Security protection method and system for private network communication

Abstract

The application relates to the technical field of communication security, and discloses a security protection method for private network communication, which comprises the following steps: synchronously collecting observation sample indexes on a target observation resource of a private network communication session and service link quality indexes on a service resource; forming observation abnormal components and service degradation components respectively according to the observation sample indexes and the service link quality indexes, and calculating an interference confidence degree based on the correlation between the observation abnormal components and the service degradation components in the time dimension; determining a service residual time delay budget of the private network communication session; and generating a corresponding anti-interference response strategy based on the interference confidence degree and the service residual time delay budget. The method significantly improves the accuracy of security protection of the private network communication under the premise of ensuring service real-time performance. The application further discloses a security protection system for private network communication.

Description

Technical Field

[0001] This invention relates to the field of communication security technology, and for example to a security protection method and system for private network communication. Background Technology

[0002] Private network communication is widely used in critical business scenarios such as industrial control, power line inspection, emergency command, port and mine scheduling, and rail transportation. These businesses typically require low latency, high reliability, and strong security for communication. When communication links encounter malicious interference, strong co-channel interference, or deceptive pilot attacks, control commands may fail to arrive in a timely manner, equipment status reporting may be interrupted, or even safety incidents may occur.

[0003] Existing security mechanisms for private network communication are mostly focused on identity authentication, access control, and end-to-end encryption at the network layer and above. These mechanisms can improve the confidentiality of business data and the credibility of identity. However, when malicious interference occurs at the physical layer, and legitimate signals are suppressed or contaminated at the air interface, upper-layer protocols can usually only observe the final results such as bit errors, retransmissions, or service interruptions. It is difficult to quickly locate the cause of interference and restore the link during continuous service transmission.

[0004] In the field of physical layer interference detection, existing solutions utilize blank subcarriers, blank resource blocks, or blanked resources that do not carry service data in OFDM (Orthogonal Frequency Division Multiplexing) systems to detect energy or occupancy anomalies. For example, patent application CN202110488867.6 discloses a method for radio disturbance detection. This method determines blanked subcarrier index data, performs interference measurements on blanked subcarriers in the time-frequency resource grid indicated by one or more blanked subcarrier index data to detect the presence of radio disturbance, and initiates defensive actions to mitigate radio disturbance when the presence of disturbance is determined.

[0005] In the process of implementing the embodiments of the present invention, at least the following problems were found in the related art: Relying solely on a single observation dimension on blank or blanking resources for interference judgment makes it difficult to distinguish between malicious interference and non-malicious interference such as channel fading, obstruction, legitimate co-frequency services, or instantaneous noise fluctuations. This can easily lead to false alarms. Moreover, after detecting anomalies, the response actions usually do not take into account the real-time constraints of the current service, which may cause the defense actions themselves to exacerbate service interruptions or timeouts. Summary of the Invention

[0006] To address the shortcomings of the existing technologies, this invention provides a security protection method and system for private network communication, which improves the accuracy of security protection for private network communication while ensuring the real-time nature of services.

[0007] According to one aspect of the present invention, the present invention provides a security protection method for private network communication, comprising: synchronously collecting observation sample indicators on target observation resources and service link quality indicators on service resources of the private network communication session; forming observation anomaly components and service degradation components according to the observation sample indicators and service link quality indicators, and calculating interference confidence based on the correlation between the observation anomaly components and service degradation components in the time dimension; determining the service remaining delay budget of the private network communication session; and generating a corresponding anti-interference response strategy based on the interference confidence and the service remaining delay budget.

[0008] Optionally, the target observation resources are determined as follows: a resource selection seed is generated based on the dynamic security information parameters of the private network communication session; the resource selection seed is mapped to the available time-frequency resource set through a deterministic mapping function to obtain a pseudo-random observation resource map; the time-frequency resource location indicated by the pseudo-random observation resource map is used as the target observation resource; wherein, the target observation resource does not carry service data.

[0009] Optionally, a resource selection seed is generated based on the dynamic security information parameters of the private network communication session, including: selecting multiple parameters from the dynamic security information parameters as input parameters; wherein, the dynamic security information parameters include a session key, the current frame number, the terminal identifier, the private network access node identifier, and multiple selectable random numbers; concatenating the input parameters to obtain a concatenated input string, and performing calculations on the concatenated input string using cryptographic functions; extracting a preset length of bits from the calculation result as an integer value, and performing a modulo operation on the total number of available time-frequency resources using the integer value to generate a resource selection seed.

[0010] Optionally, based on the temporal correlation between the observed anomaly component and the service degradation component, the interference confidence is calculated, including: determining a temporal correlation window and calculating a correlation coefficient based on the temporal correlation window; wherein, the correlation coefficient is used to characterize the temporal consistency between the observed anomaly component and the service degradation component within the temporal correlation window; and fusing the observed anomaly component, the service degradation component, and the correlation coefficient to obtain the interference confidence; wherein, the correlation coefficient is calculated according to the following formula: ， Among them, t A t represents the time of occurrence of the observed anomaly corresponding to the observed anomaly component. B T represents the time of occurrence of business degradation corresponding to the business degradation component. w This is a time-related window.

[0011] Optionally, the observation anomaly component, the service degradation component, and the correlation coefficient are fused to obtain the interference confidence level. This includes calculating the interference confidence level according to the following formula: multiply the observation anomaly component, the service degradation component, and the correlation coefficient, and use the product as the interference confidence level; or, determine the asymmetric suppression factor for the observation anomaly component and the service degradation component; multiply the observation anomaly component, the service degradation component, and the correlation coefficient to obtain the product; use the asymmetric suppression factor to suppress and correct the product, and use the suppressed and corrected product as the interference confidence level; wherein, the strength of the asymmetric suppression factor suppression correction is positively correlated with the degree of difference between the observation anomaly component and the service degradation component.

[0012] Optionally, the asymmetric suppression factor is obtained as follows: determine the absolute difference between the observed anomaly component and the service degradation component; multiply the preset first suppression intensity coefficient by the absolute difference to obtain a first intermediate quantity; add the first intermediate quantity to a constant 1 to obtain a second intermediate quantity; and take the reciprocal of the second intermediate quantity to obtain the asymmetric suppression factor; wherein, the first suppression intensity coefficient is used to adjust the rate at which the asymmetric suppression factor decays as the absolute difference between the observed anomaly component and the service degradation component increases.

[0013] Optionally, based on the interference confidence level and the remaining service latency budget, a corresponding anti-interference response strategy is generated, including: when the interference confidence level is greater than or equal to the interference confidence level threshold, comparing the remaining service latency budget with a first remaining service latency budget threshold and a second remaining service latency budget threshold; wherein the first remaining service latency budget threshold is less than the second remaining service latency budget threshold; and generating a multi-domain response vector including actions of different coordination levels based on the comparison result; wherein the multi-domain response vector includes one or more of the following: local fast path actions that do not change the current service session, coordination actions executed by the private network access node, and system parameter update actions.

[0014] Optionally, the security protection method for private network communication further includes: after executing the corresponding anti-interference response strategy, determining the link quality verification result that reflects the execution effect of the anti-interference response strategy; and adjusting the discrimination threshold of interference confidence, the sampling density of target observation resources, or the anti-interference response strategy based on the link quality verification result.

[0015] Optionally, adjusting the sampling density of the target observation resource includes: determining the target sampling density of the target observation resource based on historical interference detection results; obtaining a preset damping coefficient; processing the current sampling density based on the target sampling density and the damping coefficient to obtain the adjusted sampling density; and / or determining a time lock period; wherein the time lock period includes a preset number of scheduling cycles; during the time lock period, only maintaining the sampling density of the target observation resource unchanged or continuing to adjust it along the current adjustment direction of the sampling density is allowed, and reverse adjustment of the sampling density is prohibited.

[0016] According to another aspect of the present invention, the present invention also provides a security protection system for private network communication, comprising: a physical layer sensing module configured to synchronously collect observation sample indicators on target observation resources and service link quality indicators on service resources of the private network communication session; and an edge security control module electrically connected to the physical layer sensing module, configured to: form observation anomaly components and service degradation components according to the observation sample indicators and service link quality indicators, respectively, and calculate interference confidence based on the correlation between the observation anomaly components and service degradation components in the time dimension; determine the service remaining delay budget of the private network communication session; and generate a corresponding anti-interference response strategy based on the interference confidence and the service remaining delay budget.

