Protection method, device and system based on security gateway

Abstract

The present disclosure relates to the field of electric power monitoring technology, and specifically discloses a protection method, device, and system based on a security gateway, wherein the method comprises: obtaining an operation instruction message sent by a business system; in a first mode, obtaining a business security analysis result for the operation instruction message, and a four-tuple data corresponding to the operation instruction message; when the security analysis result is safe, judging whether the operation instruction message meets the instruction issuance condition according to the four-tuple data; when the security analysis result is safe, and when it is judged that the instruction issuance condition is met, issuing the operation instruction message; generating a target instruction message according to the operation instruction message, and transmitting the target instruction message to the plant station system. The present disclosure effectively improves the data security of the business system operation instruction in the process of being issued to the substation or power plant.

Description

Technical Field

[0001] This disclosure relates to the field of power monitoring technology, and in particular to a protection method, device, and system based on a security gateway. Background Technology

[0002] In the field of power grid information security, a preliminary security protection system has been established across the entire network according to the overall strategy of "security zoning, dedicated networks, horizontal isolation, and vertical authentication." However, with the rapid development and application of new technologies such as distributed renewable energy, distribution network automation, smart grids, and unmanned substations, the use of public wireless networks for data communication in power monitoring systems is becoming increasingly common, breaking through the traditional zoning network isolation. Simultaneously, with the reform of digital power grids, power monitoring systems have expanded from zones one, two, and three to zones four and five, and some power monitoring systems are directly exposed to the public network from zones one and two. The traditional security protection system can no longer fully meet the security protection requirements of power monitoring systems. Therefore, it is urgent to propose a comprehensive security protection strategy to effectively improve the security protection of the vertical scheduling data acquisition network of business systems (such as the master station system and the information security system), preventing unauthorized control commands from being sent from the internal network of the business system to the substation. Summary of the Invention

[0003] Therefore, it is necessary to provide a protection method, device, system, computer equipment, storage medium, and computer program product based on a security gateway to address the aforementioned technical problems.

[0004] Firstly, this disclosure provides a protection method based on a security gateway. The method includes:

[0005] Obtain operation instruction messages sent by the business system;

[0006] In the first mode, the service security analysis results for the operation instruction message and the quadruple data corresponding to the operation instruction message are obtained;

[0007] If the security analysis result is safe, determine whether the operation instruction message meets the instruction issuance conditions based on the quadruple data;

[0008] When the security analysis result is safe, and it is determined that the conditions for issuing the instruction are met, the operation instruction message is issued.

[0009] A target instruction message is generated based on the operation instruction message, and the target instruction message is transmitted to the plant system.

[0010] In one embodiment, the security analysis results are obtained based on the analysis of key operational data of the business system.

[0011] In one embodiment, determining whether the operation instruction message meets the instruction issuance conditions based on the quadruple data includes:

[0012] Parse the operation instruction message to determine the operation instruction in the operation instruction message;

[0013] The operation instruction is verified based on the quadruple data. If the verification is successful, the operation instruction message is determined to meet the instruction issuance conditions.

[0014] In one embodiment, the method further includes:

[0015] Determine the transmission protocol of the operation instruction message, and determine the corresponding matching rule based on the transmission protocol;

[0016] The operation instruction message is identified according to the matching rules to determine whether the operation instruction message is an abnormal protocol message;

[0017] If the operation instruction message is determined to be an abnormal protocol message, it is determined that the operation instruction message does not meet the instruction issuance conditions.

[0018] In one embodiment, generating a target instruction message based on the operation instruction message and transmitting the target instruction message to the plant system includes:

[0019] Extract the target data from the operation instruction message;

[0020] Generate a target instruction message based on the target data;

[0021] The target instruction message is transmitted to the plant system.

[0022] In one embodiment, the method includes:

[0023] In the second mode, the acquired operation instruction message is directly sent out;

[0024] In the third mode, the transmission of the operation instruction message is blocked.

[0025] Secondly, this disclosure also provides a protection device based on a security gateway. The device includes:

[0026] The input module is used to acquire operation instruction messages sent by the business system;

[0027] The security analysis module is used in the first mode to obtain the service security analysis results for the operation instruction message and the quadruple data corresponding to the operation instruction message;

[0028] The condition module is used to determine whether the operation instruction message meets the instruction issuance conditions based on the quadruple data when the security analysis result is safe.

[0029] The instruction issuing module issues the operation instruction message when the security analysis result is safe and the instruction issuing conditions are met.

[0030] The transmission module is used to generate a target instruction message based on the operation instruction message and transmit the target instruction message to the plant system.

[0031] In one embodiment, the security analysis results are obtained based on the analysis of key operational data of the business system.

[0032] In one embodiment, the instruction issuing module includes:

[0033] The instruction unit is used to parse the operation instruction message and determine the operation instruction in the operation instruction message;

[0034] The verification unit is used to verify the operation instruction based on the quadruple data, and if the verification is successful, determine that the operation instruction message meets the instruction issuance conditions.

