Security assessment method and device for GNSS timing signals

Abstract

The present application provides a method and device for security evaluation of GNSS timing signals, belonging to the technical field of timing security. Among them, the method includes: obtaining the current GNSS timing signal to be evaluated, and determining the attribute information of the current GNSS timing signal, where the attribute information includes the location information of the current GNSS timing signal and the corresponding device information; according to the location information, obtaining a device list within a preset area range including the device corresponding to the current GNSS timing signal, and the device list stores the number of times the corresponding device has been attacked within a preset time period; determining the device security evaluation value corresponding to the current GNSS timing signal according to the device list. In this way, it is possible to collect relevant data on GNSS timing security across the board, achieve effective integration of data, and perform GNSS timing security evaluation through multi-party linkage.

Description

Technical Field

[0001] Embodiments of the present application generally relate to the field of timing security technology, and more specifically, to a method and device for security assessment of GNSS timing signals. Background Art

[0002] The GNSS global satellite navigation system provides three core functions of PVT. Among them, T, as a timing signal, provides accurate, unified, and global clock services for geographically and physically distributed devices and hosts. It has been widely used in various key infrastructure industries such as communications, electricity, finance, and transportation, and is the cornerstone for maintaining the stable operation of the social economy. With the large-scale application of technologies such as 5G and the Internet of Things, a large number of timing devices are distributed over a wide area, and most of them are unattended. Once the timing signal is interfered with or attacked, it is impossible to perceive the current security risks as a whole and judge the overall status of GNSS timing security, thereby reducing the cost of security operations, improving the efficiency of handling security incidents, and realizing the transformation from passive response to active prevention.

[0003] The existing technical means of NGSS timing signal prevention and control are usually mainly attached to independent hosts or devices, and independent modules are implanted to realize the detection of timing information. When the timing signal is found to be interfered or erroneous, the clock synchronization is maintained through the clock synchronization crystal module inside the device or through high-reliability, high-quality, and high-frequency ground clock services. However, with the large-scale application of technologies such as 5G and the Internet of Things, the hosts and devices that need timing are widely distributed and numerous. It is difficult to accurately identify and prevent interference and attacks on timing signals by relying solely on independently deployed timing security detection modules.

[0004] In the process of implementing the technical solution of this application, the applicant found that the existing technology and solution system mainly have the following problems:

[0005] 1. Whether the timing signal of an independent device is interfered with or attacked mainly depends on the internal modules in the independent device to judge. Each device acts independently, especially when it is interfered with deceptively. There is a problem that the clock of individual devices is out of sync due to the inability to identify abnormalities, which leads to the inability to carry out business normally.

[0006] 2. The existing timing signal detection and defense modules operate independently, and there is no effective integration of data, which cannot meet the unified monitoring and supervision mechanism requirements of industry customers;

[0007] 3. Since the radio frequency signals used for timing information interference and attacks have certain range attributes, a comprehensive security assessment of the GNSS timing signals can be conducted based on attributes such as time, space, and industry, thereby achieving foresight and meeting and achieving the needs of active prevention and control. Summary of the invention

[0008] In view of this, the purpose of the embodiments of the present application is to provide a method and device for security assessment of GNSS timing signals to solve the above-mentioned problems existing in NGSS timing signals in the prior art.

[0009] In order to solve the above problems, in a first aspect of the present application, a method for security assessment of GNSS timing signals is provided, comprising:

[0010] Acquire a current GNSS timing signal to be evaluated, and determine attribute information of the current GNSS timing signal, wherein the attribute information includes location information of the current GNSS timing signal and corresponding device information;

[0011] According to the location information, a list of devices within a preset area including the device corresponding to the current GNSS timing signal is obtained, wherein the list of devices stores the number of times the corresponding device has been attacked within a preset time period;

[0012] Determine a device safety assessment value corresponding to the current GNSS timing signal according to the device list.

[0013] In some embodiments, it also includes:

[0014] The TCP protocol is used in advance to collect log data and / or alarm data distributed on the GNSS timing SOC security management platform in different regions and / or different industries through a standardized interface at a preset period.

