CN110213237B

CN110213237B - Control method for fully distributed subsystem collaborative safety control and Petri network model

Info

Publication number: CN110213237B
Application number: CN201910371368.1A
Authority: CN
Inventors: 张婷婷; 胡核算; 樊一宏
Original assignee: Xidian University
Current assignee: Xidian University
Priority date: 2019-05-06
Filing date: 2019-05-06
Publication date: 2021-08-20
Anticipated expiration: 2039-05-06
Also published as: CN110213237A

Abstract

The invention belongs to the technical field of cooperative control systems, and discloses a control method for cooperative safety control of a completely distributed subsystem and a Petri network model; decomposing the upper system into a plurality of lower systems by a decomposition technique based on index decomposition of the library; calculating the reachable state of the ith lower system and the shortest step length for reaching each reachable state; and calculating the safety of the ith lower system through a distributed safety diagnosis algorithm. The distributed diagnosis method has strong reliability, can decompose a complex Petri network model into a plurality of subnets through various network decomposition methods, obtains certain properties of the original system through the research on the subnets, can be embodied to a certain part of the original system, has reduced running time and higher speed compared with global diagnosis, and ensures that the later-stage safe maintenance of the system is more convenient.

Description

Control method for fully distributed subsystem collaborative safety control and Petri network model

Technical Field

The invention belongs to the technical field of cooperative control systems, and particularly relates to a control method and a Petri network model for cooperative safety control of a completely distributed subsystem.

Background

Today, the rapid development of internet technology has entered an era full of informatization technology, and the development of information technology has become an important strategic resource for the social development of our country, so that the competition of each country and enterprise for information is more and more intense. Security is one of the most basic features in information driven systems, such as database management, e-commerce and mobile communication networks. For these systems, any important information should not be corrupted or obtained by unauthorized users (called intruders). The concept of interference is to prevent any information leakage and to prevent intruders from getting some secret information.

Since the rise of internet technology, many researchers at home and abroad have studied information security technology from their own excellence, and most of the articles for studying information security by building a Petri net model have adopted a global diagnosis method, such as SNNI (strong non-deterministic non-interference), which is a trace-based attribute that intuitively indicates that a system is secure if contents that can be seen by a low-level part are not dependent on contents that can be done by a high-level part. In the Discrete Event System (DES), two types of users are involved, namely a high-level user and a low-level user, both of which are aware of the structure of the system, but which interact with the system in two different ways. In particular, the high-level user should be aware of the occurrence of all events involved in the system, while the low-level user is only aware of some, but not all, of them. Information leakage occurs if a low-level user (i.e., an intruder) can observe the occurrence of events in the system that are only visible to high-level users. In other words, if the high-level view and the low-level view of the system conflict, information leakage may occur. After the accuracy and review of some of these articles, a number of deficiencies were found to exist, as follows: 1. it focuses on examining the SNNI, ILPs and corresponding linear constraints of any given system, which may be astronomical numbers in their size, leading to difficult calculations. 2. Providing information about SNNI accurately and timely is inefficient. When a system is not SNNI, identifying the corresponding areas where information is leaked is time consuming and error prone if this method is used. 3. The method for global safety diagnosis has poor flexibility and fault tolerance. Whenever the system is reconfigured, all ILPs must be rebuilt. Therefore, these disadvantages make their use difficult and difficult to adopt in practical applications.

In summary, the problems of the prior art are as follows:

(1) the existing method for researching information safety by establishing a Petri network model mostly adopts a global diagnosis method after modeling the Petri network, so that the flexibility and the fault tolerance are poor, and the calculation is complex.

(2) In the existing method for researching information security by establishing a Petri network model, when the final judgment result is that the system is not secure, it is difficult to determine which part of the system is not secure at all, so that information leakage is caused, namely the system is not secure, and inconvenience is brought to later-stage system maintenance.

Disclosure of Invention

Aiming at the problems in the prior art, the invention provides a control method for fully distributed subsystem collaborative safety control and a Petri network model.

The invention is realized in such a way that a control method for the cooperative safety control of a fully distributed subsystem comprises the following steps:

a first step of decomposing an upper system into a plurality of lower systems by a decomposition technique based on index decomposition of a library;

secondly, calculating the reachable state of the ith lower system and the shortest step length for reaching each reachable state;

thirdly, calculating the safety of the ith lower system through a distributed safety diagnosis algorithm, and if the result has no feasible solution, indicating that the ith lower system is safe; and repeating the second step, otherwise, the ith lower system is unsafe, namely the original system is unsafe, and if all the lower systems are safe, the original system is safe.

