Clock timing method and device of industrial control network security system

Abstract

The invention discloses a clock timing method and device of an industrial control network security system. The system comprises an external clock source, a centralized management center device, a plurality of network security sub-devices, an external timing network and an internal timing network. The method comprises the following steps: when the equipment is started, determining the starting time of an operating system of the equipment based on the hardware time when the central equipment and each sub-equipment are started and the storage time in a file system of the equipment; when the equipment runs, acquiring the time of an external clock source according to a preset period based on an external timing network, and taking the acquired time as the time of a central equipment operating system; acquiring the time of the central equipment according to a preset period based on the internal timing network, and taking the acquired time as the time of the operating system of the sub-equipment; and according to a preset period, based on the time of each equipment operating system, correcting the hardware time and updating the storage time of the file system. According to the invention, the time accuracy and synchronism of the log data of each device can be ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a clock calibration method and device for an industrial control network security system. Background Art

[0002] With the continuous evolution of industrial digital transformation, new types of industrial equipment are constantly emerging and growing in networking and intelligence, the scale of industrial Internet and its applications are becoming increasingly large and complex, and traditional industrial control networks are constantly forced to connect to the Internet, resulting in more network exposure and risks, facing more extensive network threats and severe security situations. Therefore, how to better meet the needs of industrial enterprises, regulatory authorities, etc. for monitoring the security status of various types of industrial control networks, analyzing security logs, handling incidents and tracing security sources, better meet the increasingly precise, accurate and reliable security requirements for the operation process and analysis quality of network security systems and equipment, and ensure accurate and reliable analysis of security incidents under frequent power failures are key issues currently faced.

[0003] At present, most of the existing industrial control network security systems focus on issues such as malicious code, virus file propagation, and vulnerability-based attacks. However, for event analysis and tracing of advanced persistent threats (ATP), there is a lack of rigorous and reliable multi-source time-series security event data as an analysis basis, especially the log data of the industrial control network security system. The accuracy and reliability of the event occurrence time recorded in the log data cannot be guaranteed, and therefore, effective event tracing analysis cannot be performed.

[0004] Based on this, there is an urgent need for a clock calibration method and device for an industrial control network security system to solve the above problems. Summary of the invention

[0005] The present invention provides a clock time calibration method and device for an industrial control network security system, which can ensure the time accuracy, reliability and synchronization of log data of each device in the security system. The technical solution is as follows:

[0006] In a first aspect, a clock synchronization method for an industrial control network security system is provided, which is applied to the clock synchronization system, wherein the system comprises: an external clock source, a centralized management center device, a plurality of network security sub-devices, an external synchronization network and an internal synchronization network, wherein the central device and each of the sub-devices have a mainboard onboard supercapacitor clock circuit, and the supercapacitor clock circuit is used to power a clock chip of the device after the device is powered off; the external synchronization network is respectively connected to the external clock source and the central device, and the internal synchronization network is respectively connected to the central device and each of the sub-devices; the method comprises:

[0007] When each device is started, for the central device and each of the sub-devices, the following steps are performed: determining the startup time of the device operating system based on the hardware time when the device is started and the storage time in the file system of the device; the storage time in the file system is no more than a preset period from the shutdown time of the device;

[0008] When each device is running, for the central device, the time of the external clock source is obtained according to the preset period based on the external time synchronization network, and the obtained time of the external clock source is used as the time of the central device operating system; for each of the sub-devices, the time of the central device is obtained according to the preset period based on the internal time synchronization network, and the obtained time of the central device is used as the time of the sub-device operating system;

[0009] According to the preset period, the hardware time of the corresponding device is corrected based on the time of the operating system of each device;

[0010] According to the preset period, the storage time of the corresponding device file system is updated based on the time of the operating system of each device.