[0035] In one embodiment, the instruction issuing module further includes:

[0036] The protocol unit is used to determine the transmission protocol of the operation instruction message and to determine the corresponding matching rule according to the transmission protocol.

[0037] The identification unit is used to identify the operation instruction message according to the matching rules and determine whether the operation instruction message is an abnormal protocol message.

[0038] The judgment unit is used to determine that the operation instruction message does not meet the instruction issuance conditions when the operation instruction message is determined to be an abnormal protocol message.

[0039] In one embodiment, the transmission module includes:

[0040] Target data unit, used to extract target data from the operation instruction message;

[0041] The target instruction unit is used to generate a target instruction message based on the target data;

[0042] The transmission unit is used to transmit the target instruction message to the plant system.

[0043] In one embodiment, the device further includes:

[0044] The all-pass module is used to instruct the acquired operation instruction message to be sent directly.

[0045] The full block module is used to indicate the blocking of the transmission of the operation command message.

[0046] Thirdly, this disclosure also provides a protection system based on a security gateway. The system includes a security gateway device and a security control center, wherein the security gateway device includes:

[0047] The first communication unit is connected to the business system and is used to receive operation instruction messages sent by the business system, as well as receive quadruple data sent by the business system.

[0048] The second communication unit is connected to the security control center and is used to receive the security analysis results of the operation instruction message sent by the security control center.

[0049] The first processing unit is connected to the first communication unit and the second communication unit respectively. The first processing unit is used to acquire the quadruple data, the operation instruction message, and the security analysis result. If the security analysis result is safe, the first processing unit determines whether the operation instruction message meets the instruction issuance conditions based on the quadruple data. The first processing unit is also used to issue the target data in the operation instruction message when the security analysis result is safe and the instruction issuance conditions are met.

[0050] The second processing unit, connected to the first processing unit, is used to generate a target instruction message based on the target data;

[0051] The third communication unit is connected to the second processing unit and the plant system respectively, and the third communication unit is used to transmit the target instruction message to the plant system.

[0052] In one embodiment, an isolation component is connected between the first processing unit and the second processing unit.

[0053] In one embodiment, the security control center includes:

[0054] The fourth communication unit is connected to the business system and is used to receive key operation data and quadruple data sent by the business system.

[0055] The third processing unit is used to perform security analysis on the operation instruction message based on the key operation data to obtain the business security analysis result.

[0056] The fifth processing unit is connected to the third processing unit and the second communication unit respectively. The fifth processing unit is used to receive the business security analysis results and send them to the second communication unit, and to send the quadruple data to the second communication unit.

[0057] Fourthly, this disclosure also provides a computer device. The computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the steps of the above-described security gateway-based protection method.

[0058] Fifthly, this disclosure also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program thereon, which, when executed by a processor, implements the steps of the aforementioned security gateway-based protection method.

[0059] Sixthly, this disclosure also provides a computer program product. The computer program product includes a computer program that, when executed by a processor, implements the steps of the aforementioned security gateway-based protection method.

[0060] The aforementioned protection methods, devices, systems, computer equipment, storage media, and computer program products based on security gateways have at least the following beneficial effects:

[0061] This disclosure performs a dual assessment of security and issuance conditions for operation command messages issued by the business system. The assessment is triggered based on the business security analysis results, and the four-tuple data is used to determine whether the operation command message meets the issuance conditions. This effectively improves the data security of operation commands issued by the business system to substations or power plants. Furthermore, the operation command message is transmitted to the plant system as a target command message, making the transmission channel more stable and reducing the risk of the target command message being tampered with. Attached Figure Description

[0062] To more clearly illustrate the technical solutions in the embodiments or conventional technologies of this disclosure, the accompanying drawings used in the description of the embodiments or conventional technologies will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this disclosure. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0063] Figure 1 This is an application environment diagram of a security gateway-based protection method in one embodiment;

[0064] Figure 2 This is a flowchart illustrating a protection method based on a security gateway in one embodiment;

[0065] Figure 3 This is a flowchart illustrating a protection method based on a security gateway in one embodiment;

[0066] Figure 4 This is a flowchart illustrating a protection method based on a security gateway in one embodiment;

[0067] Figure 5 This is a flowchart illustrating a protection method based on a security gateway in one embodiment;

[0068] Figure 6 This is a flowchart illustrating a protection method based on a security gateway in one embodiment;

[0069] Figure 7 This is a structural block diagram of a security gateway-based protection device in one embodiment;

[0070] Figure 8 This is a structural block diagram of a security gateway-based protection device in one embodiment;

[0071] Figure 9 This is a structural block diagram of a security gateway-based protection device in one embodiment;

[0072] Figure 10 This is a structural block diagram of a security gateway-based protection device in one embodiment;

[0073] Figure 11 This is a block diagram of a security gateway-based protection system in one embodiment;

[0074] Figure 12 This is a block diagram of a security gateway-based protection system in one embodiment;

[0075] Figure 13 This is a block diagram of a security gateway-based protection system in one embodiment;

[0076] Figure 14 This is a block diagram of the internal structure of a computer device in one embodiment. Detailed Implementation

[0077] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0078] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure belongs. The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of this disclosure.