Further, the control method for the fully distributed subsystem collaborative safety control comprises the following steps:

the method comprises the following steps: decomposing based on indexes of the library;

definitions 1, N ═ (P, T; F, M₀) For a Petri net system, the function f is P → {1,2, …, k } satisfies:

so that

Or

f(p₁)≠f(p₂) F is the index function of the library of N, and f (p) is the index of the library p;

definitions 2, N ═ (P, T; F, M₀) Is a Petri net, and the function f is a library index function with the function P → {1,2, …, k } being N, called N_i＝(P_i,T_i,F_i,M_0i) (i ∈ {1,2, …, k }) is a decomposition net with N based on the indexes of the library; n is a radical of_iSatisfy (I) P_i＝{p∈P|f(p)＝i}；②

③F_i＝{(P_i×T_i)∪(T_i×P_i)}∩F；④M_0i＝Γp→p_iM0；

Theorem 1, N_i＝(P_i,T_i；F_i,M_0i) (i ∈ {1,2, …, k }) is N ═ P, T; f, M₀) Based on the decomposition web of the library index, then

Satisfies the following conditions:

and | t | < ═ 1;

step two, calculating the reachable state of the ith subnet and the shortest step length for reaching all reachable states according to the library place, the transition and the number of tokens in the ith subnet;

step three, distributed SNNI (CO-SNNI); s is < N, M₀Is a complex network system, S_iSubnet of S (i ∈ N)⁺) If for any two subnets S₁,S₂∈S_iIf S is₁，S₂Is decomposed based on library indices, and S₁，S₂Are both SNNI, S is CO-SNNI.

Further, in the second step, the shortest step length required by the ith subnet to reach all reachable states is calculated and is represented by J.

Further, in the third step, S ═ N, M is known₀Is a complex network system, S_iIs a subnet of S, i ∈ N⁺S is CO-SNNI if and only if each subnet satisfies the following condition:

δ_iis the optimal solution of the integer linear programming problem;

Maxδ_i(_t)

s.t.

m_i0+c_il*δ_i＞＝0

δ_i∈N^nil

and judging whether a Petri network corresponding to an actual system is CO-SNNI or not, if so, indicating that the content seen by the low-order user is not dependent on the content seen by the high-order user, and then, the system is safe, otherwise, the system is not safe.

Another object of the present invention is to provide a control system for fully distributed sub-system cooperative safety control based on the control method for fully distributed sub-system cooperative safety control, the control system for fully distributed sub-system cooperative safety control including: one upper system and several lower systems;

the lower system is a sub-part of the upper system; the upper system triggers an event of the lower system.

Another object of the present invention is to provide a Petri network model using the control method of the fully distributed sub-system cooperative security control.

Another object of the present invention is to provide a cooperative control system using the control method for cooperative safety control of fully distributed subsystems.

Another object of the present invention is to provide an information data processing terminal using the control method for the fully distributed sub-system cooperative security control.

In particular embodiments, the following results may be obtained:

experiment of	Global constraint	Distributed constraint	Results
				FIG. 2	33	27	CO-SNNI
FIG. 9	43	7	non-CO-SNNI
				FIG. 11	9306	7	non-CO-SNNI

In summary, the advantages and positive effects of the invention are: the distributed diagnosis method has strong reliability, the complex Petri network model can be decomposed into a plurality of subnets through various network decomposition methods, certain properties of the original system can be obtained through the research on the subnets, and meanwhile, a certain part of the original system can be embodied. In the implementation mode, compared with the constraint condition of global diagnosis, the constraint condition of distributed diagnosis is obviously reduced, so that the running time is reduced, the speed is high, and the later safety maintenance of the system is more convenient.

The method proposed by the invention is roughly as follows: an efficient decomposition method is adopted to divide an integral bounded PN modeling system into a plurality of subsystems. Meanwhile, the behavior and the state of the original system can be kept consistent with those of the subsystem. This is of great significance for analysis of SNNI, as in SNNI systems it requires that the overall system and underlying subnets be low-view tracking equivalents in behavior and state. Furthermore, important criteria are given, demonstrating that the SNNI of an overall system can be determined by the SNNI of its subsystems. Then, efficient conditions are presented that allow analysis of SNNI in each subsystem by solving for ILPs. And finally, determining whether the whole system is the SNNI according to the satisfaction of the SNNI of each subsystem. Furthermore, our method can return relevant information about SNNI, i.e. the corresponding region of information leakage. This is crucial to improve system security.

Significance of distributed security diagnostics:

1) the SNNI of any given network system may be checked in a distributed manner. Analyzing the global requirements of SNNI can be obtained by local analysis without the need to know global information. The method is suitable for practical application due to high calculation efficiency. This attribute is not available globally. In addition, information about SNNI locality may be returned to improve system security. 2) The SNNI analysis method enables the SNNI analysis to be applicable to any network system, and has good expandability and adaptability, and better flexibility and fault tolerance, which are not available in global diagnosis. When only a portion of the network system is reconfigured, rather than the entire network system, only the SNNI needs to be rechecked instead of checking the SNNI of the entire system.