[0011] In a second aspect, a clock synchronization device for an industrial control network security system is provided, which is applied to the clock synchronization system. The system includes: an external clock source, a centralized management center device, a plurality of network security sub-devices, an external synchronization network and an internal synchronization network. The central device and each of the sub-devices have a mainboard onboard supercapacitor clock circuit, and the supercapacitor clock circuit is used to power the clock chip of the device after the device is powered off; the external synchronization network is respectively connected to the external clock source and the central device, and the internal synchronization network is respectively connected to the central device and each of the sub-devices; the device includes:

[0012] A first determining unit is used for, when each device is started, executing, for the central device and each of the sub-devices, determining the startup time of the device operating system based on the hardware time when the device is started and the storage time in the file system of the device; the storage time in the file system is no more than a preset period from the shutdown time of the device;

[0013] The second determination unit is used for, when each device is running, for the central device, obtaining the time of the external clock source according to a preset period based on the external timing network, and using the obtained time of the external clock source as the time of the central device operating system; for each of the sub-devices, obtaining the time of the central device according to the preset period based on the internal timing network, and using the obtained time of the central device as the time of the sub-device operating system;

[0014] A correction unit, configured to correct the hardware time of the corresponding device based on the time of the operating system of each device according to the preset period;

[0015] The updating unit is used to update the storage time of the corresponding device file system based on the time of the operating system of each device according to the preset period.

[0016] In a third aspect, an embodiment of the present invention further provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method described in any embodiment of this specification is implemented.

[0017] In a fourth aspect, a computer-readable storage medium is provided, wherein the storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the clock synchronization method for the industrial control network security system are implemented.

[0018] In a fifth aspect, a computer program product is provided, including a computer program, which, when executed by a processor, implements the steps of the clock synchronization method for the industrial control network security system described above.

[0019] The embodiment of the present invention provides a clock time calibration method and device for an industrial control network security system. First, the centralized management center device can be interconnected with the external clock source through an external time calibration network, and each sub-device can be interconnected with the central device through an internal time calibration network. In this way, the central device can be synchronized with the external clock source, and each sub-device can be synchronized with the clock signal of the central device respectively, thereby ensuring the synchronization of the clock signals of each device in the industrial control network security system. Secondly, when the device is started, the startup time of the operating system is determined based on the hardware time and the storage time of the file system, which can ensure the accuracy of the event sequence. When the device is running, by synchronizing with the external clock source or the central device at every preset period, the operating system time of each device can be continuously corrected to ensure that the log time recorded by each device is consistent with the time of the external clock source, and the time of each device is accurate, reliable and coordinated. It can be seen that the present application can ensure the time accuracy, reliability and synchronization of the log data of each device in the industrial control network security system, and ensure the reasonable timing of multi-source security log data analysis and security event tracing. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0021] Figure 1This is a flow chart of a clock synchronization method for an industrial control network security system provided by an embodiment of the present invention;

[0022] Figure 2 This is a structural diagram of a clock calibration device for an industrial control network security system provided by an embodiment of the present invention;

[0023] Figure 3 is a hardware architecture diagram of a computer device provided by an embodiment of the present invention;

[0024] Figure 4 is a schematic diagram of a clock timing system provided by an embodiment of the present invention;

[0025] Figure 5 It is a schematic diagram of a charging and discharging protection circuit of a homologous clock circuit of a central device and each sub-device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0026] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0027] The specific implementation of the above concept is described below.

[0028] Please refer to Figure 1 , a clock synchronization method for an industrial control network security system provided by an embodiment of the present invention is applied to a clock synchronization system, the system includes: an external clock source, a centralized management center device, a plurality of network security sub-devices, an external synchronization network and an internal synchronization network, the central device and each sub-device have a mainboard onboard supercapacitor clock circuit, the supercapacitor clock circuit is used to power the clock chip of the device after the device is powered off; the external synchronization network is respectively connected to the external clock source and the central device, and the internal synchronization network is respectively connected to the central device and each sub-device; the method includes:

[0029] Step 100, when each device is started, for the central device and each sub-device, the following steps are performed: based on the hardware time when the device is started and the storage time in the file system of the device, determining the startup time of the device operating system;

[0030] Step 102: When each device is running, for the central device, based on the external time synchronization network, the time of the external clock source is obtained according to a preset period, and the time of the external clock source obtained is used as the time of the central device operating system; for each sub-device, based on the internal time synchronization network, the time of the central device is obtained according to a preset period, and the time of the central device obtained is used as the time of the sub-device operating system;

[0031] Step 104, correcting the hardware time of the corresponding device based on the time of the operating system of each device according to a preset period;

[0032] Step 106: updating the storage time of the corresponding device file system based on the time of the operating system of each device according to a preset period.

