Firewall security configuration method and system for industrial internet

Abstract

The application relates to the field of industrial internet firewalls, and discloses a firewall security configuration method and system for industrial internet. The application mainly solves the problems that the traditional firewall is prone to causing industrial control message packet loss and time sequence jitter during policy switching, and a single network feature is easy to be forged. The method comprises the following steps: obtaining upper-layer work order service instructions and lower-layer physical electrical characteristics, and performing time sequence coupling cross verification to determine the running stage transition of a target device; extracting a security policy containing an industrial protocol application layer read-write permission and preloading the security policy to a standby cache area; analyzing an industrial bus clock synchronization frame, locating a microsecond-level interframe idle window period between adjacent control periods; and completing atomic pointer switching of a firewall main cache area and a standby cache area in the window period.

Description

Technical Field

[0001] This invention relates to the field of industrial internet firewalls, and discloses a firewall security configuration method and system for the industrial internet. Background Technology

[0002] With the deep integration of the Industrial Internet, industrial firewalls have become a crucial infrastructure for ensuring the security of production networks. Currently, most mainstream firewall security configuration mechanisms rely on static network layer rules or simply generate basic access whitelists through shallow traffic learning. This makes it difficult to adapt to the dynamic security needs of production equipment during different operational phases, such as routine processing, high-frequency debugging, or downtime maintenance. Furthermore, some existing technologies that attempt to introduce dynamic configuration often rely solely on single logical commands issued by the upper-layer information management system to trigger policy switching. Due to the lack of time-series cross-verification with the physical and electrical characteristics of the underlying controller, firewalls are highly susceptible to being deceived and granting high-risk permissions if upper-layer business commands are hijacked or forged by hackers, resulting in serious security blind spots.

[0003] In the dynamic update and distribution of firewall policies, existing configuration update operations are typically independent of the physical cycle time of the underlying industrial communication system. In industrial control scenarios requiring microsecond-level response, arbitrarily loading and resetting security policies during high-frequency real-time data interaction can easily disrupt data access to the underlying network interface, causing latency jitter or even severe packet loss in critical control messages, potentially leading to equipment malfunction or unplanned shutdowns of the entire production line. In summary, existing industrial firewall configuration mechanisms have significant deficiencies in terms of the reliability of state transition identification against forgery and the microsecond-level timing security during dynamic policy distribution, making it difficult to meet the dual requirements of high-frequency dynamic defense and extreme communication continuity in industrial interconnection scenarios. Summary of the Invention

[0004] To overcome the aforementioned deficiencies of the prior art and to achieve the above objectives, the present invention provides the following technical solution: a firewall security configuration method for the Industrial Internet, comprising: S1: Acquire multi-source status data of the target device, including work order business instructions issued by the upper-level production system, and physical and electrical characteristics of the underlying controller synchronously collected by the edge side; S2: Perform time-coupled cross-verification of the work order business instruction and the physical and electrical characteristics. After verification, determine that the operating phase of the target equipment has changed. S3: In response to the aforementioned changes, extract the target security policy containing the industrial protocol application layer read / write permissions and register value field whitelist, and compile and preload it into the firewall's backup cache area; S4: Analyze the clock synchronization frame of the industrial bus where the target device is located, and locate the microsecond-level inter-frame idle window period between adjacent control cycles; S5: Using the arrival of the inter-frame idle window as a trigger condition, complete the atomic pointer switching of the firewall primary and backup buffers within the window period.

[0005] Preferably, in S1, the physical and electrical characteristics of the underlying controller synchronously acquired from the edge side include: The system collects drive status parameters, control status parameters, and interface status parameters during the operation of the target device, and timestamps these parameters based on a unified time base to generate a device status data sequence corresponding to the work order service instruction.

[0006] Preferably, in step S1, the work order service instruction includes target device identification information, device task type information, and task execution time information; Through data interaction between the industrial production management system and the edge communication node, the work order service instructions are transmitted to the edge, and the corresponding equipment status data collection object is determined according to the target equipment identification information.

[0007] Preferably, in step S2, the step of performing time-series coupling cross-validation between the work order service instruction and the physical electrical characteristics includes: The expected time range for equipment operation is determined based on the work order instructions. Obtain the actual response time corresponding to the physical and electrical characteristics, and determine whether the actual response time is within the expected time range of the device operation; When the actual response time meets the time consistency requirement, and the change trend corresponding to the physical electrical characteristics matches the equipment action type corresponding to the work order business instruction, the timing coupling cross-validation is determined to be successful.

[0008] Preferably, in S2, the operational phase transition of the target device includes: Based on the changes in task type corresponding to the work order business instruction and the changes in state corresponding to the physical and electrical characteristics, the target equipment is determined to switch from the current operating stage to another operating stage; The operation phase includes at least the production execution phase, the parameter adjustment phase, and the equipment maintenance phase.

[0009] Preferably, in step S3, the extraction of the target security policy includes: Based on the operational phase of the target device after its transformation, obtain historical communication behavior records for the corresponding phase. The industrial protocol communication type, access object, and data interaction range are extracted from the historical communication behavior records to form a set of security policies corresponding to the current operating stage.

[0010] Preferably, in S4, the microsecond-level inter-frame idle window period between adjacent control cycles includes: Acquire industrial bus communication cycle information and data frame transmission status within the cycle; Based on the data transmission status completed within the current communication cycle, the time interval during which no real-time data interaction occurs between adjacent control cycles is determined, and the time interval is defined as the strategy switching window.

[0011] Preferably, in step S5, the atomic pointer switching of the firewall primary and backup caches includes: Within the policy switching window, pause the data access process corresponding to the security policy configuration update operation; Set the target security policy that has been loaded in the backup cache as the currently effective policy, and update the firewall policy call relationship synchronously.

[0012] Preferably, after S5, the following is also included: Obtain industrial communication status information after the target security policy takes effect; Based on the industrial communication status information, determine whether the data transmission status after the strategy switch meets the preset communication requirements; If the preset communication requirements are not met, the security policy state before the switch is restored in the next policy switching window, and a corresponding policy adjustment record is generated.

