Access identification system in industrial control network and identification method thereof

Abstract

The invention provides an access identification system in an industrial control network and an identification method thereof, and the system comprises a data collection module which obtains the data information of the industrial network, and carries out the associated uploading of the obtained data information; the data division module is used for carrying out security analysis on the related information acquired in the data acquisition module, carrying out VLAN division according to processes by utilizing a network I and a network II which are industrially controlled, and establishing a gateway of each VLAN on the basis of core switches of the network I and the network II; under the condition that network equipment is not added, the existing network equipment is utilized, the technical characteristics of an industrial control network and an informatization network are combined, the security of the industrial control network and the informatization network is ensured, and meanwhile, VLAN, STP root node appointing, static routing and a communication-based encryption module are comprehensively utilized, so that the security of the industrial control network and the informatization network is improved. And safe and effective data exchange between the two networks is realized.

Description

Technical Field

[0001] The present invention belongs to the field of communication technology, and in particular relates to an access identification system and an identification method in an industrial control network. Background Art

[0002] Industrial control network information is mostly short frame structure, and is frequently exchanged; it has high reliability and security; the network protocol is simple and practical; the network structure is decentralized; it is easy to integrate with the information network, and has real-time and time determinism; with the widespread application of computer and network communication technology in industrial control systems, the network security issues of industrial control systems are becoming increasingly prominent. In order to strengthen the security management of industrial control systems, prevent hackers and malicious codes from attacking and infringing on industrial control systems, and ensure the safe and stable operation of industrial control systems, existing industrial control networks usually take network security protection measures.

[0003] Industrial control systems are gradually becoming open, interconnected, and universal. Many industrial control protocols are gradually running on industrial Ethernet, and attacks on industrial control systems are becoming more common. At present, the unknown device detection technology in the network mostly uses TCP (Transmission Control Protocol) timestamp and other related information to identify the access device, and detects unknown devices based on the correlation between the timestamp and the hardware device deviation. In industrial control networks, the protocol stack may be relatively old and does not support related protocol options. For example, the TCP / IP protocol stack running on most Modbus (industrial field bus protocol) protocols in the field environment does not support the TCP timestamp option. Summary of the invention

[0004] In order to solve the above technical problems, the present invention provides an access identification system and identification method in an industrial control network to solve the problems in the prior art that the protocol stack in the industrial control network may be relatively old and does not support relevant protocol options.

[0005] In order to achieve the above object, the present invention adopts the following technical solution: The present invention provides an access identification system in an industrial control network, comprising: Data acquisition module, which obtains data information from the industrial control network and associates and uploads the obtained data information; The data partitioning module performs security analysis on the relevant information collected in the data acquisition module, uses the industrial control network 1 and network 2 to divide VLANs according to their processes, and establishes a gateway for each VLAN based on the core switches of network 1 and network 2; A communication encryption module is used to select any communication channel in the industrial control network to encrypt and transmit the content transmitted in the channel; The information extraction module is used to extract the accessed information data, extract the communication account information, and send the extracted communication account information to the management personnel.

[0006] A further improvement of the present invention is that, during data collection, the data collection strategy is dynamically adjusted according to the operating load of the object being collected and the current network congestion status. If network congestion occurs, the collection frequency is reduced.

[0007] A further improvement of the present invention is that the data acquisition module includes a safety data acquisition unit and an abnormal data acquisition unit, wherein: The secure data collection unit includes a specific asset in the industrial control network as the collection target, and based on the flexible data collection strategy, it performs multi-type data collection and multi-level data collection, and generates secure messages at the same time; The abnormal data collection unit includes configuration baseline detection and control operation consistency detection on the security message generated by the security data collection, and data abnormality detection results.

