Variable logic encryption algorithm based on PLC input and output signals

Abstract

The application belongs to the field of industrial automation and information security, and particularly relates to a variable logic encryption algorithm based on PLC input and output signals. The application discloses a variable logic encryption algorithm based on PLC input and output signals, aiming at solving the problems of fixed PLC communication logic and insufficient security. The algorithm runs on a transfer control device, and is characterized in that it comprises a variable logic control module, a nonlinear sending logic is executed; an encryption processing module, encryption is performed by using a dynamic key bound with a logic state; a protocol adaptation module, unified conversion of heterogeneous protocols is realized; an access control and abnormality monitoring module, identity verification and feature analysis are performed; and a software and hardware cooperative mechanism. By adopting the above technical scheme, the application realizes dynamic security protection of PLC signals from the source to the terminal, ensures real-time performance, and significantly improves the compatibility and attack resistance of the system.

Description

Technical Field

[0001] This invention belongs to the field of industrial automation control, specifically relating to a variable logic encryption algorithm based on PLC input and output signals. Background Technology

[0002] With the accelerated advancement of global industrial intelligence, automated control systems centered on programmable logic controllers (PLCs) have become the nerve center of modern industrial systems, widely used in key areas such as precision machinery manufacturing, power dispatching, energy and chemical industries, and defense. In the current context of intelligent manufacturing, industrial control equipment is no longer an isolated operating unit, but a crucial node deeply embedded in the industrial internet architecture. To achieve global coordination and real-time monitoring of production processes, PLC devices need to frequently exchange large-scale data and control commands with host computers, cloud platforms, or other edge computing devices through various physical communication interfaces. This high degree of interconnectivity, while improving production efficiency, also places unprecedentedly stringent demands on the security of the underlying control logic, the standardization of communication protocols, and the tightness of data transmission.

[0003] In existing industrial automation scenarios, although PLC technology has evolved over decades, its underlying signal communication logic control and security protection still largely follow a relatively traditional and static design paradigm. Specifically, in mainstream existing technical solutions, signal interaction between PLC devices and their external communication objects is often based on a preset fixed frequency. For example, devices are typically set to actively broadcast sensitive information such as their identity, physical location, real-time operating parameters, and I / O register status to the network at specific second or minute intervals. This deterministic, periodic communication mode was indeed able to ensure real-time updates of monitoring data with low system overhead in early closed industrial environments. However, with the opening and increasing complexity of network environments, this communication logic, lacking dynamic sensing capabilities, has gradually revealed its profound inherent contradictions.

[0004] The root cause lies in the fact that this "indiscriminate" fixed-frequency communication pattern is essentially a blind interaction lacking semantic understanding and state awareness. From a resource scheduling perspective, during redundant periods when production conditions are stable and data remains largely unchanged, frequent signal reporting not only wastes valuable industrial intranet bandwidth resources but also increases the power consumption burden on communication nodes. More seriously, from a security perspective, this highly regularized communication behavior provides potential intruders with excellent samples for eavesdropping and reverse engineering. Due to the simplicity and predictability of the communication logic, attackers can relatively easily infer the PLC's control logic, equipment fingerprints, and even production cycle by intercepting and analyzing signal patterns over long time sequences, thereby enabling targeted man-in-the-middle (MITM) attacks or replay attacks.

[0005] Furthermore, existing encryption protection mechanisms in PLC communication systems generally suffer from severe lag and fragmentation. Although some high-end PLC devices have begun to introduce encryption protocols, most existing solutions remain at the stage of static keys or basic symmetric encryption, and the encryption logic is often deeply bound to specific proprietary communication protocols. This design approach leads to a dual technical bottleneck: on the one hand, due to the fixed encryption rules, once an attacker obtains the key through brute-force cracking or side-channel attacks, the entire communication link will face the devastating risk of "one breach leading to a hundred breaches," and may even lead to reverse control of core processing equipment, posing a fundamental threat to industrial production safety; on the other hand, due to significant differences in protocol implementation among different brands and models of PLC devices, existing encryption technologies are difficult to achieve cross-platform compatibility and smooth migration, making it difficult to uniformly deploy and dynamically adjust security strategies in complex industrial scenarios with multi-brand mixed networking.

[0006] Furthermore, within the existing technological framework, the standardized logic of signal transmission and encryption protection are often treated as two independent and uninterrupted dimensions, lacking deep algorithmic coupling and collaborative mechanisms. This means that even with basic encryption measures deployed, it is difficult to fundamentally address the risk of data leakage caused by disordered communication; while simple logic control cannot resist specialized protocol cracking. Currently, there is no integrated algorithm solution globally that can organically combine the "variable logic specifications" of PLC input and output signals with a "dynamic logic reconfiguration encryption strategy." This technological gap leads to systemic defects in existing protection measures when facing highly adversarial industrial intranet security threats, such as slow response, weak risk resistance, and insufficient system robustness.

[0007] In summary, how to break free from the constraints of traditional static communication logic and construct a signal encryption and control system that can deeply adapt to multiple PLC protocols, possess dynamic environmental awareness capabilities, and has variable logic, while ensuring the real-time performance and stability of industrial communication, has become a key technical challenge and a major industry challenge that urgently needs to be overcome in the deep integration of industrial automation and information security. Therefore, developing a variable logic encryption algorithm based on PLC input / output signals has become an urgent task for those skilled in the art, addressing the aforementioned profound technical contradictions and security requirements. Summary of the Invention

[0008] This invention provides a variable logic encryption algorithm based on PLC input / output signals, aiming to solve technical problems in existing industrial automation scenarios, such as information leakage due to fixed communication logic of programmable logic controllers (PLCs), insufficient security due to a single encryption mechanism, and poor compatibility due to closed protocols. This invention constructs a relay control system deeply integrated into the industrial communication link, realizing dynamic reconstruction of communication logic and deep encryption at the signal level, ensuring absolute security and efficient, orderly PLC signal transmission in an industrial intranet environment.

