An internet of things data security connection distributed control system

Abstract

The application discloses a kind of Internet of Things data security connection distributed control system, including multiplex frame structure management module, security micro time slot generation and embedding module, physical channel fingerprint extraction and dynamic token generation module, double-channel pipeline receiving processing module and hardware interrupt blocking and buffer management module, system is defined in the protection interval of time division multiplex frame structure security micro time slot area, carries four security credential fields of behavior baseline hash value, physical layer integrity label, dynamic identity token and serial number, realize security credential and control data in frame structure physical layer dimension decoupling, control data main channel zero waiting straight-through execution buffer, safety check is completed in parallel in bypass channel, when checking fails, hardware interrupt controller empties execution buffer in a clock cycle, dynamic identity token is dynamically generated by the time slot jump interval sequence, frequency deviation sequence and clock synchronization residual sequence of physical channel by hash operation, with strong binding to physical link, and support cross-protocol domain delivery verification.

Description

Technical Field

[0001] This invention belongs to the field of multi-channel data communication and industrial Internet of Things (IoT) security, specifically relating to a distributed control system for IoT data security connection. It is particularly suitable for industrial distributed control scenarios based on time-division multiplexing or frequency-division multiplexing channels, performing real-time integrity verification, identity authentication, and forgery blocking of control commands. Background Technology

[0002] In modern industrial IoT distributed control systems, hundreds of sensor nodes, actuators, and controllers transmit data concurrently through wired or wireless backbone networks. To improve channel utilization, the system commonly employs time-division multiplexing (TDM) or frequency-division multiplexing (FDM) techniques, dividing the physical channel into several logical sub-channels for multiplexing by different nodes. In the TDM frame structure, a guard interval is usually inserted between adjacent time slots. This interval is used to absorb inter-symbol interference and multipath propagation delay and typically does not carry valid service data, belonging to idle resources. Industrial control systems have extremely stringent requirements for communication latency. Taking the IEEE 802.1 Time-Sensitive Networking standard as an example, the end-to-end transmission delay tolerance limit for industrial real-time control messages is typically on the order of 100 microseconds to 1 millisecond. Exceeding this limit will lead to control loop instability, causing equipment damage or even production safety accidents.

[0003] Existing IoT data security solutions mainly suffer from the following three types of deficiencies: The first type of defect: End-to-end encryption schemes based on TLS or DTLS require handshake negotiation, key negotiation and packet-by-packet encryption and decryption operations, which bring additional delays of milliseconds or even seconds. The receiving end must wait for the complete cryptographic calculation to be completed before it can release control commands, which seriously disrupts the distributed real-time control closed loop. It is difficult to deploy a complete TLS protocol stack on resource-constrained programmable logic controllers or sensor nodes.

[0004] The second type of defect: the solution of combining the perimeter firewall with plaintext protocols, once the network boundary is breached, the plaintext control commands transmitted between internal network devices are completely unprotected. Attackers can directly inject malicious control commands, and it cannot defend against internal lateral movement attacks and data leakage through covert channels, and does not have the ability to protect command-level integrity.

[0005] The third type of defect: Existing identity authentication schemes are anchored to application layer protocols. In industrial scenarios where multiple protocols are used together, certificate transmission across protocol stacks requires multiple protocol encapsulation and decapsulation, making it impossible to achieve end-to-end identity binding. Attackers can inject forged control commands at protocol conversion nodes to bypass upper-layer identity authentication. At the same time, existing security detection methods are mainly focused on the application layer and cannot detect covert channel attacks and time-slot-level data tampering at the physical layer and data link layer.

[0006] The root cause of the above defects is that traditional security mechanisms tightly couple security credentials and control data into the same data packet and adopt a serial processing logic of verification first and execution later, which makes the security verification delay impossible to eliminate. At the same time, the identity authentication anchor point is located at the application layer and cannot cover the physical layer attack surface. Summary of the Invention

[0007] The technical problem to be solved by this invention is: in the distributed control system of the Internet of Things, how to achieve real-time integrity verification, identity authentication and forgery blocking of control commands transmitted on multiplexed data channels without introducing any additional delay in the control link, while solving the problems of cross-protocol domain identity authentication failure and physical layer covert channel attacks that cannot be detected.

