnel). In this case, the system should prompt for manual confirmation rather than trigger an intrusion alarm.

[0073] S9: When the comparison fails, perform different security response operations depending on whether state change information is generated.

[0074] When the comparison fails, the system has already obtained the possible reasons for the failure: whether state change information has been generated (i.e., whether the lock body has undergone slight displacement). Based on the different information, the system can determine whether the current event is a malicious intrusion or a compliant operation, and execute the corresponding response.

[0075] Preferably, in one embodiment of the present invention, when the comparison fails, different security response operations are performed depending on whether state change information is generated, including: When the comparison fails and status change information is generated, disconnect the controllable switch; When the comparison fails and no status change information is generated, the corresponding security operation is performed based on the port status of the upstream network device of the target communication link and the on / off status of the controllable switch. The security operation includes alarm or verification confirmation.

[0076] Specifically, when the comparison fails, the process of executing different security response operations based on whether or not state change information is generated can be divided into two scenarios.

[0077] (1) Comparison failed and status change information was generated. This indicates that the fusion verification information is inconsistent with the baseline verification data, and the controllable switch has undergone a slight displacement during the monitoring period (status change information has been generated). The displacement of the lock body means that the physical integrity may have been compromised. Regardless of whether the identity characteristics of the access device have changed, the system judges this situation as a potential security threat. At this time, the system performs an aggressive security response operation, namely disconnecting the controllable switch and cutting off the communication link. At the same time, the system can trigger an alarm, report the abnormal event to the operation and maintenance management platform, and record the event in the log.

[0078] The logic behind this approach is that the displacement of the lock body is itself an abnormal event that requires a response. Even if the identity characteristics of the access device are consistent with the baseline, the possibility that an attacker could damage the lock body without replacing the device cannot be ruled out.

[0079] (2) Comparison failed and no status change information was generated. This indicates that the fusion verification information is inconsistent with the baseline verification data, but the controllable switch did not undergo any slight displacement during the monitoring period. In this case, the physical state of the lock body is consistent with the initial state. Therefore, the only possibility for the comparison failure is that the identity characteristics of the access device have changed (i.e., the device has been replaced). Since the lock body did not move, the device replacement was likely carried out under compliant operation (e.g., maintenance personnel used authorized tools to unlock and then replaced the device). In this case, the system does not take aggressive link disconnection measures, but instead performs a more moderate security response operation: according to the port status of the upstream network device of the target communication link and the on / off status of the controllable switch, the corresponding security operation is performed.

[0080] The port status of upstream network devices reflects whether the switch port is locked by the management plane, while the on / off status of the controllable switch reflects whether the lock is currently locked or unlocked. These two statuses together provide auxiliary information indicating whether device replacement has been authorized. For example, when the upstream network device port is locked and the controllable switch is unlocked, it indicates that the maintenance personnel have authorized the device replacement operation through the management plane, and the system should prompt for manual verification rather than triggering an alarm. When the upstream network device port is unlocked and the controllable switch is locked, it may indicate an unauthorized access attempt, and the system should issue an alarm. Specific security actions include issuing an alarm or requesting verification; the former notifies the maintenance personnel of a potential risk, while the latter requests manual assessment of whether the device replacement is compliant.

[0081] Another embodiment of the present invention provides a security control system for a communication link; for details, please refer to [link to relevant documentation]. Figure 2 , Figure 2 The diagram shown illustrates a security control system for a communication link according to one embodiment of the present invention, which includes: The physical state monitoring module 11 is used to monitor the current physical state of the controllable switch connected in series in the target communication link; The anomaly identification and link locking module 12 is used to disconnect the controllable switch and lock the target communication link when the anomaly of the controllable switch is identified based on the current physical state. The access request processing module 13 is used to obtain the identity feature information of the external device when it receives an access request from an external device, if the target communication link is not locked. The operation status monitoring module 14 is used to continuously monitor the current physical status of the controllable switch during the operation of the external device; The state change detection module 15 is used to generate state change information of the controllable switch when the current physical state changes identibly relative to the initial physical state. The initial physical state is the physical state when the controllable switch is connected to the target communication link. Information fusion module 16 is used to fuse state change information with identity feature information to obtain fused verification information; The first comparison module 17 is used to compare the fused verification information with the benchmark verification data, which is determined based on the initial physical state of the controllable switch and the identity feature information of the external device. The second comparison module 18 is used to compare the identity feature information with the benchmark verification data when the current physical state has not undergone any identifiable change relative to the initial physical state. The security response execution module 19 is used to perform different security response operations depending on whether status change information is generated when the comparison fails.

[0082] Compared with the prior art, the beneficial effects of the embodiments of the present invention are at least one of the following: (1) This invention integrates and verifies the state change information of the controllable switch with the identity feature information of the external device, so that the access control of the communication link no longer depends solely on the device identity or the physical lock status, but binds the two together for mutual verification. When the state change information exists but the integration verification fails, the link is directly cut off. When the state change information does not exist but the identity verification fails, the upstream network status is combined for further judgment. This integration verification mechanism effectively solves the problem that a purely physical lock cannot distinguish between compliant replacement and malicious intrusion.