[0013] A firewall security configuration system for the Industrial Internet includes: Data acquisition module: used to acquire multi-source status data of the target device, including work order business instructions issued by the upper-level production system, and physical and electrical characteristics of the underlying controller synchronously collected by the edge side; Cross-validation module: used to perform time-coupled cross-validation of the work order business instructions and the physical and electrical characteristics, and determine that the operation phase of the target equipment has changed after the verification is valid; Policy preloading module: In response to the changes, it extracts the target security policy containing the industrial protocol application layer read and write permissions and register value field whitelist, and compiles and preloads it into the firewall's backup cache. Window positioning module: used to parse the clock synchronization frame of the industrial bus where the target device is located, and locate the microsecond-level inter-frame idle window period between adjacent control cycles; Atomic switching module: used to complete the atomic switching of the firewall primary and backup buffers within the window period, triggered by the arrival of the inter-frame idle window period.

[0014] Compared with the prior art, the present invention has the following beneficial effects: This invention constructs an anti-counterfeiting system that transcends the boundaries of information technology and operational technology by performing time-series coupling and cross-verification between upper-layer work order business instructions and lower-layer physical and electrical characteristics. This mechanism effectively overcomes the vulnerability of single network instructions to hijacking and tampering, ensures extremely high authenticity in determining changes in device operating status, and prevents the risk of firewalls being deceived and mistakenly granting high-risk permissions.

[0015] This invention solves the problem of conflicts between dynamic policy distribution and underlying communication timing by precisely locating the microsecond-level inter-frame idle window of the industrial bus and completing the atomic pointer switching of the primary and backup buffers during this period. This mechanism ensures seamless loading of new policies, completely avoids timing jitter and data packet loss in control messages, and eliminates the risk of equipment malfunction or downtime caused by configuration updates.

[0016] This invention, based on precise determination of the device's operational phase, dynamically extracts and applies fine-grained security policies that include application-layer read / write permissions and register value whitelists. This mechanism overcomes the shortcomings of traditional firewall static rules, which cannot adapt to changes in production, enabling security protection to closely align with different business scenarios such as processing, debugging, or maintenance, thus minimizing the attack surface while ensuring business continuity. Attached Figure Description

[0017] Figure 1 This is a schematic diagram of a firewall security configuration method for the Industrial Internet according to the present invention. Figure 2 This is a schematic diagram of a firewall security configuration system structure for the Industrial Internet according to the present invention; Figure 3 This is a timing diagram of the atomic switching of the window period security strategy of the present invention. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention. Example

[0019] Please see Figures 1-3 As shown, this embodiment provides a firewall security configuration method and system for the Industrial Internet, specifically including the following steps: In this embodiment, multi-source status data of the target device is acquired, including work order business instructions issued by the upper-layer production system and physical and electrical characteristics of the lower-layer controller synchronously collected by the edge side, specifically including: As the core scheduling node of the manufacturing network, the industrial production management system is responsible for the macro-level planning and command issuance of overall production tasks. This system establishes a stable and secure data exchange channel with edge communication nodes deployed on the production site. Through this channel, the system accurately transmits work order business instructions containing specific production and manufacturing logic to the edge. These edge communication nodes not only act as a bridge for network protocol parsing and conversion but also serve as a crucial hub connecting the upper-layer information technology network and the lower-layer operational technology network.

[0020] Upon receiving the work order service instruction, the edge communication node parses its format using the protocol parsing module, extracting the device identification information, task type information, and task execution time information contained within. This work order service instruction contains three core metadata dimensions: target device identification information, device task type information, and task execution time information.

[0021] Target device identification information is used to identify the corresponding physical device object in the industrial network topology. This is specifically represented by the media access control address, network interconnection protocol address, or globally unique product serial number of the underlying controller. This identification information is used to identify the corresponding production equipment in the industrial network topology. The task type information clearly defines the specific process action attributes that the target device needs to perform next. For example, instructing an industrial robot to perform high-frequency spot welding, instructing a CNC machine tool to perform routine cutting, or instructing a conveyor belt to enter low-power standby mode. The task execution time information provides the time constraints for the above process actions, typically including the task schedule start time, expected execution cycle, and task deadline accurate to milliseconds.

[0022] The edge communication nodes, based on the parsed target device identification information, perform a lookup and comparison in their locally maintained asset ledger and routing mapping tables to uniquely identify the corresponding device status data collection target. This process signifies that the system, starting from macroscopic business logic instructions, has successfully located a specific industrial piece of equipment in the physical world and subsequently activated various bypass data acquisition probes and monitoring gateways deployed around the target device. Employing bypass monitoring allows for the preparation of hardware-level pathways for subsequent physical status sensing without affecting the real-time performance of the existing industrial control bus.

[0023] After identifying the specific devices whose status data to collect, the data acquisition module begins to synchronously sense and collect three types of key underlying electrical data during the target device's operation: drive status parameters, control status parameters, and interface status parameters. These three types of parameters comprehensively depict the device's actual physical performance in response to business commands from different dimensions.

[0024] Drive status parameters directly reflect the energy consumption and physical motion characteristics of the target equipment's power actuators, such as the stator three-phase current fluctuation amplitude of the servo motor, the real-time speed feedback of the rotor, and the voltage change curve of the driver's DC bus. These parameters are the most direct evidence for determining whether the equipment is under high load or in a state of actual mechanical work, and are difficult for hackers to forge using purely software methods.

[0025] Control status parameters focus on reflecting the operational health and system load of the target device's internal computing center, such as the real-time computing utilization of the programmable logic controller's central processing unit, the read / write refresh frequency of the internal memory, and the level fluctuation status of the backplane communication bus. These parameters can reveal whether the device's underlying control program is operating stably as expected by the business logic.

[0026] Interface status parameters primarily record discrete signal variations in the interaction between the target device and the external physical environment, such as the high / low level switching frequency of various digital input / output ports, the activation and deactivation status of field safety relays, and the duty cycle of pulse signals at fieldbus terminals. These physical-level signal variations are direct physical representations of the device's response to external network commands.

[0027] To ensure precise time-scale alignment between the massive and heterogeneous underlying physical and electrical characteristics and macroscopic work order instructions, the system introduces a globally unified time reference mechanism. Edge devices maintain clock consistency with the upper-level industrial production management system and various sensors at the lower level through a high-precision time synchronization protocol, ensuring the entire factory network shares the same absolute time coordinate system. Based on this unified time reference, the edge data processing unit rigorously timestamps each real-time acquired drive status parameter, control status parameter, and interface status parameter, assigning a high-precision timestamp to each consecutive data sampling point.