[0008] A further improvement of the present invention is that the communication encryption module includes a communication channel classification unit, a key generation unit and a channel encryption unit. The key generation unit is used to generate a random key, and then the channel encryption unit is used to cover the signal information and maintain the communication. In the channel encryption unit, according to the needs of network communication, the information nodes and industrial control network nodes that need to communicate will establish a key access strategy based on the application port, and all other communications will be rejected. The communication encryption module also includes an output data encryption submodule and an input data decryption submodule. The output data encryption submodule encrypts and protects the data output by the user communication module, and the input data decryption submodule decrypts and analyzes the data received by the user communication module.

[0009] A further improvement of the present invention is that the key generation unit adopts a predetermined hash algorithm to encrypt the communication data channel to obtain the corresponding data decryption password, and associates the data decryption password with the channel encryption unit. The channel encryption unit determines whether the received data decryption password is consistent with the associated uploaded password. If not, it is determined that the access has failed. The communication channel classification unit classifies all channels according to the communication mode, and selects any one channel from different channel classifications for channel encryption.

[0010] The present invention also provides an identification method for an access identification system in the industrial control network, comprising: Obtain business data information accessed in the industrial control network and collect relevant information about the monitoring objects within the industrial control system; Perform security analysis on the collected relevant information to determine whether the accessed data information is authorized. If authorized, directly enter the communication encryption module to determine the identification result. If not authorized, enter the data division module; Obtain communication data messages of unauthorized data information, and control operation consistency detection. For key operation commands, establish associations between control subnet security messages, supervision subnet security messages, and business subnet security messages, and detect the consistency of operation data in the associated messages. If there is inconsistency in the operation data, an abnormal operation alarm is triggered.

[0011] A further improvement of the present invention is to obtain business data information accessed in the industrial control network and collect relevant information of the monitoring objects inside the industrial control system, including: dynamically adjusting the data collection strategy according to the operating load of the object being collected and the current network congestion status, and reducing the collection frequency if network congestion occurs.

[0012] A further improvement of the present invention is that when acquiring the business data information accessed in the industrial control network, the communication selection mode is an Ethernet communication mode and a wireless communication mode, and one or two communication modes are selected.

[0013] A further improvement of the present invention is that the system communicates and maintains according to the selected communication mode. If a terminal of one communication mode appears, it automatically switches to another communication mode, and the communication-related configuration involved in the acquired industrial control network is systematically stored.

[0014] A further improvement of the present invention is that, to determine whether the accessed data information is authorized, the access authorization status of the device to be detected is determined according to the MAC address change status and the IP address change status, including: If it is detected that the MAC address of the device to be detected has changed, and / or if it is detected that the IP address of the device to be detected has changed, it is determined that the access of the device to be detected is unauthorized.

[0015] Compared with the prior art, the present invention has at least the following beneficial technical effects: The present invention provides an access identification system and identification method in an industrial control network. By utilizing existing network equipment without adding network equipment, combining the technical characteristics of the industrial control network and the information network, while ensuring the security of the industrial control network and the information network, VLAN, STP root node designation, static routing and communication encryption module are comprehensively used to achieve safe and effective data exchange between the two networks.

[0016] The present invention provides an access identification system and identification method in an industrial control network, which can not only judge whether there is a problem with the network communication from the perspective of the communication results, but also does not require adjustment to the existing plaintext data transmission method of the industrial control network, thereby effectively solving the problem that the security protection method of the existing industrial control network cannot achieve anti-tampering detection of communication data due to its focus on communication process detection, and effectively avoids the problem that the security protection method of the existing industrial control network may affect the subsequent stable operation of the system due to the need to upgrade the software system or modify the hardware equipment of the industrial control network. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 It is a flow chart of an identification method of an access identification system in an industrial control network of the present invention; Figure 2 The invention discloses a structural block diagram of an access identification system in an industrial control network. DETAILED DESCRIPTION

[0018] In the following, only some exemplary embodiments are briefly described. As those skilled in the art will appreciate, the described embodiments may be modified in various ways without departing from the spirit or scope of the present invention. Therefore, the drawings and descriptions are considered to be exemplary and non-restrictive in nature.

[0019] It should be understood that when used in this specification and the appended claims, the terms "include" and "comprises" indicate the presence of described features, integers, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or combinations thereof.