[0008] The present invention is implemented as follows: a distributed control system for secure data connection in the Internet of Things includes a multiplexed frame structure management module, a secure micro-slot generation and embedding module, a physical channel fingerprint extraction and dynamic token generation module, a dual-channel pipeline receiving and processing module, and a hardware interrupt blocking and buffer management module.

[0009] The multiplexing frame structure management module extends the time-division multiplexing frame structure. Without changing the existing business data time slot structure, the protection interval is divided into two segments: a physical protection zone and a security micro-time slot zone. The security micro-time slot zone carries four security credential fields: behavior baseline hash value field, physical layer integrity label field, dynamic identity token field, and micro-time slot sequence number field. The four fields total 22 bytes. The duration of the security micro-time slot zone does not exceed the difference between the total duration of the protection interval and the minimum duration of the physical protection zone, thereby ensuring that the embedding of the security micro-time slot does not compress the physical protection zone and does not introduce additional inter-symbol interference.

[0010] The secure micro-slot generation and embedding module is deployed in the field-programmable gate array hardware of the transmitting master node or IoT edge gateway. It is responsible for performing a lightweight hash operation on the control message payload of each time-division multiplexed data time slot immediately after the transmission is completed, to obtain the behavior baseline hash value, synchronously reading the current physical layer channel state parameters, performing a bitwise XOR operation on the cyclic redundancy check value of the physical layer parameter vector and the lower 32 bits of the behavior baseline hash value to calculate the physical layer integrity tag, reading the currently valid dynamic identity token from the dynamic token cache register, reading the micro-slot sequence number from the monotonically increasing counter, and concatenating the above four fields byte-aligned to form the micro-slot payload, which is then transmitted within the secure micro-slot time window of the guard interval, seamlessly connecting with the transmission of the next time slot data.

[0011] The physical channel fingerprint extraction and dynamic token generation module continuously collects three inherent physical characteristic parameters from the underlying physical channels of the multiplexing system: a time slot transition interval sequence, recording the inherent jitter characteristics of physical time slot switching; a frequency deviation sequence, recording the deviation of the local oscillator frequency relative to the nominal center frequency; and a clock synchronization residual sequence, recording the synchronization residual between the local clock and the network master clock. The three collected data are averaged and zeroed before being concatenated into a normalized physical feature vector. Each element is then quantized into an 8-bit fixed-point integer to obtain a quantized feature byte sequence. The 128-bit master key (stored in the device's secure element and unreadable) is used to perform a hash operation on the quantized feature byte sequence to generate a 64-bit dynamic identity token strongly bound to the physical communication link. The current token is concatenated with the previous token and then XORed with the master key bit by bit to derive an update hash session key for use in the next round of micro-time slot hash calculation.

[0012] The dual-channel pipelined receiver processing module is deployed on the field-programmable gate array or multi-core on-chip system of the distributed control node on the receiving side. It adopts a parallel processing architecture of main channel and bypass channel. The main channel directly writes the received control message into the execution buffer without any judgment. The execution buffer adopts a first-in-first-out structure with protection gating. The read pointer is gating controlled by the instruction release signal. In the initial state, the read pointer is locked to ensure that the instruction is not executed before the verification is completed. The bypass channel parses the secure micro-timeslot payload and sequentially performs hash verification, physical layer integrity tag verification, dynamic identity token verification, and serial number anti-replay verification. The results of the four verifications are output as a comprehensive verification pass flag after logical AND operation by the comprehensive decision unit.

[0013] The hardware interrupt blocking and buffer management module performs hardware-level control based on the comprehensive verification pass flag: when the comprehensive verification passes, it sends an instruction release signal to the execution buffer, the read pointer advances, and the control instruction is sent to the execution engine for execution. When the comprehensive verification fails, the hardware interrupt controller immediately issues an interrupt signal, resets both the write pointer and read pointer of the execution buffer to their initial values ​​within one clock cycle, clears the buffer, and reports a security alarm event containing the failure verification item flag vector and timestamp to the upper-level exception management module.

