Data security protection system, method, device, computer equipment and storage medium

Abstract

The present application relates to a data security protection system, method, device, computer equipment, storage medium and computer program product. The method includes: a security control center, which is used to obtain an operation instruction message sent by a business system; the operation instruction message includes key operation data corresponding to the business system; the security control center is used to obtain the estimated analysis time of the operation instruction message; if the estimated analysis time is greater than a preset time threshold, the operation instruction message is subjected to a security analysis to obtain a business security analysis result, and the business security analysis result is sent to a security gateway device; the security gateway device is used to determine whether the operation instruction message meets the preset instruction issuance condition if the business security analysis result is safe; the security gateway device is used to transmit the operation instruction message to the plant station system if the operation instruction message meets the instruction issuance condition. The use of this method can improve the effect and efficiency of power monitoring.

Description

Technical Field

[0001] The present application relates to the field of power monitoring technology, and in particular to a data security protection system, method, device, computer equipment and storage medium. Background Art

[0002] With the development of intelligent monitoring technology, power monitoring technology has emerged. At present, the whole network has carried out power monitoring in accordance with the overall strategy of "safe zoning, network dedicated, horizontal isolation, and vertical authentication", and has initially established a safety protection system. However, with the rapid development and application of new technologies such as distributed new energy, distribution network automation, smart grid, and unmanned substations,

[0003] In traditional technologies, it is increasingly common for power monitoring systems to use wireless public networks for data communications, which has broken through the traditional partitioned network isolation. At the same time, with the reform of the digital power grid, the power monitoring system has been extended from areas one, two, and three to areas four and five. Some power monitoring systems are directly facing the public network from areas one and two. The traditional security protection system can no longer fully meet the security protection requirements of the power monitoring system, resulting in poor power monitoring effects and low monitoring efficiency. Summary of the invention

[0004] Based on this, it is necessary to provide a data security protection system, method, apparatus, computer equipment, computer-readable storage medium and computer program product that can improve data security in response to the above-mentioned technical problems.

[0005] In the first aspect, the present application provides a data security protection system. The system includes a security gateway device and a security control center, including: the security control center is used to obtain an operation instruction message sent by a business system; the operation instruction message includes key operation data corresponding to the business system; the key operation data includes at least one of basic load data, plan data and operation ticket data; the security control center is used to obtain the estimated analysis time of the operation instruction message; if the estimated analysis time is greater than a preset time threshold, the operation instruction message is security analyzed to obtain a business security analysis result, and the business security analysis result is sent to the security gateway device; the security gateway device is used to determine whether the operation instruction message meets the preset instruction issuance condition if the business security analysis result is safe; the security gateway device is used to transmit the operation instruction message to the plant station system if the operation instruction message meets the instruction issuance condition.

[0006] In the second aspect, the present application provides a data security protection method. The method includes: a security gateway device receives an operation instruction message sent by a security control center; the estimated analysis time corresponding to the operation instruction message is less than or equal to a preset time threshold; the estimated analysis time is obtained by the security control center through analysis; determining the business security analysis result corresponding to the operation instruction message; when the business security analysis result is safe, determining whether the operation instruction message meets the preset instruction issuance condition; when the operation instruction message meets the instruction issuance condition, issuing the operation instruction message.

[0007] In the third aspect, the present application also provides a data security protection device. The device includes: a message receiving module, which is used for a security gateway device to receive an operation instruction message sent by a security control center; the estimated analysis time corresponding to the operation instruction message is less than or equal to a preset time threshold; the estimated analysis time is obtained by the security control center through analysis; a result determination module, which is used to determine the business security analysis result corresponding to the operation instruction message; a judgment module, which is used to judge whether the operation instruction message meets the preset instruction issuance condition when the business security analysis result is safe; and a message issuance module, which is used to issue the operation instruction message when the operation instruction message meets the instruction issuance condition.

[0008] In one embodiment, the result determination module is used to perform security analysis on the operation instruction message to obtain the business security analysis result.

[0009] In one embodiment, a judgment module is used to parse the operation instruction message to determine the transmission protocol of the operation instruction message; determine the matching rules corresponding to the transmission protocol; identify the operation instruction message based on the matching rules to determine whether the operation instruction message is an abnormal protocol message; when the operation instruction message is not the abnormal protocol message, determine whether the operation instruction message meets the preset instruction issuing conditions.

[0010] In one embodiment, a judgment module is used to obtain four-tuple data corresponding to the operation instruction message, the four-tuple data including the operation user, the operation device, the operation type and the operation time; parse the operation instruction message to determine the operation instruction in the operation instruction message; perform sequential logic verification and operation authority verification on the operation instruction based on the four-tuple data; when both the sequential logic verification and the operation authority verification are passed, determine whether the operation instruction message meets the preset instruction issuance condition.

[0011] In one embodiment, the judgment module is used to judge whether the transmission protocol is in a pre-created whitelist; when the transmission protocol is in the pre-created whitelist, it is determined that the operation instruction message meets the instruction issuing condition.

[0012] In a fourth aspect, the present application further provides a computer device. The computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the following steps when executing the computer program: the security gateway device receives an operation instruction message sent by the security control center; the estimated analysis time corresponding to the operation instruction message is less than or equal to a preset time threshold; the estimated analysis time is obtained by the security control center through analysis; the business security analysis result corresponding to the operation instruction message is determined; when the business security analysis result is safe, it is determined whether the operation instruction message meets the preset instruction issuance condition; when the operation instruction message meets the instruction issuance condition, the operation instruction message is issued.

[0013] In a fifth aspect, the present application also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the following steps are implemented: a security gateway device receives an operation instruction message sent by a security control center; the estimated analysis time corresponding to the operation instruction message is less than or equal to a preset time threshold; the estimated analysis time is obtained by the security control center through analysis; a business security analysis result corresponding to the operation instruction message is determined; when the business security analysis result is safe, it is determined whether the operation instruction message meets the preset instruction issuance condition; when the operation instruction message meets the instruction issuance condition, the operation instruction message is issued.

[0014] In a sixth aspect, the present application also provides a computer program product. The computer program product includes a computer program, which implements the following steps when executed by a processor: a security gateway device receives an operation instruction message sent by a security control center; the estimated analysis time corresponding to the operation instruction message is less than or equal to a preset time threshold; the estimated analysis time is obtained by the security control center through analysis; a business security analysis result corresponding to the operation instruction message is determined; when the business security analysis result is safe, it is determined whether the operation instruction message meets the preset instruction issuance condition; when the operation instruction message meets the instruction issuance condition, the operation instruction message is issued.

