Method, device and system for using industrial vulnerability feature library based on national secret algorithm

Abstract

The application discloses a kind of based on industrial vulnerability feature library of state secret algorithm method, equipment and system, belong to field of industrial control network, including following steps: from the initialization and deployment use of vulnerability feature library entire life cycle, all data based on state secret algorithm decryption is completed in memory, without any plaintext text data storage.In the scheme of the application, the original data of vulnerability feature library data, initialization process and deployment process all use encrypted data, whether it is later engineering implementation joint debugging or remote joint debugging and other operations will not cause industrial vulnerability feature library data plaintext leakage risk, greatly improve the security of industrial vulnerability feature library use.Using state secret algorithm at the same time, improve self-controllability, solve the problem of data security.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of industrial control network, more particularly, to a method, device and system for using an industrial vulnerability feature library based on a national encryption algorithm. BACKGROUND

[0002] An industrial vulnerability feature library is a very important vulnerability library resource, and through the feature library data resource, industrial control vulnerabilities in an industrial control network can be found to protect industrial control equipment from vulnerability attacks. However, in order to facilitate rule analysis and matching, vulnerability library data and its deployment rule files of most systems are stored in plaintext in the system, which has a serious risk of vulnerability feature library data leakage, especially in the early engineering implementation and debugging stage, and it is easy to cause leakage of industrial vulnerability feature library data, causing immeasurable losses to the company. Therefore, a safe use technology of an industrial vulnerability feature library based on a national encryption algorithm is urgently needed to solve the problem of leakage of industrial vulnerability feature library data. SUMMARY

[0003] The present application aims to overcome the deficiencies of the prior art, and provides a method, device and system for using an industrial vulnerability feature library based on a national encryption algorithm, which improves the security of the use of the industrial vulnerability feature library.

[0004] The purpose of the present application is achieved by the following scheme:

[0005] A method for using an industrial vulnerability feature library based on a national encryption algorithm, comprising the following steps:

[0006] From the initialization and deployment of the vulnerability feature library, all data based on the national encryption algorithm decryption is completed in the memory, and there is no storage of any plaintext text data.

[0007] Further, all data based on the national encryption algorithm decryption is completed in the memory from the initialization and deployment of the vulnerability feature library, and there is no storage of any plaintext text data, specifically comprising the following sub-steps:

[0008] S1. Read the vulnerability feature library raw data in a stream, encrypt the read data one by one, use the national encryption algorithm as the encryption algorithm, and write the data to the file one by one after encryption. At this time, the vulnerability feature library data is stored in the text in the form of data encrypted by the national encryption algorithm, and the encrypted data text is used as the industrial vulnerability feature library raw data of the industrial firewall system;

[0009] S2. In the initialization stage of the industrial firewall system, read the encrypted industrial vulnerability feature library data file, and use the corresponding national encryption algorithm to decrypt and extract the vulnerability library basic information;

[0010] S3, the vulnerability base information data and the encrypted vulnerability feature data program set form an association and are respectively stored in the database vulnerability library base information table and the vulnerability library feature data table, and the corresponding vulnerability feature library data ciphertext can be queried according to the base information table data;

[0011] S4, the industrial firewall web management system is deployed in the industrial vulnerability rule, and the server business layer generates a ciphertext rule file and transmits it to the bottom rule decryption module according to the corresponding industrial vulnerability feature library data ciphertext queried by the vulnerability base information;

[0012] S5, the rule decryption module reads the encrypted vulnerability feature library file stream into the memory, and uses the national secret algorithm to perform the industrial vulnerability feature library data decryption operation in the memory, and completes the decryption operation and transmits the decrypted vulnerability feature library data to the rule analysis module as a parameter;

[0013] S6, the rule analysis module receives the vulnerability feature library data, and performs data cleaning according to the set rule to form a data format convenient for fast packet matching and stored in the memory, and thus the industrial vulnerability library security deployment is completed.

[0014] Further, in step S1, the vulnerability feature library original data includes vulnerability information and vulnerability features.

[0015] Further, in step S2, the vulnerability library base information includes vulnerability number, release time, vulnerability type, hazard level and description information.

[0016] Further, in step S3, it includes the following sub-steps: the industrial firewall management system queries the vulnerability library base information table data, which is used for the basic vulnerability data display and the action modification of the vulnerability library deployment, and the deployment actions include warning, discarding and blocking, so that the vulnerability library data viewing and action setting come from the vulnerability library base information table, and the deployment operation comes from the vulnerability feature library table.

[0017] Further, in step S4, the industrial vulnerability library data is transmitted in an encrypted form between modules.

[0018] Further, in step S5, from the beginning of data initialization to the last transmission and circulation between modules, all are transmitted in an encrypted form.