Compared with the prior art, the method has the following advantages:

1. the collaborative SNNI focuses on negotiating and integrating all decomposed lower systems to finally obtain the security of the original upper system, compared with the global SNNI, the distributed SNNI focuses on obtaining the security of the whole system from the security of all parts of the system, when the system is not secure, the system can be calculated and analyzed to obtain which part of the system is not secure, and the global SNNI cannot obtain the result.

2. Compared with global SNNI, distributed CO-SNNI has small calculation amount and fast operation time, especially when the system is non-CO-SNNI, the distributed CO-SNNI does not need to calculate all subnets, and if and only if only one subnet is non-SNNI, the original system is not CO-SNNI, namely the original system is unsafe.

3. The global SNNI generally can only aim at some smaller upper systems, when the upper systems are more complex, the global SNNI constraint conditions are relatively more, the calculation is extremely complex, some results are even difficult to obtain, the distributed CO-SNNI can decompose a large upper system, then whether each small lower system is SNNI or not is calculated, the calculation amount of each decomposed small lower system is small, the running time is fast, and particularly when one lower system is non-SNNI, the original upper system can be directly obtained to be non-CO-NI SNs without calculating other decomposed small lower systems, the calculation amount is greatly reduced, and the calculation efficiency is higher.

Drawings

Fig. 1 is a flowchart of a control method for fully distributed sub-system cooperative safety control according to an embodiment of the present invention.

Fig. 2 is a schematic diagram of a host system N according to an embodiment of the present invention.

FIG. 3 is a diagram of a lower level system according to an embodiment of the present invention;

in the figure: (a) lower system N₁(ii) a (b) Lower system N₂。

FIG. 4 shows a lower system N according to an embodiment of the present invention₃Schematic representation.

FIG. 5 is a graph 1 illustrating the results provided by an embodiment of the present invention.

FIG. 6 is a graph 2 illustrating the results provided by an embodiment of the present invention.

FIG. 7 is a graph 3 illustrating the results provided by an embodiment of the present invention.

FIG. 8 is a graph 4 illustrating the results provided by an embodiment of the present invention.

Fig. 9 is a schematic diagram 1 of a host system N according to an embodiment of the present invention.

FIG. 10 is a schematic diagram of a library-based index decomposition 1 according to an embodiment of the present invention;

in the figure: (a) lower system N₁(ii) a (b) Lower system N₂(ii) a (c) Lower system N₃。

Fig. 11 is a schematic diagram 2 of a host system N according to an embodiment of the present invention.

FIG. 12 is a schematic diagram of a library-based index decomposition scheme 2 according to an embodiment of the present invention;

DETAILED DESCRIPTION OF EMBODIMENT (S) OF INVENTION

In order to make the objects, technical solutions and advantages of the present invention more apparent, the present invention is further described in detail with reference to the following embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

The invention provides a Petri network-based distributed CO-SNNI safety diagnosis method based on the existing global SNNI (strong non-determinacy non-interference: the initiation of high-level transition can not enable the initiation of any low-level transition); the invention improves the original global diagnosis method, and has the advantages of higher detection speed of system safety, shorter diagnosis time and simpler calculation.

The following detailed description of the principles of the invention is provided in connection with the accompanying drawings.

As shown in fig. 1, a control method for coordinated safety control of a fully distributed sub-system according to an embodiment of the present invention includes the following steps:

s101: decomposing the upper system into a plurality of lower systems by a decomposition technique based on index decomposition of the library;

s102: calculating the reachable state of the ith lower system and the shortest step length for reaching each reachable state;

s103: and (4) calculating the safety of the ith lower system through a distributed safety diagnosis algorithm, if the result has no feasible solution, indicating that the ith lower system is safe, and repeating the step S102, otherwise, indicating that the ith lower system is unsafe, namely the original system is unsafe, and if all the lower systems are safe, indicating that the original system is safe.

The control method for the fully distributed subsystem collaborative safety control provided by the embodiment of the invention comprises the following steps:

the lower system is a sub-part of the upper system, and the behavior of the upper system can always trigger an event of the lower system, so that the lower system can detect the behavior of the upper system, and the system is unsafe. The lower system is a subsystem extracted from the Petri network, and the fact that the upper system is possible to happen can be predicted by observing the subsystem, so that the upper system is unsafe.

The existing large-scale upper system (a Petri network model of an actual system) decomposes an original upper system into a plurality of lower systems through index decomposition based on a library, and when one lower system is unsafe, the original upper system can be directly obtained to be unsafe; when all the lower systems are safe, the original upper system can be obtained to be safe.