[0015] The above-mentioned data security protection system, method, device, computer equipment, storage medium and computer program product are used to obtain operation instruction messages sent by the business system through the security control center; the operation instruction message includes key operation data corresponding to the business system; the key operation data includes at least one of basic load data, plan data and operation ticket data; the security control center is used to obtain the estimated analysis time of the operation instruction message; if the estimated analysis time is greater than the preset time threshold, the operation instruction message is subjected to security analysis to obtain the business security analysis result, and the business security analysis result is sent to the security gateway device; the security gateway device is used to determine whether the operation instruction message meets the preset instruction issuance condition if the business security analysis result is safe; the security gateway device is used to transmit the operation instruction message to the plant station system if the operation instruction message meets the instruction issuance condition.

[0016] Through the security control center, it is used to obtain the operation instruction message sent by the business system; the operation instruction message includes the key operation data corresponding to the business system; the key operation data includes at least one of the basic load data, plan data and operation ticket data, and the data of the operation instruction message can be uniformly coordinated by the security control center to ensure the rational allocation of resources of the entire data security protection system. Through the security control center, it is used to obtain the estimated analysis time of the operation instruction message; if the estimated analysis time is greater than the preset time threshold, the operation instruction message is security analyzed to obtain the business security analysis result, and the business security analysis result is sent to the security gateway device, and the operation instruction message with a calculation amount exceeding the threshold can be calculated by the security control center with larger computing power, so as to achieve the effect of using matching computing power for the corresponding computing task and improve computing efficiency. Through the security gateway device, if the business security analysis result is safe, it is used to determine whether the operation instruction message meets the preset instruction issuance condition, and the business security analysis result and the instruction issuance condition can be associated to improve the security and accuracy of the operation instruction message issuance. Through the security gateway device, if the operation instruction message meets the instruction issuance conditions, the operation instruction message will be transmitted to the plant station system. A special channel between the data security protection system and the plant station system can be established, so that the operation instruction message that meets the requirements can be quickly and accurately transmitted to the plant station system.

[0017] According to the data security protection system, the analysis time of the operation instruction message is first estimated by using the matching computing power, and then the business security analysis result corresponding to the operation instruction message sent by the business system is determined. When the business security analysis result is safe, it is judged whether the operation instruction message meets the preset instruction issuance conditions. When the operation instruction message meets the instruction issuance conditions, the message is issued. This implements a security protection scheme that comprehensively judges the legitimacy of the operation instruction message based on business security and instruction security, which can improve the data security of the business system operation instruction message during the issuance process. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 An application environment diagram of a data security protection system in one embodiment;

[0019] Figure 2 A schematic diagram of a process flow of a data security protection system in an embodiment;

[0020] Figure 3 A schematic diagram of a process flow of a data security protection system in an embodiment;

[0021] Figure 4 A schematic diagram of a flow chart of a data security protection system in another embodiment;

[0022] Figure 5 A schematic diagram of a flow chart of a data security protection system in yet another embodiment;

[0023] Figure 6 A schematic diagram of a flow chart of a data security protection system in yet another embodiment;

[0024] Figure 7 A schematic diagram of a data security protection method in one embodiment;

[0025] Figure 8 A schematic diagram of the flow of various protection modes in a data security protection system in one embodiment;

[0026] Fig. 9 is a schematic diagram of the structure of an electronic device in one embodiment;

[0027] Fig.10 A structural block diagram of a data security protection device in an embodiment;

[0028] Fig.11 is an internal structure diagram of a computer device in one embodiment;

[0029] Fig.12 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0030] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0031] The data security protection system provided in the embodiment of the present application can be applied to Figure 1In the application environment shown. The terminal 102 acquires data, the security control center 104 receives the data of the terminal 102 in response to the instruction of the terminal 102, and calculates the acquired data. The security control center 104 transmits the calculation result of the data to the security gateway device 106, or the terminal 102 directly transmits the data to the security gateway device 106 for calculation, and transmits the operation instruction message to the plant station system 108 through the security gateway device 106. Among them, the terminal 102 communicates with the security control center 104 through the network. The data storage system can store the data that the security control center 104 needs to process. The data storage system can be integrated in the security control center 104, or it can be placed on the cloud or other network servers. The security control center is used to obtain the operation instruction message sent by the business system; the operation instruction message includes the key operation data corresponding to the business system; the key operation data includes at least one of the basic load data, the plan data and the operation ticket data; the security control center is used to obtain the estimated analysis time of the operation instruction message; if the estimated analysis time is greater than the preset time threshold, the operation instruction message is subjected to security analysis to obtain the business security analysis result, and the business security analysis result is sent to the security gateway device; the security gateway device is used to determine whether the operation instruction message meets the preset instruction issuance condition if the business security analysis result is safe; the security gateway device is used to transmit the operation instruction message to the plant station system if the operation instruction message meets the instruction issuance condition. Among them, the terminal 102 can be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, Internet of Things devices and portable wearable devices, and the Internet of Things devices can be smart speakers, smart TVs, smart air conditioners, smart car-mounted devices, etc. The portable wearable device can be a smart watch, a smart bracelet, a head-mounted device, etc. The security control center 104 can be implemented with an independent server or a server cluster composed of multiple servers.

[0032] In one embodiment, Figure 2 As shown, a data security protection system is provided, which is applied to Figure 1 In the description:

[0033] 202, the security control center is used to obtain the operation instruction message sent by the business system.

[0034] Among them, the security control center can be a server deployed in the data security protection system, which is used to calculate the monitoring data in the business system whose calculation amount is greater than the preset threshold, and send the calculation results to the security gateway device. In addition to the function of calculating the monitoring data, it is also responsible for the operation monitoring of the entire data security protection system and timely feedback of abnormal conditions of the data security protection system.

[0035] Among them, the business system can be an operating system located at the terminal of the data security protection system, used to send command messages to the plant and station system. The operation command messages generated by the business system are transmitted to the plant and station system through the security control center and the security gateway device. In order to avoid the operation command messages generated by the business system from affecting the plant and station system, the operation command messages sent by the business system need to undergo security checks before being transmitted to the plant and station system.

[0036] Among them, the operation instruction message can be a message sent by the business system for operating the equipment of the plant system, and the message contains at least one operation command issued by the business system. The operation instruction message includes key operation data corresponding to the business system; the key operation data includes at least one of basic load data, plan data and operation ticket data.

[0037] Specifically, when the business system sends an operation instruction message to the plant station system, the operation instruction message can be sent to the security control center, and then the security control center sends it to the security gateway device after processing, or the operation instruction message can be directly sent to the security gateway device, and the security gateway device performs proxy communication to send the operation instruction message to the plant station system. The operation instruction message can be a remote control instruction message, or a telemetry data message or a telesignaling data message, etc. For example, the operation instruction message can be a control operation instruction message for the primary equipment and secondary equipment of the substation. The security gateway device can include a first communication unit, and the business system can communicate with the first communication unit to send an operation instruction message to the security gateway device.

[0038] For example, security control center A obtains an operation instruction message that has not undergone security inspection from business system B. The operation instruction message can be a remote control command message, or a telemetry data message, or a telesignaling data message. The data of the obtained operation instruction message will be stored in a storage unit in security control center A, and the required operation instruction message data will be retrieved from the storage unit according to a preset program to the central processing unit for calculation.