[0019] Further, in step S6, it includes the following sub-steps: the decrypted plaintext in the memory is used for data reorganization by selecting a business module.

[0020] A computer device includes a memory, a processor, and a computer program stored on the memory and executable by the processor, and the processor executes the program to implement the method of any one of the above.

[0021] A system comprising the computer device as described above.

[0022] Advantages of the present application include:

[0023] (1) The original data, initialization process and deployment process of the vulnerability feature library data all use encrypted data, and neither later engineering implementation joint debugging nor remote joint debugging and other operations will cause the risk of leakage of industrial vulnerability feature library data in plaintext, greatly improving the security of the use of the industrial vulnerability feature library.

[0024] (2) The national secret algorithm is used, which improves the independent controllability of the technical scheme of the embodiment of the present application, and solves the problem of data security from the essence. BRIEF DESCRIPTION OF DRAWINGS

[0025] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed to be used in the embodiment or prior art description will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor on the basis of these drawings.

[0026] Figure 1 The original data encryption and industrial firewall system initialization flowchart in the industrial vulnerability feature library security use method based on the national secret algorithm of the embodiment of the present application is shown in the following figure:

[0027] Figure 2 The industrial vulnerability library security use flowchart in the industrial vulnerability feature library security use method based on the national secret algorithm of the embodiment of the present application is shown in the following figure: DETAILED DESCRIPTION

[0028] All features disclosed in all embodiments of the present specification, or all steps in the implicitly disclosed methods, can be combined and / or extended, replaced, or substituted, in any manner, except for mutually exclusive features and / or steps.

[0029] The technical scheme of the industrial vulnerability feature library security use based on the national secret algorithm of the embodiment of the present application will be described in detail below. As shown in the following figure, it includes the following steps: Figure 1

[0030] ​1) Read the vulnerability feature library raw data (vulnerability information and vulnerability features) in the form of a stream, encrypt each piece of data read, use the national encryption algorithm for encryption, and after encryption, write each piece of data to the file. At this time, the vulnerability feature library data is stored in the text in the form of data encrypted by the national encryption algorithm. Use this encrypted data text as the industrial firewall system's industrial vulnerability feature library raw data. After this processing, the industrial firewall system only has encrypted industrial vulnerability library data. Even if the data is leaked, it is also leaked in encrypted form and cannot be directly used, thus effectively ensuring the security of the storage and use of vulnerability feature library raw data.

[0031] 2) During the initialization phase of the industrial firewall system, read the encrypted industrial vulnerability feature library data file and decrypt it using the corresponding national encryption algorithm. Extract the vulnerability library basic information (vulnerability number, release time, vulnerability type, hazard level, and description information, etc.). For specific feature key data, use the national encryption algorithm to encrypt the data in memory to form ciphertext data and set up an association with the vulnerability basic information. Store them in the database vulnerability library basic information table and vulnerability library feature data table, respectively, for industrial firewall management system vulnerability basic information viewing and deployment operations. This significantly improves the security of vulnerability feature library business data without affecting data visualization operations, effectively preventing the risk of plaintext leakage of vulnerability feature business data.

[0032] 3) The vulnerability basic information data and encrypted vulnerability feature data program are set up in an associated relationship and stored in the database vulnerability library basic information table and vulnerability library feature data table. According to the basic information table data, the corresponding vulnerability feature library data ciphertext can be queried. The industrial firewall management system queries the vulnerability library basic information table data for basic vulnerability data display and vulnerability library deployment action modification. The deployment actions include warning, discarding, and blocking. In this way, the vulnerability library data viewing and action setting come from the vulnerability library basic information table, and the deployment operation comes from the vulnerability feature library table, making it easy to deploy specific vulnerability library rules through the industrial firewall web system, objectize the storage of sub-tables, clearly define the boundaries of business data, and improve the readability of business operations.

[0033] As shown in Figure 2 the technical scheme of the embodiment of the application further includes the following steps:

[0034] 1) Deploy the industrial vulnerability rules in the industrial firewall web management system. The server business layer queries the corresponding industrial vulnerability feature library data ciphertext based on the vulnerability basic information, generates a ciphertext rule file, and passes it to the lower-level rule decryption module. In this way, the industrial vulnerability library data is transmitted in encrypted form between modules, effectively preventing data from being stolen in plaintext form during transmission, and improving the security of data transmission.

[0035] 2) Rule decryption module reads the encrypted vulnerability feature library file stream into memory, and performs industrial vulnerability feature library data decryption operation in memory using the national secret algorithm, completes the decryption operation, and passes the decrypted vulnerability feature library data to the rule analysis module as a parameter, so that the data is transmitted in an encrypted form from the beginning of initialization to the last transmission and circulation between modules, until it is loaded into memory and starts to be decrypted, the data plaintext is extracted, and the security of the data is effectively guaranteed.