[0028] After being uniformly time-stamped, the system cleans, extracts features, and reassembles the three types of timestamped data, generating a continuous sequence of equipment status data in chronological order. Because this data sequence is generated and continuously recorded within the task execution time window defined by the work order instruction, the final constructed equipment status data sequence forms a highly close correspondence with the work order instruction. This multidimensional data sequence is not merely a simple collection of underlying electrical signals, but a true physical echo of the upper-level digital instructions across three levels: power physical work, core logic operations, and external interface interactions.

[0029] In this embodiment, the work order service instruction and the physical and electrical characteristics are time-coupled and cross-validated. After verification, it is determined that the operating phase of the target equipment has changed. Specifically, this includes: The edge computing node first parses the message structure of the received work order service instruction, extracting the task issuance timestamp and the expected latency for instruction network transmission and processing. The system then adds the task issuance timestamp to the expected latency to accurately calculate the theoretical start time at which the target device's physical actuator should respond. Using this theoretical start time as the central reference point, and combining it with the average mechanical response lag time statistically analyzed from the target device's historical operation, preset time tolerances are extended forward and backward to construct a strictly closed expected time range for device action. This time range represents the reasonable time window for the underlying device to generate a physical response after a normal and legitimate instruction is issued in an industrial internet environment.

[0030] Meanwhile, the system continuously monitors the physical and electrical characteristic data streams transmitted from the underlying devices. Through a waveform edge detection algorithm built into the edge side, the system captures in real time the exact moments when drive parameters or interface parameters undergo significant step changes or threshold crossings. These abrupt changes often directly correspond to the actual physical actions of servo motor power-on or contactor engagement, and the system accurately records this as the actual response time corresponding to the physical and electrical characteristics. Subsequently, the system projects the acquired actual response time into a previously constructed tolerance window to determine whether the actual response time falls within the expected time range of the device's action. Only when the actual response time precisely falls within this expected range will the system determine that the device's physical action response meets the time consistency requirement. This completely eliminates the security risks of external hackers launching network delay attacks or command delay replay attacks.

[0031] Furthermore, considering that physical mechanical wear and increased transmission clearances inevitably occur in industrial target equipment during long-term, high-frequency operation, resulting in a gradual hysteresis in the physical response, a timing aging drift compensation mechanism is introduced to avoid misjudging such legitimate response timeouts as illegal attacks. The system continuously extracts the actual response time of the target equipment over multiple control cycles and calculates the long-term first derivative sequence of the time delay characteristics. When the system detects that the extension of the actual response time exhibits a slow, approximately linear growth trend with minimal and stable derivatives, rather than a sudden step change within a short period, it determines this change to be a legitimate physical aging characteristic of the equipment. Based on this determination, the system automatically invokes the built-in drift compensation function to positively expand the upper limit of the time tolerance of the expected time range of the equipment's actions, and simultaneously fine-tunes the benchmark matching threshold of subsequent physical and electrical characteristic evaluation factors proportionally, thereby improving the system's adaptability to changes in the long-term operating state of the equipment.

[0032] Based on the established time consistency requirements, the system further analyzes whether the changing trends of physical and electrical characteristics match the equipment action types corresponding to work order business instructions. Different business processing instructions inevitably lead to drastically different physical work performance. To achieve the correlation judgment between work order business instructions and underlying physical and electrical characteristics, the system constructs a multi-dimensional feature coupling evaluation calculation model. It then performs comprehensive calculations based on time consistency evaluation factors, state change trend matching degrees, and electrical action amplitude evaluation factors to obtain the comprehensive behavior matching degree of the target equipment, which is used to determine the degree of consistency between the current work order business instruction and the actual operating state of the equipment. The specific mathematical calculation formula for this multi-dimensional feature coupling evaluation mechanism is expressed as follows: ,in, This represents the overall behavioral matching score of the target device. The higher the score, the better the match between the upper-level business instructions at the information technology level and the lower-level physical representation at the operational technology level.

[0033] This represents the time consistency evaluation factor, used to reflect the degree of deviation between the actual response time and the theoretical response time; The state change trend matching evaluation factor is used to reflect the matching relationship between the collected physical and electrical characteristic change trends and the state change trends corresponding to the actions performed by the target equipment. This represents the electrical action amplitude evaluation factor, used to reflect the correlation between the magnitude of changes in drive current or the degree of changes in interface status and the corresponding device action of the current work order business instruction.

[0034] This represents the basic weight ratio coefficient set by the system for the time consistency evaluation factor; This represents the basic weighting ratio coefficient set by the system for the matching score of state change trends; This represents the basic weight ratio coefficient set by the system for the electrical action amplitude evaluation factor. The sum of the above three basic weight ratio coefficients is 1. The system determines the corresponding weight ratio based on the target equipment type, operating stage, and historical status data, so that the time consistency evaluation factor, the status change trend matching degree evaluation factor, and the electrical action amplitude evaluation factor all participate in the comprehensive behavior matching degree calculation.

[0035] In this system, the setting mechanism for the three factors is divided into two stages: initial baseline setting and dynamic adaptive adjustment. , and These represent the basic weight ratio coefficients for the time consistency evaluation factor, the state change trend matching degree evaluation factor, and the electrical action amplitude evaluation factor, respectively. The system strictly stipulates that the sum of these three coefficients must be 1. Initial baseline setting: When the target device is first connected, the system collects data under its normal operating conditions to establish an evaluation parameter baseline, and determines the initial corresponding weight ratios of these three factors based on the type of the target device, the current operating stage, and historical state data. Dynamic adjustment during operation: During the continuous operation of the device, the system continuously acquires physical and electrical characteristic data corresponding to the execution process of new legitimate work orders. By comparing and analyzing these newly collected data with historical state data, the system dynamically adjusts the weight ratios of these three factors according to the actual changes in the device's operating state, thereby improving the system's adaptability to different device operating states.