[0039] 204, the security control center is also used to obtain the estimated analysis time of the operation instruction message; if the estimated analysis time is greater than the preset time threshold, the operation instruction message is subjected to security analysis to obtain the business security analysis result, and the business security analysis result is sent to the security gateway device.

[0040] Among them, the estimated analysis time can be the time the security control center estimates to take for security analysis of the data in the operation instruction message obtained from the business system. The estimated analysis time is inferred by the security control center based on the actual data in the operation instruction message. Since the computing power of the security control center and the security gateway device is different, the estimated analysis time for the operation instruction message is also different. The security control center allocates the operation instruction message according to the estimated analysis time to improve the system operation efficiency.

[0041] Among them, the business security analysis result can be the result obtained after the operation instruction message is calculated by the security control center or the security gateway device. The result can accurately reflect the security status of the operation instruction message. If the security analysis result is safe, it will enter the pre-issued program. If the security analysis result is unsafe, it will be intercepted by the data security protection system.

[0042] Among them, the security gateway device can be a gateway device arranged at the terminal in the data security protection system, which is used to calculate the monitoring data in the business system whose calculation amount is less than or equal to the preset threshold. Moreover, the security gateway device is a window for communication between the plant system and the data protection system, and all data must pass through the security gateway device.

[0043] Specifically, determining the service security analysis result corresponding to the operation instruction message may include:

[0044] Acquire key operation data of the business system, including basic load data, plan data, and operation ticket data; perform multi-source joint security analysis based on key operation data to obtain the business security analysis results corresponding to the operation instruction message. Among them, performing multi-source joint security analysis may include analyzing the operation user, operation device, operation time, and operation content, etc., to determine whether the above content is compliant and consistent. If the above content is determined to be compliant and consistent, the business security analysis result can be determined to be safe. If the above content is determined to be non-compliant or inconsistent, the business security analysis result can be determined to be unsafe.

[0045] The security control center can collect the basic load data, plan data and operation ticket data of the business system, and make an estimate of the analysis time required for the operation instruction message based on the above data. If the estimated analysis time is greater than the preset time threshold, the security control center retains the data and analyzes the business security of the basic load data, plan data and operation ticket data of the business system to obtain the business security analysis results, and transmits the business security analysis results to the security gateway device in real time. The specific situation is as follows: the security gateway device may include a second communication unit, the security control center may include a third processing unit and a fourth communication unit and a fifth communication unit respectively connected to the third processing unit; the fourth communication unit may communicate with the business system to obtain the key operation data of the business system; the third processing unit may perform multi-source joint security analysis based on the key operation data to obtain the business security analysis results corresponding to the operation instruction message; the fifth communication unit may communicate with the second communication unit to transmit the business security analysis results to the security gateway device.

[0046] In actual applications, when the business system sends an operation instruction message to the security gateway device, it can also send the four-tuple data corresponding to the operation instruction message to the security control center. The security control center can adopt an efficient multi-task concurrent processing mechanism to start the business security analysis upon receiving the first four-tuple data corresponding to the operation instruction message, and ensure that the business security analysis results are delivered to the security gateway device before the operation instruction message arrives.

[0047] It can be understood that by collecting key operation data of the business system in real time and conducting multi-source joint analysis on it, the business operation standardization and business application security of the operation instructions can be analyzed, and in-depth security analysis combining business and network can be achieved. It can provide auxiliary decision-making basis for the legality judgment of operation instruction messages, realize the blocking and alarm of business layer messages, so as to ensure the business legitimacy and security of the messages.

[0048] For example, security control center A estimates the analysis time based on the basic load data C, plan data D and operation ticket data E of business system B. If the estimated analysis time T is greater than the preset time threshold t, security control center A retains the above data and performs security analysis based on the above data to obtain the business security analysis result X, and sends the business security analysis result X to the security gateway device H for preparation for sending to the plant system.

[0049] 206, a security gateway device is used to determine whether the operation instruction message meets a preset instruction issuing condition if the service security analysis result is safe.

[0050] Among them, the instruction issuing condition can be based on the industrial needs, and the pre-set conditions for the instructions to be sent to the plant station system can only be sent to the plant station system when the instruction issuing conditions are met. The instruction issuing conditions can be changed in real time with the industrial needs, and the preset conditions that can meet the current needs can be obtained.

[0051] Specifically, when the service security analysis result is determined to be safe, the security gateway device can analyze the network security of the operation instruction message to determine whether the operation instruction message meets the instruction issuance condition, and issue the operation instruction message when the instruction issuance condition is met.

[0052] For example, if the service security analysis result X calculated by the security control center A is safe, the security gateway device H analyzes the network security of the service security analysis result X to determine whether the service security analysis result X meets the real-time instruction issuance condition.

[0053] 208, a security gateway device, is further used to transmit the operation instruction message to the plant station system if the operation instruction message meets the instruction issuing condition.

[0054] The plant station system can be a system for receiving operation instruction messages sent by the business system and operating various devices in the plant station according to the instructions in the message. Since the plant station system directly operates the plant station equipment and is directly related to production safety, the existence of the data security protection system can improve production safety.

[0055] Specifically, the security gateway device can communicate with the plant station system, and when the operation instruction message meets the instruction issuance condition, the security gateway device can transmit the operation instruction message to the plant station system.

[0056] For example, the security gateway device H establishes communication with the plant station system L. When the operation instruction message P meets the instruction issuance conditions, the security gateway device H immediately responds to the instruction and sends the operation instruction message P to the plant station system L.

[0057] In the above-mentioned data security protection system, the security control center is used to obtain the operation instruction message sent by the business system; the operation instruction message includes the key operation data corresponding to the business system; the key operation data includes at least one of the basic load data, the plan data and the operation ticket data; the security control center is used to obtain the estimated analysis time of the operation instruction message; if the estimated analysis time is greater than the preset time threshold, the operation instruction message is subjected to a security analysis to obtain the business security analysis result, and the business security analysis result is sent to the security gateway device; the security gateway device is used to determine whether the operation instruction message meets the preset instruction issuance condition if the business security analysis result is safe; the security gateway device is used to transmit the operation instruction message to the plant station system if the operation instruction message meets the instruction issuance condition.

