Mine information security protection system and method

Abstract

The present disclosure proposes a mine information security protection system and method, including: a network security subsystem, a host security subsystem, an application security subsystem, and a data security subsystem, wherein the network security subsystem is configured to perform partition protection on the coal mine network; the host security subsystem is deployed on the target server in the operation and management network and the server area, and is configured to protect the access rights of the target server; the application security subsystem is deployed on the target server, and is configured to protect the application program in the target server; the data security subsystem is deployed on the target server, and is configured to protect the data in the target server. The coal mine information system can be protected from multiple angles such as network security, host security, application security, and data security, so as to ensure the security of the coal mine information system.

Description

Technical Field

[0001] The present disclosure relates to the field of mining safety technology, and in particular to a mining information safety protection system and method. Background Art

[0002] In recent years, with the widespread application and deep integration of automatic control technology and information technology in the mining process, the mine production network has adopted more and more general hardware, software and protocols, and the frequency of network vulnerabilities being discovered and exposed has also increased significantly. Among them, the coal mine network consists of an operation and management network and an industrial control network, and the industrial control network is divided into two parts: aboveground and underground. In the past, there were no terminals with data transmission functions underground, but with the construction of a new generation of mobile communication systems such as 5G for mining, underground terminals in coal mines have separate access to underground private networks and surface public networks, which puts coal mines at risk of internal and external network attacks.

[0003] Specific technical issues include the following:

[0004] 1. With the construction of intelligent information infrastructure, underground terminals have the technical foundation to access the public network above ground and the private network underground. When the terminal interacts with the outside of the coal mine above ground, it can access the public network, which causes the underground network to be exposed to the Internet, increasing the possibility of attackers finding intrusion paths and posing security and attack risks; when interacting underground, the hidden dangers will be introduced into the private network underground, relying on the industrial network as a transmission channel, forming an attack risk to the private network;

[0005] 2. The underground industrial control network adopts standardized and open communication protocols, and there is a lack of effective isolation between systems. Once invaded, all systems in the entire industrial control network will be affected.

[0006] 3. The industrial hosts in the coal mine network lack the necessary security protection and interface control, making it difficult to prevent the operation of illegal programs. There is a risk of external unknown devices accessing the industrial hosts to launch attacks.

[0007] 4. During the sharing process, coal mine data is not desensitized, labeled, watermarked, etc., which cannot guarantee the security of data disclosure. At the same time, coal mine data lacks backup management, and timely recovery of data cannot be ensured. Summary of the invention

[0008] The present disclosure proposes a mining information security protection system and method, aiming to solve one of the technical problems in the related technology at least to a certain extent.

[0009] The first aspect of the present disclosure proposes an information security protection system for mining, including: a network security subsystem, a host security subsystem, an application security subsystem, and a data security subsystem, wherein the network security subsystem is configured to perform partition protection on the coal mine network; the host security subsystem is deployed on the target server in the operation and management network and the server area, and is configured to protect the access rights of the target server; the application security subsystem is deployed on the target server, and is configured to protect the application programs in the target server; the data security subsystem is deployed on the target server, and is configured to protect the data in the target server.

[0010] In some embodiments, the network security subsystem includes at least one of the following modules: a public network and coal mine network partition protection module, including a first protection device deployed at the coal mine network traffic outlet, configured to filter the interactive data between the coal mine network and the public network; a business management network and industrial control network partition protection module, including a network switch and a first transmission device connected in sequence, wherein the network switch is connected to the switch of the business management network and configured to ferry the interactive data transmitted between the business management network and the industrial control network; the first transmission device is connected to the switch of the industrial control network and configured to encrypt the interactive data transmitted by the business management network and decrypt the interactive data transmitted by the industrial control network; an industrial network and server partition protection module, including a second transmission device and a second protection device connected in sequence, wherein The second transmission device is connected to the switch of the industrial control network, the second protection device is connected to the switch of the server area, and the second transmission device is configured to decrypt the encrypted interactive data to be received by the server area, and to encrypt the interactive data sent by the server area; the second protection device is configured to filter the interactive data between the industrial control network and the server area; and the above-ground and underground partition protection modules include a third transmission device and a third protection device connected in sequence, wherein the third transmission device is connected to the underground optical fiber ring network, the third protection device is connected to the underground terminal, and the third transmission device is configured to decrypt the encrypted interactive data to be received by the underground terminal, and to encrypt the interactive data sent by the underground terminal; the third protection device is configured to filter the interactive data between the optical fiber ring network and the underground terminal.

[0011] In some embodiments, the third protection device is specifically used to: determine the target industrial protocol based on the data packet header sent by the downhole terminal; and protect the business flow of the downhole terminal based on the protection rules corresponding to the target industrial protocol.