[0079] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this disclosure are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this disclosure described herein can be implemented in orders other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this disclosure. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this disclosure as detailed in the appended claims. The terms "comprising," "including," or any other variations thereof are intended to cover a non-exclusive inclusion, such that a process, method, product, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, product, or apparatus. Without further limitation, the presence of other identical or equivalent elements in a process, method, product, or apparatus that includes said elements is not excluded. For example, the use of terms such as "first," "second," etc., is to denote names and does not indicate any specific order.

[0080] It should be noted that when an element is considered to be "connected" to another element, it can be directly connected to the other element or connected to the other element through an intervening element. In addition, the "connection" in the following embodiments should be understood as "electrical connection", "communication connection", etc., if there is transmission of electrical signals or data between the connected objects.

[0081] When used herein, the singular forms of “a,” “an,” and “the” may also include the plural forms unless the context clearly indicates otherwise. It should also be understood that the terms “comprising / including” or “having,” etc., specify the presence of the stated features, wholes, steps, operations, components, parts, or combinations thereof, but do not preclude the possibility of the presence or addition of one or more other features, wholes, steps, operations, components, parts, or combinations thereof. Meanwhile, in this specification, the term “and / or” includes any and all combinations of the associated listed items.

[0082] The security gateway-based protection method provided in this application can be applied to, for example... Figure 1In the application environment shown, terminal 102 communicates with server 104 and business system 106 via a network. Terminal 102 is connected to substation system 108, which may include equipment such as substations and power plants. Server 104 is communicatively connected to business system 106. This method can be applied to power monitoring systems. Business system 106 may include the power monitoring system's dispatch automation master station system and operation ticket system, etc. The dispatch automation master station system may include the master station operation control system (OCS), automatic generation control (AGC) system, and automatic voltage control (AVC) system, etc. Terminal 102 may be a security gateway device. The security gateway device can be connected in series between the front-end data acquisition network and the vertical encryption device of the dispatch automation master station system. It dynamically analyzes the transmission protocol and operation instructions of the operation command messages issued by the business system in real time. Combined with the business security analysis results sent by server 104 and the four-tuple data corresponding to the operation command message (including the operator, operating device, operation type, and operation time), it performs a legality judgment on the operation command message, intercepting illegal control commands and ensuring data security during the process of issuing business system operation commands to substations or power plants. Server 104 can be implemented using a standalone server or a server cluster composed of multiple servers.

[0083] In some embodiments of this disclosure, such as Figure 2 As shown, a protection method based on a security gateway is provided, which can be applied to... Figure 1 Taking the terminal and server in the example, the following steps are included:

[0084] Step S10: Obtain the operation instruction message sent by the business system.

[0085] Step S30: In the first mode, obtain the service security analysis results for the operation instruction message and the quadruple data corresponding to the operation instruction message.

[0086] Specifically, the security gateway device communicates with the business system and receives operation instruction messages sent by the business system. This method can include multiple modes. For example, in the first mode, the received operation instruction message is sent after business security analysis and judgment of instruction issuance conditions. In the first mode, the business security analysis results sent by the server and the four-tuple data corresponding to the operation instruction message sent by the server are obtained. Specifically, the server obtains the four-tuple data sent by the business system and transmits it to the security gateway device.

[0087] Step S50: If the security analysis result is safe, determine whether the operation instruction message meets the instruction issuance conditions based on the quadruple data.

[0088] Specifically, if the security analysis result indicates that the operation command message is secure, it is determined whether the command issuance conditions are met. The four-tuple data may include operation user data, control device data, control type data, and operation time data. The operation command message is then evaluated based on the four-tuple data to determine whether the command issuance conditions are met.

[0089] Step S70: When the security analysis result is safe and the conditions for issuing the instruction are met, issue the operation instruction message.

[0090] Specifically, if the operation command message meets the conditions for command issuance based on the four-tuple data, the security gateway device will issue the operation command message. If the operation command message does not meet the conditions for command issuance, the issuance of the operation command message will be blocked.

[0091] Step S90: Generate a target instruction message based on the operation instruction message, and transmit the target instruction message to the plant system.

[0092] Specifically, the operation command message is parsed and processed to generate a target command message, which is then directly transmitted to the plant system. The target command message includes a target command, which can be a more precise and specific instruction targeting the plant system than the operation command.