[0014] Compared with the prior art, the beneficial effects of the present invention are as follows: To achieve zero-latency control link security protection, security verification data and control data are decoupled at the physical layer level of the multiplexed frame structure. The main control data channel executes the buffer with zero waiting time, while security verification is completed in parallel in the bypass hardware pipeline, completely eliminating the impact of security verification on control latency. This meets the microsecond-level end-to-end latency requirements of time-sensitive networks and enables cross-protocol domain identity binding anchored at the physical layer. Dynamic identity tokens are generated by extracting the underlying physical channel parameters of the multiplexed layer, and the tokens are strongly bound to the physical communication link. During cross-protocol conversion, fingerprint transmission and verification are performed by the edge gateway, effectively preventing cross-domain forgery and injection attacks. It has an inherent defense capability against physical layer covert attacks. The security protection anchor point is pushed down to the intersection of multiplexing at the physical layer and data link layer. Attackers cannot accurately construct forged micro-timeslot data that conforms to the physical timeslot sequence and channel fingerprint rules at the application layer, significantly increasing the difficulty of forgery. Attached Figure Description

[0015] Figure 1 This is a diagram of the overall system architecture of the present invention; Figure 2 This is a schematic diagram of the extended time-division multiplexing frame structure of the present invention; Figure 3 This is a flowchart of the dynamic identity token generation process of the present invention; Figure 4 This is a diagram of the dual-channel pipeline processing architecture of the present invention; Figure 5 This is a flowchart of the cross-protocol domain token passing and verification process of the present invention. Detailed Implementation

[0016] To further understand the invention's content, features, and effects, the following embodiments are provided, and detailed descriptions are given in conjunction with the accompanying drawings.

[0017] The structure of the present invention will now be described in detail with reference to the accompanying drawings.

[0018] I. System Overall Architecture like Figure 1 As shown, the IoT data security connection distributed control system proposed in this invention is divided into two main parts: a transmitting side and a receiving side, connected by a multiplexed physical channel. The transmitting side is deployed at the master control node or IoT edge gateway and includes a multiplexed frame structure management module, a secure micro-slot generation and embedding module, and a physical channel fingerprint extraction and dynamic token generation module. The receiving side is deployed at the distributed control node, programmable logic controller, or actuator gateway and includes a multiplexed frame parsing module, a dual-channel pipelined receiving and processing module, and a hardware interrupt blocking and buffer management module. In the figure, solid arrows distinguish the control data flow, dashed arrows mark the security credential data flow, and the interface signal names between each module are labeled.

[0019] II. Multiplexed Frame Structure and Security Microslot Definition like Figure 2 As shown, this invention extends the standard time-division multiplexing frame structure. A complete time-division multiplexing superframe consists of N data time slots and a guard interval at the end of each time slot. Within the guard interval, the front section is a physical protection zone used to absorb inter-symbol interference and multipath propagation delay, and the rear section is a newly defined security micro-time slot area used to carry security credential data.

[0020] The secure microslot carries four security credential fields: a behavior baseline hash value field (64 bits long, calculated and output by the SipHash-2-4 algorithm), a physical layer integrity tag field (32 bits long), a dynamic identity token field (64 bits long), and a microslot sequence number field (16 bits long). The four fields are concatenated byte-aligned, totaling 176 bits, or 22 bytes. The duration of the secure microslot is designed to not exceed the difference between the total duration of the protection interval and the minimum duration of the physical protection zone, thereby ensuring that the embedding of the secure microslot does not compress the physical protection zone, does not introduce additional inter-symbol interference, and does not affect the frame synchronization timing.

[0021] III. Secure Micro-timeslot Generation and Embedding Module This module is deployed in the field-programmable gate array or digital signal processor hardware of the transmitting master node or IoT edge gateway. It is responsible for immediately calculating and filling the corresponding secure micro-slot data after each time-division multiplexed data slot has been transmitted.