[0036] For example, consider an industrial robot on an automated welding production line for automotive parts. When the robot is brand new and connected to the control network for the first time, its mechanical transmission backlash is extremely small and its action response is extremely fast. Based on this, the system assigns it a high time consistency base weight and sets the initial evaluation weight coefficient as follows: , , As the robot undergoes prolonged and frequent spot welding operations on the actual production line, physical and mechanical wear and legitimate progressive response hysteresis inevitably occur. By continuously comparing the latest physical and electrical characteristic data with historical baseline data, the system accurately identifies this legitimate physical aging trend and triggers a dynamic adjustment mechanism to adaptively update its weight. , , This dynamic adjustment mechanism, while being compatible with changes in the physical state of the underlying entities, effectively ensures the reliability of intercepting high-frequency malicious forged commands and the accuracy of cross-validation.

[0037] Specifically, to accommodate the differences in operating status, response time, and electrical characteristics of different target devices, the system establishes a corresponding status evaluation parameter benchmark based on the normal operating status data collected when the target device is first connected. During device operation, the system acquires the physical and electrical characteristic data corresponding to the execution process of new legitimate work orders and compares and analyzes it with historical status data. Based on changes in device operating status, the system adjusts the weight ratios of the time consistency evaluation factor, the status change trend matching degree evaluation factor, and the electrical action amplitude evaluation factor, while also adjusting the comprehensive behavior matching degree judgment threshold to improve the adaptability of judgments under different device operating states.

[0038] When the calculated comprehensive behavior matching score is greater than or equal to the system's pre-set security and anti-counterfeiting verification threshold, the system determines that the changing trend of the physical and electrical characteristics at this time completely matches the equipment action type, and accordingly determines that the timing coupling cross-verification has passed. This cross-border verification passing indicates that the current industrial control action is triggered by a legitimate and tamper-proof upper-level instruction.

[0039] Provided that the temporal coupling cross-validation is valid and passes, the system immediately initiates the state transition identification process. Based on the change in task type corresponding to the work order's business instruction and the state change corresponding to the physical and electrical characteristics, the system jointly determines whether the target device has switched from its current operating phase to another. This two-factor concurrent verification completely eliminates the possibility of being deceived by a single network source.

[0040] In this process, the system clearly defines the target equipment's operation phases as including at least three core modes: production execution phase, parameter adjustment phase, and equipment maintenance phase. The production execution phase represents the equipment being in a large-scale, standardized assembly line manufacturing process. At this time, the tasks issued are mainly high-frequency cyclic processing instructions, and the corresponding physical and electrical characteristics exhibit regular, periodic peak-to-valley fluctuations. The parameter adjustment phase represents on-site engineers performing non-standardized prototyping or program resets on the equipment's motion trajectory or specific process parameters. At this time, the task types change to discrete debugging instructions or memory overwrite instructions, and the physical and electrical characteristics no longer possess strict periodic continuity, but rather exhibit short, irregular, tentative low-power current fluctuations. The equipment maintenance phase means the equipment is in a shutdown maintenance, safety inspection, or mold replacement state. At this time, the tasks issued from the upper layer are tagging and locking instructions or deep emergency stop instructions. The corresponding physical and electrical characteristics reduce interaction, manifested as a complete power outage of the main drive power circuit, servo motor phase current values ​​returning to zero, and the equipment only retaining the underlying network communication interface to maintain the most basic weak heartbeat message interaction.

[0041] By closely monitoring the synchronous changes in task type logic instructions and underlying electrical fluctuations, the system can accurately capture the switching nodes of the target device between the three operating stages mentioned above, thus providing a trigger point for subsequently extracting and issuing fine-grained safety strategies adapted to the characteristics of the new stage.

[0042] In this embodiment, in response to the aforementioned changes, a target security policy containing industrial protocol application layer read / write permissions and register value field whitelists is extracted and compiled and preloaded into the firewall's backup cache. Specifically, this includes: Once the system accurately determines, through the aforementioned temporal coupling cross-validation and multimodal state change analysis, that a substantial change has occurred in the operational phase of the target device, the security policy configuration center deployed on the edge computing node or central control terminal will immediately detect and respond to this change event. Considering the differences between different operational phases in industrial manufacturing sites, each phase inevitably brings with it drastically different network communication requirements and information security risk exposure surfaces. Therefore, the system automatically triggers a dynamic reconstruction and generation mechanism for security policies tailored to the new operational phase, thereby ensuring that the security protection boundary of the underlying industrial network can adaptively and elastically scale according to the business status of the physical devices.

[0043] In the specific process of generating the target security policy, the system first proactively initiates a data query request to the local edge storage or the industrial traffic audit database in the cloud, based on the new operational phase of the target device after its transition, to obtain historical communication behavior records for the corresponding phase. These historical communication behavior records are not simple network connection logs, but rather records of normal communication behavior obtained by the system when the target device was in the same operational phase in the past, through historical traffic collection and security behavior statistics. For example, when the target device transitions from a routine, standardized production execution phase to a parameter adjustment phase that receives non-standard instructions, the system will accurately retrieve all clean data interaction records generated by that specific device during its historical parameter adjustment phases. This backtracking mechanism based on historical steady-state data and real business scenarios provides a data foundation for generating customized security policies.

[0044] After acquiring a massive and detailed record of historical communication behavior, the system's message parsing module analyzes these records, first extracting two key network behavior characteristics: industrial protocol communication type and access object. When extracting the industrial protocol communication type, the system proactively strips away the transport layer shell of the data packets, deeply analyzing the protocol identifiers and message structures of specific industrial control protocols to determine the industrial communication language that the device must rely on during its current operational phase. When extracting the access object, the system precisely identifies the network interconnection protocol addresses, media access control addresses, and specific communication port numbers of the legitimate initiators and receivers in the historical communication records. This allows the system to determine which specific upper-level engineering stations, industrial gateways, or adjacent cascaded controllers the target device is permitted to exchange data with during a specific operational phase, thereby constructing a tight access isolation boundary at the network topology level.