[0093] The aforementioned security gateway-based protection method performs dual security analysis and issuance condition judgment on the operation instruction messages issued by the business system. The issuance condition judgment is triggered based on the business security analysis results, and the operation instruction message is judged based on the four-tuple data to determine whether the instruction issuance condition is met. This effectively improves the data security of the business system operation instructions during the issuance to the substation or power plant. Furthermore, the end of the operation instruction message is transmitted to the plant system as a target instruction message, making the transmission channel more stable and reducing the risk of the target instruction message being tampered with.

[0094] In some embodiments of this disclosure, the security analysis results are obtained based on the analysis of key operational data of the business system. Specifically, key operational data may include basic load data, planning data, operation ticket data, etc. The server performs multi-source joint security analysis based on the business data to obtain the business security analysis results corresponding to the operation instruction messages. The server sends the business security analysis results to the security gateway device. Multi-source joint security analysis may include analyzing the operation user, operation device, operation time, and operation content to determine whether the above content is compliant and consistent. If the above content is determined to be compliant and consistent, the business security analysis result can be determined to be secure; if the above content is determined to be non-compliant or inconsistent, the business security analysis result can be determined to be insecure.

[0095] This embodiment improves the timeliness of security analysis of operation command messages by performing multi-source joint security analysis based on key operation data of the business system, receiving quadruple data in real time, and then obtaining the business security analysis results corresponding to the operation command messages.

[0096] In some embodiments of this disclosure, such as Figure 3 As shown, step S50 includes:

[0097] Step S52: Parse the operation instruction message to determine the operation instruction in the operation instruction message.

[0098] Specifically, the operation instruction message is parsed to extract the operation instructions from the message.

[0099] Step S54: Verify the operation instruction based on the quadruple data. If the verification is successful, determine that the operation instruction message meets the instruction issuance conditions.

[0100] Specifically, the operation instruction is subjected to timing logic verification and operation permission verification based on the quadruple data. If both timing logic verification and operation permission verification pass, the operation instruction message is determined to meet the instruction issuance conditions.

[0101] This embodiment uses the quadruple data sent by the business system to perform timing logic verification and operation permission verification on the operation instruction message, and blocks and alarms the message based on the verification results, which can further ensure the legality and security of the message.

[0102] In some embodiments of this disclosure, such as Figure 4 As shown, the method further includes step S60, which includes:

[0103] Step S62: Determine the transmission protocol of the operation instruction message, and determine the corresponding matching rule according to the transmission protocol.

[0104] Specifically, the operation command message is parsed to determine the transmission protocol of the operation command message, and the corresponding matching rule is determined according to the transmission protocol. The matching rule can be an application layer (industrial protocol) rule, which can be preset according to actual needs, or it can be sent by a server or to a security gateway device; this embodiment of the invention does not impose any limitations on this.

[0105] Step S64: Identify the operation instruction message according to the matching rules, and determine whether the operation instruction message is an abnormal protocol message.

[0106] Step S66: If the operation instruction message is determined to be an abnormal protocol message, the operation instruction message is determined not to meet the instruction issuance conditions.

[0107] Specifically, the operation command message is identified according to matching rules to determine whether it is an abnormal protocol message. If the operation command message is not an abnormal protocol message, it is determined that the operation command message meets the command issuance conditions. If the operation command message is an abnormal protocol message, it is determined that the operation command message does not meet the command issuance conditions.

[0108] Alternatively, security detection for specific protocols can be customized and developed. For example, a whitelist / blacklist of transmission protocols can be maintained. If the transmission protocol of the operation instruction message is identified as being in the whitelist / blacklist, the conditions for issuing the instruction can be directly determined to be met or not.

[0109] Furthermore, in some possible embodiments, other methods can be used to determine whether the operation instruction message meets the instruction issuance conditions, and this embodiment of the invention does not impose limitations on this. For example, for certain specific transmission protocols, keyword filtering or other methods can be used to determine whether the operation instruction message meets the instruction issuance conditions. Specifically, keyword information corresponding to the transmission protocol can be determined according to the transmission protocol, and it can be determined whether the operation instruction message contains the keyword information. When the operation instruction message contains (or does not contain) the keyword information, it can be determined that the instruction issuance conditions are met.

[0110] This embodiment utilizes matching rules corresponding to the transmission protocol of operation command messages to perform legality analysis on the operation command messages. This allows for quick and accurate determination of the legality of the operation command messages, enabling the blocking and alarm of application layer messages, and further ensuring the legality and security of the messages. During the message distribution process, this embodiment can also filter messages using various information, responding only to messages that conform to the security policy, thus achieving the blocking and control of suspicious and potentially threatening messages.

[0111] In some embodiments of this disclosure, such as Figure 5As shown, step S90 includes:

[0112] Step S92: Extract the target data from the operation instruction message.

[0113] Specifically, the operation instruction message is parsed to extract the target data from the operation instruction message.

[0114] Step S94: Generate a target instruction message based on the target data.