[0022] While the control message of the current data time slot is being sent, without waiting for subsequent operations, the clean payload content of the message, after removing fixed fields such as the frame synchronization header and time slot identifier, is sent to the input register of the hash calculation unit inside the field programmable gate array.

[0023] Load the 128-bit SipHash key for the current session from the key management register. This key is periodically updated by the dynamic token generation module. Perform the SipHash-2-4 algorithm on the clean payload of the control message, perform two rounds of compression and four rounds of finalization, and output a 64-bit behavioral baseline hash value.

[0024] The current physical layer channel status register is read synchronously to obtain the frequency deviation measurement value, clock synchronization deviation value, and transmission power amplitude value during the transmission period of this time slot. A 32-bit cyclic redundancy check value is calculated for the above physical layer parameter vector. Then, the check value is XORed with the lower 32 bits of the behavior baseline hash value to obtain a 32-bit physical layer integrity tag. This tag mixes the physical layer measured parameters with the control data hash value, so that any physical layer tampering will result in tag mismatch.

[0025] The system reads the currently valid 64-bit dynamic identity token from the dynamic token cache register and the current 16-bit micro-slot sequence number from the monotonically increasing counter. The counter increments frame by frame and wraps back when it overflows, which is used for anti-replay detection at the receiver. The system concatenates the behavioral baseline hash value, physical layer integrity tag, dynamic identity token, and micro-slot sequence number into a 22-byte micro-slot payload, aligned byte by byte. The payload is then transmitted within the safe micro-slot zone time window of the guard interval, seamlessly connecting with the transmission of the next time slot data.

[0026] IV. Physical Channel Fingerprint Extraction and Dynamic Token Generation Module like Figure 3 As shown, this module is responsible for continuously extracting inherent physical characteristic parameters of the channel from the underlying physical channel of the multiplexing system, and generating a dynamic identity token strongly bound to the physical communication link. The physical channel parameter acquisition includes three parallel acquisition sub-modules: The time slot transition sequence collector records the precise time of each time slot switching event using a local high-precision clock with a resolution of no less than 1 nanosecond within W consecutive time-division multiplexing superframe cycles. It calculates the difference between adjacent switching times to form a time slot transition interval sequence vector. This vector reflects the inherent jitter characteristics of physical time slot switching and is a unique fingerprint component of the physical link. The sampling window length W is set to 32 by default and is configurable. The frequency band fingerprint collector extracts the deviation value of the local oscillator frequency relative to the nominal center frequency on the transmit power spectrum of each time slot to form a frequency deviation sequence vector. The vector elements are read by the hardware frequency counter. The clock synchronization deviation collector reads the synchronization residual value between the local clock and the network master clock (such as the master clock of the precision time protocol) to form a clock jitter sequence vector. The element unit is nanosecond.

[0027] After the three acquisition results are averaged to zero, they are concatenated into a normalized physical feature vector according to a standardized format. Each element in the normalized physical feature vector is quantized into an 8-bit fixed-point integer to obtain a quantized feature byte sequence.

[0028] The SipHash-2-4 algorithm is executed on the quantized feature byte sequence using the 128-bit master key pre-installed at the device (stored in the device's security element, such as the trusted platform module or the fuse area, and cannot be read). This outputs a 64-bit dynamic identity token. The value of this token is strongly bound to the real-time status of the physical channel. If the physical link changes (such as a man-in-the-middle attack that changes the channel characteristics), the token will inevitably change accordingly.

[0029] The current 64-bit token is concatenated with the previous 64-bit token to form a 128-bit data, which is then XORed with the master key to obtain the updated 128-bit SipHash session key. This key is stored in the key management register for use by the secure micro-slot generation module in the next round of hash calculation. This derivation mechanism ensures that the key used in each round of micro-slot hash calculation changes dynamically, preventing key replay attacks. The token refresh cycle is configured in units of superframes, with a recommended range of 1,000 to 10,000 superframes, corresponding to a physical parameter sampling window of approximately 1 to 10 seconds. After the refresh, the current token is moved to the historical token register for later use.