[0036] 3) The rule analysis module receives the vulnerability feature library data, performs data cleaning according to certain rules to form a data format convenient for rapid message matching, and stores the data format in memory, thereby completing the industrial vulnerability library

[0037] Security deployment, the plaintext decrypted in memory cannot be directly used, and must be reorganized by using a specific business module 5 to output a data format that can be used, so that the system can be normally used, thereby further reinforcing the security of the data.

[0038] The above technical scheme is adopted, all data decryption from the initialization and deployment of the vulnerability feature library throughout the entire life cycle is completed in memory, and there is no storage of any plaintext text data,

[0039] Whether it is later engineering implementation or remote technical debugging, etc. does not have the risk of data plaintext leakage, which greatly improves the security of the use of the industrial vulnerability feature library, and the technical scheme of the embodiment of the application uses the national secret algorithm, which is self-controllable, and fundamentally solves the problem of data security.

[0040] It should be noted that, within the scope of protection defined in the claims of the present application, the following embodiments can be combined and / or extended, replaced with any logical manner from the above specific embodiments, for example, the disclosed technical principles, disclosed technical features or implied technical features.

[0041] characteristics, etc.

[0042] Embodiment 1

[0043] A use method of an industrial vulnerability feature library based on a national secret algorithm, comprising the following steps:

[0044] From the initialization and deployment of the vulnerability feature library throughout the entire life cycle, all data decryption based on the national secret algorithm is completed in memory, and there is no storage of any plaintext text data.

[0045] 0 Embodiment 2

[0046] On the basis of embodiment 1, the entire life cycle of the initialization and deployment of the vulnerability feature library uses all data based on national secret algorithm decryption to be completed in memory, and there is no storage of any plaintext text data, and specifically includes the following sub-steps:

[0047] S1. Read the vulnerability feature library raw data in a stream manner, encrypt the read data in a piece-by-piece manner, use the national secret algorithm as the encryption algorithm, after the encryption is completed, write the data to the file in a piece-by-piece manner, at this time, the vulnerability feature library data is stored in the text in the form of data encrypted by the national secret algorithm, and the encrypted data text is used as the industrial vulnerability feature library raw data of the industrial firewall system;

[0048] S2. In the initialization stage of the industrial firewall system, read the encrypted industrial vulnerability feature library data file and decrypt it using the corresponding national secret algorithm to extract the vulnerability library basic information;

[0049] S3. The vulnerability basic information data and the encrypted vulnerability feature data program form an associated relationship and are stored in the database vulnerability library basic information table and the vulnerability library feature data table respectively, and according to the data in the basic information table, the corresponding vulnerability feature library data ciphertext can be queried;

[0050] S4. Deploy the industrial vulnerability rules in the industrial firewall web management system, and the server business layer queries the corresponding industrial vulnerability feature library data ciphertext according to the vulnerability basic information to generate a ciphertext rule file and transfer it to the lower-level rule decryption module;

[0051] S5. The rule decryption module reads the encrypted vulnerability feature library file stream into the memory and performs the industrial vulnerability feature library data decryption operation in the memory using the national secret algorithm, and after the decryption operation is completed, the decrypted vulnerability feature library data is transmitted to the rule analysis module as a parameter;

[0052] S6. The rule analysis module receives the vulnerability feature library data, performs data cleaning according to the set rules to form a data format convenient for fast packet matching and stores it in the memory, and thus the industrial vulnerability library security deployment is completed.

[0053] Embodiment 3

[0054] On the basis of embodiment 2, in step S1, the vulnerability feature library raw data includes vulnerability information and vulnerability features.

[0055] Embodiment 4

[0056] On the basis of embodiment 2, in step S2, the vulnerability library basic information includes vulnerability number, release time, vulnerability type, hazard level and description information.

[0057] Embodiment 5

[0058] On the basis of embodiment 2, in step S3, the following sub-steps are included: the industrial firewall management system queries the vulnerability library basic information table data, which is used for basic vulnerability data display and action modification of vulnerability library deployment, and the deployment actions include warning, discarding and blocking, so that the vulnerability library data viewing and action setting come from the vulnerability library basic information table, and the deployment operation comes from the vulnerability feature library table.

[0059] Embodiment 6

[0060] On the basis of embodiment 2, in step S4, the industrial vulnerability library data is transmitted in an encrypted form between modules.

[0061] Embodiment 7

[0062] On the basis of embodiment 2, in step S5, the data is transmitted in an encrypted form from the beginning of initialization to the last transmission and the flow between modules.

[0063] Embodiment 8

[0064] On the basis of embodiment 2, in step S6, the following sub-steps are included: the decrypted plaintext in the memory is used for data reorganization by using a selected business module.

[0065] Embodiment 9

[0066] A computer device includes a memory, a processor, and a computer program stored on the memory and executable by the processor, and the processor executes the program to implement the method of any one of embodiments 1 to 8.

