An industrial control safety early warning information pushing system and electronic equipment

Abstract

The application discloses an industrial control safety early warning information pushing system and electronic equipment, and relates to the technical field of industrial control safety early warning information pushing systems. The system comprises a center server, a terminal device and an industrial computer system. The center server comprises an information processing module, a safety early warning module and a distribution early warning module. The information processing module obtains parameter verification information from the industrial computer system. The safety early warning module processes the parameter verification information to obtain safety early warning information. The distribution early warning module generates early warning pushing information according to the safety early warning information and pushes the early warning pushing information to the terminal device and / or the industrial computer system. The application can quickly discover safety threats and give early warnings by obtaining parameter verification information in time and giving safety analysis and early warnings. Meanwhile, the application can accurately push the early warning information through the distribution early warning module, thereby ensuring the safety reliability and timeliness of the early warning information, and helping to improve the efficiency of the terminal in learning and responding to network safety early warning information.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of information security technology, and in particular to an industrial control safety early warning information pushing system and an electronic device. BACKGROUND

[0002] At present, we are facing an increasingly severe industrial information security situation, among which the traditional threats of industrial information security are increasing; at the same time, the new security of industrial internet as a new challenge is facing new problems and threats, which leads to the current industrial information security being widely concerned.

[0003] After an industrial security event occurs, the security situation should be analyzed quickly, major vulnerabilities and risks that may affect industrial control safety should be found, and red or orange early warning reports should be determined and issued, but the information transmission of the security event in the prior art is lagging behind, which seriously affects the processing efficiency of the security problem and brings great security risks. In the process of industrial information transmission, how to quickly realize the pushing of the industrial control safety early warning information and guarantee the timely notification and processing of the network security early warning information at all levels is a problem that technicians in the field urgently need to solve. SUMMARY

[0004] Therefore, the embodiments of the present application provide an industrial control safety early warning information pushing system to solve the problem of lagging behind in the transmission of security risk information in the prior art.

[0005] To achieve the above-mentioned purpose, the present application provides the following technical scheme:

[0006] The embodiments of the present application provide an industrial control safety early warning information pushing system, comprising:

[0007] a center server, a terminal device and an industrial control computer system; the center server comprises an information processing module, a safety early warning module and a distribution early warning module;

[0008] The information processing module obtains parameter verification information from the industrial control computer system and sends the parameter verification information to the safety early warning module;

[0009] The safety early warning module processes the parameter verification information to obtain safety early warning information and sends the safety early warning information to the distribution early warning module;

[0010] The distribution early warning module generates early warning pushing information according to the safety early warning information and pushes the early warning pushing information to the terminal device and / or the industrial control computer system.

[0011] Optionally, the information processing module obtains parameter information from the industrial control computer system, comprising:

[0012] The information processing module sends a parameter checking instruction to the industrial computer system through an information checking interface;

[0013] The industrial computer system generates parameter checking information according to the parameter checking instruction, and sends the parameter checking information to the information processing module through the information checking interface.

[0014] Optionally, the system further comprises a resource allocation service module, which is configured to construct a first data cache channel and a second data cache channel for each information checking interface corresponding to the industrial computer system.

[0015] The first data cache channel is connected with a local memory, and the local memory stores information data of all industrial computer systems interconnected in a local area network.

[0016] The second data cache channel is configured to transmit parameter checking instructions and parameter checking information, and is further configured to transfer and store information data of the industrial computer system.

[0017] Optionally, the system further comprises a first calculation processing module, which is configured to store and allocate information data in the industrial computer system through calculation.

[0018] Optionally, the storage and allocation of information data in the industrial computer system through calculation comprises:

[0019] Obtaining an emergency storage priority list of the industrial computer system pre-set in the industrial computer system allocation database;

[0020] Calculating the memory of the local memory to obtain the remaining storage space;

[0021] According to the remaining storage space and the storage priority in the emergency storage priority list, the information data in the industrial computer system is stored and allocated.

[0022] Optionally, the system further comprises a second calculation processing module, which is configured to transfer and store the remaining information data when the remaining storage space of the local memory is lower than a pre-set standard threshold and the storage is not completed.

[0023] Optionally, the transfer and storage of information data of the industrial computer system comprises:

[0024] Obtaining a jam emergency list pre-set in the industrial computer system allocation database;

[0025] According to the calling priority in the jam emergency list, the second data cache channel is selected to transfer the information data of the industrial computer system to the information processing module for storage.