[0015] In some embodiments, it also includes:

[0016] The collected log data and / or alarm data are classified and stored, and the classified and stored data are converted and / or completed. The number of GNSS equipment security alarms in various industries is calculated based on different time periods and / or the duration of GNSS equipment failure to work normally is calculated based on the region, and a corresponding equipment list is generated.

[0017] In some embodiments, obtaining a list of devices within a preset area including the device corresponding to the current GNSS timing signal includes:

[0018] A circular area is determined with the device corresponding to the current GNSS timing signal as the center and a preset distance as the radius, and a device list of timing devices within the circular area is obtained.

[0019] In some embodiments, determining the device safety assessment value corresponding to the current GNSS timing signal according to the device list includes:

[0020] Use the following formula to determine the device safety assessment value corresponding to the current GNSS timing signal:

[0021] VaR = (TRA / THA) * 100%, where VaR is the safety assessment value, TRA is the total risk assessment value, and THA is the predefined risk assessment standard value;

[0022] TRA=C a *W a +C b *W b +C c *W c +…, C is the number of interference or attacks each single timing device receives in the current period, and W is the weight value of the impact of different timing devices in the surrounding area on the device security corresponding to the current GNSS timing signal. The calculation formula of the weight value is: W n =(LD n ) / L, L is the length of the preset distance corresponding to the radius, D n It is the distance from the surrounding timing device to the device corresponding to the current GNSS timing signal. a, b, c, n are the numbers of the surrounding timing devices.

[0023] In some embodiments, it also includes:

[0024] The security assessment results of the devices corresponding to the GNSS timing signals are displayed through the web interface.

[0025] In some embodiments, it also includes:

[0026] The safety assessment values ​​of the devices corresponding to other GNSS timing signals are calculated in the same manner, and the generation rules of the equipment list are adjusted according to the safety assessment values ​​of the devices corresponding to multiple GNSS timing signals.

[0027] In a second aspect of the present application, a GNSS timing signal security assessment device is provided, comprising:

[0028] A signal acquisition module, used to acquire a current GNSS timing signal to be evaluated, and determine attribute information of the current GNSS timing signal, wherein the attribute information includes location information of the current GNSS timing signal and corresponding device information;

[0029] A device list acquisition module, used to acquire a device list within a preset area including the device corresponding to the current GNSS timing signal according to the location information, wherein the device list stores the number of times the corresponding device has been attacked within a preset time period;

[0030] A security assessment module is used to determine a device security assessment value corresponding to the current GNSS timing signal according to the device list.

[0031] In a third aspect of the present application, an electronic device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the program, the method described above is implemented.

[0032] In a fourth aspect of the present application, a computer-readable storage medium is provided, on which a computer program is stored, and when the program is executed by a processor, the method described above is implemented.

[0033] Through the security assessment method of GNSS timing signals of the present application, relevant data on GNSS timing security in the entire domain can be collected, and effective data integration is achieved. Through the multi-party collaborative GNSS timing security assessment, on the one hand, the business needs of relevant industries for unified supervision and operation and maintenance of GNSS timing security signals are met; on the other hand, through a comprehensive analysis of GNSS timing security, GNSS timing security can be studied and judged, realizing the transformation of security operations from passive response to active defense.

[0034] The contents described in the summary of the invention are not intended to limit the key or important features of the embodiments of the present application, nor are they intended to limit the scope of the present application. Other features of the present application will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] The above and other features, advantages and aspects of the embodiments of the present application will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. In the accompanying drawings, the same or similar reference numerals represent the same or similar elements, wherein:

[0036] Figure 1 A flow chart showing a method for security assessment of GNSS timing signals according to Embodiment 1 of the present application is shown;

[0037] Figure 2 A schematic diagram showing the structure of a GNSS timing signal security assessment device according to a second embodiment of the present application is shown;

[0038] Figure 3 A schematic diagram of the structure of a GNSS timing signal security assessment device according to Embodiment 3 of the present application is shown. DETAILED DESCRIPTION

[0039] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0040] In addition, the term "and / or" in this article is only a description of the association relationship between the associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0041] The embodiment of the present application provides a GNSS timing signal security assessment method to assess the security of the timing signal of a device.

[0042] Specifically, Figure 1 The figure shows a security assessment method for GNSS timing signals according to the first embodiment of the present application. The security assessment method for GNSS timing signals according to the embodiment may include the following steps:

[0043] S101: Acquire a current GNSS timing signal to be evaluated, and determine attribute information of the current GNSS timing signal, where the attribute information includes location information of the current GNSS timing signal and corresponding device information.