[0115] Step S96: Transmit the target instruction message to the plant system.

[0116] Specifically, the target data is integrated to generate a target instruction message, and the target instruction message is transmitted to the plant system.

[0117] In this embodiment, the target command message is transmitted to the plant system, which makes the transmission channel more stable and reduces the risk of the target command message being tampered with.

[0118] In some embodiments of this disclosure, such as Figure 6 As shown, the method further includes:

[0119] Step A10: In the second mode, the acquired operation instruction message is directly sent out.

[0120] Step A20: In the third mode, block the transmission of the operation instruction message.

[0121] Specifically, steps S30-S70 described above are the processing steps in the first mode. In the second mode, which is a fully accessible mode, the terminal directly sends the acquired operation command message. Furthermore, in the second mode, if a problem occurs with the terminal, the operation command message can still be hard-bypassed. In the third mode, which is a fully blocked mode, the sending of all operation command messages is blocked.

[0122] This embodiment supports the issuance of operation command messages in multiple modes, meeting the application scenario requirements of both all-through mode and all-block mode.

[0123] It should be understood that, although the various steps in the flowcharts involved in the various embodiments described above are displayed in sequence according to the instructions of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the flowcharts involved in the various embodiments described above can include multiple steps or multiple stages, and these steps or stages are not necessarily executed and completed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of steps or stages in other steps.

[0124] Based on the same inventive concept, this disclosure also provides a security gateway-based protection device for implementing the aforementioned security gateway-based protection method. The solution provided by this device is similar to the implementation described in the above method; therefore, the specific limitations in one or more security gateway-based protection device embodiments provided below can be found in the limitations of the security gateway-based protection method described above, and will not be repeated here.

[0125] The apparatus may include a system (including a distributed system), software (application), module, component, server, client, etc., that uses the methods described in the embodiments of this specification, combined with necessary hardware implementation. Based on the same innovative concept, the apparatuses in one or more embodiments provided in this disclosure are as described in the following embodiments. Since the implementation schemes and methods for solving the problem by the apparatus are similar, the implementation of the specific apparatus in the embodiments of this specification can refer to the implementation of the foregoing methods, and repeated details will not be repeated. As used below, the terms "unit" or "module" can refer to a combination of software and / or hardware that implements a predetermined function. Although the apparatuses described in the following embodiments are preferably implemented in software, hardware implementations, or a combination of software and hardware, are also possible and contemplated.

[0126] In some embodiments of this disclosure, such as Figure 7 As shown, a security gateway-based protection device is provided. The device can be the aforementioned terminal, or a module, component, device, or unit integrated into the terminal. The device Z00 may include:

[0127] Input module Z10 is used to acquire operation instruction messages sent by the business system;

[0128] The security analysis module Z20 is used in the first mode to obtain the service security analysis results for the operation instruction message and the quadruple data corresponding to the operation instruction message;

[0129] The condition module Z30 is used to determine whether the operation instruction message meets the instruction issuance conditions based on the quadruple data when the security analysis result is safe.

[0130] When the security analysis result is safe and the conditions for issuing instructions are met, the instruction issuing module Z40 issues the operation instruction message.

[0131] The transmission module Z50 is used to generate a target instruction message based on the operation instruction message and transmit the target instruction message to the plant system.

[0132] In some embodiments of this disclosure, the security analysis results are obtained based on the analysis of key operational data of the business system.

[0133] In some embodiments of this disclosure, such as Figure 8 As shown, the instruction issuing module Z40 includes:

[0134] Instruction unit Z412 is used to parse the operation instruction message and determine the operation instruction in the operation instruction message;

[0135] The verification unit Z414 is used to verify the operation instruction based on the quadruple data, and if the verification is successful, it is determined that the operation instruction message meets the instruction issuance conditions.

[0136] In some embodiments of this disclosure, such as Figure 9 As shown, the instruction issuing module Z40 includes:

[0137] Protocol unit Z422 is used to determine the transmission protocol of the operation instruction message and determine the corresponding matching rule according to the transmission protocol;

[0138] The identification unit Z424 is used to identify the operation instruction message according to the matching rules and determine whether the operation instruction message is an abnormal protocol message.

[0139] The judgment unit Z426 is used to determine that the operation instruction message does not meet the instruction issuance conditions when the operation instruction message is determined to be an abnormal protocol message.

[0140] In some embodiments of this disclosure, such as Figure 10 As shown, the transmission module Z50 includes:

[0141] Target data unit Z52 is used to extract target data from the operation instruction message;

[0142] Target instruction unit Z54 is used to generate a target instruction message based on the target data;

[0143] The transmission unit Z56 is used to transmit the target instruction message to the plant system.

[0144] In some embodiments of this disclosure, the apparatus further includes:

[0145] The all-pass module is used to instruct the acquired operation instruction message to be sent directly.