[0026] Optionally, the security warning module processes the parameter verification information to obtain security warning information, including:

[0027] comparing the parameter verification information with a preset security database to obtain tampering warning data;

[0028] generating security warning information based on the tampering warning data.

[0029] Optionally, the distribution warning module generates warning push information according to the security warning information, including:

[0030] The distribution warning module compares the security warning information with a preset security level to determine the priority of each security warning information.

[0031] According to the priority, the security warning information is sorted to obtain a warning push queue.

[0032] The security warning information in the warning push queue is generated into warning push information according to a preset time interval.

[0033] The embodiment of the application also provides an electronic device, including:

[0034] A memory and a processor are communicatively connected between each other, the memory stores computer instructions, and the processor executes the computer instructions to perform the workflow of the central server in the industrial control security warning information push system provided by the embodiment of the application.

[0035] The technical scheme of the application has the following advantages:

[0036] The application provides an industrial control security warning information push system, including a central server, a terminal device and an industrial computer system; the central server includes an information processing module, a security warning module and a distribution warning module; the information processing module obtains parameter verification information from the industrial computer system and sends the parameter verification information to the security warning module; the security warning module processes the parameter verification information to obtain security warning information and sends the security warning information to the distribution warning module; the distribution warning module generates warning push information according to the security warning information and pushes the warning push information to the terminal device and / or the industrial computer system. The application can quickly discover security threats and give warnings by timely obtaining parameter verification information and giving security analysis and warnings, and the warning push module is used for accurate pushing, so that the security reliability and timeliness of the warning information are ensured, thereby helping to improve the efficiency of the terminal in obtaining and responding to network security warning information. BRIEF DESCRIPTION OF DRAWINGS

[0037] In order to more clearly illustrate the technical solutions in the specific embodiments of the present application or the prior art, the drawings required to be used in the description of the specific embodiments or the prior art will be briefly introduced. Obviously, the drawings described below are some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor on the basis of these drawings.

[0038] Figure 1 The structural schematic diagram of the industrial control safety early warning information pushing system in the embodiment of the present application is shown in the figure.

[0039] Figure 2 The structural schematic diagram of the resource allocation in the embodiment of the present application is shown in the figure.

[0040] Figure 3 The structural schematic diagram of the electronic device in the embodiment of the present application is shown in the figure.

[0041] In the figure: 1-center server, 2-terminal device, 3-industrial computer system, 4-information processing module, 5-safety early warning module, 6-distribution early warning module, 7-local storage, 8-first data cache channel, 9-second data cache channel, 10-first calculation processing module, 11-second calculation processing module, 301-processor, 302-memory. DETAILED DESCRIPTION

[0042] In order to make the purpose, technical solutions and advantages of the embodiments of the present application more clear, the technical solutions in the embodiments of the present application will be described clearly and completely below in combination with the drawings in the embodiments of the present application. Obviously, the described embodiments are some of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0043] According to the embodiments of the present application, an industrial control safety early warning information pushing system embodiment is provided. It should be noted that the steps shown in the flowchart of the drawings can be executed in a computer system such as a group of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0044] In the present embodiment, an industrial control safety early warning information pushing system is provided, which can be used for network security early warning protection of industrial information, such as Figure 1As shown, the industrial control safety early warning information pushing system includes a center server 1, a terminal device 2 and an industrial control computer system 3. The center server 1 includes an information processing module 4, a safety early warning module 5 and a distribution early warning module 6. Specifically, the information processing module 4 is in communication connection with the safety early warning module 5 and the distribution early warning module 6 respectively, for transmitting interactive data; the information processing module 4 directly establishes a communication connection with the industrial control computer system 3 through an information verification interface, for sending parameter verification instructions and receiving parameter verification information. The terminal device 2 can be a smart phone, a notebook computer or a tablet computer.

[0045] The information processing module 4 obtains the parameter verification information from the industrial control computer system 3 and sends the parameter verification information to the safety early warning module 5. Specifically, a plurality of types of information data are stored in each industrial control computer system 3.

[0046] The safety early warning module 5 processes the parameter verification information to obtain safety early warning information and sends the safety early warning information to the distribution early warning module 6. Specifically, through the safety early warning module 5, it can be analyzed whether the obtained parameter verification information exists tampering, and the parameter verification information that appears tampering is confirmed to generate safety early warning information.

[0047] The distribution early warning module 6 generates early warning pushing information according to the safety early warning information and pushes the early warning pushing information to the terminal device 2 and / or the industrial control computer system 3. Specifically, through the distribution early warning module 6, the safety early warning information can be accurately pushed, ensuring the safety reliability and timeliness of the early warning information, thereby helping to improve the efficiency of the terminal in obtaining and responding to network safety early warning information.