[0058] Through the security control center, it is used to obtain the operation instruction message sent by the business system; the operation instruction message includes the key operation data corresponding to the business system; the key operation data includes at least one of the basic load data, plan data and operation ticket data, and the data of the operation instruction message can be uniformly coordinated by the security control center to ensure the rational allocation of resources of the entire data security protection system. Through the security control center, it is used to obtain the estimated analysis time of the operation instruction message; if the estimated analysis time is greater than the preset time threshold, the operation instruction message is security analyzed to obtain the business security analysis result, and the business security analysis result is sent to the security gateway device, and the operation instruction message with a calculation amount exceeding the threshold can be calculated by the security control center with larger computing power, so as to achieve the effect of using matching computing power for the corresponding computing task and improve computing efficiency. Through the security gateway device, if the business security analysis result is safe, it is used to determine whether the operation instruction message meets the preset instruction issuance condition, and the business security analysis result and the instruction issuance condition can be associated to improve the security and accuracy of the operation instruction message issuance. Through the security gateway device, if the operation instruction message meets the instruction issuance conditions, the operation instruction message will be transmitted to the plant station system. A special channel between the data security protection system and the plant station system can be established, so that the operation instruction message that meets the requirements can be quickly and accurately transmitted to the plant station system.

[0059] According to the data security protection system, the analysis time of the operation instruction message is first estimated by using the matching computing power, and then the business security analysis result corresponding to the operation instruction message sent by the business system is determined. When the business security analysis result is safe, it is judged whether the operation instruction message meets the preset instruction issuance conditions. When the operation instruction message meets the instruction issuance conditions, the message is issued. This implements a security protection scheme that comprehensively judges the legitimacy of the operation instruction message based on business security and instruction security, which can improve the data security of the business system operation instruction message during the issuance process.

[0060] In one embodiment, Figure 3 As shown, the data security protection system is also used for:

[0061] 302, the security control center is further configured to send an operation instruction message to the security gateway device if the estimated analysis time is less than or equal to a preset time threshold.

[0062] Specifically, the security control center estimates the analysis time of the operation instruction message issued by the business system. If the expected analysis time is less than or equal to the preset time threshold, the security control center believes that the computing power required to process the data can be provided by the security gateway device. Therefore, the unsigned data corresponding to the operation instruction message is transmitted to the security gateway device for calculation.

[0063] For example, security control center A estimates the analysis time of the data in the operation instruction message P transmitted from the business system, obtains the estimated analysis time T, and uses T to compare with the preset time threshold t. If the estimated analysis time T is less than or equal to the time threshold t, security control center A does not process the operation instruction message P and directly transmits it to the security gateway device H.

[0064] 304, the security gateway device is further used to perform security analysis on the operation instruction message to obtain a service security analysis result.

[0065] Specifically, the security control center can collect basic load data, plan data, and operation ticket data of the business system, and transmit the above data to the security gateway device, which analyzes the business security of the operation instruction message to obtain the business security analysis results.

[0066] At the same time, the security gateway device may include a second communication unit and a first processing unit, and the security control center may include a fourth communication unit and a fifth communication unit; the fourth communication unit can communicate with the business system to obtain key operation data of the business system; the fifth communication unit can communicate with the second communication unit to transmit the key operation data to the security gateway device; the first processing unit can perform multi-source joint security analysis based on the key operation data to obtain the business security analysis results corresponding to the operation instruction message.

[0067] For example, for an operation instruction message P transmitted from a security control neutral A to a security gateway device H, the security gateway device H is used to perform a security analysis on the data in the message P to obtain a business security analysis result X corresponding to the operation instruction message P.

[0068] In this embodiment, by diverting the calculation of operation instruction messages whose estimated analysis time is less than or equal to a preset time threshold, the computing power of the system can be reasonably utilized. For computing tasks that can be supported by the computing power of the security gateway device, the security gateway device is used to perform the calculation, thereby avoiding excessive occupation of computer resources and causing low computer efficiency.

[0069] In one embodiment, Figure 4 As shown, the security gateway device is also used for:

[0070] 402, parse the operation instruction message to determine the transmission protocol of the operation instruction message.

[0071] The analysis may be to call a matching analysis method to transform the data in the operation instruction message to obtain the corresponding analysis data, which can be transmitted using a computer to prevent damage or theft during the transmission process.

[0072] The transmission protocol may be a protocol for transmission to be reached between a sending end and a receiving end of a computer or system. Only when the transmission protocol is reached can normal transmission be performed, and different transmission protocols may result in different transmission speeds.

[0073] Specifically, the security gateway device can dynamically identify the protocol of the operation instruction message to obtain the transmission protocol of the operation instruction message. Among them, the transmission protocol of the operation instruction message can include the common industrial control protocol of the power system, the commonly used Transmission Control Protocol (TCP) / Internet Protocol (IP) and the custom transmission protocol, etc. Among them, the industrial control protocol can include IEC61850, IEC60870-101 / 102 / 104 / 103, tase2, dl476, MODBUS, OPC and other protocols, and the TCP / IP protocol can include HTTP, SFTP, SMTP, FTP, RPC and other protocols.

[0074] For example, the security gateway device H parses the data of the operation instruction message P, and from the parsing result, it can be obtained that the transmission protocol corresponding to the operation instruction message P is the industrial control protocol MODBUS.

[0075] 404, determine the matching rule corresponding to the transmission protocol.

[0076] Among them, the matching rules can be application layer (industrial protocol) rules. The matching rules can be preset according to actual needs, and can also be sent to the security gateway device by the security control center or the situation awareness system.

[0077] Specifically, various industrial protocols can be parsed in advance to determine the corresponding matching rules. Since there are many industrial protocols that need to be parsed and they are relatively complex, for example, for the IEC61850 protocol, since the IEC61850 protocol is object-oriented modeling, its modeling content includes most public actual equipment and components, uses a self-describing language, and abstracts the communication service interface, and is uniformly modeled for the entire power system, its complexity is very high, and there are also many contents that need to be analyzed. In addition, the IEC61850 protocol has undergone many years of development, and there are currently multiple versions such as V1.0, V2.0 and national standards. These versions need to be compatible, which is also a difficulty. Therefore, the processing mechanism of each protocol can be studied in advance, and a research and testing environment can be built to fully understand and verify the main content and processing process of the protocol. In software design, the strategy mode can also be used to process different versions separately.

[0078] For example, the transmission protocol corresponding to the operation instruction message P is the industrial control protocol MODBUS, so the corresponding matching rule is determined to be the application layer MODBUS rule, through which a communication channel between the security gateway device and the plant station system is established.

[0079] 406 , identifying the operation instruction message based on the matching rule, and determining whether the operation instruction message is an abnormal protocol message.

[0080] The identification may include determining whether the confirmed matching rule is consistent with the transmitted rule in the operation instruction message, and outputting the determination result.

[0081] Among them, the abnormal protocol message may be that the protocol in the operation instruction message is different from the protocol in the matching rule and cannot be transmitted, which means that the operation instruction message may be abnormal and needs further verification.

[0082] Specifically, the security gateway device can identify the operation instruction message through matching rules, determine whether the operation instruction message is an abnormal protocol message, and respond according to a preset policy.

[0083] For example, the security gateway device H uses the confirmed matching rule (application layer MODBUS rule) to identify the operation instruction message P, judges the identification result, and outputs the judgment result of whether it is an abnormal protocol message.

[0084] 408. When the operation instruction message is not an abnormal protocol message, it is determined whether the operation instruction message satisfies a preset instruction issuing condition.