[0146] The full block module is used to indicate the blocking of the transmission of the operation command message.

[0147] The modules in the aforementioned security gateway-based protection device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device in hardware form, or stored in the memory of a computer device in software form, so that the processor can call and execute the operations corresponding to each module. It should be noted that the module division in this embodiment is illustrative and only represents one logical functional division; in actual implementation, other division methods may be used.

[0148] Based on the foregoing description of embodiments of the security gateway-based protection method, another embodiment provided in this disclosure offers a security gateway-based protection system. For example... Figure 11 As shown, the system X00 includes a security gateway device X10 and a security control center X20, wherein the security gateway device X10 includes:

[0149] The first communication unit X12 is connected to the business system and is used to receive operation instruction messages sent by the business system, as well as receive quadruple data sent by the business system.

[0150] The second communication unit X13 is connected to the security control center X20 and is used to receive the security analysis results of the operation command message sent by the security control center X20.

[0151] The first processing unit X11 is connected to the first communication unit X12 and the second communication unit X13 respectively. The first processing unit X11 is used to acquire the quadruple data, the operation instruction message, and the security analysis result. If the security analysis result is secure, the first processing unit X11 determines whether the operation instruction message meets the instruction issuance conditions based on the quadruple data. The first processing unit X11 is also used to issue the target data in the operation instruction message when the security analysis result is secure and the instruction issuance conditions are met.

[0152] The second processing unit X14 is connected to the first processing unit X11 and is used to generate a target instruction message based on the target data.

[0153] The third communication unit X15 is connected to the second processing unit X14 and the plant system respectively. The third communication unit X15 is used to transmit the target instruction message to the plant system.

[0154] The security gateway device X10 can employ dual embedded hosts (i.e., including a first processing unit X11 and a second processing unit X14). The first processing unit X11 can use a proxy mechanism to implement a Transmission Control Protocol (TCP) handshake and disconnection mechanism with the devices in the business system, and this process terminates at the first processing unit X11; the second processing unit X14 can use a proxy mechanism to implement a TCP handshake and disconnection mechanism with the devices in the plant system, and this process terminates at the second processing unit X14.

[0155] In practical applications, the first processing unit X11, the first communication unit X12, the second communication unit X13, the second processing unit X14, and the third communication unit X15 can use domestically produced components to ensure the hardware security of the device. The operating system of the security gateway device X10 can also use a domestically produced system, such as NingSi or Kylin, which are independently controllable domestic operating systems, to ensure the security of the operating system.

[0156] In some embodiments of this disclosure, such as Figure 12 As shown, an isolation component X16 connects the first processing unit X11 and the second processing unit X14. That is, the security gateway device X10 adopts a "2+1" hardware architecture, meaning it can include dual embedded hosts and a dedicated isolation component X16. The first processing unit X11 and the second processing unit X14 communicate unidirectionally via the dedicated isolation component X16. The first processing unit X11 can run dedicated software responsible for identifying, filtering, discarding, and encapsulating various network information according to rules, and transmitting information to the second processing unit through the isolation component X16, thereby providing a secure information channel. Furthermore, data transmission between the first processing unit X11 and the second processing unit X14 via the isolation component X16 is purely application data transmission without any protocol information such as TCP handshakes or disconnections, thus providing a secure information channel for devices within the business system and the plant system.

[0157] In some embodiments of this disclosure, such as Figure 13 As shown, the security control center X20 includes:

[0158] The fourth communication unit X22 is connected to the business system and is used to receive key operation data and quadruple data sent by the business system.

[0159] The third processing unit X21 is used to perform security analysis on the operation instruction message based on the key operation data to obtain the business security analysis result.

[0160] The fifth processing unit is connected to the third processing unit X21 and the second communication unit X13 respectively. The fifth processing unit is used to receive the business security analysis results and send them to the second communication unit X13, and to send the quadruple data to the second communication unit X13.

[0161] The fifth communication unit X23 can communicate with the second communication unit X13 to enable communication between the security gateway device X10 and the security control center X20. Specifically, the security control center X20 can adopt an efficient multi-task concurrent processing mechanism, initiating business security analysis upon receiving the first four-tuple data corresponding to the operation instruction message, ensuring that the business security analysis results are delivered to the security gateway device X10 before the operation instruction message arrives.

[0162] In this embodiment, the security gateway device X10 can be designed with a high-performance multi-task concurrent processing mechanism, making full use of CPU resources to dynamically and in real time identify the operation instructions in the operation instruction message, and verify the timing logic and operation permissions of the control instructions. This can improve the analysis efficiency of the operation instructions, and control the delay of the operation instruction message flowing through the security gateway device X10 to the millisecond level, meeting the performance requirements of the main station system for real-time acquisition.

[0163] Furthermore, the first communication unit X12 can be configured to communicate with the business system via a first transmission protocol, and the third communication unit X15 can be configured to communicate with the plant system via a second transmission protocol.