[0033] In this embodiment, first, the centralized management center device can be interconnected with the external clock source through the external time synchronization network, and each sub-device can be interconnected with the central device through the internal time synchronization network. In this way, the central device can be synchronized with the external clock source, and each sub-device can be synchronized with the clock signal of the central device respectively, thereby ensuring the synchronization of the clock signals of each device in the industrial control network security system. Secondly, when the device is started, the startup time of the operating system is determined based on the hardware time and the storage time of the file system, which can ensure the accuracy of the event timing. When the device is running, by synchronizing with the external clock source or the central device at every preset period, the operating system time of each device can be continuously corrected to ensure that the log time recorded by each device is accurate, reliable and coordinated. It can be seen that the present application can ensure the time accuracy, reliability and synchronization of the log data of each device in the industrial control network security system, and ensure the reasonable timing of multi-source security log data analysis and security event tracing.

[0034] It should be noted that the multiple network security sub-devices can be: firewall units, monitoring and auditing units, intrusion detection units, bastion host units and other security function devices, which can be determined by users according to actual needs, and this application does not make specific restrictions. In addition, the external clock source can provide a stable clock broadcast signal for the industrial control network security system.

[0035] The following is an introduction to the specific connection relationship between the devices in the clock calibration system:

[0036] like Figure 4 As shown, in some implementations, the central device includes an uplink timing interface and multiple downlink timing interfaces, and each sub-device includes a downlink timing interface; each downlink timing interface of the central device corresponds to a downlink timing interface of a sub-device;

[0037] The uplink timing interface and the external clock source of the central device are respectively connected to the external timing network to obtain the clock signal of the external clock source based on the external timing network;

[0038] Each downlink timing interface of the central device and each downlink timing interface of the sub-device are respectively connected to the internal timing network, and each sub-device obtains the clock signal of the central device based on its downlink timing interface.

[0039] like Figure 5 As shown, in some embodiments, the central device and each sub-device include: an isolated power supply, a supercapacitor, a supercapacitor charging protection circuit, a supercapacitor discharging protection circuit, a clock chip, a frequency multiplication chip, and multiple sub-functional units; the sub-functional units are MCU, PCIE, eMMC, CPU, and network card chip;

[0040] The isolated power supply is used to supply power to the supercapacitor, clock chip, frequency multiplication chip and each sub-functional unit;

[0041] The charging protection circuit is used to protect the charging process of the supercapacitor so that the charging time of the supercapacitor is less than a first preset time length;

[0042] The discharge protection circuit is used to protect the discharge process of the supercapacitor so that the discharge time of the supercapacitor is greater than a second preset time length;

[0043] The supercapacitor is used to power the device's clock chip after the device loses power;

[0044] The clock chip is used to send clock signals to some sub-functional units and the frequency multiplier chip, and the frequency multiplier chip is used to pre-process the received clock signals and send them to the remaining sub-functional units, so that the time of each sub-functional unit is synchronized with the time of the clock chip.

[0045] In this embodiment, the first preset duration is 30 minutes; the second preset duration is 30 days. By setting a charging protection circuit, the charging process of the supercapacitor can be protected so that its charging time is less than 30 minutes, and it is not affected by the fluctuation of the external power supply, and the supercapacitor will not cause overcharging damage. By setting a discharge protection circuit, the discharge process of the supercapacitor can be protected so that its discharge time is greater than 30 days, and it is not seriously affected by leakage due to external interference, providing reliable power support for the clock chip. It should be noted that the user can determine the specific time of the first preset duration and the second preset duration as needed, and this application does not make specific restrictions.

[0046] Described below Figure 1 How the various steps are performed.