[0017] The security protection method and system for private network communication provided by this invention have at least the following beneficial technical effects: By synchronously collecting observation sample indicators from target observation resources and service link quality indicators from service resources for private network communication sessions, and introducing time-dimensional correlation analysis to calculate interference confidence, dual evidence is provided for interference determination, including physical anomalies and actual service damage. This effectively distinguishes between genuine malicious interference and non-malicious events such as channel fading and transient noise, significantly reducing the probability of false alarms. Furthermore, the introduction of the remaining service delay budget as a decision constraint allows for dynamic determination of the complexity and scope of defense actions based on the urgency of the service, ensuring that any security defense action itself does not exacerbate service interruptions or timeouts. Thus, by constructing a multi-dimensional joint discrimination and delay-aware response mechanism, the accuracy of private network communication security protection is significantly improved while ensuring service real-time performance. Attached Figure Description

[0018] Figure 1 A flowchart illustrating a security protection method for private network communication provided in an embodiment of the present invention; Figure 2 A flowchart illustrating another security protection method for private network communication provided in an embodiment of the present invention; Figure 3 A flowchart illustrating another security protection method for private network communication provided in an embodiment of the present invention; Figure 4 A flowchart illustrating another security protection method for private network communication provided in an embodiment of the present invention; Figure 5 A flowchart illustrating another security protection method for private network communication provided in an embodiment of the present invention; Figure 6 This is a schematic diagram of a security protection system for private network communication provided in an embodiment of the present invention; Figure 7 This is a schematic diagram of another security protection device for private network communication provided in an embodiment of the present invention. Detailed Implementation

[0019] To better understand the above technical solutions, a detailed description of the solutions will be provided below in conjunction with the accompanying drawings and specific embodiments. Obviously, the described embodiments are merely some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0020] The terminology used in the embodiments of this invention is for the purpose of describing particular embodiments only and is not intended to limit the invention. The singular forms “a,” “the,” and “the” as used in the embodiments of this invention and the appended claims are also intended to include the plural forms, and “multiple” generally includes at least two unless the context clearly indicates otherwise.

[0021] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that an article or device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such an article or device. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the article or device that includes said element.

[0022] The security protection method for private network communication provided by this invention can be applied to various low-latency and high-reliability private network communication systems, including but not limited to 5G private networks, industrial LTE private networks, dedicated wireless local area networks, and other dedicated communication networks with strict requirements for communication latency and reliability.

[0023] To facilitate understanding of the technical solution of this invention, the security protection system upon which this method is based is described. The security protection system includes a terminal communication module, a dedicated network access node, a physical layer perception module, an edge security control module, and a low-latency policy execution module. These modules work collaboratively to construct a low-latency security control link from physical layer covert observation, joint discrimination, latency-aware response to closed-loop feedback updates. Wherein: The terminal communication module is deployed in the private network terminal equipment and is used to send and receive business data within the private network communication session. The private network terminal equipment can be an industrial control terminal, inspection terminal, sensor, actuator, mobile robot or emergency communication terminal, etc. Private network access nodes are used to provide wireless access, resource scheduling, clock synchronization and anti-interference collaborative response for terminal communication modules. Private network access nodes can be 5G private network base stations, industrial LTE access nodes, dedicated wireless access points, edge base stations or combinations thereof. The physical layer sensing module is used to synchronously collect observation sample indicators on target observation resources and service link quality indicators on service resources during private network communication sessions, providing raw measurement data for subsequent joint interference discrimination; The edge security control module is deployed in private network access nodes, edge computing nodes, security gateways, private network controllers, or terminal-side security processing units. It is used to perform core security decision-making functions such as generating pseudo-random observation resource maps, jointly identifying observational anomaly components and service degradation components, calculating interference confidence, determining the remaining service latency budget, and generating anti-interference response strategies. The low-latency policy execution module is used to execute the anti-interference response policy generated by the edge security control module within a preset latency threshold, and to feed back the link quality verification result to the edge security control module after the anti-interference response policy is executed, so as to support closed-loop updates within the same private network communication session.

[0024] Combination Figure 1 As shown in the figure, this disclosure provides a security protection method for private network communication, including the following steps: S10 synchronously collects observation sample indicators on target observation resources of private network communication sessions and service link quality indicators on service resources.

[0025] Here, the observation sample index refers to the raw physical layer measurement parameters collected by the physical layer sensing module on the target observation resources to reflect abnormal air interface activities, including but not limited to received energy, phase offset, time and frequency occupancy, and spatial angle of arrival; the service link quality index refers to the measurement parameters collected synchronously on the service resources to reflect the actual service transmission quality, including but not limited to block error rate, retransmission rate, scheduling failure rate, and transmission delay.

[0026] S20. Based on the observed sample indicators and the service link quality indicators, an observed anomaly component and a service degradation component are formed respectively. Based on the correlation between the observed anomaly component and the service degradation component in the time dimension, the interference confidence is calculated.

[0027] Here, the observation anomaly component is a comprehensive scalar formed by normalizing and weighting multiple observation sample indicators. It is used to quantify the degree of physical layer anomalies detected on the observation resources, and its value ranges from 0 to 1. The larger the value, the more significant the anomaly on the observation resources. The service degradation component is a comprehensive scalar formed by normalizing and weighting multiple service link quality indicators. It is used to quantify the degree of service transmission quality degradation, and its value ranges from 0 to 1. The larger the value, the more severe the service damage.

[0028] S30 determines the remaining latency budget for the private network communication session.

[0029] Here, the remaining delay budget for services refers to the time margin available for the current service data packet to complete the remaining transmission, queuing, and anti-interference strategy execution between the current time and the maximum tolerable delay deadline in a private network communication session.

[0030] In some possible implementations, the remaining latency budget for the service is calculated using the following formula:

[0031] Among them, T remain For the remaining latency budget of the service, T max T is the maximum tolerable latency for the business. consumed T represents the consumed transmission delay. queue T is the queue waiting delay. action The estimated latency for strategy execution.

[0032] Maximum tolerable latency T for the service max The maximum end-to-end latency that a service data packet can withstand from the sender to the receiver is determined during the private network communication session establishment phase based on the service type and QoS requirements; the consumed transmission latency T consumed The time elapsed from when the data packet entered the transmission queue to the current moment is obtained from the difference in timestamps recorded by the MAC layer or baseband processing module; the queue waiting delay T. queue The estimated time a data packet will still need to wait in the current sending queue is calculated based on the current queue length and average service rate; the estimated policy execution delay T. action The additional time overhead required to execute the anticipated anti-interference response strategy is determined based on the type of response action to be executed.

[0033] S40 generates corresponding anti-interference response strategies based on interference confidence and remaining service latency budget.

[0034] Based on interference confidence level and remaining service latency budget, a corresponding anti-interference response strategy is generated and executed to achieve security protection for private network communication. By combining interference confidence level with remaining service latency budget to generate and execute corresponding anti-interference response strategies, the system can accurately match the strength and scope of defense actions according to the credibility of the interference judgment and the urgency of the service, thereby achieving security protection for private network communication without interrupting the current service session.

[0035] The security protection method for private network communication provided in this disclosure synchronously collects observation sample indicators on target observation resources and service link quality indicators on service resources for private network communication sessions. It also introduces time-dimensional correlation analysis to calculate interference confidence, providing dual evidence for interference determination, including physical anomalies and actual service damage. This effectively distinguishes between genuine malicious interference and non-malicious events such as channel fading and transient noise, significantly reducing the probability of false alarms. Furthermore, it introduces the remaining service delay budget as a decision constraint, dynamically determining the complexity and scope of defense actions based on the urgency of the service, ensuring that no security defense action itself exacerbates service interruption or timeout. Therefore, by constructing a multi-dimensional joint discrimination and delay-aware response mechanism, the accuracy of private network communication security protection is significantly improved while ensuring service real-time performance.

[0036] Optionally, combined Figure 2 As shown, step S10 further includes determining the target observation resources according to the following steps: S101 generates resource selection seeds based on dynamic security information parameters of the private network communication session.

[0037] In some possible implementations, a resource selection seed is generated based on the dynamic security information parameters of the private network communication session. This includes: selecting multiple parameters from the dynamic security information parameters as input parameters; wherein the dynamic security information parameters include a session key, the current frame number, the terminal identifier, the private network access node identifier, and multiple selectable random numbers; concatenating the input parameters to obtain a concatenated input string, and performing calculations on the concatenated input string using cryptographic functions; extracting a preset length of bits from the calculation result as an integer value, and performing a modulo operation on the total number of available time-frequency resources using the integer value to generate the resource selection seed.