[0020] It should also be understood that the terms used in the present specification are only for the purpose of describing specific embodiments and are not intended to limit the present invention. As used in the present specification and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include plural forms.

[0021] It should be further understood that the term "and / or" used in the present description and the appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0022] Various structural schematic diagrams of the embodiments disclosed in the present invention are shown in the accompanying drawings. These figures are not drawn to scale, and some details are magnified and some details may be omitted for the purpose of clear expression. The shapes of various regions and layers shown in the figures and the relative sizes and positional relationships therebetween are only exemplary, and may deviate in practice due to manufacturing tolerances or technical limitations, and those skilled in the art may additionally design regions / layers with different shapes, sizes, and relative positions according to actual needs.

[0023] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0024] Example 1 like Figure 1-2 As shown, this embodiment provides an access identification system in an industrial control network, including: Data acquisition module, which obtains data information from the industrial control network and associates and uploads the obtained data information; The data partitioning module performs security analysis on the relevant information collected in the data acquisition module, uses the industrial control network 1 and network 2 to divide VLANs according to their processes, and establishes a gateway for each VLAN based on the core switches of network 1 and network 2; A communication encryption module is used to select any communication channel in the industrial control network to encrypt and transmit the content transmitted in the channel; The information extraction module is used to extract the accessed information data, extract the communication account information, and send the extracted communication account information to the management personnel.

[0025] As an implementation mode of the present invention, during data collection, the data collection strategy is dynamically adjusted according to the operating load of the object being collected and the current network congestion status. If network congestion occurs, the collection frequency is reduced.

[0026] As an embodiment of the present invention, the data acquisition module includes a safety data acquisition unit and an abnormal data acquisition unit, wherein: The secure data collection unit includes a specific asset in the industrial control network as the collection target, and based on the flexible data collection strategy, it performs multi-type data collection and multi-level data collection, and generates secure messages at the same time; The abnormal data collection unit includes configuration baseline detection and control operation consistency detection on the security message generated by the security data collection, and data abnormality detection results.

[0027] As an embodiment of the present invention, the communication encryption module includes a communication channel classification unit, a key generation unit and a channel encryption unit. The key generation unit is used to generate a random key, and then the channel encryption unit is used to cover the signal information and maintain the communication. In the channel encryption unit, according to the network communication needs, the information nodes and industrial control network nodes that need to communicate will establish a key access strategy based on the application port, and all other communications will be rejected. The communication encryption module also includes an output data encryption submodule and an input data decryption submodule. The output data encryption submodule encrypts and protects the data output by the user communication module, and the input data decryption submodule decrypts and analyzes the data received by the user communication module.

[0028] As an embodiment of the present invention, the key generation unit uses a predetermined hash algorithm to encrypt the communication data channel to obtain the corresponding data decryption password, and associates and uploads the data decryption password to the channel encryption unit. The channel encryption unit determines whether the received data decryption password is consistent with the associated uploaded password. If not, it is determined that the access fails. The communication channel classification unit classifies all channels according to the communication mode, and selects any channel from different channel classifications for channel encryption. Hash algorithm is an algorithm that converts an input of any length (such as a string, a file, etc.) into a fixed-length output (usually called a hash value or summary) through a certain calculation process. This process is one-way, that is, the original input data cannot be reversely calculated through the hash value. Hash algorithms are widely used in data integrity verification, secure storage, fast data retrieval and other fields.

[0029] Example 2 This embodiment provides an identification method for an access identification system in an industrial control network, including: Obtain business data information accessed in the industrial control network and collect relevant information about the monitoring objects within the industrial control system; Perform security analysis on the collected relevant information to determine whether the accessed data information is authorized. If authorized, directly enter the communication encryption module to determine the identification result. If not authorized, enter the data division module; Obtain communication data messages of unauthorized data information, and control operation consistency detection. For key operation commands, establish associations between control subnet security messages, supervision subnet security messages, and business subnet security messages, and detect the consistency of operation data in the associated messages. If there is inconsistency in the operation data, an abnormal operation alarm is triggered.