[0047] First, with respect to step 100, based on the hardware time when the device is started and the storage time in the file system of the device, the startup time of the device operating system is determined, including:

[0048] The hardware time when the device is started is used as the initial time of the device operating system;

[0049] Determine whether the initial time is not less than the storage time in the device file system; if so, use the initial time as the startup time of the device operating system; if not, update the sum of the storage time of the device file system and at least one preset period as the new storage time of the device file system, and use the new storage time as the startup time of the device operating system.

[0050] It should be noted that the preset period can be 10 minutes, which can be determined by the user according to needs, and this application does not make any specific limitation.

[0051] The following first introduces the device's hardware time, operating system time, and file system storage time.

[0052] (1) The hardware time of the device, denoted as Tr: the time of the clock chip. When the device is turned off, the supercapacitor is used to power it. As long as the supercapacitor has power, the clock chip will continue to count. The hardware time can be maintained for a second preset time period, such as 30 days.

[0053] (2) Operating system time, denoted as Tc: the time recorded by the system and displayed to the outside world when the device is operating normally.

[0054] (3) Storage time of the file system, denoted as Ts: When the device is running, the operating system time is stored once every preset period in the device's file system. When the device file system receives the new time, it replaces the time stored in the previous period. When the device is turned off, the operating system is no longer working. At this time, the time stored in the file system is the last saved time.

[0055] Based on the above concept, when the device is restarted, it is assumed that the clock chip of the device is in normal operation, so the initial time of the device operating system is equal to the hardware time, that is, Tc=Tr.

[0056] Since the last storage time of the file system is earlier than or equal to the time when the device is shut down, and the clock chip is still timing after the device is shut down, therefore, Tc≥Ts. If this condition is met, it means that the clock chip of the device is operating normally, and the initial time is used as the startup time of the operating system. If this condition is not met, that is, Tc<Ts, that is, Tr<Ts, it means that the clock chip of the device is operating abnormally, and the initial time cannot be used as the startup time of the operating system. At this time, in order to ensure the accuracy of the event timing, that is, the time when the device is turned on again is after the last shutdown time, Ts+nt is required as the new time Ts' of the file system, that is, Ts'=Ts+nt, n is a positive integer not less than 1, t is a preset period, and Tc=Ts'. Since Ts' must be greater than the time when the device was last powered off and shut down, the timing of the new data after the operating system is running can be guaranteed to be correct. It should be noted that n is preferably 1.

[0057] The following examples illustrate the above concept:

[0058] For example, the preset cycle t=10, that is, the operating system time is saved every 10 minutes. Assume that the device is turned off at 6:29, and the last saved time of the file system is 6:25. Under normal circumstances, the clock chip is still timing. For example, the device may be turned on again at 7:30. At this time, the hardware device time should be 7:30, so the startup time of the operating system is set to 7:30. However, if the hardware time is 6:10, which is less than the last shutdown time, it means that the clock chip is abnormal. If the startup time of the operating system is still equal to the hardware time, the next startup time is less than the last shutdown time, which obviously does not conform to the real event sequence. At this time, the last saved time of the file system should be added with at least 10 minutes to 6:35, and the startup time of the operating system should be the storage time after the file system is updated, that is, 6:35, so as to ensure that the startup time of the device is after the shutdown time, which conforms to the real event sequence.

[0059] It can be seen that this step can ensure that the timing of new data after the device operating system is started is correct, that is, the new data after the device operating system is running is after the data before shutdown.

[0060] Secondly, for steps 102 to 106, when the device is running, the operating system time, hardware time and storage time of the file system of the device are continuously corrected according to a preset period through the external time correction network and the internal time correction network.

[0061] In some implementations, correcting the hardware time of the corresponding device based on the time of the operating system of each device according to a preset period includes:

[0062] At every preset period, the time of the current period of the operating system of each device is used as the new hardware time of the corresponding device, that is, Tr=Tc, so that the hardware time can be effectively corrected.

[0063] In some implementations, updating the storage time of the corresponding device file system based on the time of each device operating system according to a preset period includes:

[0064] Every preset period, the time of the current period of each device operating system is stored;

[0065] The time of the previous cycle is replaced by the time of the current cycle to update the storage time of the corresponding file system.