[0038] Here, dynamic security information parameters include some or all of the following: session key, current frame number, terminal identifier, private network access node identifier, and optional random number. The session key is a symmetric key generated by the terminal and the private network access node through authentication and key negotiation during the establishment of the private network communication session, and is shared by both parties. The current frame number is a time-varying parameter used in private network communication to identify the sequence number of a radio frame or scheduling frame, which increments or updates with each frame. The terminal identifier is the identity information used to uniquely identify the private network terminal device in private network communication; it can be the hardware identifier of the private network terminal device, a temporary network identifier, or a user identifier assigned upon access. The private network access node identifier is the identity information used to uniquely identify the access node (such as a base station or access point) in private network communication. The optional random number is an additional random factor introduced, which can be generated by the terminal or the private network access node during the session and synchronized to the other end.

[0039] For example, when the dynamic security information parameters include a session key, current frame number, terminal identifier, private network access node identifier, and optional random number, the input parameters include a session key, current frame number, terminal identifier, private network access node identifier, and optional random number, or the input parameters include a session key, current frame number, and optional random number; when the dynamic security information parameters include a session key, current frame number, terminal identifier, and optional random number, the input parameters include a session key, current frame number, terminal identifier, and optional random number, or the input parameters include a session key and optional random number.

[0040] Cryptographic functions include one or more of the following: hash-based message authentication code functions (e.g., HMAC-SHA256), secure hash functions (e.g., SHA-256, SHA-3), block cipher algorithms (AES-128 / 256), and key derivation functions (e.g., PBKDF2, HKDF).

[0041] Taking the input parameters including session key Key, current frame number Fn, terminal identifier IDu, private network access node identifier IDn, and optional random number Rnd as an example, the input parameters are concatenated to obtain the concatenated input string X, X = Key || Fn ||IDu || IDn || Rnd, where "||" represents a string-level concatenation operation; the HMAC-SHA256 algorithm is applied to the input string X, with the session key Key as the HMAC key and X as the HMAC message, to obtain a 256-bit hash result H: H = HMAC-SHA256(Key, X); the first 64 bits (8 bytes) are extracted from the hash result H and converted into an integer value S: S = int(H[0:64]), where int(·) indicates that the bit string is interpreted as an integer in big-endian or little-endian order; the modulo operation is performed on the total number of available time-frequency resources M to obtain the final resource selection seed Seed: Seed = S mod M, where M represents the total number of currently available time-frequency resource units (such as the number of blank subcarriers, the number of blank resource blocks, etc.).

[0042] By using the session key, current frame number, terminal identifier, private network access node identifier, and optional random number as input parameters to generate a resource selection seed, the time-frequency location of the observed resource depends simultaneously on the secret credentials shared by both communicating parties, the real-time changing time-domain parameters, and the identity information of the communicating parties. This enables precise synchronization and knowledge of the observed resource location between legitimate terminals and access nodes, significantly enhancing the anti-evasion capability and security of physical layer interference detection.

[0043] S102, through a deterministic mapping function, the resource selection seed is mapped to the available time-frequency resource set to obtain a pseudo-random observation resource map.

[0044] In some possible implementations, a deterministic mapping function is used to map resource selection seeds to an available time-frequency resource set, resulting in a pseudo-random observation resource map. This includes: indexing each time-frequency resource unit in the available time-frequency resource set to obtain a resource index set {0, 1, …, M-1}, where M is the total number of available time-frequency resource units; selecting N target indices from the resource index set based on the deterministic mapping function, where N is the preset number of observation resources; and determining the corresponding time-frequency resource units from the available time-frequency resource set according to each target index, with the determined N time-frequency resource units constituting the pseudo-random observation resource map.

[0045] For example, using a linear congruential mapping approach, based on a deterministic mapping function, N target indices are selected from the resource index set, including selecting N target indices from the resource index set according to the following formula: Idx(i) = (Seed + i×Q) mod M Where Idx(i) is the i-th target index, Seed is the resource selection seed, Q is the preset step value, and i = 0,1, …, N-1.

[0046] For example, a Logistic chaotic mapping-based approach is adopted, which selects N target indices from the resource index set based on a deterministic mapping function. This includes: normalizing the resource selection seed to obtain the initial value of the chaotic mapping; iterating using the Logistic chaotic mapping to generate a chaotic sequence; extracting the last N iteration values ​​from the chaotic sequence and mapping them as candidate indices; and deduplicating the candidate indices. If duplicate candidate indices are found, the chaotic sequence is iterated again to generate new candidate indices for replacement, until N distinct target indices are obtained.

[0047] Specifically, the resource selection seed is normalized to obtain the initial value of the chaotic map, including determining the initial value of the chaotic map according to the following formula:

[0048] Where x0 is the initial value of the chaotic map, and δ is a preset positive offset used to ensure that the initial value does not fall into the fixed point of the chaotic map.

[0049] Specifically, a chaotic sequence is generated through iteration using a Logistic chaotic mapping, including generating the chaotic sequence according to the following formula:

[0050] Where, x {k+1} Let x be the chaotic state value after the (k+1)th iteration. k Let be the chaotic state value after the k-th iteration, μ be the chaotic control parameter with a value range of (3.57, 4], K be the preset number of iterations, and K ≥ N.

[0051] Specifically, the last N iteration values ​​are extracted from the chaotic sequence and mapped to candidate indices, including selecting N target indices from the resource index set according to the following formula: Idx(j) = floor(x {K-N+j} × M) mod M, j = 0, 1, …, N-1 Where Idx(j) is the j-th target index, x {K-N+j} This represents the chaotic state value after the (K-N+j)th iteration, where floor() indicates rounding down.

[0052] S103, the time-frequency resource locations indicated by the pseudo-random observation resource map are used as target observation resources; wherein, the target observation resources do not carry operational data.

[0053] By transforming resource selection seeds into pseudo-random observation resource maps using a deterministic mapping function, the time-frequency location of observation resources is uniquely determined by dynamic security information parameters such as the session key and the current frame number. Legitimate communicating parties can synchronously obtain the location of observation resources based on the same seed and mapping function, while illegal interference sources cannot deduce the content of the pseudo-random observation resource map because they do not possess the key. Among these methods, linear congruent mapping has the advantages of simple computation and low latency, making it suitable for resource-constrained scenarios. However, the Logistic chaotic mapping method utilizes the high sensitivity of chaotic systems to initial values ​​and the nonlinear iterative characteristics, which causes small differences in resource selection seeds to be amplified dramatically after multiple rounds of chaotic diffusion. The locations of observation resources generated by different frames or different terminals exhibit completely different quasi-random distribution patterns. Even if an illegal interference source intercepts the observation location of a certain frame, it cannot fit or predict the map of other frames based on this information. This significantly enhances the anti-evasion capability and unpredictability of observation resources, providing a concealed and reliable physical layer evidence basis for subsequent joint interference discrimination.

[0054] Optionally, combined Figure 3 As shown, in step 20, based on the correlation between the observed abnormal components and the service degradation components in the time dimension, the interference confidence is calculated, including the following steps: S201, determine the time correlation window and calculate the correlation coefficient based on the time correlation window; wherein, the correlation coefficient is used to characterize the temporal consistency between the observed abnormal component and the service degradation component within the time correlation window.

[0055] In some possible implementations, observation anomaly components and service degradation components are formed based on the observed sample indicators and the service link quality indicators, respectively. This includes: normalizing the observed sample indicators to form the observation anomaly component; and normalizing the service link quality indicators to form the service degradation component.

[0056] For example, the observed anomaly component Ao is represented as: Ao = w1×E + w2×Phase + w3×TimeFreq + w4×Angle, where E is the energy anomaly degree, Phase is the phase perturbation degree, TimeFreq is the time-frequency resource anomaly degree, Angle is the spatial orientation anomaly degree, wi (w1, w2, w3, w4) are the weights, and sum(wi)=1.

[0057] For example, the service degradation component Bo is represented as: Bo = v1×BLER + v2×Retrans + v3×SchedFail + v4×Delay, where BLER is the block error rate, Retrans is the retransmission rate, SchedFail is the scheduling failure rate, Delay is the delay normalization index, vi (v1, v2, v3, v4) are the weights, and sum(vi)=1.