[0030] V. Dual-channel pipeline receiving and processing module like Figure 4 As shown, this module is deployed on the field-programmable gate array or multi-core on-chip system of the distributed control node on the receiving side. It is the core hardware architecture for achieving zero-latency control and parallel security verification in this invention. After receiving a complete frame, the multiplexed frame parsing module synchronously performs time slot separation, sending the data time slot payload to the main channel input and the safety micro time slot payload in the protection interval to the bypass channel input. The two distribution operations are triggered simultaneously without any sequential dependency.

[0031] The main channel has no judgment logic and directly writes control messages into the execution buffer. The write pointer increments automatically. The execution buffer adopts a first-in-first-out structure with protection gating. The read pointer is gating controlled by the instruction release signal. The read pointer can only advance when the instruction release signal is valid, and the execution engine can only read the instruction. The instruction release signal is initially in an invalid state to ensure that the instruction is not executed before the verification is completed.

[0032] The bypass channel microslot parsing unit extracts four fields sequentially from the microslot payload by byte offset: the received behavior baseline hash value (64 bits), the physical layer integrity tag (32 bits), the dynamic identity token (64 bits), and the microslot sequence number (16 bits).

[0033] The SipHash verification unit uses the same current session key as the sending side to recalculate the hash value of the received control message and compares it with the received behavior baseline hash value. If they match, the hash verification flag is set to pass; otherwise, it fails.

[0034] The physical layer parameter verification unit reads the current channel measurement parameters from the local physical layer status register, recalculates the integrity label using the same calculation method as the transmitting side, and compares it with the received physical layer integrity label. If they match, the integrity label verification flag is set to pass; otherwise, it fails.

[0035] The dynamic identity token verification unit performs the same hash calculation on the quantized feature byte sequence collected by the local physical channel to obtain the expected token, and compares it with the received dynamic identity token. If they match, the token verification flag is set to pass; otherwise, it fails.

[0036] The serial number anti-replay verification unit maintains a local processed serial number register. It verifies that the received serial number is equal to the result of the local processed serial number plus one modulo 65536. If the result is satisfied, the serial number verification flag is set to pass and the local serial number register is updated. Otherwise, it is set to fail and a replay attack alarm is triggered.

[0037] The comprehensive decision unit performs a logical AND operation on the above four verification flags. If all four pass, the comprehensive verification pass flag is valid; if any one fails, the comprehensive verification pass flag is invalid.

[0038] VI. Hardware Interrupt Blocking and Buffer Management Module When the comprehensive verification passes, a release signal is sent to the execution buffer gating, the read pointer advances, and the control command is sent to the execution engine for execution. When the comprehensive verification fails, the hardware interrupt controller immediately sends an interrupt signal, the execution buffer management logic responds to the interrupt, and within one clock cycle, both the write pointer and the read pointer are reset to their initial values, the buffer is cleared, the release signal is kept invalid, the execution engine is locked, and at the same time, a security alarm event is reported to the upper-level exception management module. The alarm content includes the failed verification item flag vector and timestamp.

[0039] There is a safety margin between the control message being written to the execution buffer and the bypass verification result being output. This safety margin is equal to the sum of the transmission time of the secure micro-slot data and the channel propagation delay, plus the time required for the bypass verification unit to complete the four verifications, minus the inherent read delay between the execution buffer and the control execution engine. In a field-programmable gate array hardware pipeline implementation, the time required for the bypass verification unit to complete the four verifications is approximately 20 to 80 nanoseconds. The system design requires this safety margin to be greater than zero, meaning that the bypass verification result arrives before the control command is actually executed, to ensure that the hardware interrupt clearing of the buffer occurs before the command is executed in the worst case.