[0085] Specifically, when it is identified that the operation instruction message is not an abnormal protocol message, the operation instruction message may be sent down; when it is identified that the operation instruction message is an abnormal protocol message, the downlink of the operation instruction message is blocked and an alarm is given.

[0086] For example, when it is identified that the operation instruction message P is not an abnormal protocol message, the operation instruction message P is sent down through the security gateway device H. When it is identified that the operation instruction message P is an abnormal protocol message, the operation instruction message P is blocked from being sent down through the security gateway device H, and a warning prompt is sent.

[0087] In this embodiment, by using the matching rules corresponding to the transmission protocol of the operation instruction message to perform a legitimacy analysis on the operation instruction message, the legitimacy of the operation instruction message can be quickly and accurately determined to achieve blocking and alarming of the application layer message, further ensuring the legitimacy and security of the message.

[0088] In one embodiment, Figure 5 As shown, the security gateway device is also used for:

[0089] 502, obtain the four-tuple data corresponding to the operation instruction message.

[0090] The four-tuple data may be multi-dimensional data including the operating user, the operating device, the operation type and the operation time, and can reflect the actual situation of the operation instruction message from these four dimensions.

[0091] Specifically, the security gateway device can obtain the four-tuple data corresponding to the operation instruction message from the security control center. When sending the operation instruction message, the business system can send the four-tuple data corresponding to the operation instruction message to the security control center. The security control center can receive the four-tuple data sent by the business system through the fourth communication unit that communicates with the business system, and transmit the four-tuple data to the security gateway device through the fifth communication unit that communicates with the second communication unit. Specifically, the security control center can adopt an efficient multi-task concurrent processing mechanism to send the received four-tuple data to the security gateway device in real time, and ensure the timing of the four-tuple data being delivered to the security gateway device before the operation instruction message arrives.

[0092] For example, the security gateway device H obtains four-tuple data R from the security control center A or the business system, wherein the four-tuple data includes data of four dimensions including the operating user, the operating device, the operation type and the operation time.

[0093] 504, parse the operation instruction message to determine the operation instruction in the operation instruction message.

[0094] Among them, operating instructions can be instructions and commands to direct the machine to work, the program is a series of instructions arranged in a certain order, and the process of executing the program is the working process of the computer.

[0095] Specifically, the security gateway device can dynamically identify the operation instruction message and obtain the operation instruction in the operation instruction message. The operation instruction may include the closing and opening operation of the switch device, the gear adjustment operation of the transformer device, the remote switching operation of the software board, and the remote modification operation of the protection setting value.

[0096] For example, the operation instruction message P is parsed using a corresponding parsing method, and the operation commands 1-n corresponding to the operation instruction message P are obtained after parsing.

[0097] 506 , performing sequential logic verification and operation authority verification on the operation instruction based on the four-tuple data.

[0098] Among them, sequential logic can be a network composed of multiple triggers and multiple combinational logic blocks. Commonly used ones are: counters, complex data flow control logic, operation control logic, instruction analysis and operation control logic. Synchronous sequential logic is the core of designing complex digital logic systems. Sequential logic uses state registers to remember its current state. In different states, even if all inputs are the same, its output may not be the same.

[0099] The operation permission may refer to the access restriction of the user to the object, for example, whether the user can create, read, or delete the object. The types of objects include files, folders, partitions, disks, and printers.

[0100] Specifically, the security gateway device can verify the timing logic of the operation instructions based on the four-tuple data. For example, the remote control instructions must be preset, returned to school, and then executed. It can also verify the authority of the operation device of the operation instruction based on the four-tuple data to determine whether the authority of the operation device corresponding to the operation instruction corresponds to the operation user.

[0101] For example, the security gateway device H verifies the timing logic and operation authority of the operation instruction parsed from the operation instruction message B based on the four dimensions of data in the four-tuple data R, namely the operation user, operation device, operation type and operation time, and outputs two corresponding verification results for the timing logic and operation authority respectively after verification.

[0102] 508, when both the timing logic verification and the operation authority verification are passed, it is determined whether the operation instruction message meets the preset instruction issuing conditions.

[0103] Specifically, when both the timing logic verification and the operation authority verification are passed, the operation instruction message can be sent down. When the timing logic verification or the operation authority verification fails, the downlink of the operation instruction message is blocked and / or an alarm is given.

[0104] For example, when the security gateway device H performs timing logic and operation authority verification on all instructions in the operation instruction message B, and the output results are all passed, it is further determined whether the operation instruction message B meets the preset instruction issuance condition L.

[0105] In this embodiment, by using the four-tuple data sent by the business system to perform timing logic verification and operation authority verification on the operation instruction message, and blocking and alarming the message based on the verification result, the legitimacy and security of the message can be further guaranteed.

[0106] In one embodiment, Figure 6 As shown, the security gateway device is also used for:

[0107] 602, determine whether the transmission protocol is in a pre-created white list.

[0108] Among them, the whitelist can be a list set in the data security protection system that can meet the corresponding requirements. The list contains the characteristics and parameters of the projects that meet the corresponding requirements. When the characteristics or parameters of the project change and exceed the preset range of the whitelist, the project is removed from the whitelist.

[0109] Specifically, the security gateway device uses a pre-created whitelist list to traverse the transmission protocol obtained from the matching rules to determine whether the transmission protocol is in the whitelist mentioned above. If the transmission protocol is found to be in the whitelist during the traversal, but the parameters that determine the transmission protocol have obvious disturbances, then it is determined that the transmission protocol does not meet the requirements of the whitelist.

[0110] For example, for the security gateway device H, it is necessary to determine whether the transmission protocol obtained by matching the rules is in the pre-created whitelist M. If it is found during traversal that the transmission protocol is in the pre-created whitelist M, it is extracted to form a new list.

[0111] 604. When the transmission protocol is in the pre-created white list, it is determined that the operation instruction message meets the instruction issuing condition.

[0112] Specifically, security detection for specific protocols can be customized and developed. For example, a whitelist of transmission protocols can be maintained. If the transmission protocol of the identified operation instruction message is in the whitelist, it can be directly determined that the instruction issuance condition is met. Alternatively, a blacklist of transmission protocols can also be maintained. If the transmission protocol of the identified operation instruction message is in the blacklist, it can be directly determined that the instruction issuance condition is not met and the operation instruction is discarded.

[0113] For example, when security gateway device A finds during traversal that the transmission protocol is in the pre-set whitelist M, it is determined that the transmission protocol meets the conditions for issuing instructions; similarly, when the pre-set is blacklist m, when security gateway device A traverses and does not find that the transmission protocol is in the pre-set blacklist m, it is determined that the transmission protocol meets the conditions for issuing instructions.

[0114] In this embodiment, by pre-setting a whitelist, the whitelist is traversed when making a judgment, and the transmission protocols that meet the conditions are allowed to pass. This can reduce the amount of processing calculations of the security gateway device, and can call on excess computing power to accelerate other calculations, thereby improving the computing speed of the security gateway device.