[0066] Through the above process, the storage time of the file system can be updated regularly. In a complex and running environment (such as the on-board network security system of a high-speed railway train), the system time can be guaranteed to be safe and reliable, and the subsequent security log data analysis and security event tracing can be guaranteed to be reasonable in timing.

[0067] like Figure 2 , Figure 3 As shown, an embodiment of the present invention provides a clock time calibration device for an industrial control network security system. The device embodiment can be implemented by software, or by hardware or a combination of software and hardware. From the hardware level, Figure 2 As shown, it is a hardware architecture diagram of a computing device where a clock time calibration device of an industrial control network security system provided by an embodiment of the present invention is located, except Figure 2 In addition to the processor, memory, network interface, and non-volatile memory shown in the figure, the computing device in which the device is located in the embodiment may also generally include other hardware, such as a forwarding chip responsible for processing messages, etc. Taking software implementation as an example, Figure 3 As shown, as a device in a logical sense, the CPU of the computing device in which it is located reads the corresponding computer program in the non-volatile memory into the internal memory and runs it.

[0068] Please refer to Figure 3 The embodiment of the present invention provides a clock synchronization device for an industrial control network security system, which is applied to the clock synchronization system. The system includes: an external clock source, a centralized management center device, a plurality of network security sub-devices, an external synchronization network and an internal synchronization network. The center device and each sub-device have a mainboard onboard supercapacitor clock circuit, which is used to power the clock chip of the device after the device is powered off; the external synchronization network is connected to the external clock source and the center device respectively, and the internal synchronization network is connected to the center device and each sub-device respectively; the device includes:

[0069] The first determination unit 300 is used to perform, for each device when starting up, the following steps for the central device and each sub-device: determining the startup time of the device operating system based on the hardware time when the device is started up and the storage time in the file system of the device; the storage time in the file system is within a preset period from the shutdown time of the device;

[0070] The second determining unit 302 is used for, when each device is running, for the central device, obtaining the time of the external clock source based on the external time synchronization network according to a preset period, and using the obtained time of the external clock source as the time of the central device operating system; for each sub-device, obtaining the time of the central device based on the internal time synchronization network according to a preset period, and using the obtained time of the central device as the time of the sub-device operating system;

[0071] The correction unit 304 is used to correct the hardware time of the corresponding device based on the time of the operating system of each device according to a preset period;

[0072] The updating unit 306 is used to update the storage time of the corresponding device file system based on the time of the operating system of each device according to a preset period.

[0073] In some implementations, when determining the boot time of the device operating system based on the hardware time when the device is booted and the storage time in the file system of the device, the first determining unit 300 is configured to perform the following operations:

[0074] The hardware time when the device is started is used as the initial time of the device operating system;

[0075] Determine whether the initial time is not less than the storage time in the device file system; if so, use the initial time as the startup time of the device operating system; if not, update the sum of the storage time of the device file system and at least one preset period as the new storage time of the device file system, and use the new storage time as the startup time of the device operating system.

[0076] In some implementations, the correction unit 304 is configured to perform the following operations:

[0077] At every preset period, the time of the current period of the operating system of each device is used as the new hardware time of the corresponding device.

[0078] In some implementations, the updating unit 306 is configured to perform the following operations:

[0079] Every preset period, the time of the current period of each device operating system is stored;

[0080] The time of the previous cycle is replaced by the time of the current cycle to update the storage time of the corresponding file system.

[0081] In some implementations, the central device includes an uplink timing interface and multiple downlink timing interfaces, and each sub-device includes a downlink timing interface; each downlink timing interface of the central device corresponds to a downlink timing interface of a sub-device;

[0082] The uplink timing interface and the external clock source of the central device are respectively connected to the external timing network to obtain the clock signal of the external clock source based on the external timing network;

[0083] Each downlink timing interface of the central device and each downlink timing interface of the sub-device are respectively connected to the internal timing network, and each sub-device obtains the clock signal of the central device based on its downlink timing interface.