[0083] (2) In this invention, the entire security control process does not require the installation of any additional software or hardware on the access device. Identity feature information is obtained by analyzing the communication data generated by the access device, without relying on the access device's own computing resources or operating system environment. This design makes the solution applicable to various heterogeneous devices, including industrial control terminals with limited computing resources or closed operating systems, and has good compatibility and scalability.

[0084] The embodiments described above are merely illustrative of several implementations of the present invention, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these modifications and improvements all fall within the scope of protection of the present invention. Therefore, the scope of protection of this patent should be determined by the appended claims.

Claims

1. A security control method for a communication link, characterized in that, include: Monitor the current physical state of the controllable switch connected in series in the target communication link; When the controllable switch is identified as malfunctioning based on the current physical state, the controllable switch is disconnected and the target communication link is locked. When an external device access request is received, if the target communication link is not locked, the identity feature information of the external device is obtained; During the operation of the external device, the current physical state of the controllable switch is continuously monitored; When the current physical state undergoes a identifiable change relative to the initial physical state, state change information of the controllable switch is generated, wherein the initial physical state is the physical state when the controllable switch is connected to the target communication link; The state change information is fused with the identity feature information to obtain fused verification information; The fusion verification information is compared with the benchmark verification data, which is determined based on the initial physical state of the controllable switch and the identity feature information of the external device. When the current physical state has not undergone the identifiable change relative to the initial physical state, the identity feature information is compared with the benchmark verification data; When the comparison fails, different security response operations are performed depending on whether the state change information is generated.

2. The security control method for a communication link as described in claim 1, characterized in that, The controllable switch is a bidirectional, non-polarized analog switch. Monitoring the current physical state of the controllable switch connected in series in the target communication link includes: Obtain the initial distance between the lock body of the controllable switch and its fixed mounting surface; During the monitoring process, the current distance between the lock body and the mounting surface is collected at a preset sampling frequency; The initial distance value is compared with the current distance value, and the current physical state is obtained based on the comparison result.

3. The security control method for a communication link as described in claim 2, characterized in that, The step of disconnecting the controllable switch and locking the target communication link when the current physical state indicates that the controllable switch is malfunctioning includes: When the difference between the current distance value corresponding to the current physical state and the initial distance value exceeds the first safety threshold, it is determined that the controllable switch has malfunctioned. A disconnect command is sent to the controllable switch, and a status flag is set to indicate that the target communication link is in a locked state.

4. The security control method for a communication link as described in claim 3, characterized in that, When the current physical state undergoes a identifiable change relative to the initial physical state, generating state change information for the controllable switch includes: When the difference between the current distance value corresponding to the current physical state and the initial distance value exceeds the second safety threshold, it is determined that the controllable switch has undergone the identifiable change; The state change information is generated, and the state change information is used to indicate that the controllable switch has been displaced.

5. The security control method for a communication link as described in claim 4, characterized in that, The second security threshold is less than the first security threshold.

6. The security control method for a communication link as described in claim 3, characterized in that, When an external device access request is received, if the target communication link is not locked, the method of obtaining the identity feature information of the external device includes: When the status flag is detected to be absent, it is determined that the target communication link is not locked. The identity feature information of the external device is determined, and the identity feature information is extracted from the protocol data sent by the external device.

7. The security control method for a communication link as described in claim 1, characterized in that, The step of fusing the state change information with the identity feature information to obtain fused verification information includes: The state change information is concatenated with the identity feature information; A hash operation is performed on the concatenated data to obtain the fusion verification information.

8. The security control method for a communication link as described in claim 1, characterized in that, The process of determining the benchmark verification data includes: Obtain the initial physical state of the controllable switch and the identity feature information of the external device; The initial physical state and the identity feature information are concatenated, and a hash operation is performed on the concatenated information to generate the benchmark verification data.

9. A security control method for a communication link as described in claim 1, characterized in that, When the comparison fails, different security response operations are performed depending on whether the state change information has been generated, including: When the comparison fails and the state change information is generated, the controllable switch is disconnected; When the comparison fails and the status change information is not generated, the corresponding security operation is performed based on the port status of the upstream network device of the target communication link and the on / off status of the controllable switch. The security operation includes alarm or verification confirmation.

10. A security control system for a communication link, characterized in that, include: The physical status monitoring module is used to monitor the current physical status of the controllable switch connected in series in the target communication link; An anomaly identification and link locking module is used to disconnect the controllable switch and lock the target communication link when the current physical state indicates that the controllable switch is malfunctioning. The access request processing module is used to obtain the identity feature information of the external device when it receives an access request from an external device, if the target communication link is not locked. The operation status monitoring module is used to continuously monitor the current physical state of the controllable switch during the operation of the external device; The state change detection module is used to generate state change information of the controllable switch when the current physical state undergoes an identifiable change relative to the initial physical state, wherein the initial physical state is the physical state when the controllable switch is connected to the target communication link; The information fusion module is used to fuse the state change information with the identity feature information to obtain fused verification information; The first comparison module is used to compare the fusion verification information with the benchmark verification data, wherein the benchmark verification data is determined based on the initial physical state of the controllable switch and the identity feature information of the external device. The second comparison module is used to compare the identity feature information with the benchmark verification data when the current physical state has not undergone the identifiable change relative to the initial physical state. The security response execution module is used to perform different security response operations depending on whether the status change information is generated when the comparison fails.

Images