[0164] Specifically, the first transmission protocol / second transmission protocol can be a preset industrial control protocol, a commonly used TCP / IP protocol, or a custom transmission protocol. The industrial control protocol can be any one or more of the following common power system industrial control protocols: IEC61850, IEC60870-101 / 102 / 104 / 103, tase2, dl476, MODBUS, OPC, etc. The TCP / IP protocol can include protocols such as HTTP, SFTP, SMTP, FTP, RPC, etc.

[0165] In one possible embodiment, the security gateway device X10 also supports initiating key requests, message encryption and decryption requests, and other cryptographic-related work requests to the cryptographic service platform. The cryptographic service platform supports digital certificate-based authentication, standard cryptographic algorithms (SM1, SM2, SM3, and SM4) approved by the State Cryptography Administration, explicit and implicit cryptographic policy settings, and manual / automatic key destruction functions. It is understood that requesting the cryptographic service platform to encrypt and decrypt messages can further improve the security of message transmission.

[0166] Furthermore, multiple security gateway devices X10 can be configured.

[0167] Specifically, load balancing of traffic can be achieved by using multiple security gateway devices X10 to reduce the pressure on each security gateway device X10. This not only avoids congestion and improves the efficiency of packet transmission, but also prevents the security gateway device X10 from crashing due to excessive pressure, ensuring the normal operation of the security gateway system and improving protection efficiency.

[0168] Furthermore, the system may also include a backup security gateway device X10 and a backup security control center X20.

[0169] Specifically, the backup security gateway device X10 can be configured to detect heartbeat messages sent by the security gateway device X10, determine the status of the security gateway device X10 based on the heartbeat messages, and automatically start when the status of the security gateway device X10 is abnormal, so that the backup security gateway device X10 can replace the security gateway device X10 to realize the transmission of operation command messages between the business system and the plant system.

[0170] Specifically, the backup security gateway device X10 can also perform link status data backup by detecting heartbeat messages sent by the security gateway device X10; when the backup security gateway device X10 detects a failure of the security gateway device X10, it immediately starts up. Since the link status data is backed up in real time, seamless link switching can be achieved; when the backup security gateway device X10 detects that the security gateway device X10 has recovered, it immediately switches the link back to the security gateway device X10. This process does not require manual intervention and can automatically complete the link switching and continuous operation.

[0171] Specifically, the security control center X20 can adopt a primary / backup service and dual network card communication design to solve the single point of failure problem. The link switching method between the backup machine of the security control center X20 and the security control center X20 is the same as the link switching method between the security gateway device X10100 and its backup machine, and will not be described again in this embodiment of the invention.

[0172] It is understandable that by designing and implementing dual-machine hot standby and dual-machine fault-tolerant service functions, two devices are used to back each other up and jointly execute the same service. When the primary link fails, the backup device can take over the message transmission task, thereby automatically ensuring that the system can continue to provide services without manual intervention.

[0173] Based on the foregoing description of embodiments of the security gateway-based protection method, in another embodiment provided in this disclosure, a computer device is provided. This computer device may be a terminal, and its internal structure diagram may be as follows: Figure 14 As shown, the computer device includes a processor, memory, communication interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, NFC (Near Field Communication), or other technologies. When the computer program is executed by the processor, it implements a security gateway-based protection method. The display screen can be an LCD screen or an e-ink screen. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad mounted on the computer device casing, or an external keyboard, touchpad, or mouse.

[0174] Those skilled in the art will understand that the structure shown in the figure is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have different component arrangements.

[0175] Based on the foregoing description of the protection method based on a security gateway, in another embodiment provided in this disclosure, a computer-readable storage medium is provided, on which a computer program is stored, which, when executed by a processor, implements the steps in the above-described method embodiments.

[0176] Based on the foregoing description of the protection method based on a security gateway, in another embodiment provided in this disclosure, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above-described method embodiments.

[0177] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this disclosure are all information and data authorized by the user or fully authorized by all parties.

[0178] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0179] Throughout this specification, references to terms such as "some embodiments," "other embodiments," and "desired embodiments" indicate that a particular feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the present invention. In this specification, the schematic descriptions of these terms do not necessarily refer to the same embodiment or example.

[0180] It is understood that the various embodiments of the methods described in this specification are presented in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on its differences from other embodiments. Relevant details can be found in the descriptions of other method embodiments.

[0181] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features of the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0182] The embodiments described above are merely illustrative of several implementations of this disclosure, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this disclosure, and these all fall within the scope of protection of this disclosure. Therefore, the scope of protection of this patent should be determined by the appended claims.