[0044] In this embodiment, when evaluating the timing signal of the target device, it is first necessary to obtain the current GNSS timing signal to be evaluated and determine the attribute information of the current GNSS timing signal, wherein the attribute information includes the location information of the current GNSS timing signal and the corresponding device information.

[0045] Specifically, the TCP protocol can be used in advance to collect log data and / or alarm data on the GNSS timing SOC security management platform distributed in different regions and / or different industries through a standardized interface according to a preset period. The collected log data and alarm data are classified and stored according to the requirements of the data model; the collected related data are combined with the basic equipment information of the timing firewall and the basic geographical location information to convert or complete the collected data; a GNSS security indicator model is established, basic data statistics are calculated and analyzed, and a corresponding equipment list is generated. For example: the number of GNSS equipment security alarms in various industries is calculated based on different time periods (hours, days, weeks, months, years), and the duration of GNSS equipment failure to work normally is calculated based on the region, etc., to provide data support for GNSS security analysis and evaluation.

[0046] S102: Acquire a list of devices within a preset area including the device corresponding to the current GNSS timing signal according to the location information, wherein the list of devices stores the number of times the corresponding device is attacked within a preset time period.

[0047] In this embodiment, after the location information is obtained, an area range can be determined based on the obtained location information, and then a list of devices within the preset area range including the device corresponding to the current GNSS timing signal can be obtained, and then the number of times each device in the device list is attacked within a preset time period can be obtained, so as to provide data support for subsequent GNSS security analysis and evaluation.

[0048] As an optional implementation of this embodiment, a circular area is determined with the device corresponding to the current GNSS timing signal as the center and a preset distance as the radius, and a device list of timing devices within the circular area is obtained.

[0049] In addition, the area range may be determined by other methods, and then a device list of corresponding devices within the area range may be obtained.

[0050] S103: Determine a device safety assessment value corresponding to the current GNSS timing signal according to the device list.

[0051] In this embodiment, after obtaining the number of times each device in the device list is attacked within a preset time period, the device security assessment value corresponding to the current GNSS timing signal can be determined according to the device list and preset rules.

[0052] Specifically, the device safety assessment value corresponding to the current GNSS timing signal can be determined using the following formula:

[0053] VaR = (TRA / THA) * 100%, where VaR is the safety assessment value, TRA is the total risk assessment value, and THA is the predefined risk assessment standard value. And, TRA = C a *W a +C b *W b +C c *W c +…, C is the number of interference or attacks each single timing device receives in the current period, and W is the weight value of the impact of different timing devices in the surrounding area on the device security corresponding to the current GNSS timing signal. The calculation formula of the weight value is: W n =(LD n ) / L, L is the length of the preset distance corresponding to the radius, D n It is the distance from the surrounding timing device to the device corresponding to the current GNSS timing signal. a, b, c, n are the numbers of the surrounding timing devices.

[0054] The security assessment method for GNSS timing signals of this embodiment can collect relevant data on GNSS timing security in the entire domain, realize effective data integration, and through multi-party collaborative GNSS timing security assessment, on the one hand, meet the business needs of related industries for unified supervision and operation and maintenance of GNSS timing security signals; on the other hand, through a comprehensive analysis of GNSS timing security, GNSS timing security can be studied and judged, realizing the transformation of security operations from passive response to active defense.

[0055] In addition, as an optional embodiment of the present disclosure, the above method further includes:

[0056] The security assessment results of the equipment corresponding to the GNSS timing signal are displayed through the Web interface. Specifically, in order to more intuitively display the security assessment results and status of GNSS, the platform provides a Web interface to support personnel of different roles to display the assessment results of the security status of GNSS, and combine multiple attributes such as geographical location, time period, industry, etc. to display pictures, lists and GIS graphics, and directly display alarms in the interface to assist in the security operation and maintenance of GNSS.

[0057] In addition, GNSS security operation and maintenance managers can use the decision support module to assess the security situation of GNSS in general, in a certain industry, or in a certain region, and provide an interface for external data services. They can also notify construction personnel at nearby sites via email, text messages, etc., and handle GNSS security incidents in a timely manner.