[0115] In one embodiment, Figure 7 As shown, a data security protection method is provided, which is applied to a security gateway device and is characterized by comprising:

[0116] Step 702: The security gateway device receives an operation instruction message sent by the security control center.

[0117] Specifically, when the business system sends an operation instruction message to the plant station system, the operation instruction message can be sent to the security control center, and then the security control center sends it to the security gateway device after processing, or the operation instruction message can be directly sent to the security gateway device, and the security gateway device performs proxy communication to send the operation instruction message to the plant station system. The operation instruction message can be a remote control instruction message, or a telemetry data message or a telesignaling data message, etc. For example, the operation instruction message can be a control operation instruction message for the primary equipment and secondary equipment of the substation. The security gateway device can include a first communication unit, and the business system can communicate with the first communication unit to send an operation instruction message to the security gateway device.

[0118] For example, the security control center H obtains an operation instruction message that has passed the security inspection from the business system B. The operation instruction message may be a remote control instruction message, or a telemetry data message or a telesignaling data message.

[0119] Step 704: Determine the business security analysis result corresponding to the operation instruction message.

[0120] Specifically, the security control center can collect basic load data, plan data, and operation ticket data of the business system, and transmit the above data to the security gateway device, which analyzes the business security of the operation instruction message to obtain the business security analysis results.

[0121] At the same time, the security gateway device may include a second communication unit and a first processing unit, and the security control center may include a fourth communication unit and a fifth communication unit; the fourth communication unit can communicate with the business system to obtain key operation data of the business system; the fifth communication unit can communicate with the second communication unit to transmit the key operation data to the security gateway device; the first processing unit can perform multi-source joint security analysis based on the key operation data to obtain the business security analysis results corresponding to the operation instruction message.

[0122] For example, for an operation instruction message P transmitted from a security control neutral A to a security gateway device H, the security gateway device H is used to perform a security analysis on the data in the message P to obtain a business security analysis result X corresponding to the operation instruction message P.

[0123] Step 706: When the service security analysis result is safe, determine whether the operation instruction message meets the preset instruction issuing conditions.

[0124] Specifically, when the service security analysis result is determined to be safe, the security gateway device can analyze the network security of the operation instruction message to determine whether the operation instruction message meets the instruction issuance condition, and issue the operation instruction message when the instruction issuance condition is met.

[0125] For example, if the service security analysis result X calculated by the security control center H is safe, the security gateway device H analyzes the network security of the service security analysis result X to determine whether the service security analysis result X meets the real-time instruction issuance condition.

[0126] Step 708: When the operation instruction message meets the instruction issuing condition, the operation instruction message is issued.

[0127] Specifically, the security gateway device can communicate with the plant station system, and when the operation instruction message meets the instruction issuance condition, the security gateway device can transmit the operation instruction message to the plant station system.

[0128] For example, the security gateway device H establishes communication with the plant station system L. When the operation instruction message P meets the instruction issuance conditions, the security gateway device H immediately responds to the instruction and sends the operation instruction message P to the plant station system L.

[0129] In this embodiment, a security gateway device is used to perform business security analysis on the operation instruction message. When the business security analysis result is safe, it is further determined whether the preset instruction issuance conditions are met. This can implement a security protection solution that comprehensively determines the legitimacy of the operation instruction message based on business security and instruction security, and can improve the data security of the business system operation instruction message during the issuance process.

[0130] In one embodiment, all steps in the above data security protection method can be executed by the first processing unit of the security gateway device. Specifically, the security gateway device can also include a second processing unit and a third communication unit, and the first processing unit can communicate with the second processing unit through the isolation component.

[0131] Accordingly, step 708 may include: when the operation instruction message meets the instruction issuing condition, extracting the data part in the operation instruction message, and transmitting the data part to the second processing unit through the isolation component. Accordingly, the method may also include the steps performed by the second processing unit: generating a target instruction message based on the received data part; and the steps performed by the third communication unit: transmitting the target instruction message to the plant station system.

[0132] In the embodiment of the present system, when the operation instruction message meets the instruction issuing conditions, the first processing unit can strip off the data part of the operation instruction message and transmit it to the second processing unit through a dedicated isolation component. Since there is no protocol between the first processing unit and the second processing unit (such as TCP handshake or disconnection information), it is pure application data transmission, and thus it is a secure communication, which can ensure the security of message transmission. The second processing unit can reassemble the message based on the acquired data part to obtain the reassembled target instruction message, and transmit the target instruction message to the plant station system through the third communication unit, thereby realizing the instruction transmission from the business system to the plant station system.

[0133] In one embodiment, the system may further include: when the service security analysis result is unsafe, the security gateway device may block the sending of the operation instruction message. Optionally, the security gateway device may also generate a first alarm prompt, the first alarm prompt is used to indicate that the service security analysis result is abnormal.

[0134] In one embodiment, the system may further include: when the operation instruction message does not meet the instruction sending condition, blocking the sending of the operation instruction message. Optionally, the security gateway device may also generate a second alarm prompt, the second alarm prompt is used to indicate that the operation instruction message is abnormal.

[0135] It can be understood that the embodiment of the system implements the interception function of illegal messages by blocking messages that are unsafe according to the business security analysis results and messages that do not meet the conditions for issuing instructions, thereby ensuring the system security of the plant system.

[0136] It should be noted that, in some possible embodiments, other methods may be used to determine whether the operation instruction message meets the instruction issuance condition, and the present system embodiment does not limit this. For example, for certain specific transmission protocols, it is also possible to determine whether the operation instruction message meets the instruction issuance condition by methods such as keyword filtering. Specifically, after determining the transmission protocol of the operation instruction message, the keyword information corresponding to the transmission protocol can be determined, and it is determined whether the operation instruction message contains the keyword. When the operation instruction message contains (or does not contain) the keyword information, it can be determined that the instruction issuance condition is met.

[0137] It should be noted that the system can use one method or a combination of multiple methods to filter the operation instruction message, and the present system embodiment does not limit this. It can be understood that the method provided by the present system embodiment filters the message through multiple information during the message transmission process, and only responds to the message that complies with the security policy, which can achieve the blocking and control of suspicious messages and messages with potential threats.

[0138] In this system embodiment, Figure 8 As shown, the data security protection system is located in, after obtaining the operation instruction message sent by the business system, it can also be used to:

[0139] 802. Determine the current protection mode of the security gateway device.

[0140] In one embodiment, the protection modes of the security gateway device may include a signature verification mode, a full-pass mode, a full-interception mode, etc., and the switching of the protection modes may be controlled by a dispatcher.

[0141] 804, when the current protection mode is the full-pass mode, the operation instruction message is sent.

[0142] In one embodiment, when the current protection mode is the full-pass mode, all downlink operation instruction messages are released. By designing the full-pass mode, when a problem occurs in the security gateway device, the operation instruction message can be hard-bypassed and will not affect the normal operation of the system.