[0058] In some possible implementations, the correlation coefficient is calculated using the following formula:

[0059] Among them, t A t represents the time of occurrence of the observed anomaly corresponding to the observed anomaly component. B T represents the time of occurrence of business degradation corresponding to the business degradation component. w This is a time-related window.

[0060] When the time difference between the observed anomaly and the business degradation is 0, C=1 (fully correlated); when the time difference is exactly equal to Tw, C≈0.368 (weakly correlated but still contributing); when the time difference is large, C approaches 0 (almost unrelated).

[0061] For example, the time correlation window Tw is set to 2 scheduling periods. Assume the observed anomaly occurs at time t. A For the 5th scheduling cycle (t) A =5), Business degradation occurs at time t B Also the 5th scheduling cycle (t) B =5), the time difference between the two is 0, then C=exp(-abs(5 - 5) / 2) = exp(-0 / 2) = exp(0) = 1.0; assuming the observed anomaly occurs at time t A and the time t of business degradation B Occurring in different scheduling periods (e.g., t) A =5,t B =6), then C = exp(-abs(5 - 6) / 2) =exp(-1 / 2) ≈ 0.607.

[0062] By transforming the time difference between the observed anomaly occurrence time and the service degradation occurrence time into a continuous correlation coefficient between 0 and 1 using an exponential decay function, a refined characterization of the correlation strength between the two types of anomalies is achieved: when the time difference is zero, the correlation coefficient is 1, indicating that the two are highly synchronized and have the strongest correlation; as the time difference increases, the correlation coefficient decays exponentially and smoothly, rather than abruptly dropping to zero at a certain window boundary. This effectively avoids the problem of abrupt changes in correlation judgment results caused by the time difference falling precisely near the window boundary in traditional hard-decision schemes, significantly improving the stability of interference judgment. Simultaneously, the mathematical characteristics of exponential decay are highly consistent with the physical laws of air interface interference (the impact of interference on services has causality and timeliness; service damage is most severe at the moment interference is applied, and the residual effect of interference gradually weakens over time). Modeling this decay process using an exponential function is closer to the physical essence of actual interference. By continuously mapping the time difference to a correlation coefficient through the exponential decay function, a smooth transition of time correlation strength and a mathematical fit to the physical decay law of interference are achieved. This enhances the physical rationality of interference detection while improving the stability of the judgment, effectively reducing the risk of misjudgment caused by hard boundaries of the time window.

[0063] S202 integrates the observed abnormal components, service degradation components, and correlation coefficients to obtain the interference confidence level.

[0064] In some possible implementations, the observation anomaly component, the service degradation component, and the correlation coefficient are fused to obtain the interference confidence level. This includes multiplying the observation anomaly component, the service degradation component, and the correlation coefficient, and using the product as the interference confidence level.

[0065] Specifically, the interference confidence level is calculated using the following formula: Gi = Ao ×Bo ×C Where Gi is the interference confidence level, Ao is the observation anomaly component, Bo is the service degradation component, and C is the correlation coefficient.

[0066] By multiplying the observed anomaly component, the service degradation component, and the correlation coefficient to obtain the interference confidence, the interference determination must simultaneously meet three conditions: "the observed resources are abnormal," "the service quality is indeed degraded," and "the two are synchronized in time." This product fusion mechanism achieves a natural "AND logic" constraint on multi-dimensional evidence with a simple mathematical structure, effectively avoiding the false alarm problem that can be triggered by a single-dimensional anomaly in traditional schemes, and significantly improving the accuracy of interference determination.

[0067] In some possible implementations, the observation anomaly component, the service degradation component, and the correlation coefficient are fused to obtain the interference confidence level. This includes: determining the asymmetric suppression factor for the observation anomaly component and the service degradation component; multiplying the observation anomaly component, the service degradation component, and the correlation coefficient to obtain the product result; using the asymmetric suppression factor to suppress and correct the product result, and using the suppressed and corrected product result as the interference confidence level; wherein, the strength of the asymmetric suppression factor suppression correction is positively correlated with the degree of difference between the observation anomaly component and the service degradation component.

[0068] Specifically, the interference confidence level is calculated using the following formula: Gi = Ao ×Bo ×C× η(Ao, Bo) Where Gi is the interference confidence level, Ao is the observation anomaly component, Bo is the service degradation component, C is the correlation coefficient, and η(Ao, Bo) is the asymmetric inhibition factor.

[0069] For example, the asymmetric suppression factor is obtained as follows: determine the absolute difference between the observed anomaly component and the service degradation component; multiply the absolute difference by a preset first suppression intensity coefficient to obtain a first intermediate quantity; add the first intermediate quantity to a constant 1 to obtain a second intermediate quantity; and take the reciprocal of the second intermediate quantity to obtain the asymmetric suppression factor; wherein the first suppression intensity coefficient is used to adjust the rate at which the asymmetric suppression factor decays as the absolute difference between the observed anomaly component and the service degradation component increases.

[0070] Specifically, the asymmetric inhibition factor is calculated according to the following formula:

[0071] Where λ is the first inhibition intensity coefficient, λ ≥ 0.

[0072] The first suppression strength coefficient The system is configured as an adjustable parameter, which allows it to flexibly control the sensitivity of the asymmetric suppression factor as the difference between observed anomalies and service degradation increases, thereby achieving a fine balance between false alarm suppression strength and detection tolerance under different interference scenarios.

[0073] By multiplying the absolute difference between the observed anomaly component and the service degradation component by the suppression strength coefficient, adding 1, and then taking the reciprocal, an asymmetric suppression factor with a value range of (0, 1) is constructed. (When the observed anomaly and service degradation are completely consistent, the absolute difference is zero, and the suppression factor takes the maximum value of 1, without applying any suppression to the interference confidence. As the difference between the two gradually increases, the suppression factor decays smoothly, and the decay rate is flexibly adjusted by the suppression strength coefficient.) This allows the interference confidence to be automatically penalized and weakened when the strength of the observed evidence and the service evidence do not match, effectively suppressing false alarms caused by only one-sided anomalies and improving the accuracy and robustness of interference judgment.

[0074] For example, the asymmetric suppression factor is obtained as follows: calculate the difference between the observed anomaly component and the service degradation component; multiply the difference by a preset second suppression intensity coefficient and square it to obtain the numerator; add the observed anomaly component, the service degradation component, and a preset minimum positive number to obtain the denominator; calculate the ratio of the numerator to the denominator and subtract the ratio from the constant 1 to obtain the asymmetric suppression factor; wherein, the second suppression intensity coefficient is used to adjust the rate at which the asymmetric suppression factor decays as the difference between the observed anomaly component and the service degradation component increases.

[0075] Specifically, the asymmetric inhibition factor is calculated according to the following formula:

[0076] Where σ is the second inhibition strength coefficient of the sigmoid type, 0 < σ ≤ 1, For a very small positive number (e.g.) ).

[0077] Setting a second suppression strength coefficient σ allows the asymmetric suppression factor to penalize the difference between observation anomalies and service degradation in a nonlinear squared decay manner. This results in a stronger suppression effect than linear decay when the difference between the two is large, and more sensitively identifies and eliminates the interference of pseudo-anomalies such as "empty shouting" (high observation anomaly component Ao, low service degradation component Bo) or "blind landing" (high service degradation component Bo, low observation anomaly component Ao) on the interference judgment.

[0078] By calculating the ratio of the squared difference between the observed anomaly component and the service degradation component to their sum, and subtracting this ratio from 1 to construct an asymmetric suppression factor, the suppression effect exhibits nonlinear and asymmetric characteristics. (When the observed anomaly and service degradation are equal, the numerator is zero, the suppression factor is 1, and no suppression is applied; as the difference between the two increases, the numerator grows rapidly due to the presence of the squared term, and the suppression factor decays rapidly, resulting in a stronger penalty effect for significantly asymmetric anomalies; simultaneously, the extremely small positive number ε introduced in the denominator avoids division-by-zero anomalies in the extreme case where Ao and Bo are both zero, ensuring the numerical stability of the algorithm.) Compared with linear or reciprocal suppression factors, it has a more sensitive ability to identify and a stronger suppression effect on pseudo-anomaly signals that deviate significantly from consistency, further reducing the risk of false alarms caused by one-sided channel fluctuations or measurement noise.