[0058] In addition, in the above embodiment, it can also include: calculating the security assessment value of the equipment corresponding to other GNSS timing signals in the same way, and adjusting the generation rules of the equipment list according to the security assessment values ​​of the equipment corresponding to multiple GNSS timing signals. At the same time, the risk assessment standard value in the equipment risk assessment process can also be adjusted according to the security assessment result values ​​of multiple devices according to a preset period (for example, 1 month, 3 months, etc.), so that the assessment result of the equipment is more in line with expectations. In this way, through feedback adjustment, the security assessment of the GNSS timing signal can be made more accurate.

[0059] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that this application is not limited by the described order of actions, because according to this application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily required by this application.

[0060] The above is an introduction to the method embodiment. The following is a further explanation of the scheme described in this application through an apparatus embodiment.

[0061] like Figure 2 FIG. 1 is a schematic diagram of the structure of a security assessment device for GNSS timing signals according to Embodiment 2 of the present application. The security assessment device for GNSS timing signals according to this embodiment includes:

[0062] The signal acquisition module 201 is used to acquire the current GNSS timing signal to be evaluated and determine the attribute information of the current GNSS timing signal, wherein the attribute information includes the location information of the current GNSS timing signal and the corresponding device information;

[0063] The device list acquisition module 202 is used to acquire a device list within a preset area including the device corresponding to the current GNSS timing signal according to the location information, wherein the device list stores the number of times the corresponding device has been attacked within a preset time period;

[0064] The security assessment module 203 is used to determine the device security assessment value corresponding to the current GNSS timing signal according to the device list.

[0065] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the described module can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0066] Figure 3 A schematic block diagram of an electronic device 300 that can be used to implement an embodiment of the present application is shown. As shown, the device 300 includes a central processing unit (CPU) 301, which can perform various appropriate actions and processes according to computer program instructions stored in a read-only memory (ROM) 302 or loaded from a storage unit 308 into a random access memory (RAM) 303. In RAM 303, various programs and data required for the operation of the device 300 can also be stored. CPU 301, ROM 302 and RAM 303 are connected to each other via a bus 304. An input / output (I / O) interface 305 is also connected to the bus 304.

[0067] A number of components in the device 300 are connected to the I / O interface 305, including: an input unit 306, such as a keyboard, a mouse, etc.; an output unit 307, such as various types of displays, speakers, etc.; a storage unit 308, such as a disk, an optical disk, etc.; and a communication unit 309, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 309 allows the device 300 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0068] The processing unit 301 performs the various methods and processes described above, which are tangibly contained in a machine-readable medium, such as a storage unit 308. In some embodiments, part or all of the computer program can be loaded and / or installed on the device 300 via the ROM 302 and / or the communication unit 309. When the computer program is loaded into the RAM 303 and executed by the CPU 301, one or more steps of the method described above can be performed. Alternatively, in other embodiments, the CPU 301 can be configured to perform the above method in any other suitable manner (e.g., by means of firmware).

[0069] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chip systems (SOCs), load programmable logic devices (CPLDs), and the like.

[0070] The program code for implementing the method of the present application can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, implements the functions / operations specified in the flow chart and / or block diagram. The program code can be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0071] In the context of the present application, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0072] In addition, although each operation is described in a specific order, this should be understood as requiring such operation to be performed in the specific order shown or in a sequential order, or requiring that all illustrated operations should be performed to obtain desired results. Under certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details are included in the above discussion, these should not be interpreted as limiting the scope of the application. Some features described in the context of a separate embodiment can also be implemented in a single implementation in combination. On the contrary, the various features described in the context of a single implementation can also be implemented in multiple implementations individually or in any suitable sub-combination mode.

[0073] Although the subject matter has been described in language specific to structural features and / or methodological logical actions, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. On the contrary, the specific features and actions described above are merely example forms of implementing the claims.