[0048] The industrial control safety early warning information pushing system provided by the embodiment of the application can quickly discover security threats and give early warnings by timely obtaining parameter verification information and giving safety analysis and early warnings, and can ensure the safety reliability and timeliness of the early warning information by accurately pushing through the distribution early warning module 6, thereby helping to improve the efficiency of the terminal in obtaining and responding to network safety early warning information.

[0049] Specifically, in an embodiment, the information processing module 4 obtains parameter information from the industrial control computer system 3, including:

[0050] The information processing module 4 sends a parameter verification instruction to the industrial control computer system 3 through an information verification interface. Specifically, the information processing module 4 is provided with a plurality of information verification interfaces, and the information verification interfaces are connected with the respective industrial control computer systems 3, for directly sending information data verification instructions to the industrial control computer systems 3.

[0051] The industrial control computer system 3 generates parameter verification information according to the parameter verification instruction and sends the parameter verification information to the information processing module 4 through the information verification interface.

[0052] Specifically, the information transmission through the information verification interface can avoid most network devices that may have virus risks, and improve the security and reliability of the information transmission.

[0053] Specifically, in an embodiment, as shown in the figure, Figure 2 The system further includes a resource allocation service module, which is configured to construct a first data cache channel 8 and a second data cache channel 9 for each information verification interface of the industrial computer system 3. Specifically, the resource allocation service module is further configured to implement emergency storage of the information data allocated by the industrial computer system 3 while sending the parameter verification instruction directly to the industrial computer system 3. The resource allocation service module is provided with an industrial computer system 3 allocation database.

[0054] The first data cache channel 8 is connected to the local memory 7, and the local memory 7 stores information data of all the industrial computer systems 3 interconnected in the local area network.

[0055] The second data cache channel 9 is configured to transmit the parameter verification instruction and the parameter verification information, and to transfer and store the information data of the industrial computer system 3.

[0056] Specifically, the first data cache channel 8 and the second data cache channel 9 implement two-level channel resource matching processing, which can ensure the transmission of the parameter verification information and the emergency transfer and storage processing of the information data in the industrial computer system 3, and realize safe, efficient and reasonable allocation and use of the independent information verification interface.

[0057] Specifically, in an embodiment, the system further includes a first calculation processing module 10. The first calculation processing module 10 is configured to store and allocate the information data in the industrial computer system 3 by calculation.

[0058] Specifically, the first calculation processing module 10 is configured to analyze the data in the industrial computer system 3 when the industrial computer system 3 has a security problem, and store the information data according to the storage space of the industrial computer system 3.

[0059] Specifically, in an embodiment, the storage and allocation of the information data in the industrial computer system 3 by calculation includes:

[0060] Obtaining an emergency storage priority list of the industrial computer system 3 in the industrial computer system 3 allocation database. Specifically, the emergency storage priority list includes the names of the information data, i.e., the industrial computer systems 3, arranged in descending order of priority.

[0061] Calculating the memory of the local memory 7 to obtain the remaining storage space.

[0062] The information data in the industrial computer system 3 is stored and allocated according to the remaining storage space and the storage priority in the emergency storage priority list.

[0063] Specifically, by obtaining the priority of each information data and the size of the storage space, the key data with high priority is stored preferentially, so that the data with higher importance in the system can be retained to the maximum extent when a safety problem occurs, and the loss is reduced.

[0064] Specifically, in an embodiment, the system further comprises a second computing and processing module 11. The second computing and processing module 11 is used to transfer and store the remaining information data when the remaining storage space of the local storage 7 is lower than the preset standard threshold and the storage is not completed. Specifically, the second computing and processing module 11 compares the current remaining storage space with the preset standard threshold, and when the remaining storage space is less than the preset standard threshold, it is judged whether the current storage is completed. If the current storage is not completed, the remaining information data is transferred and stored. When the amount of data in the local storage 7 is not enough, the data is transferred in time to ensure the emergency transfer and storage of the information data.

[0065] Specifically, in an embodiment, the information data of the industrial computer system 3 is transferred and stored, comprising:

[0066] The preset jam emergency list in the allocation database of the industrial computer system 3 is obtained. Specifically, the jam emergency list records the remaining list usage rate of the second data cache channel 9 in real time. The remaining list usage rate = the standard number of the number of information data queues to be transmitted / the total number of information data queues.

[0067] According to the calling priority in the jam emergency list, the information data of the industrial computer system 3 is transferred to the information processing module 4 for storage by the second data cache channel 9.