[0009] To achieve the aforementioned objectives, an industrial control PLC input / output signal variable logic encryption algorithm is provided. The algorithm operates within a relay control device deployed between the programmable logic controller (PLC) and external communication objects. The algorithm achieves industrial communication protection by constructing a multi-dimensional signal control and dynamic logic reassembly encryption system. Specifically, it includes the following steps: 1) Dynamically encrypting the transmission behavior of PLC signals using a variable logic control module; 2) Pre-setting basic and advanced dynamic logic reassembly instructions through a rule configuration unit; 3) Combining the real-time acquisition of PLC operating modes, I / O register change rates, and communication link load status by a state perception unit; 4) Dynamically generating a transmission strategy by a logic execution unit to control the signal transmission timing, priority, and content filtering; 5) Dynamically reassembling and encrypting the logic-processed PLC signals using an encryption processing module; 6) Generating encryption for each batch or frame by using a key derivation engine with the current logic state vector of the variable logic control module as an entropy source. The system employs a unique dynamic key deeply bound to the signal and performs multiple rounds of bit-level permutation and diffusion operations on the original signal payload. A protocol adaptation module eliminates protocol barriers between heterogeneous devices. A protocol parsing matrix is ​​used to identify feature operators and perform deep packet inspection on the original messages entering the relay control device, extracting them to a general data abstraction layer to transform them into a unified internal format. After encryption, secondary encapsulation and checksum reconstruction are performed according to the target receiver's communication protocol. Access control and anomaly monitoring modules construct a security boundary. The access control unit performs dual verification of physical address and logical identity, while the anomaly monitoring unit performs entropy analysis and feature comparison on the communication stream based on time-series correlated group behavior benchmarks to identify and block unauthorized access or communication anomalies. An algorithm and hardware collaboration mechanism enhances system resilience. An industrial-grade embedded microprocessor accelerates encryption and links with the physical layer's mechanical pressure sensing circuit and electrical continuity detection circuit, triggering self-destruct logic protection measures at the algorithm layer upon detecting physical intrusion.

[0010] When the variable logic control module performs signal transmission timing control, it specifically adopts a nonlinear flow shaping strategy based on a sliding window: the logic execution unit maintains a signal strength index in memory that reflects the communication activity per unit time. The signal strength index is calculated by weighting the I / O register change rate and data packet functional attributes provided by the state perception unit. When the change rate of the signal strength index is within a preset stable range, the logic execution unit's instruction communication interface enters a keep-alive monitoring mode, reducing the communication frequency to a preset minimum keep-alive frequency, transmitting only heartbeat signals. When the change rate of the signal strength index exceeds a preset sensitivity threshold, the logic execution unit determines that the PLC has entered a critical process stage, immediately switches the communication state to a high-frequency real-time mode, and activates a preemptive transmission channel to ensure real-time transparent transmission of control signals. Through the dynamic frequency adjustment based on content characteristics, the communication behavior of the relay control device exhibits non-deterministic characteristics, thus countering the modeling and analysis of communication patterns by external monitoring devices.

[0011] The core of the dynamic logic recombination encryption process executed by the encryption processing module lies in the entropy source fusion and iteration mechanism of the key derivation engine: the key derivation engine obtains multi-dimensional original entropy vectors in real time, including: the current rule base index of the variable logic control module, the monotonically increasing sequence number of the current communication batch, the nanosecond-level high-precision clock vector provided by the temperature-compensated crystal oscillator, and the hardware random number generated by the physical layer random number generator; the key derivation engine nonlinearly mixes the above entropy vectors with the root key initialized by the system, and generates a time-sensitive subkey for the currently processed PLC signal stream through preset S-box permutation and linear feedback shift register operations; when encrypting the signal payload, the encryption processing module first determines the encryption iteration round according to the signal importance level defined by the rule configuration unit, and then uses the subkey to perform a physical position rearrangement permutation operation on the original data bits, and combines the logic gate-level XOR conversion to achieve influence diffusion, so that any change in any bit of the original signal will cause a nonlinear avalanche effect in the ciphertext segment.

[0012] When performing key switching, the encryption processing module employs a smooth transition mechanism based on double buffering: when rules are updated or the key lifecycle reaches a threshold, the key derivation engine simultaneously maintains the currently effective old key buffer pool and the new key buffer pool that is about to take effect in memory; within the set key switching window period, the encryption processing module identifies the key index used by the current message through the version identifier bit in the message header and calls the corresponding key buffer pool for decryption; when the communication link under the new key successfully passes the consistency check a preset number of times, the algorithm automatically destroys the residual data in the old key buffer pool and completes the seamless switch of the key system to avoid encryption synchronization interruption caused by network latency or packet loss.

[0013] When performing protocol parsing and reconstruction, the protocol adaptation module executes the following deep packet processing flow: The protocol parsing matrix pre-stores binary message templates for various mainstream industrial communication protocols. When the original signal flows through the relay control device, the parsing matrix performs a sliding window scan on the input binary bit stream, extracting feature fields including protocol identifiers, length fields, function codes, and unit identifiers. The parsing unit locates the control load area according to the offset defined by the corresponding template based on the identified protocol type, and strips and maps the original control data to the structured model of the general data abstraction layer. In the data encapsulation stage, the adaptation module constructs a standard-compliant message header structure at the front end of the encrypted load according to the protocol specifications of the target communication object, and calls hardware acceleration logic to recalculate the Cyclic Redundancy Check (CRC) or Message Verification Code (MAC) to ensure that the encrypted message conforms to the communication consistency standard of the industrial bus, realizing transparent proxying of heterogeneous PLC devices.

[0014] The protocol adaptation module also features traffic aggregation and fragmentation for large-scale PLC clusters: In complex gateway topology mode, the protocol adaptation module semantically aggregates scattered I / O signals from multiple PLC nodes within a general data abstraction layer, encapsulating them into a single high-strength encrypted data packet to reduce network protocol header overhead; for real-time monitoring streams with high bandwidth consumption, the adaptation module divides the encrypted long message into multiple short fragments with anti-analysis features according to the maximum transmission unit (MTU) limit of the link, and adds independent timing tags and integrity check bits to each fragment to improve the survivability of the signal in unstable industrial network environments.

[0015] The access control unit in the access control and anomaly monitoring module performs defense based on a dual "physical-logical" dimension: the access control unit maintains a dynamically updated whitelist of authorized devices. This whitelist not only records the MAC addresses, IP addresses, and specific function codes of authorized interactions, but also records the impedance fingerprints of devices connected to the physical ports of the relay control device. When a new connection request is initiated, the access control unit first performs logical authentication based on digital signatures, and then obtains the electrical characteristics of the current physical link through an electrical continuity detection circuit and compares them with the stored fingerprints. If the logical authentication fails or the deviation of the physical fingerprint exceeds the security threshold, the access control unit determines it as unauthorized access or a physical layer spoofing attack, and immediately blocks signal interaction at the physical link layer.

[0016] The anomaly monitoring unit executes a deep defense strategy based on behavioral fingerprint learning and temporal correlation analysis: In the initial learning mode of system deployment, the anomaly monitoring unit automatically extracts the signal interaction sequence of PLC under different production process cycles and constructs a normal behavior benchmark based on Markov model or statistical probability distribution. During real-time monitoring, the monitoring unit continuously calculates the entropy change of the communication flow and the temporal correlation characteristics of message length and transmission frequency. If the deviation between the monitored real-time characteristics and the benchmark model exceeds the preset safety boundary, or an abnormal signal sequence that violates the production logic is identified, the system automatically determines it as a communication anomaly. The anomaly monitoring module (7) performs a graded alarm response based on the judgment result: for low-risk deviations, only log recording is performed; for medium-risk anomalies, temporary logic blocking of specific ports is performed; for high-risk attacks, a global security lockout is triggered, and an alarm message encrypted with a timestamp provided by a temperature-compensated crystal oscillator is sent to the industrial control center.