[0079] The inhibition factor η(Ao, Bo) is significantly less than 1 when Ao and Bo differ greatly, thus penalizing the two asymmetric scenarios of "abnormal observation resources but unaffected operations" or "damaged operations but clean observation resources." When Ao and Bo are close (e.g., Ao≈0.8, Bo≈0.8), |Ao-Bo| approaches 0, η approaches 1, the product is not suppressed, and the confidence level is fully expressed. Based on the product fusion of the observational anomaly component, the operational degradation component, and the correlation coefficient, an asymmetric inhibition factor is introduced. The correlation coefficient C filters inconsistencies from the time dimension (time misalignment reduces confidence), and the inhibition factor η filters inconsistencies from the intensity dimension (mismatch between observation and operational intensity reduces confidence). Together, they constitute a "time-intensity" dual filtering system, ensuring that only combinations of observational anomalies and operational degradation that are synchronized in time and matched in intensity can trigger a high-confidence interference judgment.

[0080] By introducing a time correlation window and a correlation coefficient, the synchronicity of the observed anomaly component and the service degradation component in the time dimension is quantified into a continuous correlation coefficient. This coefficient is then fused with the two components to calculate the interference confidence. This ensures that interference determination not only relies on the two independent evidentiary dimensions of "whether the observed resources are abnormal" and "whether the service quality is degraded," but also strictly constrains their temporal consistency (the interference confidence only increases significantly when physical layer anomalies and service layer damage occur synchronously in the same or adjacent time periods; even if temporally misaligned anomalies are severe, their confidence is effectively suppressed by the correlation coefficient). This enables accurate differentiation between real interference and occasional channel fluctuations, instantaneous noise, or asynchronous events, significantly reducing the false alarm rate and providing a more reliable decision-making basis for subsequent anti-interference response strategies.

[0081] Optionally, combined Figure 4As shown, in step S30, based on the interference confidence level and the remaining service delay budget, a corresponding anti-interference response strategy is generated, including the following steps: S301, when the interference confidence level is greater than or equal to the interference confidence level threshold, compare the remaining service delay budget with the first remaining service delay budget threshold and the second remaining service delay budget threshold.

[0082] The remaining latency budget threshold for the first service is less than the remaining latency budget threshold for the second service. In practical applications, the first threshold can be set to 15%–40% of the maximum tolerable latency for the service, and the second threshold can be set to 40%–70% of the maximum tolerable latency for the service.

[0083] S302, Based on the comparison results, generate multi-domain response vectors that include actions at different coordination levels.

[0084] The multi-domain response vector includes one or more of the following: local fast path actions that do not change the current business session, collaborative actions executed by the private network access node, and system parameter update actions.

[0085] A multi-domain response vector is a set of response actions selected and combined in an orderly manner from a pre-defined anti-interference action library based on interference confidence and remaining service latency budget. Actions in a multi-domain response vector can span multiple execution domains, including the terminal local domain, the access node collaboration domain, and the system policy domain.

[0086] In some possible implementations, based on the comparison results, a multi-domain response vector is generated that includes actions at different levels of coordination. These actions include: when the remaining service latency budget is less than a first service latency budget threshold, the multi-domain response vector includes a local fast path action that does not change the current service session; when the remaining service latency budget is greater than or equal to the first service latency budget threshold but less than a second service latency budget threshold, the multi-domain response vector includes a local fast path action and a coordination action performed by the private network access node; and when the remaining service latency budget is greater than or equal to the second service latency budget threshold, the multi-domain response vector includes a local fast path action, a coordination action performed by the private network access node, and a system parameter update action.

[0087] Here, local fast path actions refer to rapid anti-interference actions executed independently by the private network terminal equipment locally, without signaling interaction with the private network access node. For example, local fast path actions include one or more of the following: resource avoidance actions within the current link, modulation and coding parameter adjustment actions, receive parameter adjustment actions, coding redundancy adjustment actions, and fast receive filter parameter adjustment actions. Specifically: resource avoidance actions within the current link refer to switching transmission to a resource block or subcarrier with less interference within the same wireless link; modulation and coding parameter adjustment actions refer to reducing the modulation order or increasing coding redundancy to trade rate for anti-interference robustness; receive parameter adjustment actions refer to adjusting the receiver filter coefficients, gain, or beamforming weights to enhance the ability to suppress interference signals; coding redundancy adjustment actions refer to dynamically increasing the redundancy ratio of the forward error correction code to improve the decoding success rate under interference conditions; and fast receive filter parameter adjustment actions refer to fine-tuning the receive filter bandwidth or center frequency to precisely suppress narrowband interference.

[0088] The collaborative actions performed by the private network access node are anti-interference actions that require the private network terminal equipment and the private network access node to cooperate through air interface signaling. For example, the collaborative actions performed by the private network access node include one or more of the following: scheduling resource reallocation, short packet redundancy transmission, dual-link replication, and short-time protection resource reconfiguration. Specifically: scheduling resource reallocation refers to the private network access node reallocating a less-interfered time-frequency resource to the private network terminal equipment after receiving an interference indication; short packet redundancy transmission refers to the private network access node repeatedly transmitting the same data packet in multiple consecutive time slots to increase the probability of correct reception by the terminal; dual-link replication refers to the access node simultaneously transmitting the same data to the terminal through two independent wireless links, ensuring communication even if one link is interfered with; and short-time protection resource reconfiguration refers to the private network access node temporarily allocating a protection time slot or protection frequency band specifically for emergency transmission of critical control commands or status data.

[0089] System parameter update actions are actions that optimize and adjust the operating parameters of the interference detection and security protection system itself, provided there is sufficient time. For example, system parameter update actions include one or more of the following: observation resource density adjustment, discrimination parameter update, collaborative scheduling parameter update, and security level enhancement. Specifically: observation resource density adjustment refers to increasing or decreasing the number of observation resources in the pseudo-random observation resource map; discrimination parameter update refers to adjusting the discrimination threshold of interference confidence (i.e., the interference confidence threshold), or adjusting the weighting coefficients of observational anomaly components and service degradation components; collaborative scheduling parameter update refers to optimizing the scheduling strategy parameters of the private network access nodes; and security level enhancement refers to improving the overall security protection level of the communication session, such as increasing observation resource density, enabling stronger cryptographic algorithms, and shortening the key update cycle.

[0090] By incorporating both interference confidence and remaining service latency budget constraints into the generation process of anti-interference response strategies, a deep integration of security protection and real-time service requirements is achieved. On the one hand, interference confidence serves as a precondition for triggering a response, ensuring that defensive actions are only initiated when the interference determination is sufficiently credible, thus avoiding unnecessary response overhead due to misjudgment. On the other hand, the remaining service latency budget serves as a constraint on the complexity and scope of response actions. When time is extremely tight, only microsecond-level fast-path actions are executed locally on the terminal to maintain uninterrupted service sessions. When time is slightly more generous, collaborative actions from access nodes are introduced to enhance the anti-interference effect. When time is ample, system parameter optimization is further performed to improve long-term defense capabilities. This ensures that the strength of the anti-interference response strategy is precisely matched with the urgency of the service, solving the problem that in traditional solutions, defensive actions themselves may become timeout triggers due to excessive time consumption.

[0091] In some embodiments, the security protection method for private network communication further includes: generating a corresponding anti-interference response strategy and then executing the anti-interference response strategy within a preset delay threshold.

[0092] Optionally, the preset latency threshold is determined as follows: determine the maximum tolerable latency of the service and the remaining latency budget of the service; based on the service type of the private network communication session, determine the preset latency threshold according to the maximum tolerable latency of the service and the remaining latency budget of the service.

[0093] Here, business types include real-time control business (such as industrial motion control, robot commands, etc.), real-time interactive business (such as voice scheduling, remote control, etc.), and non-real-time monitoring business (such as status detection, video transmission, etc.).

[0094] In some possible implementations, based on the service type of the network switching communication session, a preset latency threshold is determined according to the maximum tolerable latency of the service and the remaining latency budget of the service, including determining the preset latency threshold according to the following formula:

[0095] Among them, T threshold T is the preset delay threshold. remain For the remaining latency budget of the service, T max Let ω be the maximum tolerable latency for the service, and let ω be the latency sensitivity weight for the service, where ω ∈ (0, 1). For example, for services requiring strong real-time control, the value of ω ranges from 0.6 to 0.8; for services requiring real-time interaction, the value of ω ranges from 0.4 to 0.6; and for services requiring non-real-time monitoring, the value of ω ranges from 0.1 to 0.3.