[0143] 806, when the current protection mode is the full interception mode, blocking the sending of the operation instruction message.

[0144] In one embodiment, when the current protection mode is the full interception mode, all downlink operation instruction messages are intercepted.

[0145] 808, when the current protection mode is the signature verification mode, executing the step of determining the business security analysis result corresponding to the operation instruction message.

[0146] In one embodiment, when the current protection mode is the signature verification mode, the security protection device can use Figure 2 The data security protection system shown performs security analysis on the operation instruction messages sent by the business system, issues alarms for messages that do not meet security requirements, and / or blocks the downlink of messages that do not meet security requirements.

[0147] like Fig. 9 , which is a block diagram of an electronic device 900 according to an embodiment of the present system. The electronic device 900 may include one or more processors 902, a system control logic 908 connected to at least one of the processors 902, a system memory 904 connected to the system control logic 908, a non-volatile memory (NVM) 906 connected to the system control logic 908, and a network interface 910 connected to the system control logic 908.

[0148] The processor 902 may include one or more single-core or multi-core processors. The processor 902 may include any combination of general-purpose processors and special-purpose processors (e.g., graphics processors, application processors, baseband processors, etc.). In the embodiments of this document, the processor 902 may be configured to perform one or more embodiments of the various embodiments.

[0149] In some embodiments, system control logic 908 may include any suitable interface controller to provide any suitable interface to at least one of processors 902 and / or any suitable device or component in communication with system control logic 908 .

[0150] In one embodiment, the system control logic 908 may include one or more memory controllers to provide an interface to the system memory 904. The system memory 904 may be used to load and store data and / or instructions. In some embodiments, the memory 904 of the device 900 may include any suitable volatile memory, such as a suitable dynamic random access memory (DRAM).

[0151] NVM / memory 906 may include one or more tangible, non-transitory computer-readable media for storing data and / or instructions. In some embodiments, NVM / memory 906 may include any suitable non-volatile memory such as flash memory and / or any suitable non-volatile storage device, such as at least one of a HDD (Hard Disk Drive), a CD (Compact Disc) drive, and a DVD (Digital Versatile Disc) drive.

[0152] NVM / storage 906 may include a portion of storage resources installed on a device of apparatus 900, or it may be accessible to the apparatus but not necessarily a part of the apparatus. For example, NVM / storage 906 may be accessed over a network via network interface 910.

[0153] In particular, system memory 904 and NVM / storage 906 may include, respectively, a temporary copy and a permanent copy of instructions 914. Instructions 914 may include instructions that, when executed by at least one of processors 902, cause device 900 to implement a data security protection system. In some embodiments, instructions 914, hardware, firmware, and / or software components thereof may be additionally / alternatively placed in system control logic 908, network interface 910, and / or processor 902.

[0154] The network interface 910 may include a transceiver for providing a radio interface for the device 900, thereby communicating with any other suitable device (such as a front-end module, an antenna, etc.) through one or more networks. In some embodiments, the network interface 910 may be integrated with other components of the device 900. For example, the network interface 910 may be integrated with at least one of a communication module of the processor 902, a system memory 904, an NVM / storage 906, and a firmware device (not shown) having instructions, and when at least one of the processors 902 executes the instructions, the device 900 implements one or more embodiments of various embodiments.

[0155] The network interface 910 may further include any suitable hardware and / or firmware to provide a multiple-input multiple-output radio interface. For example, the network interface 910 may be a network adapter, a wireless network adapter, a telephone modem and / or a wireless modem.

[0156] In one embodiment, at least one of the processors 902 may be packaged together with logic for one or more controllers of the system control logic 908 to form a system in package (SiP). In one embodiment, at least one of the processors 902 may be integrated on the same die with logic for one or more controllers of the system control logic 908 to form a system on chip (SoC).

[0157] The device 900 may further include an input / output (I / O) device 912. The I / O device 912 may include a user interface to enable a user to interact with the device 900; the design of the peripheral component interface enables the peripheral components to interact with the device 900. In some embodiments, the device 900 further includes a sensor for determining at least one of an environmental condition and location information related to the device 900.

[0158] In one embodiment, the user interface may include, but is not limited to, a display (e.g., an LCD display, a touch screen display, etc.), a speaker, a microphone, one or more cameras (e.g., a still image camera and / or a video camera), a flashlight (e.g., an LED flash), and a keyboard.

[0159] In one embodiment, the peripheral component interface may include, but is not limited to, a non-volatile memory port, an audio jack, and a power interface.

[0160] In one embodiment, the sensors may include, but are not limited to, a gyroscope sensor, an accelerometer, a proximity sensor, an ambient light sensor, and a positioning unit. The positioning unit may also be part of or interact with the network interface 910 to communicate with components of a positioning network (e.g., a global positioning system (GPS) satellite).

[0161] It is to be understood that the structure illustrated in the embodiment of the present system does not constitute a specific limitation on the electronic device 900. In other embodiments of the present system, the electronic device 900 may include more or fewer components than shown in the figure, or combine some components, or split some components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.

[0162] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0163] Based on the same inventive concept, the embodiment of the present application also provides a data security protection device for implementing the data security protection method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more data security protection device embodiments provided below can refer to the limitations on the data security protection method above, and will not be repeated here.

[0164] In one embodiment, Fig.10 As shown, a data security protection device is provided, including: a message receiving module, a result determination module, a judgment module and a message sending module, wherein:

[0165] The message receiving module 1002 is used for the security gateway device to receive the operation instruction message sent by the security control center; the estimated analysis time corresponding to the operation instruction message is less than or equal to the preset time threshold; the estimated analysis time is obtained by the security control center through analysis;

[0166] Result determination module 1004, used to determine the business security analysis result corresponding to the operation instruction message;

[0167] The judgment module 1006 is used to judge whether the operation instruction message meets the preset instruction issuing condition when the business security analysis result is safe;

[0168] The message sending module 1008 is used to send the operation instruction message when the operation instruction message meets the instruction sending condition.

[0169] In one embodiment, the result determination module is used to perform security analysis on the operation instruction message to obtain a business security analysis result.

[0170] In one embodiment, a judgment module is used to parse an operation instruction message to determine a transmission protocol of the operation instruction message; determine a matching rule corresponding to the transmission protocol; identify the operation instruction message based on the matching rule to determine whether the operation instruction message is an abnormal protocol message; when the operation instruction message is not an abnormal protocol message, determine whether the operation instruction message meets a preset instruction issuing condition.

[0171] In one embodiment, a judgment module is used to obtain four-tuple data corresponding to an operation instruction message, the four-tuple data including an operation user, an operation device, an operation type, and an operation time; parse the operation instruction message to determine the operation instruction in the operation instruction message; perform timing logic verification and operation authority verification on the operation instruction based on the four-tuple data; when both the timing logic verification and the operation authority verification are passed, determine whether the operation instruction message meets a preset instruction issuance condition.