[0068] Specifically, when it is detected that the current remaining storage space is lower than the preset standard threshold and the emergency storage priority list is still not stored, the corresponding industrial information verification interface of the remaining industrial computer system 3 is called to transfer and store the information to the information processing module 4 of the central server 1 through the information verification interface. At this time, since multiple industrial information verification interfaces read and write to the same information processing module 4, the queue emergency usage jam list of the second data cache channel 9 is called. Since the second data cache channel 9 needs to perform two tasks (verification information transmission and data information transmission), the current task calculation needs to be performed, that is, the queue emergency usage of the second data cache channel 9. The jam emergency list records the remaining list usage rate of the current information verification interface execution queue number in real time. The remaining list usage rate = the standard number of the number of information data queues to be transmitted / the total number of information data queues.

[0069] For example, the jam emergency list of the second data cache channel 9 is set to be 1000, but the current data information transmission execution queue number is 600, so the remaining queue number is 400, and then the remaining list usage rate of the current information check interface is calculated, that is, the remaining list usage rate = the number of data queues of information to be transmitted / the standard number of total information data queues (that is, the remaining list usage rate = 0.4), that is, the channel queue usage rates of different information check interfaces are arranged in order from low to high (in the above case, the remaining list usage rate is 0.4, and the remaining list usage rates of other industrial information check interfaces are assumed to be 0.2, 0.3, 0.8, and 0.9), and the priority is higher when the remaining usage rate is lower.

[0070] Specifically, in an embodiment, when the second data cache channel 9 transfers the information data of the industrial computer system 3 to the information processing module 4 for storage according to the call priority in the jam emergency list, the N information check interfaces with the highest priority can be called first to store and transfer the information data of the industrial computer system 3 according to the remaining usage rate (for example, N can be a fixed value or a dynamic value, and it is assumed that N is 2, so the information check interfaces with the remaining list usage rates of 0.2 and 0.3 are used to store and transfer the information data of all the industrial computer systems 3 connected in the local area network); and the information data of the information check interfaces with lower priority is temporarily suspended and transferred and stored by the information check interfaces with higher priority according to the remaining usage rate.

[0071] Specifically, in an embodiment, the security warning module 5 processes the parameter check information to obtain security warning information, including:

[0072] Comparing the parameter check information with the preset security database to obtain tampering warning data.

[0073] Generating security warning information based on the tampering warning data.

[0074] Specifically, by comparison, it can be more accurately found out whether there is data modification, and once it is found that the data is inconsistent, it is determined that the data may be tampered with and the tampering warning data is extracted, and then the security warning information is generated based on the tampering warning data. At the same time, according to the parameter check information that the tampering occurs, it can be determined that there is a security risk in the industrial computer system 3, and the system attributes and name of the industrial computer system 3 and the tampering warning data can be combined into the security warning information, so as to facilitate the security protection personnel to identify in time, and quickly and specifically maintain the industrial computer system 3.

[0075] Specifically, in an embodiment, the distribution warning module 6 generates warning push information according to the security warning information, including:

[0076] The warning distribution module compares security warning information with preset security levels to determine the priority of each security warning message.

[0077] The security warning information is sorted according to priority to obtain the warning push queue.

[0078] Specifically, when multiple security alerts occur simultaneously, the priority order for pushing them is determined based on the security level of each alert. Alerts are generated from the alert queue at preset time intervals, with priority given to alerts posing serious threats. Furthermore, alerts can be determined based on security levels after the discovery of significant vulnerabilities and risks in industrial control systems (ICS) security. Alerts indicating the potential for particularly serious or more severe ICS security incidents are promptly reported to administrators.

[0079] According to embodiments of the present invention, an electronic device is also provided, such as... Figure 3 As shown, the electronic device may include a processor 301 and a memory 303, wherein the processor 301 and the memory 303 may be connected via a bus or other means. Figure 3 Taking the example of a connection between China and Israel via a bus.

[0080] Processor 301 can be a central processing unit (CPU). Processor 301 can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or combinations of the above types of chips.

[0081] The memory 303, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs, non-transitory computer-executable programs, and modules, such as the program instructions / modules corresponding to the workflow of the central server in this embodiment of the invention. The processor 301 executes various functional applications and data processing of the processor by running the non-transitory software programs, instructions, and modules stored in the memory 303, thereby realizing the workflow of the central server in the above embodiment.