[0012] In some embodiments, the business flow of the downhole terminal is protected based on the protection rules corresponding to the target industrial protocol, including at least one of the following: when the target industrial protocol is used for data acquisition, the first protection rule is used to protect the business flow of the downhole sensor equipment; or when the target industrial protocol is used for communication between field devices, the second protection rule is used to protect the business flow of the downhole automation equipment; or when the target industrial protocol is used for power system automation, the third protection rule is used to protect the business flow of the downhole power system equipment; or when the target industrial protocol is used for media stream transmission, the fourth protection rule is used to protect the business flow of the downhole media equipment.

[0013] In some embodiments, the first protection rule, the second protection rule, the third protection rule, and the fourth protection rule include at least one of the following: determining whether the downhole terminal is a feature device based on a preset whitelist; and / or performing abnormal behavior detection and alarm on the business flow of the downhole terminal; and / or configuring an upper limit on the number of connections from the same address to limit the number of concurrent connections of a single device.

[0014] In some embodiments, the above-ground and underground partition protection modules are specifically used for: the third transmission device is configured to decrypt the encrypted interactive data to be received by multiple underground terminals, and to encrypt the interactive data sent by multiple underground terminals; the third protection device is configured to filter the interactive data between the optical fiber ring network and multiple underground terminals.

[0015] In some embodiments, the host security subsystem is specifically used to: authorize devices that access the target server through a data interface; and / or set read and write permissions for external devices; and / or protect the core parameter configuration of the target server from tampering.

[0016] In some embodiments, the application security subsystem is specifically used to: control the execution of trusted programs in the target server based on a preset program whitelist; and control the update of signed trusted programs.

[0017] In some embodiments, the data security subsystem is specifically used to: uniformly configure and manage network security devices in the industrial control network; and / or perform desensitizing, labeling, and watermarking on shared data in the server area; and / or perform scheduled and incremental backup of stored data in the service area.

[0018] In some embodiments, the fourth protection rule further includes: in response to the target industrial protocol being a media stream transmission protocol, limiting the bandwidth of the downhole terminal media stream.

[0019] In some embodiments, the uphole and downhole partition protection modules are integrated into the switch of the downhole optical fiber ring network; or the uphole and downhole partition protection modules are independently deployed at the traffic outlets of different business networks downhole; and, the uphole and downhole partition protection modules are designed to adopt a third transmission device of the explosion-proof and intrinsically safe type or the intrinsically safe type, and are designed to adopt a third protection device of the explosion-proof and intrinsically safe type or the intrinsically safe type.

[0020] The second aspect of the present disclosure proposes a method for protecting information security for mining, which is applied to the above-mentioned information security protection system for mining. The system includes a network security subsystem, a host security subsystem, an application security subsystem, and a data security subsystem. The method includes: controlling the network security subsystem to perform partition protection on the coal mine network; controlling the host security subsystem to protect the access rights of the target server; controlling the application security subsystem to protect the application programs in the target server; and controlling the data security subsystem to protect the data in the target server.

[0021] In this embodiment, the mining information security protection system and method include a network security subsystem, a host security subsystem, an application security subsystem, and a data security subsystem. Among them, the network security subsystem is configured to perform partition protection on the coal mine network; the host security subsystem is deployed on the target server in the business management network and the server area, and is configured to protect the access rights of the target server; the application security subsystem is deployed on the target server and is configured to protect the application programs in the target server; the data security subsystem is deployed on the target server and is configured to protect the data in the target server. The coal mine information system can be protected from multiple angles such as network security, host security, application security, and data security to ensure the security of the coal mine information system.

[0022] Additional aspects and advantages of the present disclosure will be given in part in the following description and in part will be obvious from the following description or learned through practice of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] The above and / or additional aspects and advantages of the present disclosure will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0024] Figure 1 It is a schematic diagram of the equipment deployment architecture of the mining information security protection system provided according to an embodiment of the present disclosure;

[0025] Figure 2 It is a schematic diagram of the data interaction process between the coal mine network and the public network provided according to an embodiment of the present disclosure;

[0026] Figure 3 It is a schematic diagram of the data interaction process between the industrial control network and the business management network provided according to an embodiment of the present disclosure;

[0027] Figure 4 is a schematic diagram of a data interaction process between an industrial control network and a server area according to an embodiment of the present disclosure;

[0028] Figure 5 It is a schematic diagram of the data interaction process between the industrial control network and the downhole terminal according to the embodiment of the present disclosure;

[0029] Figure 6 It is a schematic diagram of the functional module of the third underground protection equipment provided according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0030] Embodiments of the present disclosure are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present disclosure, and are not to be construed as limitations of the present disclosure. On the contrary, the embodiments of the present disclosure include all changes, modifications, and equivalents that fall within the spirit and connotation of the appended claims.