The application of the principles of the present invention will now be described in further detail with reference to the accompanying drawings.

The control method for the fully distributed subsystem collaborative safety control provided by the embodiment of the invention specifically comprises the following steps:

the method comprises the following steps:

1. bank-based index decomposition

Definitions 1 and N ═ P, T; F, M₀) For a Petri net system, the function f is P → {1,2, …, k } satisfies:

so that

Or

f(p₁)≠f(p₂) Let f be the library index function of N, and f (p) be the index of library p.

Definitions 2N ═ (P, T; F, M)₀) Is a Petri net, and the function f is a library index function with the function P → {1,2, …, k } being N, called N_i＝(P_i,T_i,F_i,M_0i) (i ∈ {1,2, …, k }) is a decomposition net with N based on the library index. N is a radical of_iSatisfy (I) P_i＝{p∈P|f(p)＝i}；②

③F_i＝{(P_i×T_i)∪(T_i×P_i)}∩F；④M_0i＝Γp→p_iM0。

Theorem 1 setting N_i＝(P_i,T_i；F_i,M_0i) (i ∈ {1,2, …, k }) is N ═ P, T; f, M₀) Based on the decomposition web of the library index, then

Satisfies the following conditions:

and | t | < ═ 1.

Step two:

and calculating the reachable state of the ith subnet according to the library position and the transition in the ith subnet and the number of tokens (calculated according to a SIMIPN simulation platform in a laboratory).

The shortest step length (calculated according to the SIMIPN simulation platform of the laboratory) required by the ith subnet to reach all reachable states is calculated and is represented by J.

Step three:

definitions distributed SNNI (CO-SNNI)

Known as S ═ N, M₀Is a complex network system, S_iSubnet of S (i ∈ N)⁺) If for any two subnets S₁,S₂∈S_iIf S is₁，S₂Is decomposed based on library indices, and S₁，S₂Are both SNNI, S is CO-SNNI.

Known as S ═ N, M₀Is a complex network system, S_iSubnet of S (i ∈ N)⁺) S is called CO-SNNI if and only if each subnet satisfies the following condition:

δ_iis the optimal solution of the integer linear programming problem;

Maxδ_i(t)

s.t.

m_i0+c_il*δ_i＞＝0

δ_i∈N^nil

symbolic interpretation in the algorithm:

m_i0	initial state of ith subnet
		c_il	Incidence matrix containing low-order transition only in ith sub-network
δ_i	Optimal solution for ith subnet integer linear programming
		pre_i	Pre-incidence matrix of ith sub-network
c_i	Incidence matrix of ith sub-network

When judging whether a Petri network corresponding to an actual system is CO-SNNI, if so, the system is safe, otherwise, the system is unsafe, and the content which can be seen by a low-order user does not depend on the content which can be seen by a high-order user.

The application of the principles of the present invention will now be described in further detail with reference to specific embodiments.

Example 1:

in FIGS. 3 and 4N₁、N₂、N₃The subnet decomposed by the upper system N based on the index of the library in FIG. 2, the two methods are used respectivelyAnd calculating the safety of the upper system.

Global formula SNNI:

max＝l₁+l₂+l₃；

2-2*l₁>＝0；

2-2*l₁-2*l₂>＝0；

2-2*l₃>＝0；

l₁>＝0；

l₁+l₂>＝0；

l₃>＝0；

@bin(l₁)；

@bin(l₂)；

@bin(l₃)；

calculate at the initial mark m₀The maximum number of initiation of low level transitions, the results are as follows:

the results are carried over to yield:

2>＝2*l₁₁；

0>＝2*l₁₁+2*l₁₂；

0>＝2*l₁₃+2*h₁₂；

0>＝h₁₁；

0>＝h₁₂；

0>＝h₁₁；

0>＝h₁₄；

1>＝h₁₃；

2-2*l₁₁+h₁₁>＝2*l₂₁；

-2*l₁₁-2*l₁₂+h₁₂>＝2*l₂₁+2*l₂₂；

-2*l₁₃+h₁₁-2*h₁₂>＝2*l₂₃+2*h₂₂；

l₁₁-h₁₁>＝h₂₁；

1+l₁₁+l₁₂-h₁₂>＝h₂₂；

-h₁₁+h₁₂>＝h₂₁；

h₁₃-h₁₄>＝h₂₄；

1+l₁₃-h₁₃+h₁₄>＝h₂₃；

2-2*l₁₁+h₁₁-2*l₂₁+h₂₁>＝2*l₃₁；

-2*l₁₁-2*l₁₂+h₁₂-2*l₂₁-2*l₂₂+h₂₂>＝2*l₃₁+2*l₃₂；

-2*l₁₃+h₁₁-2*h₁₂-2*l₂₃+h₂₁-2*h₂₂>＝2*l₃₃+2*h₃₂；

l₁₁-h₁₁+l₂₁-h₂₁>＝h₃₁；

1+l₁₁+l₁₂-h₁₂+l₂₁+l₂₂-h₂₂>＝h₃₂；

-h₁₁+h₁₂-h₂₁+h₂₂>＝h₃₁；

h₁₃-h₁₄+h₂₃-h₂₄>＝h₃₄；

1+l₁₃-h₁₃+h₁₄+l₂₃-h₂₃+h₂₄>＝h₃₃；

2-2*l₁₁+h₁₁-2*l₂₁+h₂₁-2*l₃₁+h₃₁>＝0；

-2*l₁₁-2*l₁₂+h₁₂-2*l₂₁-2*l₂₂+h₂₂-2*l₃₁-2*l₃₂+h₃₂>＝0；

-2*l₁₃+h₁₁-2*h₁₂-2*l₂₃+h₂₁-2*h₂₂-2*l₃₃+h₃₁-2*h₃₂>＝0；

l₁₁-h₁₁+l₂₁-h₂₁+l₃₁-h₃₁>＝0；

1+l₁₁+l₁₂-h₁₂+l₂₁+l₂₂-h₂₂+l₃₁+l₃₂-h₃₂>＝0；

-h₁₁+h₁₂-h₂₁+h₂₂-h₃₁+h₃₂>＝0；

h₁₃-h₁₄+h₂₃-h₂₄+h₃₃-h₃₄>＝0；

1+l₁₃-h₁₃+h₁₄+l₂₃-h₂₃+h₂₄+l₃₃-h₃₃+h₃₄>＝0；

l₁₁+l₁₂+l₁₃+l₂₁+l₂₂+l₂₃+l₃₁+l₃₂+l₃₃＝1；

@bin(l₁₁)；

@bin(l₁₂)；

@bin(1₁₃)；

@bin(h₁₁)；

@bin(h₁₂)；

@bin(h₁₃)；

@bin(h₁₄)；

@bin(l₂₁)；

@bin(l₂₂)；

@bin(l₂₃)；

@bin(h₂₁)；

@bin(h₂₂)；

@bin(h₂₃)；

@bin(h₂₄)；

@bin(l₃₁)；

@bin(l₃₂)；

@bin(l₃₃)；

@bin(h₃₁)；

@bin(h₃₂)；

@bin(h₃₃)；

@bin(h₃₄)；

the results are shown in FIG. 5: therefore, the upper system N is safe.

Distributed CO-SNNI: first lower system N₁：

max＝l₁；

2-2*l₁＞＝0；

l₁＞＝0；

@bin(l₁)；

Calculate at the initial mark m₀Is enabled, the first subordinate system N₁The maximum number of triggers for medium to low level transitions, the results are as follows:

Variable Value Reduced Cost

L1 1.000000 -1.000000

the results are carried over to yield:

2-2*l₁＞＝2*l₁₁；

l₁＞＝h₁₁；

-2*l₁₁+h₁₁＞＝2*l₂₁；

1+l₁₁-h₁₁＞＝h₂₁；

-2*l₁₁+h₁₁-2*l₂₁+h₂₁＞＝0；

1+l₁₁-h₁₁+l₂₁-h₂₁＞＝0；

l₁₁+l₂₁＝1；

@bin(l₁₁)；

@bin(h₁₁)；

@bin(l₂₁)；

@bin(h₂₁)；

the results are shown in FIG. 6; i.e. the lower system N₁Is SNNI safe;

second lower system N₂：

max＝l₁+l₂；

2-2*l₁-2*l₂＞＝0；

l₁+l₂＞＝0；

@bin(l₁)；

@bin(l₂)；

Calculate at the initial mark m₀Enabled, second subordinate system N₂The maximum number of triggers for medium to low level transitions, the results are as follows:

Variable Value Reduced Cost

L1 0.000000 -1.000000

L2 1.000000 -1.000000

the results are carried over to yield:

0＞＝2*l₁₁+2*l₁₂；

1＞＝h₁₁；

-2*l₁₁-2*l₁₂+h₁₁＞＝2*l₂₁+2*l₂₂；

1+l₁₁+l₁₂-h₁₁＞＝h₂₁；

-2*l₁₁-2*l₁₂+h₁₁-2*l₂₁-2*l₂₂+h₂₁＞＝0；

1+l₁₁+l₁₂-h₁₁+l₂₁+l₂₂-h₂₁＞＝0；

l₁₁+l₁₂+l₂₁+l₂₂＝1；

@bin(l₁₁)；

@bin(l₁₂)；

@bin(h₁₁)；

@bin(l₂₁)；

@bin(l₂₂)；

@bin(h₂₁)；

the results are shown in FIG. 7: so that the second lower system N₂Is SNNI safe。

Third subordinate system N₃：

max＝l₁；

2-2*l₁＞＝0；

l₁＞＝0；

@bin(l₁)；

Calculate at the initial mark m₀Is enabled, a third lower system N₃The maximum number of triggers for medium to low level transitions, the results are as follows:

Variable Value Reduced Cost

L1 1.000000 -1.000000

the results are carried over to yield:

0＞＝2*l₁₁+2*h₁₁；

0＞＝h₁₂；

0＞＝h₁₄；

1＞＝h₁₃；

-2*l₁₁-2*h₁₁+h₁₂＞＝2*l₂₁+2*h₂₁；

h₁₁-h₁₂＞＝h₂₂；

h₁₃-h₁₄＞＝h₂₄；

1+＞₁₁-h₁₃+h₁₄＞＝h₂₃；

-2*l₁₁-2*h₁₁+h₁₂-2*l₂₁-2*h₂₁+h₂₂＞＝0；

h₁₁-h₁₂+h₂₁-h₂₂>＝0；

h₁₃-h₁₄+h₂₃-h₂₄>＝0；

1+l₁₁-h₁₃+h₁₄+l₂₁-h₂₃+h₂₄>＝0；

l₁₁+l₂₁＝1；

@bin(l₁₁)；

@bin(h₁₁)；

@bin(h₁₂)；

@bin(h₁₃)；

@bin(h₁₄)；

@bin(l₂₁)；

@bin(h₂₁)；

@bin(h₂₂)；

@bin(h₂₃)；

@bin(h₂₄)；

the results are shown in FIG. 8: so that the third lower system N₃Is SNNI safe. In summary, it can be seen that the original upper system N is CO-SNNI secure, and it is obvious that some parts of the system can be embodied by using the distributed algorithm, and the constraint conditions become less, the running time is shortened, and the method is simple and clear compared with the global algorithm.

Example 2:

in FIG. 10N₁、N₂、N₃The upper system N in fig. 9 calculates the security of the upper system by using two methods based on the subnet decomposed by the library index.

Global formula SNNI:

max＝l₁+l₂；

1-l₁>＝0；

1+l₁-l₂>＝0；

1+l₂>＝0；

l₁>＝0；

-l₁+l₂>＝0；

-l₂>＝0；

@bin(l₁)；

@bin(l₂)；

Variable Value Reduced Cost

L1 0.000000 -1.000000

L2 0.000000 -1.000000

the results are carried over to yield:

1>＝l₁₁；

1>＝l₁₂；

1>＝h₁₂；

0>＝h₁₁；

0>＝l₁₁；

0>＝l₁₂；

1-l₁₁+h₁₁>＝l₂₁；

1+l₁₁-l₁₂>＝l₂₂；

1+l₁₂-h₁₂>＝h₂₂；

l₁₁-h₁₁>＝h₂₁；

-l₁₁+l₁₂>＝l₂₁；

-l₁₂+h₁₂>＝l₂₂；

1-l₁₁+h₁₁-l₂₁+h₂₁>＝l₃₁；

1+l₁₁-l₁₂+l₂₁-l₂₂>＝l₃₂；

1+l₁₂-h₁₂+l₂₂-h₂₂>＝h₃₂；

l₁₁-h₁₁+l₂₁-h₂₁>＝h₃₁；

-l₁₁+l₁₂-l₂₁+l₂₂>＝l₃₁；

-l₁₂+h₁₂-l₂₂+h₂₂>＝l₃₂；

1-l₁₁+h₁₁-l₂₁+h₂₁-l₃₁+h₃₁>＝l₄₁；

1+l₁₁-l₁₂+l₂₁-l₂₂+l₃₁-l₃₂>＝l₄₂；

1+l₁₂-h₁₂+l₂₂-h₂₂+l₃₂-h₃₂>＝h₄₂；

l₁₁-h₁₁+l₂₁-h₂₁+l₃₁-h₃₁>＝h₄₁；

-l₁₁+l₁₂-l₂₁+l₂₂-l₃₁+l₃₂>＝l₄₁；

-l₁₂+h₁₂-l₂₂+h₂₂-l₃₂+h₃₂>＝l₄₂；

1-l₁₁+h₁₁-l₂₁+h₂₁-l₃₁+h₃₁-l₄₁+h₄₁>＝l₅₁；

1+l₁₁-l₁₂+l₂₁-l₂₂+l₃₁-l₃₂+l₄₁-l₄₂>＝l₅₂；

1+l12-h12+l22-h22+l32-h32+l42-h42>＝h52；

l₁₁-h₁₁+l₂₁-h₂₁+l₃₁-h₃₁+l₄₁-h₄₁>＝h₅₁；

-l₁₁+l₁₂-l₂₁+l₂₂-l₃₁+l₃₂-l₄₁+l₄₂>＝l₅₁；

-l12+h12-l22+h22-l32+h32-l42+h42>＝l₅₂；

1-l₁₁+h₁₁-l₂₁+h₂₁-l₃₁+h₃₁-l₄₁+h₄₁-l₅₁+h₅₁>＝l₆₁；

1+l₁₁-l₁₂+l₂₁-l₂₂+l₃₁-l₃₂+l₄₁-l₄₂+l₅₁-l₅₂>＝l₆₂；

1+l₁₂-h₁₂+l₂₂-h₂₂+l₃₂-h₃₂+l₄₂-h₄₂+l₅₂-h₅₂>＝h₆₂；

l₁₁-h₁₁+l₂₁-h₂₁+l₃₁-h₃₁+l₄₁-h₄₁+l₅₁-h₅₁>＝h₆₁；

-l₁₁+l₁₂-l₂₁+l₂₂-l₃₁+l₃₂-l₄₁+l₄₂-l₅₁+l₅₂>＝l₆₁；

-l₁₂+h₁₂-l₂₂+h₂₂-l₃₂+h₃₂-l₄₂+h₄₂-l₅₂+h₅₂>＝l₆₂；

1-l₁₁+h₁₁-l₂₁+h₂₁-l₃₁+h₃₁-l₄₁+h₄₁-l₅₁+h₅₁-l₆₁+h₆₁>＝0；

1+l₁₁-l₁₂+l₂₁-l₂₂₊l₃₁-l₃₂+l₄₁-l₄₂+l₅₁-l₅₂+l₆₁-l₆₂>＝0；

1+l₁₂-h₁₂+l₂₂-h₂₂+l₃₂-h₃₂+l₄₂-h₄₂+l₅₂-h₅₂+l₆₂-h₆₂>＝0；

l₁₁-h₁₁+l₂₁-h₂₁+l₃₁-h₃₁+l₄₁-h₄₁+l₅₁-h₅₁+l₆₁-h₆₁>＝0；

-l₁₁+l₁₂-l₂₁+l₂₂-l₃₁+l₃₂-l₄₁+l₄₂-l₅₁+l₅₂-l₆₁+l₆₂>＝0；

-l₁₂+h₁₂-l₂₂+h₂₂-l₃₂+h₃₂-l₄₂+h₄₂-l₅₂+h₅₂-l₆₂+h₆₂>＝0；

l₁₁+l₁₂+l₂₁+l₂₂+l₃₁+l₃₂+l₄₁+l₄₂+l₅₁+l₅₂+l₆₁+l₆₂＝1；

@bin(l₁₁)；

@bin(l₁₂)；

@bin(h₁₁)；

@bin(h₁₂)；

@bin(l₂₁)；

@bin(l₂₂)；

@bin(h₂₁)；

@bin(h₂₂)；

@bin(l₃₁)；

@bin(l₃₂)；

@bin(h₃₁)；

@bin(h₃₂)；

@bin(l₄₁)；

@bin(l₄₂)；

@bin(h₄₁)；

@bin(h₄₂)；

@bin(l₅₁)；

@bin(l₅₂)；

@bin(h₅₁)；

@bin(h₅₂)；

@bin(l₆₁)；

@bin(l₆₂)；

@bin(h₆₁)；

@bin(h₆₂)；

the results are as follows:

it can be seen that the initiation of a high level of migration can enable a low level of migration, so the original system is non-SNNI, i.e. the original system is not safe.

Distributed CO-SNNI:

first lower system N₁：

max＝l；

1-l＞＝0；

l＞＝0；

@bin(l)；

Calculate at the initial mark m₀The maximum number of triggers for low level transitions, enabled, results are as follows:

Variable Value Reduced Cost

L 1.000000 -1.000000

the results are carried over to yield:

0＞＝l₁₁；

1＞＝h₁₁；

-l₁₁+h₁₁＞＝l₂₁；

1+l₁₁-h₁₁＞＝h₂₁；

-l₁₁+h₁₁-l₂₁+h₂₁＞＝0；

1+l₁₁-h₁₁+l₂₁-h₂₁＞＝0；

l₁₁+l₂₁＝1；

@bin(l₁₁)；

@bin(h₁₁)；

@bin(l₂₁)；

@bin(h₂₁)；

the results are as follows:

it is seen that the initiation of high level transitions can enable low level transitions, so the first lower level system is non-SNNI, i.e. the original system is non-CO-SNNI.

In conclusion, the calculation amount is greatly saved by the obtained distributed algorithm, when a lower system is judged to be unsafe, the operation does not need to be continued, the fact that the original system is unsafe can be directly obtained, and the fact that information leakage occurs at the first subnet can be obtained.