[0096] When ω is large, T threshold Closer to T max This means that the constraints on policy execution latency are more stringent (suitable for services requiring strong real-time control); when ω is small, T threshold Closer to T remain The strategy has a larger time and space for execution (suitable for non-real-time monitoring businesses).

[0097] By introducing service type and service latency sensitivity weights, the preset latency threshold is dynamically correlated with the maximum tolerable latency and the remaining latency budget of the service. This allows the upper limit of the execution time of the anti-interference response strategy to be adaptively adjusted according to the real-time requirements of the service. For services requiring strong real-time control, the preset latency threshold is more strictly limited by the maximum tolerable latency of the service, ensuring that defensive actions do not encroach on the transmission time of critical control commands. For services requiring non-real-time monitoring, the preset latency threshold relies more loosely on the current remaining latency budget, providing ample execution time for complex collaborative defense or system parameter optimization. This achieves a precise match between the strength of the anti-interference response and the latency sensitivity of the service while ensuring service real-time performance.

[0098] In some embodiments, the security protection method for private network communication further includes: after executing the corresponding anti-interference response strategy, determining the link quality verification result that reflects the execution effect of the anti-interference response strategy; and adjusting the discrimination threshold of interference confidence, the sampling density of target observation resources, or the anti-interference response strategy according to the link quality verification result.

[0099] Here, the discrimination threshold for interference confidence is the threshold value used to classify interference confidence into different interference judgment levels (i.e., interference confidence threshold). The discrimination threshold determines the sensitivity of the system to interference: the lower the discrimination threshold, the easier it is to trigger interference judgment; the higher the discrimination threshold, the less likely it is to trigger interference judgment. The sampling density of the target observation resources is the density of observation resources deployed in the time-frequency resource grid of the private network communication session. The sampling density directly affects the sensitivity of interference detection and system overhead: the higher the sampling density, the more observation points, and the greater the probability of detecting interference, but the more resources available for normal services are occupied; the lower the sampling density, the smaller the system overhead, but local interference may be missed due to sparse observation points. The anti-interference response strategy refers to the decision rules by which the system selects and combines response actions from the preset anti-interference action library based on the interference confidence and the remaining delay budget of the service, and adjusts the anti-interference response strategy, including adjusting the delay budget threshold, adjusting the action priority ranking, and optimizing the parameters of coordinated actions.

[0100] Optionally, determining the link quality verification result reflecting the effectiveness of the anti-interference response strategy includes: collecting service link quality indicators on service resources again within a preset verification period; normalizing the collected service link quality indicators; weighting and fusing the normalized service link quality indicators to obtain the link recovery indicator; and determining the link quality verification result based on the comparison between the link recovery indicator and a preset reliability threshold.

[0101] Here, the service link quality indicators include one or more of the following: signal-to-interference-plus-noise ratio (SINR), block error rate (BLER), retransmission rate (Retrans), scheduling failure rate (SchedFail), round-trip time (RTT), and end-to-end delay (Delay).

[0102] For example, the link recovery metric R is calculated using the following formula: R = a×SINR norm + b×(1-BLER norm ) + c×(1-Delay norm ) Among them, SINR norm BLER norm and Delay norm , respectively, are the normalized signal-to-interference-plus-noise ratio (SIR), block error rate (BIR), and end-to-end delay, and a, b, and c are the weighting coefficients corresponding to SIR, BIR, and end-to-end delay, respectively, and a+b+c=1.

[0103] In some possible implementations, when the verification period includes multiple scheduling periods, the R values ​​from multiple scheduling periods are averaged or the minimum value is taken as the final link recovery indicator R. final .

[0104] For example, the R value over multiple scheduling cycles is averaged to obtain the final link recovery metric R. final R final = (1 / P)×ΣR p Let p = 1, 2, …, P, where P is the number of scheduling periods within the verification period, and R is the number of scheduling periods within the verification period. p This is the link recovery metric for the p-th scheduling cycle.

[0105] The minimum value of R over multiple scheduling cycles is taken as the final link recovery metric R. final R final = min(R1, R2, …, R P ).

[0106] By setting a verification cycle after strategy execution and collecting business link quality indicators again, the link recovery indicator is obtained through normalization and weighted fusion. This indicator is then compared with a preset reliability threshold to determine the link quality verification result. This allows for an objective and quantitative assessment of the actual execution effect of the anti-interference response strategy, providing a reliable data-driven basis for subsequent adjustments to detection thresholds, observation density, or response strategies. Furthermore, by averaging or minimizing the link recovery indicator in multi-scheduling cycle scenarios, the interference of instantaneous fluctuations on a single sampling can be smoothed out, and the minimum guarantee level of link quality can be reflected in the most conservative way, ensuring the stability and reliability of closed-loop feedback decisions.

[0107] Optionally, based on the link quality verification results, the discrimination threshold of interference confidence, the sampling density of the target observation resources, or the anti-interference response strategy can be adjusted, including: if the link recovery index is greater than or equal to a preset reliability threshold, reducing the sampling density of the target observation resources, maintaining the current discrimination threshold of interference confidence, or maintaining the current anti-interference response strategy; if the link recovery index is less than a preset reliability threshold, increasing the sampling density of the target observation resources, increasing the current discrimination threshold of interference confidence, or upgrading the current anti-interference response strategy.

[0108] By quantifying and comparing link recovery indicators with preset reliability thresholds, the adjustment direction is determined based on whether the link recovery meets the standard (when the recovery meets the standard, the sampling density of the target observation resources is reduced to reduce system overhead; when the recovery fails, the sampling density of the target observation resources is increased, the current interference confidence threshold is increased, or the current anti-interference response strategy is upgraded to cope with continuous or escalating interference). This allows for dynamic optimization of security protection parameters and strategies based on real-time link status, avoiding both continuous service damage due to insufficient defense and resource waste caused by excessive defense. It significantly improves the generalization ability and long-term operating efficiency of private network communication against unknown interference.

[0109] Optionally, adjusting the sampling density of the target observation resources includes: determining the target sampling density of the target observation resources based on historical interference detection results; obtaining a preset damping coefficient; and processing the current sampling density based on the target sampling density and the damping coefficient to obtain the adjusted sampling density.

[0110] In some possible implementations, the target sampling density of the target observation resources is determined based on historical interference detection results, including: acquiring interference detection results records of private network communication sessions within a preset historical time window; wherein, the interference detection results records include one or more of the following: interference detection accuracy, successful detection rate of interference events, false alarm rate, and false negative rate; and based on the interference detection results records, determining the sampling density of the target observation resources that achieves the optimal overall interference detection effect, as the target sampling density.

[0111] In some possible implementations, the current sampling density is processed based on the target sampling density and the damping coefficient to obtain an adjusted sampling density, including calculating the adjusted sampling density according to the following formula: D(t+1) = (1- alpha)×D(t) + alpha×D target Where D(t+1) is the adjusted sampling density, D(t) is the current sampling density, and D... target Let α be the target sampling density, and alpha be the damping coefficient, with a value ranging from 0.1 to 0.3.

[0112] By using the sampling density corresponding to the historical best interference detection effect as the adjustment target, and introducing a damping coefficient to perform weighted smooth updates on the current sampling density, the adjustment of the observation resource sampling density always takes the historically verified best detection effect as the reference benchmark, ensuring that the adjustment direction of the sampling density is consistent with the global optimal detection performance of the system. At the same time, the setting of the damping coefficient α ensures that each adjustment gradually approaches the optimal target with a small step size, effectively avoiding drastic changes in sampling density caused by instantaneous fluctuations in the channel environment or brief changes in interference status, and preventing detection performance oscillations caused by parameter mutations.

[0113] Optionally, adjusting the sampling density of the target observation resource may further include: determining a time lock period; wherein the time lock period includes a preset number of scheduling cycles; during the time lock period, it is only allowed to maintain the sampling density of the target observation resource unchanged or to continue adjusting along the current adjustment direction of the sampling density, and it is prohibited to adjust the sampling density in the opposite direction.