[0067] Embodiment 10

[0068] A system includes the computer device of embodiment 9.

[0069] The units described in the embodiments of the present application can be implemented in the form of software, or can be implemented in the form of hardware, and the described units can also be arranged in a processor. In some cases, the names of these units do not constitute a limitation on the units themselves.

[0070] According to an aspect of an embodiment of the present application, a computer program product or computer program is provided, which includes computer instructions stored in a computer readable storage medium. The processor of the computer device reads the computer instructions from the computer readable storage medium, and the processor executes the computer instructions, so that the computer device executes the method provided in the various optional implementation manners.

[0071] As another aspect, the embodiments of the present application also provide a computer readable medium, which can be included in the electronic device described in the above embodiments, or can exist independently without being assembled into the electronic device. The computer readable medium carries one or more programs, which, when executed by the electronic device, enable the electronic device to implement the method described in the above embodiments.

[0072] The parts of the present application not involved in the embodiments are the same as or can be implemented by the prior art.

[0073] The technical solution described above is only one embodiment of the present application. Based on the application method and principle disclosed in the present application, those skilled in the art can easily make various types of improvements or modifications without being limited to the method described in the above specific embodiments. Therefore, the above description is only preferred and not limiting.

[0074] In addition to the above examples, those skilled in the art can obtain other embodiments by making changes based on the above disclosure or using knowledge or technology in related fields. The features of each embodiment can be interchanged or replaced. Changes and variations made by those skilled in the art do not deviate from the spirit and scope of the present application, and should be within the protection scope of the claims of the present application.

Claims

1. A method for using an industrial vulnerability feature database based on national cryptographic algorithms, characterized in that, Includes the following steps: S1 reads the raw data of the vulnerability feature database one by one in a stream, encrypts the read data one by one using the national cryptographic algorithm, and writes the data one by one to a file after encryption. At this time, the vulnerability feature database data is stored in the text in the form of data encrypted by the national cryptographic algorithm. This encrypted data text is used as the raw data of the industrial vulnerability feature database of the industrial firewall system. S2, Industrial firewall system initialization phase: Read the encrypted industrial vulnerability feature database data file, decrypt it using the corresponding national cryptographic algorithm, and extract basic vulnerability database information; the basic vulnerability database information includes vulnerability number, release time, vulnerability type, severity level, and description information; S3, the basic vulnerability information data and the encrypted vulnerability feature data are set to form an association relationship and stored in the database vulnerability database basic information table and vulnerability database feature data table respectively. Based on the data in the vulnerability database basic information table, the corresponding industrial vulnerability feature database data ciphertext can be queried. S4. Deploy industrial vulnerability rules in the industrial firewall web management system. The server-side business layer queries the corresponding encrypted data of the industrial vulnerability feature library based on the basic vulnerability information and generates an encrypted rule file, which is then passed to the underlying rule decryption module. S5, the rule decryption module reads the encrypted vulnerability feature library file stream into memory, and uses the national cryptographic algorithm in memory to decrypt the industrial vulnerability feature library data. After completing the decryption operation, the decrypted vulnerability feature library data is passed as a parameter to the rule parsing module. S6, the rule parsing module receives the vulnerability signature database data, cleans the data according to the set rules to form a data format that facilitates rapid message matching, and stores it in memory. This completes the secure deployment of the industrial vulnerability database.

2. The method for using the industrial vulnerability feature database based on national cryptographic algorithms according to claim 1, characterized in that, In step S1, the raw data of the vulnerability feature database includes vulnerability information and vulnerability features.

3. The method for using the industrial vulnerability feature database based on national cryptographic algorithms according to claim 1, characterized in that, Step S3 includes the following sub-steps: The industrial firewall management system queries the vulnerability database basic information table for basic vulnerability data display and vulnerability database deployment action modification. Deployment actions include warning, dropping, and blocking. Thus, the vulnerability database data viewing and action settings come from the vulnerability database basic information table, and the deployment operations come from the vulnerability feature database table.

4. The method for using the industrial vulnerability feature database based on national cryptographic algorithms according to claim 1, characterized in that, In step S4, the data in the industrial vulnerability signature database is transmitted between modules in an encrypted form.

5. The method for using the industrial vulnerability feature database based on national cryptographic algorithms according to claim 1, characterized in that, Step S6 includes the sub-step: the plaintext decrypted in memory is reconstructed using a selected business module.

6. A computer device, characterized in that, It includes a memory, a processor, and a computer program stored in the memory and executable by the processor, wherein the processor executes the program to implement the method as described in any one of claims 1 to 5.

7. A system for using an industrial vulnerability feature database based on national cryptographic algorithms, characterized in that, Includes the computer device as described in claim 6.

Images