[0040] VII. Cross-protocol domain dynamic token passing mechanism like Figure 5 As shown, in the scenario of multi-protocol co-use in the Industrial Internet of Things (IIoT), this invention defines a cross-protocol domain dynamic token passing rule, taking a typical scenario of the field-layer low-power wide-area network protocol being forwarded to the control center message queue telemetry transmission protocol via the edge gateway as an example: Field-layer sensors transmit control data via low-power wide-area network multiplexed frames. A dynamic token generated based on the physical channel fingerprint is embedded in the secure micro-slot. After the frame arrives at the edge gateway, a complete four-step verification is performed. If the verification is successful, the edge gateway extracts the dynamic identity token and performs a hash operation on the dynamic identity token and the device identifier using the gateway's local cross-domain key to obtain the cross-domain token mapping value. This value is then appended to the protocol extension field of the uplink message queue telemetry transmission message and forwarded to the control center. The control center extracts the cross-domain token mapping value from the protocol extension field and verifies it using a pre-registered copy of the cross-domain key and the device identifier. If the verification is successful, the service data is processed; otherwise, it is rejected and an alarm is reported.

[0041] VIII. Alternative Implementation Methods In frequency division multiplexing systems (such as industrial wireless orthogonal frequency division multiplexing systems and power line carrier communication systems), the security micro-slot mechanism can be extended from the time dimension to the frequency dimension. A dedicated security sub-band with extremely narrow bandwidth is reserved in the spectrum allocation. The center frequency of the security sub-band is placed in the guard band area at the edge of the main service sub-band. The transmitting end modulates the security credential data on this security sub-band and transmits it in parallel with the main service sub-band. The receiving end demodulates the security sub-band independently through a narrowband filter. A dual-channel pipeline mechanism is also used for parallel verification and hardware blocking to achieve physical layer decoupling of the security credential and control data transmission.

[0042] In low-cost IoT node scenarios with limited computing resources, the dual-channel pipelined processing architecture can be implemented as a dual-thread concurrent software solution based on a field-programmable gate array (FPGA) on-chip RISC soft-core processor. The main thread, as a high-priority real-time thread, is responsible for receiving and writing control instructions to the execution buffer, while the verification thread, as a medium-priority thread, is responsible for micro-slot parsing and four-item verification logic. The two threads coordinate through a verification result flag in shared memory and software-simulated interrupts. The verification latency implemented in the software is approximately 0.5 to 5 microseconds. In low-speed IoT scenarios with control execution cycles on the order of milliseconds (such as environmental monitoring and building automation), it can still meet the design constraint of a safety margin greater than zero, achieve the same security protection effect as the hardware solution, and significantly reduce the node hardware cost.

Claims

1. A distributed control system for secure data connection in the Internet of Things (IoT), characterized in that, include: The multiplexed frame structure management module is used to extend the protection interval of the time-division multiplexed frame structure, dividing the protection interval into a physical protection zone and a secure micro-timeslot zone. The secure micro-timeslot zone carries a behavior baseline hash value field, a physical layer integrity label field, a dynamic identity token field, and a micro-timeslot sequence number field. The duration of the secure micro-timeslot zone does not exceed the difference between the total duration of the protection interval and the minimum duration of the physical protection zone. The secure micro-slot generation and embedding module is deployed on the transmitting side. After each data slot is sent, it performs a lightweight hash operation on the control message payload of the slot to obtain the behavior baseline hash value, calculates the physical layer integrity label by combining the current physical layer channel state parameters, reads the currently valid dynamic identity token and micro-slot sequence number, concatenates the four fields into a micro-slot payload, and sends it within the secure micro-slot time window. The physical channel fingerprint extraction and dynamic token generation module is used to continuously collect time slot transition interval sequence, frequency deviation sequence and clock synchronization residual sequence from multiplexed physical channels. After the three collected data are averaged to zero, they are concatenated into a normalized physical feature vector. Then, each element is quantized into an 8-bit fixed-point integer. The quantized feature byte sequence is hashed using the master key preset in the device security element to generate a dynamic identity token strongly bound to the physical communication link. The dual-channel pipelined receiving and processing module is deployed on the receiving side, including a main channel and a bypass channel. The two channels operate synchronously. The main channel directly writes the received control messages into the execution buffer without waiting. The bypass channel parses the security micro-slot payload and sequentially performs hash verification, physical layer integrity tag verification, dynamic identity token verification, and serial number anti-replay verification. The results of the four verifications are output as a comprehensive verification pass flag after being logically ANDed by the comprehensive decision unit. The hardware interrupt blocking and buffer management module is used for hardware-level control based on the comprehensive verification pass flag: when the comprehensive verification passes, an instruction release signal is sent to the execution buffer, allowing the control instruction to be sent to the execution engine for execution; when the comprehensive verification fails, the hardware interrupt controller resets both the write pointer and read pointer of the execution buffer to their initial values ​​within one clock cycle, completes the buffer clearing, and reports a security alarm event containing the failure verification item flag vector and timestamp to the upper-level exception management module.