[0045] Furthermore, the system extracts deeper data interaction ranges from the historical communication behavior records. This extraction process directly determines the accurate generation of read / write permissions and register value range whitelists for the industrial protocol application layer. The system parses the data payload portion of historical messages and determines the corresponding read / write permission ranges based on the industrial protocol function codes and register access records. For example, during normal production execution, the system may only extract read permission instructions such as status queries or heartbeat keep-alive through record analysis; while during equipment maintenance or parameter adjustment, the system will legally extract write permission instructions that include process parameter modifications. Simultaneously, the system extracts the absolute addresses of frequently interacted programmable logic controller (PLC) registers from historical communications and performs statistical extreme value analysis and normal distribution calculations on the read / write values ​​corresponding to these addresses to determine the maximum upper limit and minimum lower limit of acceptable values ​​for specific registers under safe production conditions. These read / write permission restrictions for specific function codes and the address ranges with strict upper and lower limit value constraints together solidify the register value range whitelist for the industrial control protocol payload content.

[0046] Through the aforementioned multi-dimensional feature extraction and deep semantic analysis, the system structurally reorganizes and logically concatenates the extracted industrial protocol communication types, access objects, and data interaction ranges covering application-layer read / write permissions and register value whitelists. This results in a security policy set that perfectly corresponds to and is highly compatible with the current operational phase. This security policy set completely abandons the crude management based on simple five-tuples used by traditional information technology firewalls, achieving extremely fine-grained flexible access control down to the level of industrial control instructions and underlying process parameters. It can minimize the exposure to malicious network attacks and illegal parameter tampering while ensuring that industrial business continuity is not affected at all.

[0047] Finally, to smoothly deploy this target security policy to the underlying network in the industrial field, the system needs to compile and preload it into the firewall's backup buffer. Since the newly generated security policy set is often described using high-level logic languages ​​or extensible markup languages, the underlying hardware data flow forwarding plane of the industrial firewall cannot directly recognize and execute it. Therefore, the system's built-in underlying policy compiler quickly starts. This compiler performs a dimensionality reduction translation of these complex access object restrictions and value domain whitelist constraints, generating access control lists and bitmap rule matching trees that the underlying hardware processor can retrieve concurrently at high frequency. The compiled, efficient binary configuration instructions are then distributed to the industrial firewall deployed at the front end of the target device through a secure, encrypted management channel. To avoid disrupting normal real-time industrial communication during policy distribution and writing, these newly compiled binary configuration instructions do not take effect immediately but are precisely pushed into the silent backup buffer in the firewall's hardware memory architecture for residence and preloading. Throughout the process of loading and receiving the new policy in the backup buffer, the existing security policies in the firewall's main buffer continue to perform high-speed packet filtering and forwarding tasks, thus providing comprehensive underlying data preparation for seamless switching using microsecond-level idle windows.

[0048] In this embodiment, parsing the clock synchronization frame of the industrial bus where the target device is located and locating the microsecond-level inter-frame idle window period between adjacent control cycles specifically includes: In industrial internet control scenarios, the underlying communication protocols generally employ time-sensitive networking (TSN) or high real-time industrial Ethernet architectures. To ensure highly deterministic latency in the coordinated actions of massive numbers of automated devices, these network architectures periodically broadcast clock synchronization messages at the network data link layer. The firewall's built-in deep packet inspection engine accesses the industrial bus in full-duplex bypass monitoring mode, accurately intercepting the clock synchronization frames sent by the master controller during each round of communication initiation. By deeply analyzing these clock synchronization frames, the system can extract crucial global network scheduling information, namely, the industrial bus communication cycle information. This industrial bus communication cycle information clearly defines the absolute time span required for the master station and all slave devices to complete a full round of data interaction, defining the most basic time rhythm of the underlying control network operation.

[0049] After clarifying the industrial bus communication cycle information, the system further continuously tracks and acquires the data frame transmission status within the current communication cycle. The number of process parameter reads and writes involved in each control cycle is not constant, causing the actual data throughput within the current communication cycle to exhibit dynamic fluctuations. By accumulating the total length of data packets successfully sent and acknowledged within the current communication cycle in real time, and combining this with the current physical layer transmission baud rate of the industrial bus, the system can accurately calculate the actual transmission time occupied by these real-time control messages on the bus medium. The data frame transmission status within this cycle not only reflects the current load congestion level of the industrial control network but also precisely depicts the end point of effective data interaction activities on the timeline.

[0050] The system then determines the time interval between adjacent control cycles where no real-time data interaction occurs based on the data transmission status completed within the current communication cycle. In most standard high-real-time industrial communication cycles, to prevent data frame overflow and to provide necessary redundancy and fault tolerance for the network, the master station will never completely fill the time slice of the entire communication cycle. After all the real-time control data frames that must be exchanged and the regular alarm messages have been transmitted, there will inevitably be a period of absolute silence and network idle time on the industrial bus until the clock synchronization frame of the next communication cycle arrives. During this time interval, the target device and its industrial bus do not perform any form of real-time data interaction.

[0051] The system utilizes a real-time computing engine to identify this time interval as the policy switching window, thus successfully locating the microsecond-level inter-frame idle window period between adjacent control cycles. To achieve precise quantification of the policy switching window duration, the system employs a high-precision mathematical derivation model for calculation. The specific time parameter calculation formula is expressed as follows: ,in, This represents the duration of the inter-frame idle window, measured in microseconds, that the system ultimately determines and that the firewall can perform underlying memory replacement operations; it is also the total duration of the aforementioned policy switching window. The calculation of this window duration is accurate to the microsecond level and is a core time boundary ensuring that the firewall can achieve seamless policy application. This represents the total duration of the industrial bus communication cycle obtained by the system through parsing the clock synchronization frame. This total duration is determined by a globally constant time cycle parameter preset by the industrial automation master station system, which determines the speed of the communication cycle of the entire production line. This represents the cumulative time spent transmitting all valid data frames within the current communication cycle, calculated by the system based on the completed data transmission status. This time includes the total time spent transmitting the message header to the cyclic redundancy check (CRC) code on the physical medium, and is the most significant portion of network usage within the communication cycle. This represents the sum of the fixed transmission time of the clock synchronization frame itself and the hardware latency required for each device to process the clock synchronization protocol. This time represents the basic time overhead that an industrial bus must incur to maintain a globally unified clock.