[0031] In response to the technical problems in the background technology, an embodiment of the present disclosure provides a mining information security protection system, which includes, for example, a network security subsystem, a host security subsystem, an application security subsystem, a data security subsystem and any other possible subsystems, without limitation.

[0032] Figure 1 Schematic diagram of equipment deployment architecture of mining information security protection system provided according to an embodiment of the present disclosure. Figure 1 As shown, the mining information system of this embodiment is composed of a coal mine network (private network), and the coal mine network is connected to the public network; wherein, the coal mine network is divided into an above-ground network and an underground network, wherein the above-ground network includes an industrial control network composed of multiple core switches, a business management network (including telephones, office computers, ERP servers, OA servers, etc.) that interacts with the industrial control network for data, and an industrial server area (including coal mine safety monitoring servers, personnel positioning servers, video servers, etc.); the underground network includes an optical fiber ring network, underground terminals (for example, PLC, CPE, intrinsically safe mobile phones, etc.) business network, etc., without limitation. The network security subsystem, host security subsystem, application security subsystem, and data security subsystem of the disclosed embodiment are configured in the above-mentioned mining information system.

[0033] Specifically, the network security subsystem configuration implemented in this embodiment is used to perform partition protection on the coal mine network, for example, including public network and coal mine network partition protection modules, business management network and industrial control network partition protection modules, industrial network and server partition protection modules, and aboveground and underground partition protection modules.

[0034] Some embodiments, Figure 2 Schematic diagram of data interaction process between coal mine network and public network provided according to the embodiment of the present disclosure, such as Figure 1 and Figure 2 As shown, the public network and coal mine network partition protection module includes a network security protection device, which is called the first protection device. The first protection device is deployed at the coal mine network traffic outlet, specifically between the public network and the core switch of the operation and management network (hereinafter referred to as the switch), and is configured to filter and process the interactive data between the coal mine network and the public network. That is to say, when the terminal / server in the coal mine network accesses the public network data, the interactive data will be filtered by the first protection device and flow into the coal mine network. On the contrary, when the coal mine network uploads data to the public network, the uploaded interactive data will be filtered by the first protection device and flow into the public network, thereby ensuring the boundary protection between the two networks. Among them, the first protection device of this embodiment is configured with a data packet detection function, which can detect the format, integrity, size and other information of the TCP / IP protocol data packet, and filter and process abnormal data packets.

[0035] In some other embodiments, Figure 3 is a schematic diagram of the data interaction process between the industrial control network and the business management network provided according to an embodiment of the present disclosure, such as Figure 3As shown, the partition protection module design of the business management network and the industrial control network adopts network security transmission equipment and industrial network gate to carry the function of partition protection of the business management network and the industrial control network. Specifically, the network security transmission equipment of this embodiment is called the first transmission equipment, which is connected to the network gate and deployed between the traffic nodes of the business management network and the industrial control network. More specifically, the network gate is connected to the switch of the business management network, and the first transmission equipment is connected to the switch of the industrial control network. Among them, the network gate is configured to ferry the interactive data transmitted between the business management network and the industrial control network, and the first transmission equipment is configured to encrypt the interactive data transmitted by the business management network, and decrypt the interactive data transmitted by the industrial control network. That is to say, when the business management network provides data services to the industrial control network (industrial network terminal / server), the provided interactive data will complete the information ferrying through the network gate, and then flow into the industrial control network after being encrypted by the network security transmission equipment (first transmission equipment), so as to ensure the physical isolation and network transmission security between the industrial control and non-industrial control networks, and vice versa. Among them, the network security transmission device of this embodiment adopts hardware encryption, which is independent of the operating system and application software, has better security than the commonly used software encryption, and has little impact on the transmission network throughput and delay.

[0036] In some other embodiments, Figure 4 is a schematic diagram of the data interaction process between the industrial control network and the server area according to an embodiment of the present disclosure, such as Figure 4 and Figure 1 As shown, the industrial network and server partition protection module design of this embodiment adopts network security transmission equipment and network security protection equipment to carry the function of industrial network server partition protection. Specifically, the network security transmission equipment is called the second transmission equipment, and the network security protection equipment is called the second protection equipment. The second transmission equipment and the second protection equipment are deployed at the flow exit of the server area. More specifically, the second transmission equipment is connected to the switch of the industrial control network, and the second protection equipment is connected to the switch of the server area. The second transmission equipment is configured to decrypt the encrypted interactive data transmitted from the industrial control network to the server area, and encrypt the interactive data sent from the server area. That is to say, when the server receives the data, the data will be decrypted by the network security transmission equipment, and then filtered by the network security protection equipment, and uploaded to the server, so as to realize the boundary protection and network transmission security between the server and the transmission network, and vice versa. The function of the second transmission equipment is similar to that of the first transmission equipment mentioned above, and the second protection equipment is configured with a data packet detection function, which can detect the data packets interacting between the server and the industrial control network, and filter the abnormal data packets.