[0114] In practical applications, after each adjustment to the sampling density of the target observation resource, a time-lock period is initiated. This time-lock period consists of M scheduling cycles, where M ranges from 3 to 10. Upon entering the time-lock period, the direction of the current sampling density adjustment (e.g., positive adjustment, negative adjustment, or maintaining the current density) is recorded. During the time-lock period, permitted operations include: maintaining the current sampling density; or continuing to adjust in the same direction as recorded upon entering the time-lock period (e.g., increasing or decreasing the density). Prohibited operations include: prohibiting reverse adjustments to the sampling density. For example, if the adjustment direction upon entering the time-lock period was positive (increasing the sampling density of the target observation resource), reverse adjustments are prohibited during the lock period. If M complete scheduling cycles have passed since entering the time-lock period, and the link stability index has reached the preset reliability threshold for M consecutive scheduling cycles, the time-lock period is lifted, restoring the freedom to adjust the sampling density.

[0115] By setting a time lockout period containing a preset number of scheduling cycles after the sampling density is adjusted, only maintaining or continuing to adjust in the current direction is allowed during the lockout period, while reverse adjustment is prohibited. The lockout is only released after the link stability index reaches the stable threshold for several consecutive cycles. This effectively prevents frequent back-and-forth adjustments to the sampling density caused by instantaneous fluctuations in link quality or brief recurrences of interference. While ensuring timely enhancement of observation efforts for continuously deteriorating links, it avoids the adverse effects of parameter jumps on system stability and detection continuity, significantly improving the smoothness and robustness of the closed-loop feedback control process.

[0116] In some embodiments, combined with Figure 5 As shown, the security protection method for private network communication includes the following steps: S00, establish a private network communication session, generate a pseudo-random observation resource map, and use the time-frequency resource locations indicated by the pseudo-random observation resource map as target observation resources.

[0117] S10 synchronously collects observation sample indicators on target observation resources of private network communication sessions and service link quality indicators on service resources.

[0118] S20. Based on the observed sample indicators and the service link quality indicators, an observed anomaly component and a service degradation component are formed respectively. Based on the correlation between the observed anomaly component and the service degradation component in the time dimension, the interference confidence is calculated.

[0119] S30 determines the remaining latency budget for the private network communication session.

[0120] S40 generates corresponding anti-interference response strategies based on interference confidence and remaining service latency budget.

[0121] S50 executes an anti-interference response strategy.

[0122] S60, determine the link quality verification results that reflect the effectiveness of the anti-interference response strategy.

[0123] S70, based on the link quality verification results, adjust the discrimination threshold of interference confidence, the sampling density of target observation resources, or the anti-interference response strategy.

[0124] The following example illustrates the specific implementation of security protection methods for private network communication.

[0125] In industrial control 5G private network scenarios, the terminal communication module is an industrial robot control terminal, the private network access node is a campus 5G private network base station, and the edge security control module is deployed on the base station side or in the edge computing node. After the private network terminal device establishes a private network communication session with the private network access node, the maximum tolerable latency for the service is determined to be 5ms to 20ms. The edge security control module generates a resource selection seed based on the session key, the current frame number, the terminal identifier, and the private network access node identifier. It then maps the resource selection seed to the available time-frequency resource set through a deterministic mapping function, selects blank subcarriers, guard slots, and dummy pilots as target observation resources, and generates a pseudo-random observation resource map.

[0126] During communication, the physical layer sensing module collects observation sample indicators on the target observation resources indicated by the pseudo-random observation resource map, and simultaneously collects service link quality indicators on the service resources. The edge security control module normalizes the observation sample indicators and service link quality indicators respectively, forming observation anomaly components and service degradation components, and calculates the interference confidence level based on the correlation between the two in the time dimension. When the received energy on the target observation resource exceeds the historical noise baseline, and the block error rate and retransmission count on the service resources increase simultaneously within the same or adjacent scheduling windows, the interference confidence level increases significantly. When only the service link quality indicators decrease but no corresponding anomalies appear on the target observation resources, the interference confidence level decreases or a non-malicious degradation flag is output, and this situation is preferentially interpreted as channel fading, signal obstruction, or the impact of legitimate co-frequency services.

[0127] If the interference confidence level exceeds a preset interference confidence level threshold, an interference attack risk is identified. The edge security control module calculates the remaining latency budget for the service and generates corresponding anti-interference response strategies based on the interference confidence level and the remaining latency budget: When the remaining latency budget is less than the first remaining latency budget threshold, the generated multi-domain response vector includes local fast path actions that do not change the current service session, such as avoiding disturbed resources within the current link, adjusting receive filtering parameters, or increasing coding redundancy; when the remaining latency budget is greater than or equal to the first remaining latency budget threshold and less than the second remaining latency budget threshold, the multi-domain response vector also includes coordinated actions performed by the private network access node, such as short packet redundant transmission, scheduling resource reallocation, or dual-link replication; when the remaining latency budget is greater than or equal to the second remaining latency budget threshold, the multi-domain response vector further includes system parameter update actions, such as increasing the sampling density of target observation resources and updating the discrimination parameters of the interference confidence level.

[0128] The low-latency strategy execution module executes the actions in the multi-domain response vector within a preset latency threshold. Link quality verification results reflecting the effectiveness of the anti-interference response strategy are collected within a verification period of 1 to 5 scheduling cycles. Based on the link quality verification results, the discrimination threshold of interference confidence, the sampling density of target observation resources, or the anti-interference response strategy are adjusted, thereby forming a closed-loop feedback within the same private network communication session.

[0129] The security protection method for private network communication adopted in this invention embodiment firstly, generates a pseudo-random observation resource map that makes the observation location unpredictable for illegal interference sources, providing a concealed and evasive source of evidence for physical layer anomaly detection; secondly, by correlating and fusing the observation anomaly component and the service degradation component in the time dimension to calculate the interference confidence, the method effectively distinguishes between real malicious interference and non-malicious events such as channel fading, obstruction, or legitimate co-frequency services through simultaneous verification of two pieces of evidence: physical layer anomaly and service layer impairment, significantly reducing the false alarm rate and the missed alarm rate; thirdly, the interference confidence and the remaining service delay budget are used together as an anti-interference response strategy. The generation of data ensures that the complexity and scope of defensive actions are precisely matched with the urgency of the business, guaranteeing that only local fast-path actions that do not interrupt the session are executed when latency is extremely tight. This fundamentally prevents the defensive actions themselves from becoming a cause of business timeouts. Finally, through link quality verification and interference confidence thresholding after the execution of the anti-interference response strategy, sampling density of target observation resources, or closed-loop feedback adjustment of the anti-interference response strategy, the system can continuously optimize security protection parameters and strategies based on the real-time link recovery status. This comprehensively improves the generalization capability and long-term operating efficiency of private network communication against unknown interference while ensuring low-latency business continuity.

[0130] Combination Figure 6As shown, this embodiment of the disclosure provides a security protection system 60 for private network communication, including a physical layer sensing module 601 and an edge security control module 602. The physical layer sensing module 601 is configured to synchronously collect observation sample indicators on target observation resources and service link quality indicators on service resources for the private network communication session. The edge security control module 602 is electrically connected to the physical layer sensing module 601 and is configured to: form an observation anomaly component and a service degradation component based on the observation sample indicators and the service link quality indicators, respectively; calculate the interference confidence level based on the temporal correlation between the observation anomaly component and the service degradation component; determine the remaining service delay budget for the private network communication session; and generate a corresponding anti-interference response strategy based on the interference confidence level and the remaining service delay budget.

[0131] In some possible implementations, the physical layer sensing module 601 includes an observation resource sampling unit and a service resource sampling unit. The observation resource sampling unit is configured to collect observation sample indicators on the target observation resources of the private network communication session; the service resource sampling unit is configured to collect service link quality indicators on the service resources of the private network communication session.

[0132] Continue to combine Figure 6 As shown, the security protection system for private network communication also includes a low-latency policy execution module 603, which is electrically connected to the edge security control module 602. It is configured to execute an anti-interference response strategy and determine the link quality verification result that reflects the effect of the anti-interference response strategy execution, so that the edge security control module 602 can adjust the discrimination threshold of interference confidence, the sampling density of target observation resources, or the anti-interference response strategy according to the link quality verification result.

[0133] Continue to combine Figure 6 As shown, the security protection system for private network communication also includes: a terminal communication module 604 and a private network access node 605, wherein the terminal communication module 604 is configured to perform local fast path actions, and the private network access node 605 is configured to perform collaborative actions.

[0134] Combination Figure 7 As shown in the figure, this disclosure provides a security protection device 70 for private network communication, including a processor 700 and a memory 701, and may also include a communication interface 702 and a bus 703. The processor 700, communication interface 702, and memory 701 can communicate with each other via the bus 703. The communication interface 702 can be used for information transmission. The processor 700 can call logical instructions in the memory 701 to execute the security protection method for private network communication described in the above embodiment.