Claims

1. A protection method based on a security gateway, characterized in that: The method comprises: Obtain the operation instruction message sent by the business system; In the first mode, a business security analysis result for the operation instruction message and four-tuple data corresponding to the operation instruction message are obtained; the business security analysis result is obtained according to the key operation data of the business system, the key operation data includes basic load data, plan data, operation ticket data, and the business security analysis result includes safe and unsafe; the four-tuple data includes operation user data, control device data, control type data and operation time data; If the security analysis result is safe, the operation instruction message is parsed to determine the operation instruction in the operation instruction message; the operation instruction is verified according to the four-tuple data, and if the verification passes, it is determined that the operation instruction message meets the instruction issuance condition; the verification method includes sequential logic verification and operation authority authentication; When the security analysis result is safe and it is determined that the instruction issuance condition is met, issuing the operation instruction message; Generating a target instruction message according to the operation instruction message, and transmitting the target instruction message to the plant station system; the generation process includes: extracting target data in the operation instruction message, and generating a target instruction message based on the target data; In the second mode, the obtained operation instruction message is directly sent down; In the third mode, the sending of the operation instruction message is blocked.

2. The method according to claim 1, characterized in that The security analysis result is obtained based on the analysis of key operation data of the business system.

3. The method according to claim 1, characterized in that The method further comprises: Determine the transmission protocol of the operation instruction message, and determine the corresponding matching rule according to the transmission protocol; Identify the operation instruction message according to the matching rule, and determine whether the operation instruction message is an abnormal protocol message; When it is determined that the operation instruction message is an abnormal protocol message, it is determined that the operation instruction message does not meet the instruction issuing condition.

4. The method according to claim 1, characterized in that Generating a target instruction message according to the operation instruction message, and transmitting the target instruction message to the plant station system comprises: Extracting target data from the operation instruction message; Generate a target instruction message based on the target data; The target instruction message is transmitted to the plant station system.

5. A protection device based on a security gateway, characterized in that: The device comprises: An input module is used to obtain the operation instruction message sent by the business system; A security analysis module is used to obtain, in a first mode, a business security analysis result for the operation instruction message and four-tuple data corresponding to the operation instruction message; the business security analysis result is obtained by analyzing key operation data of the business system, the key operation data includes basic load data, plan data, and operation ticket data, and the business security analysis result includes safe and unsafe; the four-tuple data includes operation user data, control device data, control type data, and operation time data; The issuing condition module is used to parse the operation instruction message and determine the operation instruction in the operation instruction message when the security analysis result is safe; verify the operation instruction according to the four-tuple data, and judge that the operation instruction message meets the instruction issuing condition when the verification passes; the verification method includes sequential logic verification and operation authority authentication; An instruction issuing module, when the security analysis result is safe and the instruction issuing conditions are met, issues the operation instruction message; A transmission module is used to generate a target instruction message according to the operation instruction message, and transmit the target instruction message to the plant station system; the generation process includes: extracting the target data in the operation instruction message, and generating the target instruction message based on the target data; In the second mode, the obtained operation instruction message is directly sent down; In the third mode, the sending of the operation instruction message is blocked.

6. A protection system based on a security gateway, characterized in that: The system includes a security gateway device and a security control center, wherein the security gateway device includes: A first communication unit, connected to the business system, for receiving an operation instruction message sent by the business system, and receiving a four-tuple data sent by the business system; the four-tuple data includes operation user data, control device data, control type data and operation time data; a second communication unit, connected to the security control center, and configured to receive a security analysis result for the operation instruction message sent by the security control center; the security analysis result is obtained by analyzing key operation data of the business system, the key operation data includes basic load data, plan data, and operation ticket data, and the security analysis result includes safe and unsafe; a first processing unit, connected to the first communication unit and the second communication unit respectively, the first processing unit being used to obtain the four-tuple data, the operation instruction message, and the security analysis result, and if the security analysis result is safe, judging whether the operation instruction message meets the instruction issuing condition according to the four-tuple data; the verification method includes sequential logic verification and operation authority authentication; The first processing unit is further configured to issue the target data in the operation instruction message when the security analysis result is safe and the instruction issuance condition is determined to be met; a second processing unit, connected to the first processing unit, and configured to generate a target instruction message according to the target data; The third communication unit is connected to the second processing unit and the plant station system respectively, and the third communication unit is used to transmit the target instruction message to the plant station system; the generation process includes: extracting the target data in the operation instruction message, and generating the target instruction message based on the target data; In the second mode, the obtained operation instruction message is directly sent down; In the third mode, the sending of the operation instruction message is blocked.

7. The system according to claim 6, characterized in that An isolation component is connected between the first processing unit and the second processing unit.

8. The system according to claim 6, characterized in that The security control center includes: A fourth communication unit, connected to the business system, and configured to receive key operation data and quadruple data sent by the business system; A third processing unit, configured to perform security analysis on the operation instruction message according to the key operation data to obtain the service security analysis result; The fifth processing unit is connected to the third processing unit and the second communication unit respectively, and is used to receive the business security analysis result and send it to the second communication unit, and to send the four-tuple data to the second communication unit.

Images