[0017] The physical layer linkage protection in the algorithm and hardware collaboration mechanism specifically includes the following self-destruction and isolation logic: The hardware carrier of the relay control device integrates a mechanical pressure sensing circuit for real-time monitoring of the physical integrity of the device casing; when the sensing circuit detects illegal physical skidding, casing damage, or attempted physical intrusion signals, the hardware layer sends a high-priority unmasked interrupt signal to the industrial-grade embedded microprocessor; upon receiving the interrupt signal, the algorithm layer immediately executes a memory erasure algorithm to forcibly clear all dynamic key remnants, logic rule bases, trust certificates, and audit logs stored in the non-volatile memory, and physically disconnects the electrical connections of all input / output channels, causing the device to enter an irreversible logical lockout state to prevent the leakage of core secrets.

[0018] The algorithm and hardware collaboration mechanism also involves power integrity monitoring and energy efficiency management logic: the hardware unit of the relay control device monitors the real-time power consumption characteristics of the microprocessor and converts the power consumption fluctuation curve into a digital feedback signal to be sent to the algorithm layer. The algorithm layer analyzes the timing correlation between power consumption characteristics and encryption / decryption operations to assess whether there is a risk of side-channel attacks, and introduces hardware random current compensation noise when necessary to smooth out physical power consumption characteristics. When the algorithm detects that the PLC device enters a shutdown or standby mode for a preset duration, the relay control device automatically switches to a low-power mode, shuts down unnecessary hardware acceleration engines, and retains only the basic physical intrusion detection circuit and wake-up logic. Once the status sensing unit detects the reactivation of the PLC communication signal, the algorithm can restore the full-strength protection state through a microsecond-level cold start process, achieving a balance between security strength and energy efficiency performance.

[0019] The core principle of this invention lies in transforming the originally static, transparent, and unprotected industrial control signals into dynamic and secure data streams that are logically variable in the time dimension, encrypted and masked in the spatial dimension, and subject to strict auditing in the behavioral dimension. This profound algorithmic innovation not only meets the needs of modern smart factories for efficient PLC communication but also provides solid algorithmic support and technical assurance for the security of industrial intranets of critical national infrastructure.

[0020] Furthermore, the variable logic control module described in this invention employs a sliding window-based flow shaping algorithm when controlling the timing of signal transmission. The execution unit maintains a signal strength index per unit time. When the rate of change of this index fluctuates within a preset stable range, the execution unit reduces the communication frequency to the minimum keep-alive frequency, transmitting only necessary pulse signals; conversely, when the rate of change of the index exceeds a dynamic threshold, the execution unit quickly switches the communication state to a high-frequency real-time mode. This dynamic frequency adjustment based on signal content characteristics makes the PLC's external communication behavior highly nonlinear and uncertain, significantly increasing the difficulty for external sniffing devices to model and predict communication patterns.

[0021] In the implementation details of the encryption processing module, this invention relates to a multi-level key distribution and synchronization logic. During the system initialization phase, the relay control device obtains a set of root keys through a physically isolated configuration channel. Subsequently, during real-time communication, the encryption processing module uses the logic state vector generated by the variable logic control module as a salt value to perform nonlinear iteration on the root keys, generating a subkey for the current session. Before encapsulation, each frame of PLC signal to be transmitted undergoes multiple rounds of permutation and diffusion operations with the subkey. The permutation operation is achieved by changing the physical arrangement order of data bits, while the diffusion operation spreads the minor changes in the original data to the entire ciphertext segment through the influence propagation at the logic gate level.

[0022] Furthermore, the protocol adaptation module employs a deep packet inspection technique based on template matching during protocol parsing. The protocol parsing matrix pre-stores binary message templates for various protocols. When the original signal flows through, the parsing unit extracts key fields of the message, such as the protocol identifier, length field, and sequence number, and compares them with the template library. Once identification is successful, the parsing unit accurately locates the control payload area based on the offset defined in the template. This parsing method does not rely on specific application layer software and enables near real-time processing above the physical link layer. During the re-encapsulation phase, the adaptation module calculates and reconstructs the cyclic redundancy check (CRC) or message verification code required by the protocol to ensure that the encrypted message passes the standard communication consistency check at the receiving end.

[0023] In the defense-in-depth mechanism of the access control and anomaly monitoring module, the anomaly monitoring unit not only focuses on the communication characteristics of individual points but also constructs a group behavior benchmark based on time-series correlation. The monitoring unit continuously records the signal interaction sequence of the PLC cluster under normal production cycle. If a PLC node suddenly makes frequent requests that violate the production process logic, or if the entropy value of its signal sequence increases abnormally (indicating possible illegal encrypted traffic penetration), the monitoring unit will determine whether there is a risk that the controlled device is being used as an attack springboard through logical correlation analysis.

[0024] As an extension of the technical solution of this invention, the algorithm and hardware collaboration mechanism also includes a power integrity monitoring logic. The hardware unit of the relay control device can sense subtle fluctuations in the power supply voltage. Since certain high-intensity hacking behaviors can cause abnormal increases in microprocessor power consumption, the hardware unit converts this power consumption characteristic into a digital signal and feeds it back to the algorithm. The algorithm layer then assesses whether there is a risk of side-channel attacks. This design, which maps the logical security state in reverse from the dimension of physical energy consumption, further strengthens the security foundation of the system.

[0025] In summary, the variable logic encryption algorithm based on PLC input / output signals described in this invention not only reconstructs communication behavior at the logic layer but also constructs a comprehensive security closed loop at the physical, protocol, and data layers. By implementing refined logic control and high-strength dynamic logic reconfiguration encryption of industrial control signals, it completely reverses the passive situation of insufficient protection in existing PLC communication systems. The implementation of this algorithm can significantly improve the anti-attack capability of industrial automation systems, protecting enterprises' core process parameters and production data from illegal theft or tampering.

[0026] In one specific application scenario of this invention, when a PLC is used to control a precision CNC machine tool, every position pulse signal output by the PLC is processed by this algorithm. The variable logic control module determines whether the machine tool is currently in a machining cycle. If it is in a non-machining state, even if a signal indicating a change in machine tool position is generated, the module will determine it as interference or illegal operation according to preset rules, thereby intercepting the signal transmission. If it is in a normal machining state, the signal will be given high priority and encrypted by the encryption processing module using a dynamic key specific to the current cutting step. Finally, it is converted into a standard industrial bus format by the protocol adaptation module and sent to the monitoring terminal. The entire process is transparent to the operator, but provides extremely high protection at the logical and security levels.

[0027] The algorithmic concept involved in this invention is not limited to single-machine protection of a single PLC, but can also be extended to collaborative defense of large-scale PLC clusters. Through information sharing between intermediate control devices, the algorithms of each node can synchronously update a global threat signature database, forming a distributed industrial security immune network.