[0084] In some embodiments, the central device and each sub-device include: an isolated power supply, a supercapacitor, a supercapacitor charging protection circuit, a supercapacitor discharging protection circuit, a clock chip, a frequency multiplication chip, and a plurality of sub-functional units; the sub-functional units are respectively MCU, PCIE, eMMC, CPU, and network card chip;

[0085] The isolated power supply is used to supply power to the supercapacitor, clock chip, frequency multiplication chip and each sub-functional unit;

[0086] The charging protection circuit is used to protect the charging process of the supercapacitor so that the charging time of the supercapacitor is less than a first preset time length;

[0087] The discharge protection circuit is used to protect the discharge process of the supercapacitor so that the discharge time of the supercapacitor is greater than a second preset time length;

[0088] The supercapacitor is used to power the device's clock chip after the device loses power;

[0089] The clock chip is used to send clock signals to some sub-functional units and the frequency multiplier chip, and the frequency multiplier chip is used to pre-process the received clock signals and send them to the remaining sub-functional units, so that the time of each sub-functional unit is synchronized with the time of the clock chip.

[0090] In some embodiments, the first preset time length is 30 minutes, and / or the second preset time length is 30 days.

[0091] It should be noted that the clock synchronization device for the industrial control network security system provided in the above embodiment is only illustrated by the division of the above functional modules. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the clock synchronization device for the industrial control network security system provided in the above embodiment and the clock synchronization method embodiment for the industrial control network security system belong to the same concept. The specific implementation process is detailed in the method embodiment and will not be repeated here.

[0092] The embodiment of the present application also provides a computer device, please refer to Figure 3 The computer device includes a processor and a memory, in which at least one instruction, at least one program, a code set or an instruction set is stored, and the at least one instruction, at least one program, a code set or an instruction set is loaded and executed by the processor to implement the clock synchronization method of the industrial control network security system provided by the above-mentioned method embodiments.

[0093] An embodiment of the present application also provides a computer-readable storage medium, on which is stored at least one instruction, at least one program, code set or instruction set, and the at least one instruction, at least one program, code set or instruction set is loaded and executed by a processor to implement the clock synchronization method of the industrial control network security system provided by the above-mentioned method embodiments.

[0094] An embodiment of the present application also provides a computer program product, which includes a computer program. A processor of a computer device reads the computer program from a computer-readable storage medium, and the processor executes the computer program, so that the computer device executes the clock synchronization method for the industrial control network security system described in any of the above embodiments.

[0095] For the convenience of description, the above system or device is described by dividing it into various modules or units according to its functions. Of course, when implementing the present application, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0096] It can be known from the description of the above implementation methods that those skilled in the art can clearly understand that the present application can be implemented by means of software plus a necessary general hardware platform. Based on such an understanding, the technical solution of the present application can be essentially or partly contributed to the prior art in the form of a software product, which can be stored in a storage medium such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in the various embodiments of the present application or certain parts of the embodiments.

[0097] Finally, it should be noted that, in this article, relational terms such as first, second, third and fourth are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0098] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A clock calibration method for an industrial control network security system, characterized in that: Applied to a clock timing system, the system includes: an external clock source, a centralized management center device, a plurality of network security sub-devices, an external timing network and an internal timing network, the central device and each of the sub-devices have a mainboard onboard supercapacitor clock circuit, the supercapacitor clock circuit is used to power the clock chip of the device after the device is powered off; the external timing network is connected to the external clock source and the central device respectively, and the internal timing network is connected to the central device and each of the sub-devices respectively; the method includes: When each device is started, for the central device and each of the sub-devices, the following steps are performed: determining the startup time of the device operating system based on the hardware time when the device is started and the storage time in the file system of the device; the storage time in the file system is no more than a preset period from the shutdown time of the device; When each device is running, for the central device, based on the external time synchronization network, the time of the external clock source is obtained according to the preset period, and the time of the external clock source obtained is used as the time of the central device operating system; for each of the sub-devices, based on the internal time synchronization network, the time of the central device is obtained according to the preset period, and the time of the central device obtained is used as the time of the sub-device operating system; According to the preset period, the hardware time of the corresponding device is corrected based on the time of the operating system of each device; According to the preset period, the storage time of the corresponding device file system is updated based on the time of the operating system of each device.