Example 3:

the upper system N is shown in FIG. 11; the library-based index decomposition is shown in FIG. 12;

global formula SNNI:

max＝l₁+l₂；

1+l₁>＝0；

-l₁>＝0；

1+l₁>＝0；

1+l₂>＝0；

-l₂>＝0；

@bin(l₁)；

@bin(l₂)；

Variable Value Reduced Cost

L1 0.000000 -1.000000

L2 0.000000 -1.000000

through a SIMIPN simulation platform in a laboratory, the reachable state of the original upper system is 3722, the shortest step length reaching all reachable states is 1860 under the condition that the initial state is [1, 0, 1, 1, 0], if global SNNI calculation is used, after the maximum initiation number of low-order transition under the condition of the initial state is calculated, the safety of the original upper system is judged together with 9306 constraint conditions, the calculation is extremely complex compared with distributed CO-SNNI, and if distributed calculation is used, the result is easily obtained.

Distributed CO-SNNI

First lower system N₁：

max＝l；

l+l＞＝0；

-l＞＝0；

@bin(l)；

Variable Value Reduced Cost

L 0.000000 -1.000000

the results are carried over to yield:

1＞＝h₁；

0＞＝l₁；

1+l₁-h₁＞＝h₂；

-l₁+h₁＞＝l₂；

1+l₁-h₁+l₂-h₂＞＝0；

-l₁+h₁-l₂+h₂＞＝0；

l₁+l₂＝1；

@bin(h₁)；

@bin(l₁)；

@bin(h₂)；

@bin(l₂)；

as a result:

in summary, the initiation of a high level transition may enable a low level transition, so the first lower system is non-SNNI, i.e., the original system is non-CO-SNNI.

The above three examples can be summarized as follows:

The above description is only for the purpose of illustrating the preferred embodiments of the present invention and is not to be construed as limiting the invention, and any modifications, equivalents and improvements made within the spirit and principle of the present invention are intended to be included within the scope of the present invention.

Claims

1. A control method for fully distributed subsystem cooperative safety control is characterized by comprising the following steps:

2. The method for controlling the fully distributed sub-system cooperative safety control as claimed in claim 1, wherein the method for controlling the fully distributed sub-system cooperative safety control comprises:

definitions 1, N ═ (P, T; F, M₀) For a Petri net system, the function f is P → {1,2, ·, k } satisfies:

so that

Or

f(p₁)≠f(p₂) F is the index function of the library of N, and f (p) is the index of the library p; wherein M is₀Is the initial identity of the net;

definitions 2, N ═ (P, T; F, M₀) Is a Petri net, and the function f is a library index function with P → {1,2, ·, k } being N, called N_i＝(P_i,T_i,F_i,M_0i) (i epsilon {1,2, ·, k }) is a decomposition net with N based on the indexes of the library; n is a radical of_iSatisfy (I) P_i＝{p∈P|f(p)＝i}；②

③F_i＝{(P_i×T_i)∪(T_i×P_i)}∩F；④M_0i＝Γp→p_iM0；

Theorem 1, N_i＝(P_i,T_i；F_i,M_0i) (i ∈ {1,2, ·, k }) is N ═ P, T; f, M₀) Based on the decomposition web of the library index, then

Satisfies the following conditions:

1 and 1, | t | < |;

step three, distributed SNNI (CO-SNNI); s is < N, M₀Is a complex network system, S_iIf the S subnet is opposite to any two subnets S₁,S₂∈S_i，i∈N⁺(ii) a If S₁，S₂Is decomposed based on library indices, and S₁，S₂Are both SNNI, S is CO-SNNI.

3. The method as claimed in claim 2, wherein the shortest step length required for the ith subnet to reach all reachable states is calculated in the second step and is represented by J.

4. The method for controlling fully distributed sub-system cooperative safety control according to claim 2, wherein S ═ N, M is known in the three steps₀Is a complex network system, S_iIs a subnet of S, i ∈ N⁺S is CO-SNNI if and only if each subnet satisfies the following condition:

wherein m is_i0Is the initial state of the ith subnet, c_ilIs the incidence matrix, pre, containing only low-order transitions in the ith subnet_iIs the pre-incidence matrix of the ith subnet, c_iIs the incidence matrix of the ith subnet;

δ_iis the optimal solution of the integer linear programming problem;

Maxδ_i(t)

s.t.

m_i0+c_il*δ_i＞＝0

δ_i∈N^nil

5. A control system for fully distributed sub-system cooperative safety control based on the control method for fully distributed sub-system cooperative safety control according to claim 1, wherein the control system for fully distributed sub-system cooperative safety control comprises: a host system including a plurality of lower systems;