[0028] As another important component of this invention, the rule base update mechanism of the variable logic control module employs a secure distribution protocol based on digital signatures. When a user needs to modify the PLC's transmission logic or encryption rules via a host computer, the configuration command must be accompanied by a valid digital signature. Upon receiving the update packet, the relay control device first verifies the signature using its built-in public key. After successful verification, the update packet is stored in the secure storage area of ​​the hardware carrier and seamlessly switched over during the next communication idle period. This design prevents attackers from paralyzing or taking over the security management system by issuing forged configuration rules.

[0029] The encryption processing module employs a smooth transition "double-buffering" mechanism during key switching. Within a specific time window before the old key expires, the relay control device simultaneously retains both the old key and the newly generated backup key. This mechanism ensures that even if network fluctuations cause a slight delay in key synchronization, legitimate communication messages can still be correctly decrypted, effectively preventing industrial communication interruptions caused by encryption synchronization issues. This demonstrates the invention's profound consideration of balancing security and real-time performance.

[0030] The protocol adaptation module also features a transparent protocol proxy function. In certain complex gateway topologies, the relay control device can simulate the communication behavior of a PLC, interacting with the host computer as a virtual slave and with the real PLC as a virtual master. In this mode, the algorithm can perform deeper reconstruction of the signal flow, such as merging scattered I / O signals into aggregated encrypted data packets or segmenting long messages into short fragments with anti-analysis features. This high degree of flexibility at the protocol level allows the invention to adapt to various physical environments, from traditional serial links to modern gigabit industrial Ethernet.

[0031] The alarm response logic of the access control and anomaly monitoring module is subdivided into multiple security levels. For low-risk anomalies, the system only logs and provides local notifications; for medium-risk anomalies, the system automatically blocks the corresponding communication port for a period of time; and for high-risk anomalies, the system triggers global security interlocking logic and attempts to send distress signals through all available network paths. This tiered response strategy ensures that the system has good availability and anti-interference capabilities while maintaining security.

[0032] In the algorithm and hardware collaboration mechanism, the hardware circuit of the relay control device is also designed with a dedicated electromagnetic interference shielding layer. In industrial environments with strong electromagnetic interference, the hardware layer can ensure the accuracy of the signal source data input to the algorithm layer through differential signal compensation and dynamic gain adjustment. The algorithm layer then performs digital filtering to eliminate false alarms caused by environmental noise. This collaborative anti-interference design from the underlying hardware to the high-level algorithm ensures the stable operation of this invention in extremely harsh industrial environments.

[0033] This invention presents a variable logic encryption algorithm based on PLC input / output signals, which represents a significant leap forward compared to existing technologies in terms of logic depth, encryption dimensions, protocol breadth, and hardware assimilation. It is not merely a data encryption method, but a complete industrial communication security paradigm with adaptive evolution capabilities. By incorporating every pulse and byte of the PLC signal into this rigorous logic control and encryption protection system, this invention provides an invisible "logic armor" for core industrial equipment in the era of intelligent manufacturing, fundamentally enhancing the core security competitiveness of industrial automation systems.

[0034] In a further system architecture description, the relay control device is connected to its internal non-volatile memory via a dedicated high-speed bus for storing encrypted logs and audit trails. The audit trails record in detail every change in logical rules, every successful access, and every intercepted anomaly. After being anonymized using algorithms, this data can be periodically uploaded to an industrial big data platform for offline analysis, helping maintenance personnel identify potential security vulnerabilities and continuously optimize the variable logical rule base.

[0035] Furthermore, the algorithm described in this invention is designed with low-power operation in mind. Through the coordinated operation of the hardware and algorithm, when the PLC is detected to have entered a prolonged shutdown or standby mode, the relay control device automatically enters a low-power sleep state, retaining only basic wake-up circuitry and physical intrusion detection logic. Once the PLC restarts and generates a communication signal, the algorithm can complete a cold start and environmental verification within one microsecond, quickly restoring to a high-strength protection state. This intelligent energy efficiency management mechanism extends the lifespan of hardware equipment and reduces the overall operating cost of industrial systems.

[0036] The solution provided by this invention forms an organic whole through the decoupling and synergy of four major modules. The variable logic control module solves the problem of "when to transmit and what to transmit"; the encryption processing module solves the problem of "how to transmit securely"; the protocol adaptation module solves the problem of "in what environment to transmit"; and the access control and anomaly monitoring module, along with the hardware coordination mechanism, solves the problem of "who can transmit and what to do if something goes wrong". This multi-dimensional technical layout ensures that this invention can maintain its technological leadership and operational robustness in the face of complex and ever-changing industrial network security challenges.

[0037] As a final supplement to the technical solution, the encryption algorithm described in this invention does not rely on any specific external clock source. The relay control device integrates a temperature-compensated crystal oscillator, providing a high-precision time reference. When the network is interrupted or interfered with and unable to synchronize with the host computer, the algorithm can continue to maintain dynamic logic reassembly encryption operation based on its internal timing, ensuring that even in an isolated, network-disconnected state, the PLC's local signal interaction remains under strict encryption protection. This autonomous and controllable time synchronization capability further enhances the robustness of this invention under extreme conditions.

[0038] In summary, the invention covers a full range of technical fields, from dynamic reconfiguration of PLC communication logic and high-strength data encryption to deep adaptation of heterogeneous protocols and integrated hardware and software security protection. Its logic is rigorous, its structure complete, and its technical methods clear, effectively addressing the deep-seated security challenges faced in the industrial communication field. The implementation of this invention will provide crucial algorithmic guidance and engineering reference for achieving the security, intelligence, and standardization of industrial control systems.

[0039] Addressing the technological gaps mentioned in the background section, this invention proposes and implements for the first time an integrated solution that deeply couples the "logic normalization" and "encryption dynamization" of PLC signals. The non-obviousness of this solution lies in its departure from the traditional notion that encryption is merely a communication accessory, instead embedding encryption logic deeply into the communication decision-making logic. This collaborative mechanism of "logic-driven encryption and encryption-protected logic" constitutes the core technological originality of this invention.

[0040] In practical engineering implementation, the relay control device described in this invention can be designed as a compact rail-mounted module, directly installed in the electrical control cabinet next to the PLC. Its external interfaces fully comply with industry standards, enabling even older PLC equipment that has been in operation for many years to quickly obtain the logic control and encryption protection capabilities provided by this invention through simple cable connections and software configuration. This extremely high engineering practical value gives this invention broad market prospects and social benefits.

[0041] The core of the technical solution described in this invention lies in using the determinism of algorithms to combat the uncertainty of industrial networks. Every logical judgment, every encryption iteration, and every protocol parsing is executed based on preset, rigorous scientific rules. This highly deterministic technical output ensures that the PLC system maintains its expected and controlled operating state under any working condition. This invention not only solves current industry pain points but also lays a solid technical foundation for future industrial security defense systems in Industry 4.0 and even higher stages.