[0052] As can be seen from the above formula parameters, the total duration of the policy switching window is essentially equal to the total duration of the entire industrial bus communication cycle, minus the cumulative time consumed by all valid data frame transmissions, and then minus the basic clock synchronization time overhead, leaving the remaining absolute quiet clearance time. The system determines this microsecond-level network gap as the only legitimate secure time interval for implementing security firewall configuration replacement. This mechanism of positioning the policy switching window within the absolute network quiet period overturns the inherent mode of random or asynchronous configuration distribution by traditional information security devices. Because if a firewall configuration update command is forcibly inserted when the target device is in the stage of high-speed data frame transmission and reception or critical clock synchronization alignment, it will inevitably cause the transmission and reception queue of the underlying network interface chip to be unexpectedly blocked, thereby causing serious control message timing jitter, and even causing control command loss and physical equipment shutdown. In this embodiment, all pointer flipping and rule base overwriting actions related to firewall kernel-state data are forcibly limited to this network gap, ensuring from the physical timing root that dynamic changes in security policies can be completely hidden in the underlying control communication cycle.

[0053] In this embodiment, the arrival of the inter-frame idle window period is used as a trigger condition to complete the atomic pointer switching of the firewall's primary and backup buffers within the window period, specifically including: When the underlying network monitoring engine confirms that the last valid real-time data frame in the current communication cycle has been completely transmitted through the physical medium, the system's high-precision hardware timer immediately generates a high-priority hardware interrupt signal. This interrupt signal marks the official start of the network's absolute silence period. The system uses this interrupt signal as the core trigger condition to promptly enter the policy switching window. During this extremely brief microsecond-level time interval, the entire industrial network is in a completely silent data state, with no control commands or process parameter messages flowing on the bus. At this moment, the firewall's central processing unit gains control of the system bus and memory controller, preparing to execute the most critical security defense policy change.

[0054] To ensure the security and data integrity of the memory replacement process, the system first suspends the data access process corresponding to the security policy configuration update operation within the policy switching window. Specifically, the firewall operating system kernel layer immediately suspends the underlying packet receiving and forwarding queues of the network interface controller and temporarily blocks all unnecessary external hardware interrupt requests. This suspension operation not only cuts off the physical channel for external network data to flow into the firewall kernel-mode engine, but also strictly blocks any attempts by the upper-layer management process to read or asynchronously modify the currently effective security policy rule base.

[0055] By freezing all data flow access processes related to the security policy comparison engine at the microsecond level, the system creates an absolute vacuum and completely static execution environment in the underlying hardware memory space. This static state prevents serious system-level errors that may occur during policy address changes, such as memory cross-boundary read / write conflicts, wild pointer references, and rule matching errors, clearing all underlying environmental obstacles for the upcoming core pointer replacement operation.

[0056] In a silent environment where data access is paused, the system immediately triggers the atomic pointer switch of the core firewall primary and backup caches. Considering the extreme sensitivity of industrial control scenarios to time latency, the system abandons the traditional rule-by-rule read and overwrite mode, instead utilizing a single-instruction-cycle atomic operation mechanism at the CPU instruction set level. The system directly overwrites the base address pointer of the primary cache, which points to the currently used old version of the security policy, with a single, uninterruptible low-level machine assembly instruction, using a single instruction to replace it with the base address pointer of the new backup cache. Since the backup cache has already undergone comprehensive parsing, structured compilation, and deep memory preloading of the target security policy in the previous process, this atomic pointer modification instruction can be executed instantaneously within just a few nanoseconds of clock cycles.

[0057] With the instantaneous address shift of the underlying base address memory pointer, the system immediately sets the target security policy already loaded in the backup buffer as the currently effective policy. At this moment, the previously silent backup buffer is instantly activated, and the latest security defense rules, containing fine-grained industrial control protocol function code restrictions and whitelists of specific register value fields, take over the firewall's traffic filtering execution logic. Simultaneously, the system updates the firewall policy call relationships in the kernel cache. The firewall's deep packet inspection and analysis engine, traffic connection detection state machine, and the core data structure mapping relationships of the underlying network fast forwarding path are all synchronously redirected to this new buffer memory address space. All rule hash lookup tables and multi-branch matching logic tree logical associations are rapidly reconstructed in memory at this moment, ensuring that when the industrial data packets of the next control cycle arrive, the network security comparison engine can immediately locate the latest protection rules along the new memory call path.

[0058] Once the atomic pointer switching and policy call relationship synchronization update are fully executed, and the system kernel verifies that the new memory pointer mapping logic is absolutely correct, the system will quickly unlock the previously suspended network interface controller receive queue and fully restore all hardware-level interrupt responses before the current microsecond-level inter-frame idle window expires. At this time, the firewall resumes the data interface and waits for the next industrial control clock synchronization frame. Because the cumulative time of the entire core pointer switching and memory call relationship update is tightly compressed into an extremely short nanosecond to microsecond range, its overall hardware overhead time is far less than the inherent physical inter-frame silence time of the industrial bus. Therefore, when the control message of the next cycle arrives, the firewall has already completed the activation and application of fine-grained target security policies. This time-difference-based underlying operation mechanism avoids control message queuing congestion and physical timing jitter caused by long-term rule overwriting and refreshing. The field physical equipment cannot detect that a complete reconstruction of the core security defense logic has occurred on the network data link. Ultimately, under the stringent premise of ensuring the smooth and continuous operation of the underlying industrial control cycle, the system successfully achieves the seamless application of target security policies and the seamless leap of the dynamic protection system.

[0059] In this embodiment, after completing the atomic pointer switch of the firewall's primary and backup caches, in order to form a complete security protection closed loop, the system further introduces a performance monitoring and rollback mechanism, specifically including: The system acquires industrial communication status information after the target security policy takes effect. During the first complete control cycle after the new target security policy officially takes over the firewall traffic forwarding plane, the underlying network performance monitoring module remains on high alert. This module uses bypass traffic analysis technology to capture and statistically analyze multiple key underlying network performance indicators in real time when the firewall is executing new rule filtering and matching. These indicators together constitute industrial communication status information, and its core data dimensions mainly cover microsecond-level packet forwarding latency, end-to-end communication message jitter rate, and packet loss rate of key process control commands. Because the new policy includes in-depth analysis of the industrial control protocol application layer and comparison of specific register value ranges, it increases computational overhead and poses a potential performance bottleneck risk. Therefore, acquiring the above status information is a prerequisite for determining whether the new policy disrupts the physical underlying communication rhythm.