[0030] As an implementation mode of the present invention, determining whether authorization is granted is to determine the access authorization status of the device to be detected according to the MAC address change status and the IP address change status, including: If it is detected that the MAC address of the device to be detected has changed, and / or if it is detected that the IP address of the device to be detected has changed, it is determined that the access of the device to be detected is unauthorized.

[0031] As an embodiment of the present invention, when acquiring business data information accessed in an industrial control network, the communication selection modes are Ethernet communication mode and wireless communication mode. One or two communication modes are selected, and the system communicates and maintains the system according to the selected communication mode. If a terminal of one of the communication modes appears, it automatically switches to another communication mode, and the communication-related configurations involved in the acquired industrial control network are stored in the system.

[0032] The present invention utilizes existing network equipment without adding network equipment, combines the technical characteristics of industrial control networks and information networks, and while ensuring the security of the industrial control network and the information network, comprehensively uses VLAN, STP root node designation, static routing and communication encryption modules to achieve safe and effective data exchange between the two networks. It can not only judge whether there is a problem in network communication from the perspective of communication results, but also does not need to adjust the existing plaintext data transmission method of the industrial control network, thereby effectively solving the problem that the security protection method of the existing industrial control network cannot achieve anti-tampering detection of communication data due to its focus on communication process detection, and effectively avoids the problem that the security protection method of the existing industrial control network may affect the subsequent stable operation of the system due to the need to upgrade the software system or modify the hardware equipment of the industrial control network.

[0033] Example 3 This embodiment provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the steps of the identification method of the access identification system in the industrial control network.

[0034] Through the communication encryption module, the identity of the visitor can be verified in various ways. It can be verified through the communication channel classification unit, the key generation unit and the channel encryption unit. At the same time, the visitor's permissions can be set, including the setting of access, deletion and information classification access permissions, which can effectively protect the security of industrial controllers and avoid access and traffic by irrelevant personnel. Through the data acquisition module, the information of manual and equipment can be entered into the industrial information database, which is convenient for management and control. Through the information extraction module, the visitor's operations and equipment can be monitored, and the visitor's access records, historical retention and deletion operations can be monitored, which is convenient for subsequent accountability, thereby improving the processing efficiency of staff.

[0035] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0036] The present application is described with reference to the flowcharts and / or block diagrams of the methods, systems and computer program products according to the embodiments of the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A system that specifies the functions of a box or multiple boxes.

[0037] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0038] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0039] The above shows and describes the basic principles and main features of the present invention and the advantages of the present invention. It is obvious to those skilled in the art that the present invention is not limited to the details of the above exemplary embodiments, and the present invention can be implemented in other specific forms without departing from the spirit or basic features of the present invention. Therefore, no matter from which point of view, the embodiments should be regarded as exemplary and non-restrictive. The scope of the present invention is defined by the attached claims rather than the above description, and it is intended that all changes falling within the meaning and scope of the equivalent elements of the claims are included in the present invention. Any figure mark in the claims should not be regarded as limiting the claims involved.

[0040] In addition, it should be understood that although this specification is described in accordance with the implementation modes, not every implementation mode contains only one independent technical solution. This description of the specification is only for the sake of clarity. Those skilled in the art should regard the specification as a whole. The technical solutions in each embodiment can also be appropriately combined to form other implementation modes that can be understood by those skilled in the art. The above content is only to illustrate the technical idea of ​​the present invention, and cannot be used to limit the protection scope of the present invention. Any changes made on the basis of the technical solution according to the technical idea proposed by the present invention shall fall within the protection scope of the claims of the present invention.

Claims

1. An access identification system in an industrial control network, characterized in that: include: Data acquisition module, which obtains data information from the industrial control network and associates and uploads the obtained data information; The data partitioning module performs security analysis on the relevant information collected in the data acquisition module, uses the industrial control network 1 and network 2 to divide VLANs according to their processes, and establishes a gateway for each VLAN based on the core switches of network 1 and network 2; A communication encryption module is used to select any communication channel in the industrial control network to encrypt and transmit the content transmitted in the channel; The information extraction module is used to extract the accessed information data, extract the communication account information, and send the extracted communication account information to the management personnel.