[0042] Furthermore, the adaptive nature of the algorithm is also reflected in its intelligent response to network congestion. When the protocol adaptation module detects an increase in packet loss rate or latency in the communication link, the variable logic control module automatically triggers traffic compression logic. By merging packet payloads and reducing the transmission frequency of non-critical states, it prioritizes the successful transmission of critical control commands without compromising security. This algorithm design, which balances security and efficiency, is an important indicator of the maturity of the technical solution of this invention.

[0043] Finally, the access control and anomaly monitoring module described in this invention also features a behavioral fingerprint-based learning mode. In the initial stage of system deployment, the algorithm can run in supervised mode, automatically learning and extracting the communication characteristic patterns of the PLC during normal operation. After the learning period, the baseline model generated by the system will serve as the core reference for anomaly detection. This feature extraction mechanism based on artificial intelligence significantly reduces the complexity of manually configuring rules and improves the system's probability of detecting unknown threats.

[0044] In summary, the variable logic encryption algorithm based on PLC input / output signals of this invention, through its unique architectural design and precise module collaboration, achieves an unprecedented depth of security protection while ensuring the real-time performance of industrial communication. The disclosure of this invention will undoubtedly propel industrial automation equipment protection technology to a higher level and contribute Chinese wisdom and original innovation to the sustainable development of the global industrial information security field. Attached Figure Description

[0045] Figure 1 A schematic diagram of the overall system architecture provided in this embodiment of the invention.

[0046] Figure 2 An internal structural block diagram of the variable logic control module in an embodiment of the present invention.

[0047] Figure 3 The key derivation and encryption flowchart of the encryption processing module in this embodiment of the invention.

[0048] Figure 4The flowchart of data parsing and conversion of the protocol adaptation module in this embodiment of the invention.

[0049] Figure 5 A schematic diagram of the hardware composition of the transfer control device in this embodiment of the invention. Detailed Implementation

[0050] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0051] The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. The present invention provides a variable logic encryption algorithm based on PLC input / output signals, the implementation of which is based on the security protection requirements of modern industrial automation networks. In complex industrial production environments, the PLC device 22, as a core control unit, interacts with external communication objects 33 through physical links such as industrial Ethernet and buses. To achieve deep control and security reinforcement of these interactive signals, the algorithm described in this invention runs in a relay control device 11 deployed between the PLC device 22 and the external communication object 33. This relay control device 11 acts as a transparent bridge or protocol gateway in terms of physical topology, and as a signal logic reconstruction and encryption center at the logical level. Specifically, the internal logic of the relay control device 11 is composed of a variable logic control module 44, an encryption processing module 55, a protocol adaptation module 66, and an access control and anomaly monitoring module 77. When the PLC device 22 sends an output signal or receives an external input signal, the signal first enters the relay control device 11. The variable logic control module 44, as the core hub of signal management, is responsible for multi-dimensional dynamic logic encryption of signal transmission behavior. The rule configuration unit 41 integrated within this module connects to the host computer via a configuration interface, receiving logic instructions including signal transmission time windows, data filtering Boolean conditions, and priority weights. The status awareness unit 42 provides basic data for logic judgment by real-time monitoring of the I / O register change rate of the PLC device 22, the communication link load, and the internal buffer status of the relay device. The logic execution unit 43 dynamically determines the transmission priority and timing of each signal frame based on the matching results of preset rules and real-time parameters. Furthermore, the variable logic control module 44 employs a dynamic adjustment mechanism based on signal characteristic strength when executing signal transmission timing control. The logic execution unit 43 continuously maintains a numerical indicator reflecting communication activity. When the PLC signal is in a static or low-activity state with slight fluctuations, the indicator is in a low range, and the logic execution unit 43's instruction communication interface enters keep-alive mode, sending pulse signals at a low frequency to maintain the link connection. However, when the status sensing unit 42 detects that the signal change rate exceeds a preset sensitivity threshold, indicating that the production process has entered a critical stage, the indicator rapidly increases, and the logic execution unit 43 immediately switches the communication frequency to a high-frequency real-time mode to ensure the strict timeliness of the control logic. This non-linear transmission logic makes the communication characteristics exhibited by the relay control device 11 unpredictable. In the implementation of the encryption processing module 55, this invention achieves high-strength protection of the PLC signal through a dynamic key generation mechanism. The key derivation engine 51 inside the encryption processing module 55 uses multi-dimensional entropy source input to generate time-sensitive subkeys.These entropy sources include, but are not limited to, the current rule base index of the variable logic control module 44, the monotonically increasing sequence number of the current transmission batch, and the random number vector provided by the hardware unit. Each batch of signals undergoes multiple rounds of permutation and diffusion operations when passing through the encryption processing module 55. Specifically, the encryption processing module 55 splits the original PLC signal bytes into bit-level data and changes the physical arrangement order of each data bit according to the permutation table generated by the current subkey. Subsequently, through a logic gate-level influence propagation process, any change in any bit of the original signal can affect multiple bytes in the final ciphertext. This mechanism ensures that even if an attacker intercepts part of the communication message, they cannot deduce the plaintext of the communication content through reverse engineering without real-time logic state information. To ensure the synchronization of the encryption and decryption process, the encryption processing module 55 employs a double-buffered key switching mechanism. When the rule configuration unit 41 issues a new logic rule or key update instruction, the key derivation engine 51 simultaneously maintains a set of currently effective keys and a set of pre-generated keys. Within a specific switching window, the relay control device 11 can identify and decrypt messages encrypted using either of the two sets of keys. This design effectively solves the key synchronization problem caused by transmission delays or packet loss in industrial networks, ensuring the continuity of the production process. The protocol adaptation module 66 eliminates interoperability barriers between different industrial communication protocols. Its internal protocol parsing matrix 61 stores feature operator templates for mainstream protocols such as Modbus TCP, Profinet, and EtherNet / IP. When the original message from the PLC device 22 arrives, the protocol parsing matrix 61 executes deep packet inspection logic, identifying the current protocol type by matching specific byte sequences and function codes in the message header. Subsequently, the general data abstraction layer 62 maps the parsed control instructions, register addresses, and data values ​​into a unified internal intermediate representation format. After the encryption processing module 55 encrypts the intermediate representation data, the protocol adaptation module 66 encapsulates it again according to the target receiver's protocol requirements. During encapsulation, the module automatically recalculates the checksum, cyclic redundancy check code, and sequence number to ensure that the encapsulated encrypted message can pass the consistency check of the external communication object 33. As an important component of proactive protection, the access control and anomaly monitoring module 77 constructs a multi-layered defense boundary. The access control unit 7171 uses dual verification based on physical address and logical identity to compare the MAC address, IP address, and function code request of the access request in real time. The anomaly monitoring unit 72 collects characteristic data during the communication process in real time, including but not limited to the number of messages per unit time, message length distribution patterns, and encryption verification failure rate. The anomaly monitoring unit 72 has a built-in behavioral benchmark model based on statistical laws, which records the signal interaction characteristics of the PLC under normal operating conditions.When the communication characteristics detected in real time deviate from the baseline model beyond the preset security boundary, such as when abnormal high-frequency status query requests or unauthorized remote configuration modification attempts occur, the anomaly monitoring module 77 will immediately link with the variable logic control module 44 to cut off the suspicious communication path and trigger an alarm process. The algorithm and hardware coordination mechanism of this invention embodies a deep coupling between software and hardware. The hardware carrier of the relay control device 11 is an industrial-grade embedded microprocessor 81, which integrates a physical layer random number generator 82 and a hardware encryption acceleration engine 83. To prevent physical layer attacks, a mechanical pressure sensing circuit 84 is integrated inside the device casing, while an electrical continuity detection circuit 85 is designed at the communication port. When the mechanical pressure sensing circuit 84 detects that the casing has been illegally pried open, or the electrical continuity detection circuit 85 detects abnormal plugging and unplugging of the communication cable, the hardware layer will generate a high-priority unmasked interrupt signal. After receiving the interrupt, the microprocessor 81 immediately executes a memory erasure algorithm to clear all sensitive logic rules and real-time dynamic keys stored in the non-volatile memory 86, causing the device to enter a locked self-destruct state. Furthermore, the temperature-compensated crystal oscillator 87 provides the algorithm with a high-precision time reference independent of the network clock, ensuring that the time-based key update logic can still operate accurately even in a network outage environment. To further demonstrate the technical effectiveness of the present invention, a specific embodiment is described in detail below. In this embodiment, the present invention is applied to a precision machining workshop containing multiple PLC nodes.