[0082] The memory 303 can include a program storage area and a data storage area, wherein the program storage area can store an operating system, at least one application required by a function, and the data storage area can store data created by the processor 301, etc. In addition, the memory 303 can include a high-speed random access memory, and can also include a non-transitory memory, such as at least one magnetic disk storage device, a flash memory device, or other non-transitory solid-state memory device. In some embodiments, the memory 303 can optionally include a memory disposed remotely with respect to the processor 301, which can be connected to the processor 301 through a network. Examples of the above network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0083] One or more modules are stored in the memory 303, which, when executed by the processor 301, perform the methods in the above method embodiments.

[0084] The above electronic device specific details can be understood in correspondence with the relevant description and effects in the above embodiments, which will not be described here.

[0085] Those skilled in the art can understand that all or part of the processes in the above embodiments can be completed by instructing relevant hardware through a computer program, and the program can be stored in a computer readable storage medium. When the program is executed, it can include the processes of the above embodiments. The storage medium can be a magnetic disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), a flash memory, a hard disk drive (HDD) or a solid-state drive (SSD), etc. The storage medium can also include a combination of the above types of memories.

[0086] Although the embodiments of the present application are described in conjunction with the accompanying drawings, various modifications and changes can be made by those skilled in the art without departing from the spirit and scope of the present application, and such modifications and changes fall within the scope defined by the appended claims.

Claims

1. An industrial control safety early warning information pushing system, characterized in that, The system comprises a central server, a terminal device and an industrial computer system; the central server comprises an information processing module, a security warning module and a distribution warning module; The information processing module obtains parameter verification information from the industrial computer system and sends the parameter verification information to the security warning module; The security warning module processes the parameter verification information to obtain security warning information and sends the security warning information to the distribution warning module; The distribution warning module generates warning push information according to the security warning information and pushes the warning push information to the terminal device and / or industrial computer system; The system further comprises a resource allocation service module and a second computing processing module, the resource allocation service module is used to construct a first data cache channel and a second data cache channel for each information verification interface of the industrial computer system; the first data cache channel is connected with a local memory, and the local memory stores information data of all interconnected industrial computer systems in the local area network; the second data cache channel is used to transmit parameter verification instructions and parameter verification information, and is also used to transfer and store information data of the industrial computer system; The second computing processing module is used to obtain a preset jam emergency list in the industrial computer system allocation database when the remaining storage space of the local memory is lower than a preset standard threshold and the storage is not completed; according to the calling priority in the jam emergency list, the second data cache channel is selected to transfer the information data of the industrial computer system to the information processing module for storage, wherein the preset jam emergency list in the industrial computer system allocation database is obtained; according to the calling priority in the jam emergency list, the second data cache channel is selected to transfer the information data of the industrial computer system to the information processing module for storage, and the lower the remaining list usage rate, the higher the calling priority. The information processing module obtains parameter information from the industrial computer system, comprising:

2. The industrial control safety early warning information pushing system according to claim 1, characterized in that, The information processing module sends a parameter verification instruction to the industrial computer system through an information verification interface; The industrial computer system generates parameter verification information according to the parameter verification instruction and sends the parameter verification information to the information processing module through the information verification interface. The system further comprises a first computing processing module; the first computing processing module is used to store and allocate information data in the industrial computer system by calculation.

3. The industrial control safety early warning information pushing system according to claim 2, characterized in that, The storage and allocation of information data in the industrial computer system by calculation, comprising:

4. The industrial control safety early warning information pushing system according to claim 3, characterized in that, Obtain a preset emergency storage priority list of the industrial computer system in the industrial computer system allocation database; Calculate the remaining storage space of the local memory; According to the remaining storage space and the storage priority in the emergency storage priority list, the information data in the industrial computer system is stored and allocated. The security warning module processes the parameter verification information to obtain security warning information, comprising:

5. The industrial control safety early warning information pushing system according to claim 1, characterized in that, Compare the parameter verification information with a preset security database to obtain tampering warning data; Generate security warning information based on the tampering warning data. ​ 6. The industrial control safety early warning information pushing system according to claim 1, characterized in that, The distribution warning module generates warning push information according to the safety warning information, including: The distribution warning module compares the safety warning information with a preset safety level to determine the priority of each safety warning information; According to the priority, the safety warning information is sorted to obtain a warning push queue; According to a preset time interval, the safety warning information in the warning push queue is generated into warning push information.

7. An electronic device, comprising: Comprising: A memory and a processor, which are communicatively connected, the memory stores computer instructions, and the processor executes the computer instructions to perform the workflow of the industrial control safety warning information push system center server in any one of claims 1-6.

Images