[0060] The system deeply analyzes the underlying data and, based on the industrial communication status information, determines whether the data transmission status after the strategy switch meets the preset communication requirements. These preset communication requirements are performance safety limits pre-programmed into the operating system kernel based on the sensitivity of different field services. For example, for a high-frequency real-time motion control bus, the preset requirement limits the data packet forwarding latency to no more than 150 microseconds, and the jitter rate to near zero. The high-speed comparison logic unit cross-checks the real-time acquired latency and jitter rate against these safety limits. If, after the new strategy takes effect, the forwarding latency suddenly spikes to over 200 microseconds or critical synchronization frames are lost, the system determines that the underlying network performance indicators have severely exceeded the limits, meaning the data transmission status after the strategy switch does not meet the preset communication requirements.

[0061] When the preset communication requirements are not met, to prevent continuous latency deterioration from causing widespread network disconnection of underlying devices or even production line paralysis, the system immediately triggers a microsecond-level self-healing circuit breaker mechanism at the underlying level, restoring the security policy state to its pre-switch state within the next policy switching window. The system precisely waits and utilizes the microsecond-level idle time gap of the immediately following control cycle, and upon precisely entering the next policy switching window, suspends the underlying data receiving queue again, executing a reverse single-instruction-cycle atomic operation. The system rewrites the kernel base address pointer, making it point back to the main cache area that fully retains the old security policy. Through this precise memory-level micro-manipulation, the system safely, smoothly, and imperceptibly restores the security protection array to its pre-switch state without affecting any remaining legitimate communication.

[0062] The system synchronously generates corresponding policy adjustment records in the local security audit log library. This detailed record includes precise high-frequency timestamps that triggered the rollback, abnormal values ​​of out-of-bounds performance indicators, and network topology node information of the target device. The edge computing node encrypts this record with high strength and reports it to the overall configuration management center. After receiving it, the operations engineer can quickly locate the root cause of the fault and analyze whether it is due to overly complex value comparison logic causing the underlying calculation timeout, or instantaneous concurrent connection overflow causing cache congestion. This underlying closed-loop mechanism with high self-correction and fault tracing capabilities gives the industrial firewall extremely high adaptive resilience, ensuring the continuity of real-time communication and production security of the control network while pursuing the ultimate security defense depth. Example

[0063] This embodiment uses the industrial robot control network in an automated welding production line for automotive parts as a specific application scenario to provide a detailed explanation of a firewall security configuration method for the Industrial Internet.

[0064] In the automotive parts welding production process, the production management system issues welding task orders to target industrial robots based on the macro production plan. The task order instructions include the target robot number, welding process type, and task execution time information. For example, the production management system issues a continuous spot welding task to the 6-axis welding robot numbered R01, with the task execution time set from 10:00:00 to 10:30:00, requiring the robot to complete the body bracket welding operation according to a preset trajectory.

[0065] Upon receiving the aforementioned work order service instruction, the edge communication node immediately parses the work order data, extracting the target device identification information, task type information, and execution time information. Based on the target device identification information, it determines the corresponding data acquisition object. The edge communication node connects to the robot controller's industrial network via bypass acquisition, synchronously acquiring the underlying physical and electrical characteristics of the robot's operation without affecting normal robot control communication. The underlying physical and electrical characteristics acquired by the edge side include robot servo drive current data, joint motion feedback data, controller interface status data, and industrial communication status data. Specifically, the servo drive current data reflects the robot's joint drive status, the joint motion feedback data reflects the robot's actual execution trajectory, and the interface status data reflects the control command execution status.

[0066] The system uses a globally unified time base to strictly time-mark work order business instructions and underlying physical and electrical characteristics. For example, if the production management system issues a task instruction at 10:00:00:00 milliseconds, and the edge detection shows a start-up step change in the current of the robot's first axis servo motor at 10:00:00:080 milliseconds, simultaneously detecting a displacement change in joint position feedback data, the system uses this physical action response time as the actual response time of the equipment. Based on the task type, the system determines the expected response time range for the robot to perform welding actions to be from 10:00:00:00:050 milliseconds to 10:00:00:150 milliseconds, and projects the actual response time into this range for precise matching.

[0067] When the actual response time is within the expected range, the system introduces a multi-dimensional feature evaluation model to further analyze the matching relationship between the servo current change trend and the standard state curve. During normal spot welding, the robot motor current will continuously change with joint start-up, uniform motion, and precise positioning. The system matches the actual current sequence with the historical normal state sequence. When the trends of the two are consistent and the amplitude is within a safe range, it is determined that the robot's actual operating state completely corresponds to the issued task, and the target equipment can be reliably determined to have officially entered the production execution stage from the standby stage.

[0068] After determining that a change has occurred in the robot's operational phase, the system dynamically generates a target safety policy based on the set of safety policies corresponding to the production execution phase. The system extracts clean communication data from historical behavior records for the robot during that phase. Historical records show that during normal welding, the robot controller only needs to access the welding module's status read function code and is only allowed to write data within the range of 0 to 100 to specified process parameter register addresses. Therefore, the system generates a dedicated security policy that includes communication type, access object, read / write permissions, and a register value whitelist. This policy is compiled into binary rules executable by the firewall and silently preloaded into the backup cache. At this time, the firewall's main cache continues to run the original policy, preventing the update process from blocking underlying real-time communication.

[0069] The system parses the synchronization frame information in the industrial bus where the robot is located to obtain the current control cycle. The global communication cycle of the industrial bus is detected to be 1000 microseconds, of which the cumulative physical transmission time of effective control data frames in the current cycle is 760 microseconds, and the basic clock synchronization processing time is 40 microseconds. Based on these precise parameters, the system calculates that the strategy switching window time is equal to 1000 microseconds minus 760 microseconds and then minus 40 microseconds, resulting in 200 microseconds. The system determines that this 200 microsecond absolute quiet clearance time meets the hardware's ultra-fast switching requirements, therefore it locks and waits for the next control cycle's idle window to arrive.

[0070] Once the system detects that the last valid data frame in the current period has completely completed physical transmission, it immediately triggers a low-level policy switch. During this brief 200-microsecond idle window, the firewall suspends the network queue call process and, through atomic micro-operations at the single-instruction cycle level, instantly overwrites the current main buffer base address pointer and switches to the standby buffer where rules have been loaded, making the new anti-spoofing policy take effect immediately.