[0052] In Example 1, the relay control device 11 is connected in series between a PLC device 22 controlling a five-axis CNC machine tool and the workshop monitoring center (external communication object 33). The experimental parameters are set as follows: the PLC device 22 uses the standard Modbus TCP protocol, and its communication load is 200 register read / write requests per second under normal processing conditions. The sensitivity threshold of the variable logic control module 44 is set to a signal change rate of 55, the normal keep-alive frequency is set to 1Hz, and the high-frequency real-time frequency is set to 100Hz.

[0053] In the initial stage of system operation, the anomaly monitoring unit 72, after 4848 hours of learning, established a communication fingerprint database covering the machine tool's roughing, finishing, and standby states. When the machine tool enters the formal machining process, the state perception unit 4242 detects high-frequency fluctuations in the I / O signals, and the logic execution unit 4343 quickly increases the communication frequency to real-time mode. At this time, the encryption processing module 55 uses the current machining step number as one of the entropy sources and generates a 128128-bit dynamic key through the key derivation engine 5151. Each output position pulse signal is extracted by the protocol parsing matrix 6161, standardized in the general data abstraction layer 6262, and then bit-level permutation and XOR diffusion are completed in the encryption processing module 55. To test the anti-attack capability of the present invention, a man-in-the-middle attack was simulated in the experiment. The attacker obtained the encrypted messages during the machine tool's operation through the mirror port. Since the key changes dynamically with the logic state, and the message characteristics have been non-linearly shaped by the variable logic control module 44, the attacker cannot forge control commands through traditional message replay attacks. Experimental results show that, protected by the algorithm of this invention, even if an attacker obtains historical communication data, their success rate in cracking the current control commands remains close to zero. Furthermore, through quantitative monitoring of performance indicators, the following data was obtained. The table below shows a performance comparison of the embodiments of this invention with the original communication without this encryption scheme, and with a traditional fixed VPN encryption scheme.

[0054] Table 1: Comparison Test Table of PLC Signal Transmission Performance and Security Analysis of the data in Table 1 reveals that while Comparative Example 1 has the lowest communication latency, it is almost entirely devoid of security protection, with extremely obvious message characteristics that are susceptible to sniffing and instruction tampering. Comparative Example 2 employs a traditional VPN encryption method, which provides some data security, but significantly increases communication latency (15.40ms), which is often unacceptable in PLC control scenarios with extremely high real-time requirements. Furthermore, its long key update cycle limits security due to its fixed algorithm. In contrast, the solution of this invention maintains extremely low latency (only 1.12ms, far superior to traditional encryption schemes) while drastically reducing the predictability of message characteristics from 0.95 to 0.12. This is attributed to the non-linear reconstruction of communication behavior by the variable logic control module 44. Regarding security, the key of this invention is dynamically updated according to the logic state, greatly compressing the attacker's cracking time window. Moreover, the abnormal behavior detection rate is increased to 98.50%, demonstrating the superiority of the access control and anomaly monitoring module 77 in identifying complex industrial network attacks. In network congestion situations, the traffic shaping mechanism of this invention, by combining non-critical signals, actually reduces the packet loss rate of critical instructions to 1.20%, further improving the stability of the control system. The technical details of the algorithm in the protocol conversion process of this invention are further discussed. When processing packets, the protocol parsing matrix 61 first performs a windowed sliding scan of the input binary stream. Taking a Modbus TCP packet as an example, the parsing matrix accurately locates the transaction identifier (22 bytes), protocol identifier (22 bytes), length (22 bytes), and unit identifier (11 bytes). Subsequently, the parsing unit jumps to the function code field (11 bytes). If the function code indicates a request to write multiple registers (function code 0x100x10), the protocol parsing matrix 61 extracts the starting address and the number of registers according to the pre-stored template, and then captures the corresponding data payload. These extracted pure payload data then enter the general data abstraction layer 62, where they are encapsulated into an internal structure with a timestamp and logical context label. This processing method does not rely on the protocol stack provided by the operating system, but is completed directly at the hardware level of the relay control device 11, thereby controlling the processing latency to the microsecond level. In the specific steps of the encryption process, the key derivation engine 51 executes a multi-level mapping process. First, it performs bit mixing of the high-precision nanosecond-level timestamp from the temperature-compensated crystal oscillator 87 with the state vector of the current variable logic. Then, the mixed result is sent to a nonlinear permutation network based on hardware feedback. This permutation network consists of multiple parallel lookup tables and XOR arrays, which can quickly transform the input entropy source into a subkey stream with extremely high randomness. When encrypting the PLC data payload, the encryption processing module 55 does not simply process the entire block of data, but adopts different encryption strengths according to the importance of the payload (defined by the rule configuration unit 41).For example, for signals involving emergency stops, the algorithm uses the highest number of permutation iterations to ensure absolute safety; while for general environmental monitoring parameters, a lower number of iterations is used to optimize transmission efficiency. When performing physical address filtering, the access control unit 71 not only checks the authenticity of the source MAC address but also obtains the impedance characteristics of the physical port through the electrical continuity detection circuit 85. This physical fingerprinting prevents attackers from using MAC address spoofing techniques for unauthorized access, because even if the logical address is the same, differences in the electrical characteristics of the physical interface after device replacement will trigger an abnormal alarm. During operation, the anomaly monitoring unit 72 continuously calculates the entropy value of the communication flow. Under normal production logic, PLC communication exhibits periodic fluctuations, with its entropy value located within a stable baseline range. When external injection attacks or worm viruses spread within the network, the randomness of the communication flow will abnormally increase or decrease, causing an entropy value shift. Upon recognizing this shift, the monitoring unit immediately issues an instruction through the logic execution unit 43 to put the system into a "security lockout" mode. In this mode, the relay control device 11 only allows configuration instructions with the highest digital signature privileges to pass through, blocking all regular data services. The algorithm and hardware coordination mechanism of this invention also specifically consider the impact of power integrity on security. The voltage monitoring unit built into the microprocessor 81 can detect millisecond-level fluctuations in the supply voltage. Some side-channel attacks infer key information by observing changes in the chip's power consumption during encryption operations. To combat such attacks, the hardware encryption acceleration engine 83 instructs the power management unit to introduce random current compensation noise during computation, thereby smoothing out the characteristic mapping of encryption and decryption operations in the physical energy dimension. This reinforcement at the energy consumption level, combined with variable encryption at the logic layer, constitutes a comprehensive defense system.