2. The access identification system in the industrial control network according to claim 1, characterized in that: During data collection, the data collection strategy is dynamically adjusted according to the operating load of the object being collected and the current network congestion status. If network congestion occurs, the collection frequency is reduced.

3. The access identification system in the industrial control network according to claim 1, characterized in that: The data acquisition module includes a safety data acquisition unit and an abnormal data acquisition unit, wherein: The secure data collection unit includes a specific asset in the industrial control network as the collection target, and based on the flexible data collection strategy, it performs multi-type data collection and multi-level data collection, and generates secure messages at the same time; The abnormal data collection unit includes configuration baseline detection and control operation consistency detection on the security message generated by the security data collection, and data abnormality detection results.

4. The access identification system in the industrial control network according to claim 1, characterized in that: The communication encryption module includes a communication channel classification unit, a key generation unit and a channel encryption unit. The key generation unit is used to generate a random key, and then the channel encryption unit is used to cover the signal information and maintain the communication. In the channel encryption unit, according to the needs of network communication, the information nodes and industrial control network nodes that need to communicate will establish a key access strategy based on the application port, and all other communications will be rejected. The communication encryption module also includes an output data encryption submodule and an input data decryption submodule. The output data encryption submodule encrypts and protects the data output by the user communication module, and the input data decryption submodule decrypts and analyzes the data received by the user communication module.

5. The access identification system in the industrial control network according to claim 4, characterized in that: The key generation unit adopts a predetermined hash algorithm to encrypt the communication data channel to obtain the corresponding data decryption password, and associates and uploads the data decryption password to the channel encryption unit. The channel encryption unit determines whether the received data decryption password is consistent with the associated uploaded password. If not, it is determined that the access has failed. The communication channel classification unit classifies all channels according to the communication mode, and selects any channel from different channel classifications for channel encryption.

6. An identification method for an access identification system in an industrial control network according to any one of claims 1 to 5, characterized in that: include: Obtain business data information accessed in the industrial control network and collect relevant information about the monitoring objects within the industrial control system; Perform security analysis on the collected relevant information to determine whether the accessed data information is authorized. If authorized, directly enter the communication encryption module to determine the identification result. If not authorized, enter the data division module; Obtain communication data messages of unauthorized data information, and control operation consistency detection. For key operation commands, establish associations between control subnet security messages, supervision subnet security messages, and business subnet security messages, and detect the consistency of operation data in the associated messages. If there is inconsistency in the operation data, an abnormal operation alarm is triggered.

7. The identification method of the access identification system in the industrial control network according to claim 6, characterized in that: Acquire business data information accessed in the industrial control network and collect relevant information of the monitoring objects inside the industrial control system, including: dynamically adjusting the data collection strategy according to the operating load of the collected object and the current network congestion status, and reducing the collection frequency if network congestion occurs.

8. The identification method of the access identification system in the industrial control network according to claim 6, characterized in that: When acquiring business data information accessed in the industrial control network, the communication selection mode is Ethernet communication mode and wireless communication mode, and one or two communication modes are selected.

9. The identification method of the access identification system in the industrial control network according to claim 8, characterized in that: The system communicates and maintains according to the selected communication mode. If a terminal of one communication mode appears, it will automatically switch to another communication mode, and the communication-related configurations involved in the acquired industrial control network will be stored in the system.

10. The identification method of the access identification system in the industrial control network according to claim 6, characterized in that: To determine whether the access data information is authorized, the access authorization status of the device to be detected is determined based on the MAC address change and IP address change, including: If it is detected that the MAC address of the device to be detected has changed, and / or if it is detected that the IP address of the device to be detected has changed, it is determined that the access of the device to be detected is unauthorized.

Images