[0135] Furthermore, the logic instructions in the aforementioned memory 701 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium.

[0136] The memory 701, as a computer-readable storage medium, can be used to store software programs and computer-executable programs, such as program instructions / modules corresponding to the methods in the embodiments of this disclosure. The processor 700 executes functional applications and data processing by running the program instructions / modules stored in the memory 701, thereby implementing the security protection method for private network communication in the above method embodiments.

[0137] The memory 701 may include a program storage area and a data storage area. The program storage area may store the operating system and application programs required for at least one function; the data storage area may store data created based on the use of the terminal device. Furthermore, the memory 701 may include high-speed random access memory and may also include non-volatile memory.

[0138] Processor 700 is a circuit with signal processing capabilities. In one implementation, processor 700 can be a circuit with instruction read and execute capabilities, such as a central processing unit (CPU), microprocessor, graphics processing unit (GPU) (which can be understood as a type of microprocessor), or digital signal processor (DSP). In another implementation, processor 700 can achieve certain functions through the logical relationships of hardware circuits. These logical relationships of hardware circuits are fixed or reconfigurable. For example, processor 700 can be a hardware circuit implemented as an ASIC or a programmable logic device (PLD), such as an FPGA. In a reconfigurable hardware circuit, the process of the processor loading a configuration document and configuring the hardware circuit can be understood as the process of the processor loading instructions to achieve the functions of some or all of the above modules. Furthermore, it can also be a hardware circuit designed for artificial intelligence, which can be understood as a type of ASIC, such as a neural network processing unit (NPU), tensor processing unit (TPU), or deep learning processing unit (DPU). The processor 700 is used to execute related programs to implement the functions required by the units in the security protection device for private network communication in the embodiments of this application, or to execute the security protection method for private network communication in the method embodiments of this application.

[0139] As can be seen, each module in the above device can be one or more processors (or processing circuits) configured to implement the above methods, such as: CPU, GPU, NPU, TPU, DPU, microprocessor, DSP, ASIC, FPGA, or a combination of at least two of these processor types.

[0140] Furthermore, the modules in the above devices can be integrated in whole or in part, or they can be implemented independently. In one implementation, these modules are integrated together as a system-on-a-chip (SOC). The SOC may include at least one processor for implementing any of the above methods or for implementing the functions of the modules of the device. The at least one processor may be of different types, such as CPU and FPGA, CPU and artificial intelligence processor, CPU and GPU, etc.

[0141] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention. Clearly, those skilled in the art can make various alterations and modifications to the invention without departing from its spirit and scope. Thus, if these modifications and modifications of the invention fall within the scope of the claims and their equivalents, the invention is also intended to include these modifications and modifications.

Claims

1. A security protection method for private network communication, characterized in that, include: Simultaneously collect observation sample indicators on target observation resources and service link quality indicators on service resources for private network communication sessions; Based on the observed sample indicators and the business link quality indicators, observed anomaly components and business degradation components are formed respectively, and the interference confidence is calculated based on the correlation between observed anomaly components and business degradation components in the time dimension. Determine the remaining latency budget for private network communication sessions; Based on the interference confidence level and the remaining latency budget of the service, a corresponding anti-interference response strategy is generated.

2. The security protection method according to claim 1, characterized in that, Target observation resources shall be determined in the following manner: Based on the dynamic security information parameters of the private network communication session, a resource selection seed is generated; By using a deterministic mapping function, the resource selection seed is mapped to the available time-frequency resource set to obtain a pseudo-random observation resource map; The time-frequency resource locations indicated by the pseudo-random observation resource map are used as target observation resources; however, the target observation resources do not carry operational data.

3. The security protection method according to claim 2, characterized in that, Based on the dynamic security information parameters of the private network communication session, a resource selection seed is generated, including: Select multiple parameters from the dynamic security information parameters as input parameters; among them, the dynamic security information parameters include the session key, current frame number, terminal identifier, private network access node identifier, and multiple optional random numbers; The input parameters are concatenated to obtain the concatenated input string, and cryptographic functions are used to perform calculations on the concatenated input string. Extract a preset length of bits from the calculation result as an integer value, and use the integer value to perform a modulo operation on the total number of available time-frequency resources to generate a resource selection seed.

4. The security protection method according to claim 1, characterized in that, Based on the temporal correlation between observed anomaly components and service degradation components, the interference confidence level is calculated, including: Determine the time correlation window and calculate the correlation coefficient based on the time correlation window; whereby the correlation coefficient is used to characterize the temporal consistency between the observed abnormal component and the service degradation component within the time correlation window; The interference confidence level is obtained by fusing the observed anomaly component, the service degradation component, and the correlation coefficient. The correlation coefficient is calculated using the following formula: ； Among them, t A t represents the time of occurrence of the observed anomaly corresponding to the observed anomaly component. B T represents the time of occurrence of business degradation corresponding to the business degradation component. w This is a time-related window.

5. The safety protection method according to claim 4, characterized in that, The interference confidence level is obtained by fusing the observed anomaly component, the service degradation component, and the correlation coefficient, including: Multiply the observed anomaly component, the service degradation component, and the correlation coefficient, and use the product as the interference confidence level; or, Determine the asymmetric suppression factors for the observed anomaly component and the service degradation component; multiply the observed anomaly component, the service degradation component, and the correlation coefficient to obtain the product result; use the asymmetric suppression factor to suppress and correct the product result, and use the suppressed and corrected product result as the interference confidence level; among which, the strength of the asymmetric suppression factor suppression correction is positively correlated with the degree of difference between the observed anomaly component and the service degradation component.

6. The security protection method according to claim 5, characterized in that, Asymmetric repression factors are obtained as follows: Determine the absolute difference between the observed abnormal component and the service degradation component; Multiply the preset first suppression intensity coefficient by the absolute difference to obtain the first intermediate value; Add the first intermediate quantity to the constant 1 to obtain the second intermediate quantity; The asymmetric inhibition factor is obtained by taking the reciprocal of the second intermediate value. The first suppression intensity coefficient is used to adjust the rate at which the asymmetric suppression factor decays as the absolute difference between the observed anomaly component and the service degradation component increases.

7. The security protection method according to claim 1, characterized in that, Based on the interference confidence level and the remaining service latency budget, corresponding anti-interference response strategies are generated, including: When the interference confidence level is greater than or equal to the interference confidence level threshold, the remaining service latency budget is compared with the first remaining service latency budget threshold and the second remaining service latency budget threshold; wherein, the first remaining service latency budget threshold is less than the second remaining service latency budget threshold. Based on the comparison results, a multi-domain response vector including actions at different levels of coordination is generated. The multi-domain response vector includes one or more of the following: local fast path actions that do not change the current business session, collaborative actions executed by the private network access node, and system parameter update actions.

8. The security protection method according to any one of claims 1 to 7, characterized in that, Also includes: After implementing the corresponding anti-interference response strategy, determine the link quality verification results that reflect the effectiveness of the anti-interference response strategy. Based on the link quality verification results, adjust the discrimination threshold of interference confidence, the sampling density of target observation resources, or the anti-interference response strategy.

9. The security protection method according to claim 8, characterized in that, Adjusting the sampling density of target observation resources includes: Based on historical interference detection results, determine the target sampling density of the target observation resources; obtain the preset damping coefficient; based on the target sampling density and the damping coefficient, process the current sampling density to obtain the adjusted sampling density; and / or, A time lock period is determined; the time lock period includes a preset number of scheduling cycles; during the time lock period, it is only allowed to maintain the sampling density of the target observation resources unchanged or to continue adjusting along the current adjustment direction of the sampling density, and it is prohibited to adjust the sampling density in the opposite direction.

10. A security protection system for private network communication, characterized in that, include: The physical layer sensing module is configured to synchronously collect observation sample indicators on target observation resources of private network communication sessions and service link quality indicators on service resources. The edge security control module, electrically connected to the physical layer sensing module, is configured to: form observation anomaly components and service degradation components based on observation sample indicators and service link quality indicators, respectively; calculate interference confidence based on the correlation between observation anomaly components and service degradation components in the time dimension; determine the service remaining delay budget for the private network communication session; and generate corresponding anti-interference response strategies based on the interference confidence and service remaining delay budget.

Images