2. The method according to claim 1, characterized in that: The step of determining the startup time of the device operating system based on the hardware time when the device is started and the storage time of the device file system includes: The hardware time when the device is started is used as the initial time of the device operating system; Determine whether the initial time is not less than the storage time in the device file system; if so, use the initial time as the startup time of the device operating system; if not, update the sum of the storage time of the device file system and at least one of the preset periods as the new storage time of the device file system, and use the new storage time as the startup time of the device operating system.

3. The method according to claim 1, characterized in that The step of correcting the hardware time of the corresponding device based on the time of the operating system of each device according to the preset period includes: At every preset period, the time of the current period of the operating system of each device is used as the new hardware time of the corresponding device.

4. The method according to claim 1, characterized in that: The updating of the storage time of the corresponding device file system based on the time of the operating system of each device according to the preset period includes: Every preset period, storing the time of the current period of each device operating system; The time of the previous cycle is replaced by the time of the current cycle to update the storage time of the corresponding file system.

5. The method according to claim 1, characterized in that: The central device includes an uplink timing interface and multiple downlink timing interfaces, and each of the sub-devices includes a downlink timing interface; each downlink timing interface of the central device corresponds to a downlink timing interface of the sub-device; The uplink timing interface of the central device and the external clock source are respectively connected to the external timing network to obtain the clock signal of the external clock source based on the external timing network; Each downlink timing interface of the central device and each downlink timing interface of the sub-device are respectively connected to the internal timing network, and each sub-device obtains the clock signal of the central device based on its downlink timing interface.

6. The method according to claim 1, characterized in that The central device and each of the sub-devices include: an isolated power supply, a supercapacitor, a supercapacitor charging protection circuit, a supercapacitor discharging protection circuit, a clock chip, a frequency multiplication chip and a plurality of sub-functional units; the sub-functional units are respectively MCU, PCIE, eMMC, CPU and network card chip; The isolated power supply is used to supply power to the super capacitor, the clock chip, the frequency multiplication chip and each of the sub-functional units; The charging protection circuit is used to protect the charging process of the supercapacitor so that the charging time of the supercapacitor is less than a first preset time length; The discharge protection circuit is used to protect the discharge process of the super capacitor so that the discharge time of the super capacitor is greater than a second preset time length; The supercapacitor is used to supply power to the clock chip of the device after the device is powered off; The clock chip is used to send clock signals to some sub-functional units and the frequency multiplier chip, and the frequency multiplier chip is used to pre-process the received clock signals and send them to the remaining sub-functional units, so that the time of each sub-functional unit is synchronized with the time of the clock chip.

7. The method according to claim 6, characterized in that The first preset time length is 30 minutes, and / or the second preset time length is 30 days.

8. A clock calibration device for an industrial control network security system, characterized in that: Applied to a clock timing system, the system includes: an external clock source, a centralized management center device, a plurality of network security sub-devices, an external timing network and an internal timing network, the central device and each of the sub-devices have a mainboard onboard supercapacitor clock circuit, the supercapacitor clock circuit is used to power the clock chip of the device after the device is powered off; the external timing network is connected to the external clock source and the central device respectively, and the internal timing network is connected to the central device and each of the sub-devices respectively; the device includes: A first determining unit is used for, when each device is started, executing, for the central device and each of the sub-devices, determining the startup time of the device operating system based on the hardware time when the device is started and the storage time in the file system of the device; the storage time in the file system is no more than a preset period from the shutdown time of the device; The second determination unit is used for, when each device is running, for the central device, obtaining the time of the external clock source according to a preset period based on the external timing network, and using the obtained time of the external clock source as the time of the central device operating system; for each of the sub-devices, obtaining the time of the central device according to the preset period based on the internal timing network, and using the obtained time of the central device as the time of the sub-device operating system; A correction unit, configured to correct the hardware time of the corresponding device based on the time of the operating system of each device according to the preset period; The updating unit is used to update the storage time of the corresponding device file system based on the time of the operating system of each device according to the preset period.

9. A computer device, characterized in that: The computer device includes a memory and a processor, the memory is used to store a computer program, and the processor is used to execute the computer program stored in the memory to implement the steps of any one of the methods described in claims 1-7.

10. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method described in any one of claims 1 to 7 are implemented.

Images