Claims

1. Security assessment method for GNSS timing signals, It is characterized in that include: Acquire a current GNSS timing signal to be evaluated, and determine attribute information of the current GNSS timing signal, wherein the attribute information includes location information of the current GNSS timing signal and corresponding device information; According to the location information, a list of devices within a preset area including the device corresponding to the current GNSS timing signal is obtained, wherein the list of devices stores the number of times the corresponding device has been attacked within a preset time period; Determine, according to the equipment list, a device safety assessment value corresponding to the current GNSS timing signal; The step of obtaining a list of devices within a preset area including the device corresponding to the current GNSS timing signal includes: Taking the device corresponding to the current GNSS timing signal as the center of the circle and the preset distance as the radius, determine a circular area, and obtain a device list of timing devices within the circular area; The determining, according to the device list, a device safety assessment value corresponding to the current GNSS timing signal includes: Use the following formula to determine the device safety assessment value corresponding to the current GNSS timing signal: VaR = (TRA / THA) * 100%, where VaR is the safety assessment value, TRA is the total risk assessment value, and THA is the predefined risk assessment standard value; TRA=C a *W a +C b *W b +C c *W c +…, C is the number of interference or attacks each single timing device receives in the current period, and W is the weight value of the impact of different timing devices in the surrounding area on the device security corresponding to the current GNSS timing signal. The calculation formula of the weight value is: W n =(LD n ) / L, L is the length of the preset distance corresponding to the radius, D n It is the distance from the surrounding timing device to the device corresponding to the current GNSS timing signal. a, b, c, n are the numbers of the surrounding timing devices.

2. The security assessment method according to claim 1, It is characterized in that Also includes: The TCP protocol is used in advance to collect log data and / or alarm data distributed on the GNSS timing SOC security management platform in different regions and / or different industries through a standardized interface at a preset period.

3. The security assessment method according to claim 2, It is characterized in that Also includes: The collected log data and / or alarm data are classified and stored, and the classified and stored data are converted and / or completed. The number of GNSS equipment security alarms in various industries is calculated based on different time periods and / or the duration of GNSS equipment failure to work normally is calculated based on the region, and a corresponding equipment list is generated.

4. The security assessment method according to claim 1, It is characterized in that Also includes: The security assessment results of the devices corresponding to the GNSS timing signals are displayed through the web interface.

5. The security assessment method according to claim 1, It is characterized in that Also includes: The safety assessment values ​​of the devices corresponding to other GNSS timing signals are calculated in the same manner, and the generation rules of the equipment list are adjusted according to the safety assessment values ​​of the devices corresponding to multiple GNSS timing signals.

6. GNSS timing signal security assessment device, It is characterized in that include: A signal acquisition module, used to acquire a current GNSS timing signal to be evaluated, and determine attribute information of the current GNSS timing signal, wherein the attribute information includes location information of the current GNSS timing signal and corresponding device information; A device list acquisition module, used to acquire a device list within a preset area including the device corresponding to the current GNSS timing signal according to the location information, wherein the device list stores the number of times the corresponding device has been attacked within a preset time period; A security assessment module, used to determine a device security assessment value corresponding to the current GNSS timing signal according to the device list; The step of obtaining a list of devices within a preset area including the device corresponding to the current GNSS timing signal includes: Taking the device corresponding to the current GNSS timing signal as the center of the circle and the preset distance as the radius, determine a circular area, and obtain a device list of timing devices within the circular area; The determining, according to the device list, a device safety assessment value corresponding to the current GNSS timing signal includes: Use the following formula to determine the device safety assessment value corresponding to the current GNSS timing signal: VaR = (TRA / THA) * 100%, where VaR is the safety assessment value, TRA is the total risk assessment value, and THA is the predefined risk assessment standard value; TRA=C a *W a +C b *W b +C c *W c +…, C is the number of interference or attacks each single timing device receives in the current period, and W is the weight value of the impact of different timing devices in the surrounding area on the device security corresponding to the current GNSS timing signal. The calculation formula of the weight value is: W n =(LD n ) / L, L is the length of the preset distance corresponding to the radius, D n It is the distance from the surrounding timing device to the device corresponding to the current GNSS timing signal. a, b, c, n are the numbers of the surrounding timing devices.

7. An electronic device comprising a memory and a processor, wherein a computer program is stored in the memory. It is characterized in that When the processor executes the program, the method according to any one of claims 1 to 5 is implemented.

8. A computer-readable storage medium having a computer program stored thereon, It is characterized in that When the program is executed by a processor, the method according to any one of claims 1 to 5 is implemented.

Images