2. The system according to claim 1, characterized in that, The behavior baseline hash value field carried by the secure micro-slot area has a length of 64 bits, the physical layer integrity label field has a length of 32 bits, the dynamic identity token field has a length of 64 bits, and the micro-slot sequence number field has a length of 16 bits. The total length of the four fields after being concatenated byte-aligned is 22 bytes.

3. The system according to claim 1, characterized in that, The secure micro-slot generation and embedding module uses the SipHash-2-4 algorithm to perform hash operations. The physical layer integrity tag is obtained by bitwise XORing the 32-bit cyclic redundancy check value of the physical layer parameter vector with the lower 32 bits of the behavior baseline hash value. The micro-slot sequence number is generated by a monotonically increasing counter, incrementing frame by frame, and wrapping back when overflowing.

4. The system according to claim 1, characterized in that, The physical channel fingerprint extraction and dynamic token generation module is also used to: concatenate the current dynamic identity token with the previous dynamic identity token and then XOR it with the device master key to obtain the updated hash session key, which is used by the secure micro-slot generation and embedding module in the next round of hash calculation. The token refresh cycle is configured in units of superframes, and after the refresh is completed, the current token is moved into the historical token register.

5. The system according to claim 1, characterized in that, The execution buffer adopts a first-in-first-out structure with protection gating. The read pointer is gating controlled by the instruction release signal. The initial value of the instruction release signal is invalid. The safety margin between the control message being written into the execution buffer and the bypass verification result being output is greater than zero, so as to ensure that the bypass verification is completed before the control instruction is executed.

6. The system according to claim 1, characterized in that, The serial number anti-replay verification unit of the bypass channel maintains a local processed serial number register. It verifies that the received serial number is equal to the result of the local processed serial number plus one modulo 65536. If the condition is met, the verification is passed and the local serial number register is updated. If the condition is not met, a replay attack alarm is triggered.

7. The system according to claim 1, characterized in that, The system also includes a cross-protocol domain dynamic token passing unit, deployed on the edge gateway, used in multi-protocol mixed scenarios: after completing four verifications on the security micro-slots from the field layer multiplexed frames, the dynamic identity token is extracted, and the cross-domain key of the edge gateway is used to perform a hash operation on the dynamic identity token and the device identifier to obtain the cross-domain token mapping value. The cross-domain token mapping value is appended to the extended field of the uplink protocol message and forwarded to the control center. The control center uses a pre-registered copy of the cross-domain key and the device identifier to verify the cross-domain token mapping value. If the verification is successful, the business data is processed; if the verification fails, the data is rejected and a security alarm is reported.

8. The system according to claim 1, characterized in that, The multiplexing frame structure management module supports frequency division multiplexing mode: a dedicated security sub-band is reserved in the spectrum allocation, the center frequency of the security sub-band is located in the guard band area at the edge of the main service sub-band, the transmitting end modulates the security credential data on the security sub-band and transmits it in parallel with the main service sub-band, the receiving end demodulates the security sub-band independently through a narrowband filter, and performs parallel verification and hardware blocking through a dual-channel pipeline mechanism.

9. The system according to claim 1, characterized in that, The dual-channel pipeline receiving and processing module is implemented using a dual-thread concurrent software solution of a field-programmable gate array on-chip soft-core processor: the main thread is responsible for controlling the writing of the instruction receiving and execution buffer, and the verification thread is responsible for micro-timeslot parsing and four-item verification logic. The two threads coordinate through the verification result flag bit in shared memory and software simulated interrupts. The software simulated interrupts trigger the main thread to execute the buffer clearing logic.

Images