[0055] In another specific application scenario, when this invention is deployed in a large-scale PLC cluster environment, multiple relay control devices 11 share threat intelligence through encrypted secure tunnels. The rule configuration unit 41 of the variable logic control module 44 can pre-update its own logical filtering rules based on the abnormal characteristics reported by other nodes. For example, if the anomaly monitoring unit 72 of node A discovers a new type of attack payload that exploits a specific protocol vulnerability, this feature will be quickly distributed to nodes B and C. The relay control devices 11 of nodes B and C will immediately add interception operators targeting this payload feature to the protocol parsing matrix 6161. This distributed cluster defense mechanism enables the algorithm of this invention to possess adaptive learning capabilities similar to a biological immune system.

[0056] In summary, the variable logic encryption algorithm based on PLC input / output signals of this invention completely solves the vulnerability of industrial control signals during transmission by constructing a closed-loop system integrating logic control, dynamic logic reconfiguration encryption, protocol adaptation, and anomaly monitoring. Its technical solution does not rely on expensive external security equipment; instead, it achieves deep protection of core data in industrial automation systems by embedding lightweight, high-efficiency relay control logic into the communication link. The above embodiments and experimental data demonstrate that this invention significantly improves the system's anti-attack strength and operational robustness without sacrificing industrial real-time performance, possessing extremely high engineering application value and technological foresight.

[0057] Those skilled in the art will understand that the above-described specific embodiments are merely preferred embodiments of the present invention and are not intended to limit its scope of protection. Within the scope of the technical concept of the present invention, any equivalent substitution or logical adjustment based on the function of the module should be included within the scope of the claims of the present invention. For example, adjusting the matrix template of the protocol adaptation module according to different industrial bus standards, or adjusting the rounds of encryption permutation according to hardware computing power, are all flexible applications of the algorithm framework described in the present invention. The core of the present invention lies in using the dynamic uncertainty of algorithmic logic to combat the determinism of external attacks. This core principle constitutes the main technical feature that distinguishes the present invention from the prior art.

Claims

1. A variable logic encryption algorithm for input / output signals of industrial control PLCs, characterized in that, The algorithm runs in the relay control device (1) deployed between the programmable logic controller (PLC) device (2) and the external communication object (3). The algorithm realizes industrial communication protection by constructing a multi-dimensional signal control and dynamic logic reorganization encryption system. Specifically, it includes the following steps: using the variable logic control module (4) to perform dynamic logic encryption on the transmission behavior of PLC signals, using the rule configuration unit (41) to preset the basic and advanced instructions of dynamic logic reorganization, and combining the PLC operating mode, I / O register change rate and communication link load status collected in real time by the state perception unit (42), the logic execution unit (43) dynamically generates the transmission strategy to control the signal sending timing, transmission priority and content filtering; using the encryption processing module (5) to perform dynamic logic reorganization encryption on the PLC signals after logic processing, using the key derivation engine (51) to take the current logic state vector of the variable logic control module (4) as the entropy source to generate a unique dynamic key that is deeply bound to each batch or each frame of signals, and to encrypt the original signal carrier. The system performs multiple rounds of bit-level permutation and diffusion operations; the protocol adaptation module (6) eliminates protocol barriers between heterogeneous devices; the protocol parsing matrix (61) performs feature operator identification and deep packet detection on the original message entering the relay control device (1), extracts it to the general data abstraction layer (62) to convert it into a unified internal format, and performs secondary encapsulation and verification code reconstruction according to the communication protocol of the target receiver after encryption; the access control and anomaly monitoring module (7) constructs a security boundary; the access control unit (71) performs dual verification of physical address and logical identity, and the anomaly monitoring unit (72) performs entropy analysis and feature comparison on the communication flow based on the time-series correlation group behavior benchmark to identify and block illegal access or communication anomalies; the system's resilience is improved by using the algorithm and hardware collaboration mechanism; encryption acceleration is performed by the industrial-grade embedded microprocessor (81), and the mechanical pressure sensing circuit (84) and electrical continuity detection circuit (85) of the physical layer are linked to trigger the self-destruct logic protection measures of the algorithm layer when physical intrusion is detected.

2. The PLC input / output signal-based variable logic encryption algorithm according to claim 1, characterized in that, When the variable logic control module (4) performs signal transmission timing control, it specifically adopts a nonlinear flow shaping strategy based on a sliding window: the logic execution unit (43) maintains a signal strength index in memory that reflects the communication activity per unit time. The signal strength index is calculated by weighting the I / O register change rate and data packet functional attributes provided by the state perception unit (42). When the change rate of the signal strength index is within the preset stable range, the logic execution unit (43) instructs the communication interface to enter the keep-alive monitoring mode, reduces the communication frequency to the preset minimum keep-alive frequency, and only transmits heartbeat signals. When the change rate of the signal strength index exceeds the preset sensitivity threshold, the logic execution unit (43) determines that the PLC has entered the critical process stage, immediately switches the communication state to the high-frequency real-time mode, and activates the preemptive transmission channel to ensure the real-time transparent transmission of control signals. Through the dynamic frequency adjustment based on content characteristics, the communication behavior of the relay control device (1) to the outside presents nondeterministic characteristics in order to resist the modeling and analysis of communication patterns by external monitoring devices.

3. The PLC input / output signal-based variable logic encryption algorithm according to claim 1, characterized in that, The core of the dynamic logic recombination encryption process executed by the encryption processing module (5) lies in the entropy source fusion and iteration mechanism of the key derivation engine (51): the key derivation engine (51) acquires multi-dimensional original entropy vectors in real time, including: the current rule base index of the variable logic control module (4), the monotonically increasing sequence number of the current communication batch, the nanosecond-level high-precision clock vector provided by the temperature-compensated crystal oscillator (87), and the hardware random number generated by the physical layer random number generator (82); the key derivation engine (51) combines the above entropy vectors with the system initialization... The root key is nonlinearly mixed, and a time-sensitive subkey is generated for the PLC signal stream being processed by the preset S-box permutation and linear feedback shift register operation. When encrypting the signal load, the encryption processing module (5) first determines the encryption iteration round according to the signal importance level defined by the rule configuration unit (41), and then uses the subkey to perform a physical position rearrangement permutation operation on the original data bits, and combines the logic gate level XOR conversion to achieve influence diffusion, so that any change in any bit of the original signal will cause the ciphertext segment to produce a nonlinear avalanche effect.