[0071] After the pointer switch is completed, the system quickly restores the network queue and continues to collect communication status information, closely monitoring latency, jitter, and packet loss after the policy takes effect. Actual testing revealed that the average transmission latency of control messages only slightly changed from 80 microseconds to 85 microseconds after the policy switch, far below the preset performance threshold, thus confirming the successful completion of the dynamic switch. Through this complete process, without interrupting continuous spot welding tasks, the industrial firewall defense strategy achieves highly adaptive adjustment according to the physical operation phase. It cleverly utilizes extremely short idle gaps at the underlying level to complete seamless memory-level replacement, avoiding control message timing jitter or out-of-order delivery, and improving configuration continuity and underlying production security in complex industrial environments.

[0072] It should be noted that all formulas in this manual are calculated by removing dimensions and taking their numerical values. The formulas are derived from software simulations based on a large amount of collected data to obtain the most recent real-world results. The preset parameters and thresholds in the formulas are set by those skilled in the art according to the actual situation.

[0073] The above description is merely a preferred embodiment of the present invention, and the scope of protection of the present invention is not limited to the above embodiments. All technical solutions falling within the scope of the present invention's concept are within the scope of protection of the present invention. It should be noted that for users of ordinary technical skills, any improvements and modifications made without departing from the principles of the present invention should also be considered within the scope of protection of the present invention.

Claims

1. A firewall security configuration method for the Industrial Internet, characterized in that, include: S1: Acquire multi-source status data of the target device, including work order business instructions issued by the upper-level production system, and physical and electrical characteristics of the underlying controller synchronously collected by the edge side; S2: Perform time-coupled cross-verification of the work order business instruction and the physical and electrical characteristics. After verification, determine that the operating phase of the target equipment has changed. S3: In response to the aforementioned changes, extract the target security policy containing the industrial protocol application layer read / write permissions and register value field whitelist, and compile and preload it into the firewall's backup cache area; S4: Analyze the clock synchronization frame of the industrial bus where the target device is located, and locate the microsecond-level inter-frame idle window period between adjacent control cycles; S5: Using the arrival of the inter-frame idle window as a trigger condition, complete the atomic pointer switching of the firewall primary and backup buffers within the window period.

2. The firewall security configuration method for the Industrial Internet according to claim 1, characterized in that, In S1, the physical and electrical characteristics of the underlying controller synchronously acquired from the edge side include: The system collects drive status parameters, control status parameters, and interface status parameters during the operation of the target device, and timestamps these parameters based on a unified time base to generate a device status data sequence corresponding to the work order service instruction.

3. The firewall security configuration method for the Industrial Internet according to claim 1, characterized in that, In S1, the work order service instruction includes target device identification information, device task type information, and task execution time information; Through data interaction between the industrial production management system and the edge communication node, the work order service instructions are transmitted to the edge, and the corresponding equipment status data collection object is determined according to the target equipment identification information.

4. The firewall security configuration method for the Industrial Internet according to claim 1, characterized in that, In S2, the step of performing time-series coupling cross-validation between the work order service instruction and the physical and electrical characteristics includes: The expected time range for equipment operation is determined based on the work order instructions. Obtain the actual response time corresponding to the physical and electrical characteristics, and determine whether the actual response time is within the expected time range of the device operation; When the actual response time meets the time consistency requirement, and the change trend corresponding to the physical electrical characteristics matches the equipment action type corresponding to the work order business instruction, the timing coupling cross-validation is determined to be successful.

5. A firewall security configuration method for the Industrial Internet according to claim 1, characterized in that, In S2, the operational phase transitions of the target device include: Based on the changes in task type corresponding to the work order business instruction and the changes in state corresponding to the physical and electrical characteristics, the target equipment is determined to switch from the current operating stage to another operating stage; The operation phase includes at least the production execution phase, the parameter adjustment phase, and the equipment maintenance phase.

6. A firewall security configuration method for the Industrial Internet according to claim 1, characterized in that, In step S3, the extraction of the target security policy includes: Based on the operational phase of the target device after its transformation, obtain historical communication behavior records for the corresponding phase. The industrial protocol communication type, access object, and data interaction range are extracted from the historical communication behavior records to form a set of security policies corresponding to the current operating stage.

7. A firewall security configuration method for the Industrial Internet according to claim 1, characterized in that, In S4, the microsecond-level inter-frame idle window period between adjacent control cycles includes: Acquire industrial bus communication cycle information and data frame transmission status within the cycle; Based on the data transmission status completed within the current communication cycle, the time interval during which no real-time data interaction occurs between adjacent control cycles is determined, and the time interval is defined as the strategy switching window.

8. A firewall security configuration method for the Industrial Internet according to claim 7, characterized in that, In S5, the atomic pointer switching of the firewall primary and backup caches includes: Within the policy switching window, pause the data access process corresponding to the security policy configuration update operation; Set the target security policy that has been loaded in the backup cache as the currently effective policy, and update the firewall policy call relationship synchronously.

9. A firewall security configuration method for the Industrial Internet according to claim 7, characterized in that, Following S5, it also includes: Obtain industrial communication status information after the target security policy takes effect; Based on the industrial communication status information, determine whether the data transmission status after the strategy switch meets the preset communication requirements; If the preset communication requirements are not met, the security policy state before the switch is restored in the next policy switching window, and a corresponding policy adjustment record is generated.

10. A firewall security configuration system for the Industrial Internet, implemented by any one of claims 1 to 9, characterized in that, include: Data acquisition module: used to acquire multi-source status data of the target device, including work order business instructions issued by the upper-level production system, and physical and electrical characteristics of the underlying controller synchronously collected by the edge side; Cross-validation module: used to perform time-coupled cross-validation of the work order business instructions and the physical and electrical characteristics, and determine that the operation phase of the target equipment has changed after the verification is valid; Policy preloading module: In response to the changes, it extracts the target security policy containing the industrial protocol application layer read and write permissions and register value field whitelist, and compiles and preloads it into the firewall's backup cache. Window positioning module: used to parse the clock synchronization frame of the industrial bus where the target device is located, and locate the microsecond-level inter-frame idle window period between adjacent control cycles; Atomic switching module: used to complete the atomic switching of the firewall primary and backup buffers within the window period, triggered by the arrival of the inter-frame idle window period.

Images