[0172] In one embodiment, the judgment module is used to judge whether the transmission protocol is in a pre-created white list; when the transmission protocol is in the pre-created white list, it is determined that the operation instruction message meets the instruction issuing condition.

[0173] Each module in the above data security protection device can be implemented in whole or in part by software, hardware and their combination. Each module can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the corresponding operations of each module.

[0174] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Fig.11 As shown. The computer device includes a processor, a memory and a network interface connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store server data. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a data security protection method is implemented.

[0175] In one embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as follows: Fig.12 As shown. The computer device includes a processor, a memory, a communication interface, a display screen and an input device connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be achieved through WIFI, a mobile cellular network, NFC (near field communication) or other technologies. When the computer program is executed by the processor, a data security protection method is implemented. The display screen of the computer device can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covered on the display screen, or a button, trackball or touchpad set on the computer device housing, or an external keyboard, touchpad or mouse, etc.

[0176] Those skilled in the art will understand that Fig.11 as well as Fig.12 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0177] In one embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above method embodiments when executing the computer program.

[0178] In one embodiment, a computer-readable storage medium is provided, storing a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0179] In one embodiment, a computer program product or computer program is provided, the computer program product or computer program includes computer instructions, the computer instructions are stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device performs the steps in the above-mentioned method embodiments.

[0180] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0181] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0182] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0183] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A data security protection system, characterized in that: The system includes a security gateway device and a security control center, including: The security control center is used to obtain an operation instruction message sent by the business system; the operation instruction message includes key operation data corresponding to the business system; the key operation data includes at least one of basic load data, plan data and operation ticket data; The security control center is used to obtain the estimated analysis time of the operation instruction message; if the estimated analysis time is greater than a preset time threshold, perform security analysis on the operation instruction message to obtain a business security analysis result, and send the business security analysis result to the security gateway device; The security control center is further configured to send the operation instruction message to the security gateway device if the estimated analysis time is less than or equal to a preset time threshold; The security gateway device is used to determine whether the operation instruction message meets the preset instruction issuance condition if the result of the business security analysis is safe; the security gateway device is also used to parse the operation instruction message to determine the transmission protocol of the operation instruction message; determine the matching rule corresponding to the transmission protocol; identify the operation instruction message based on the matching rule to determine whether the operation instruction message is an abnormal protocol message; when the operation instruction message is not the abnormal protocol message, determine whether the operation instruction message meets the preset instruction issuance condition; the security gateway device is also used to obtain the four-tuple data corresponding to the operation instruction message, the four-tuple data includes the operating user, the operating device, the operation type and the operation time; parse the operation instruction message to determine the operation instruction in the operation instruction message; perform sequential logic verification and operation authority verification on the operation instruction based on the four-tuple data; when the sequential logic verification and the operation authority verification are both passed, determine whether the operation instruction message meets the preset instruction issuance condition; The security gateway device is used to transmit the operation instruction message to the plant station system if the operation instruction message meets the instruction issuance condition.

2. The system according to claim 1, characterized in that The security gateway device is further used to determine whether the transmission protocol is in a pre-created whitelist; when the transmission protocol is in the pre-created whitelist, it is determined that the operation instruction message meets the instruction issuance condition.

3. A data security protection method, applied to a security gateway device, characterized in that: include: The security gateway device receives the operation instruction message sent by the security control center; The security control center is used to obtain the operation instruction message sent by the business system; The operation instruction message includes key operation data corresponding to the business system; the key operation data includes at least one of basic load data, plan data and operation ticket data; the security control center is used to obtain the estimated analysis time of the operation instruction message; If the estimated analysis time is greater than a preset time threshold, a security analysis is performed on the operation instruction message to obtain a business security analysis result, and the business security analysis result is sent to the security gateway device; the security control center is also used to send the operation instruction message to the security gateway device if the estimated analysis time is less than or equal to the preset time threshold; Determine the business security analysis result corresponding to the operation instruction message; When the service security analysis result is safe, determining whether the operation instruction message meets the preset instruction issuing condition; The security gateway device is also used to parse the operation instruction message and determine the transmission protocol of the operation instruction message; Determine a matching rule corresponding to the transmission protocol; identify the operation instruction message based on the matching rule, and determine whether the operation instruction message is an abnormal protocol message; when the operation instruction message is not the abnormal protocol message, determine whether the operation instruction message meets the preset instruction issuance condition; the security gateway device is also used to obtain the four-tuple data corresponding to the operation instruction message, and the four-tuple data includes the operating user, the operating device, the operation type and the operation time; Parsing the operation instruction message to determine the operation instruction in the operation instruction message; Performing sequential logic verification and operation authority verification on the operation instruction based on the four-tuple data; When both the sequence logic verification and the operation authority verification are passed, determining whether the operation instruction message meets the preset instruction issuing condition; When the operation instruction message meets the instruction issuing condition, the operation instruction message is issued.

4. A safety protection device, characterized in that: The device comprises: A message receiving module, used for a security gateway device to receive an operation instruction message sent by a security control center; the security control center is used to obtain an operation instruction message sent by a business system; the operation instruction message includes key operation data corresponding to the business system; the key operation data includes at least one of basic load data, plan data and operation ticket data; the security control center is used to obtain an estimated analysis time for the operation instruction message; if the estimated analysis time is greater than a preset time threshold, a security analysis is performed on the operation instruction message to obtain a business security analysis result, and the business security analysis result is sent to the security gateway device; the security control center is also used to send the operation instruction message to the security gateway device if the estimated analysis time is less than or equal to the preset time threshold; A result determination module, used to determine the business security analysis result corresponding to the operation instruction message; A judgment module, used to judge whether the operation instruction message meets the preset instruction issuance condition when the result of the business security analysis is safe; the security gateway device is also used to parse the operation instruction message to determine the transmission protocol of the operation instruction message; determine the matching rule corresponding to the transmission protocol; identify the operation instruction message based on the matching rule to judge whether the operation instruction message is an abnormal protocol message; when the operation instruction message is not the abnormal protocol message, judge whether the operation instruction message meets the preset instruction issuance condition; the security gateway device is also used to obtain the four-tuple data corresponding to the operation instruction message, the four-tuple data includes the operating user, the operating device, the operation type and the operation time; parse the operation instruction message to determine the operation instruction in the operation instruction message; perform sequential logic verification and operation authority verification on the operation instruction based on the four-tuple data; when the sequential logic verification and the operation authority verification are both passed, judge whether the operation instruction message meets the preset instruction issuance condition; The message sending module is used to send the operation instruction message when the operation instruction message meets the instruction sending condition.

5. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method described in claim 3 are implemented.

6. A computer-readable storage medium having a computer program stored thereon, characterized in that: The computer program implements the steps of the method described in claim 3 when executed by a processor.

7. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method described in claim 3 are implemented.

Images