Industrial network endogenous security boundary protection method, device and architecture

Abstract

The invention relates to an industrial network endogenous security boundary protection method, device and system, and the method comprises the steps: monitoring and collecting production management network data traffic through a network card, caching the data traffic, and distributing the data traffic to a plurality of heterogeneous filtering review executors; filtering and reviewing the address, the protocol, the industrial control protocol and the control parameter in the data flow by using a filtering and reviewing executor, and outputting a reviewing result; performing mimicry judgment on the review results output by the plurality of heterogeneous filtering review executors, and determining whether to forward the data traffic to the field control network based on the mimicry judgment results and discriminating the abnormal executors to dynamically schedule the executors for filtering and reviewing the data traffic to be online and offline. Aiming at security threats faced by the industrial network boundary protection equipment, a mimicry defense technology is combined, a filtering review function is stripped out, and the uncertainty threats caused by unknown vulnerabilities or backdoors of the industrial network boundary protection equipment are relieved through heterogeneous and redundancy filtering review execution bodies.

Description

technical field [0001] The invention belongs to the technical field of industrial network border protection, and in particular relates to a method, equipment and system for endogenous safety border protection of industrial networks. Background technique [0002] Industrial control systems generally adopt border protection methods to protect themselves. Under the development trend of digitization, intelligence, and networking, border protection devices such as gateways and firewalls are directly exposed to the connection border. Industrial network boundary protection is an important line of defense to protect industrial control systems. It provides access control and traffic filtering for connections in various areas within the industrial control network, and realizes the isolation and information exchange of networks with different security levels. However, due to the unavoidable loopholes in the development process, and the backdoors reserved for strategic purposes are usua...

AI Technical Summary

Problems solved by technology

[0003] Due to the inherent static nature of conventional architecture and configuration methods, the current border protection technology mainly focuses on strengthening static confrontation capabilities. The main deficiency of industrial network border protection equipment is that defense attacks rely on accurate prior knowledge, and the long-term determinism after deployment In this state, the attacker can repeatedly try to attack. Once a flaw is found (such as a flaw in the filtering review logic that makes the pseudo-legal malicious payload packet escape inspection), it can be used effectively in the future; the main threat is that it may be implanted based on a specific payload. Vulnerabilities / backdoors, such as transmitting industrial control information to the outside or transmitting illegal control instructions to the internal network, etc.

However, the static nature of industrial network border protection equipment causes such vulnerabilities / backdoors to be effectively triggered for a long time, and the singleness of deployment causes a lack of comparison, making it difficult to detect in time. The similarity causes the breakthrough of one line of defense to be equivalent to the breakthrough of the entire line

Images