4. The PLC input / output signal-based variable logic encryption algorithm according to claim 3, characterized in that, When performing key switching, the encryption processing module (5) adopts a smooth transition mechanism based on double buffering: when the rule is updated or the key lifecycle reaches the threshold, the key derivation engine (51) maintains the currently effective old key buffer pool and the new key buffer pool to be effective in memory at the same time; within the set key switching window period, the encryption processing module (5) identifies the key index used by the current message through the version identifier bit in the message header and calls the corresponding key buffer pool for decryption; when the communication link under the new key successfully passes the consistency check a preset number of times, the algorithm automatically destroys the residual data in the old key buffer pool and completes the seamless switching of the key system to avoid encryption synchronization interruption caused by network delay or packet loss.

5. The variable logic encryption algorithm based on PLC input / output signals according to claim 1, characterized in that, When performing protocol parsing and reconstruction, the protocol adaptation module (6) executes the following deep packet processing flow: The protocol parsing matrix (61) has pre-stored binary message templates of various mainstream industrial communication protocols. When the original signal flows through the relay control device (1), the parsing matrix performs a sliding window scan on the input binary bit stream and extracts feature fields including protocol identifier, length field, function code and unit identifier. The parsing unit locates the control load area according to the offset defined by the corresponding template based on the identified protocol type, and strips and maps the original control data to the structured model of the general data abstraction layer (62); During the data encapsulation stage, the adapter module constructs a standard-compliant message header structure at the front end of the encrypted payload according to the protocol specifications of the target communication object, and calls the hardware acceleration logic to recalculate the Cyclic Redundancy Check (CRC) or Message Verification Code (MAC) to ensure that the encrypted message conforms to the communication consistency standard of the industrial bus, thereby realizing transparent proxy for heterogeneous PLC devices.

6. The PLC input / output signal-based variable logic encryption algorithm according to claim 5, characterized in that, The protocol adaptation module (6) also has a traffic aggregation and fragmentation function for large-scale PLC clusters: In complex gateway topology mode, the protocol adaptation module (6) performs semantic aggregation of scattered I / O signals from multiple PLC nodes in the general data abstraction layer (62) and encapsulates them into a single high-strength encrypted data packet to reduce the overhead of the network protocol header; For real-time monitoring streams with high bandwidth usage, the adaptation module divides the encrypted long message into multiple short fragments with anti-analysis features according to the maximum transmission unit (MTU) limit of the link, and adds independent timing tags and integrity check bits to each fragment to improve the survivability of the signal in unstable industrial network environments.

7. The variable logic encryption algorithm based on PLC input / output signals according to claim 1, characterized in that, The access control unit (71) in the access control and anomaly monitoring module (7) performs defense based on a dual "physical-logical" dimension: the access control unit (71) maintains a dynamically updated whitelist of authorized devices. The whitelist not only records the MAC address, IP address and specific function code access permissions of the authorized interaction, but also records the impedance characteristic fingerprint of the device connected to the physical port of the relay control device (1). When a new connection request is initiated, the access control unit (71) first performs logical authentication based on digital signature, and then obtains the electrical characteristics of the current physical link through the electrical continuity detection circuit (85) and compares them with the stored characteristic fingerprint. If the logical verification fails or the deviation of the physical fingerprint exceeds the security threshold, the access control unit (71) determines that it is an illegal access or a physical layer spoofing attack, and immediately blocks the signal interaction at the physical link layer.

8. The variable logic encryption algorithm based on PLC input / output signals according to claim 1 or 7, characterized in that, The anomaly monitoring unit (72) executes a deep defense strategy based on behavioral fingerprint learning and temporal correlation analysis: In the learning mode at the initial stage of system deployment, the anomaly monitoring unit (72) automatically extracts the signal interaction sequence of PLC under different production process cycles and constructs a normal behavior benchmark based on Markov model or statistical probability distribution. During real-time monitoring, the monitoring unit continuously calculates the entropy change of the communication flow and the temporal correlation characteristics of message length and transmission frequency. If the deviation between the monitored real-time characteristics and the benchmark model exceeds the preset security boundary, or an abnormal signal sequence that violates the production logic is identified, the system automatically determines that it is a communication abnormality. The abnormality monitoring module (7) performs a graded alarm response based on the judgment result: for low-risk deviations, only log recording is performed; for medium-risk abnormalities, temporary logic blocking of specific ports is performed; for high-risk attacks, a global security lockout is triggered, and an alarm message encrypted with a timestamp provided by a temperature-compensated crystal oscillator (87) is sent to the industrial control center.

9. The variable logic encryption algorithm based on PLC input / output signals according to claim 1, characterized in that, The physical layer linkage protection in the algorithm and hardware collaboration mechanism specifically includes the following self-destruction and isolation logic: The hardware carrier of the relay control device (1) integrates a mechanical pressure sensing circuit (84) for real-time monitoring of the physical integrity of the device shell; when the sensing circuit detects illegal physical skidding, shell damage or attempted physical intrusion signals, the hardware layer sends the highest priority unmasked interrupt signal to the industrial-grade embedded microprocessor (81); after receiving the interrupt signal, the algorithm layer immediately executes the memory erasure algorithm, forcibly clears all dynamic key remnants, logic rule base, trust certificate and audit log stored in the non-volatile memory (86), and physically cuts off the electrical connection of all input and output channels, so that the device enters an irreversible logic lock state to prevent the leakage of core secrets.

10. The variable logic encryption algorithm based on PLC input / output signals according to claim 1 or 9, characterized in that, The algorithm and hardware collaboration mechanism also involves power integrity monitoring and energy efficiency management logic: the hardware unit of the relay control device (1) monitors the real-time power consumption characteristics of the microprocessor (81) and converts the power consumption fluctuation curve into a digital feedback signal to be sent to the algorithm layer. The algorithm layer analyzes the timing correlation between power consumption characteristics and encryption / decryption operations, assesses whether there is a risk of side-channel attack, and introduces hardware random current compensation noise when necessary to smooth out physical power consumption characteristics. When the algorithm detects that the PLC device (2) has entered a shutdown or standby mode for a preset duration, the transfer control device (1) automatically switches to a low-power mode, shuts down the unnecessary hardware acceleration engine (83), and retains only the basic physical intrusion detection circuit and wake-up logic; once the status sensing unit (42) detects the reactivation of the PLC communication signal, the algorithm can restore the full-strength protection state through a microsecond-level cold start process, achieving a balance between safety strength and energy efficiency.

Images