[0037] In some other embodiments, Figure 5 is a schematic diagram of the data interaction process between the industrial control network and the underground terminal according to an embodiment of the present disclosure, such as Figure 5 and Figure 1 As shown, the design of the above-ground and underground partition protection modules uses network security transmission equipment and network security protection equipment to carry the function of partition protection of the underground optical fiber ring network and the underground terminal. Among them, the network security transmission equipment is called the third transmission equipment, and the network security protection equipment is called the third protection equipment. The third transmission equipment and the third protection equipment are deployed at the flow outlet of the underground terminal business network. More specifically, the third transmission equipment is connected to the underground optical fiber ring network of the industrial control network, and the third protection equipment is connected to the underground terminal. Among them, the third transmission equipment is configured to decrypt the encrypted interactive data transmitted from the optical fiber ring network to the underground terminal, and the third transmission equipment can also encrypt the interactive data sent by the underground terminal; and the third protection equipment is configured to filter the interactive data between the optical fiber ring network and the underground terminal, so as to achieve boundary protection and network transmission security between different underground networks.

[0038] In actual applications, since the air underground in coal mines contains explosive substances such as gas and coal dust, underground equipment needs to be explosion-proofed. In view of this, the above-ground and underground partition protection modules in this embodiment are designed to adopt a third transmission equipment that is explosion-proof and intrinsically safe or intrinsically safe, and are designed to adopt a third protection equipment that is explosion-proof and intrinsically safe or intrinsically safe.

[0039] For coal mines with network security requirements in new projects, network security protection equipment (third protection equipment) and network security transmission equipment (third transmission equipment) can be integrated into the ring network switch to form an underground optical fiber ring network. As an underground integrated network security device, the terminal industrial control network under the ring network can be isolated and protected at the boundary. Figure 6 Schematic diagram of the functional module of the underground third protection equipment provided according to the embodiment of the present disclosure, such as Figure 6 As shown, the integrated third protection device and the third transmission device can be connected to multiple downhole terminals. In this case, the third transmission device is configured to decrypt the encrypted interactive data to be received by the multiple downhole terminals, and to encrypt the interactive data sent by the multiple downhole terminals; and the third protection device is configured to filter the interactive data between the optical fiber ring network and the multiple downhole terminals.

[0040] For coal mines that have already built industrial ring networks and need to upgrade and add network security functions, independent network security protection equipment (third protection equipment) can be designed and deployed at the traffic exits of different terminal business networks underground to perform boundary isolation and protection on the business flows of the underground industrial control networks.

[0041] In actual applications, different underground terminals use different industrial protocols. For example, sensor devices (temperature sensors, pressure sensors, etc.) need to collect data, usually using the Modbus protocol; automation equipment (such as conveyor belts, hoists, etc.) need to control signal transmission, usually using the Profibus protocol for communication between field devices; and for power system equipment (such as protection relays), the IEC 61850 protocol is usually used for data transmission; media devices (such as cameras) need to upload video streams in real time, usually using the RTSP protocol to control audio or video playback in real-time systems. In view of this, the third protection device of the embodiment of the present invention can determine the industrial protocol adopted by the downhole terminal based on the data packet header sent by the downhole terminal during the process of filtering and processing the interactive data between the optical fiber ring network and the downhole terminal. The industrial protocol is called the target industrial protocol. The target industrial protocol is, for example, any one of the above-mentioned Modbus protocol, Profibus protocol, IEC 61850 protocol, and RTSP protocol. For example, if the downhole terminal is a temperature sensor, the third protection device can determine that the adopted target industrial protocol is the Modbus protocol; for another example, if the downhole terminal is a camera, the third protection device can determine that the adopted target industrial protocol is the RTSP protocol, and there is no limitation on this.

[0042] Furthermore, based on the protection rules corresponding to the target industrial protocol, the business flow of the downhole terminal is protected, that is, different industrial protocols correspond to different protection rules.

[0043] For example, when the downhole terminal is a sensor device, its corresponding target industrial protocol is the Modbus protocol used for data acquisition. The protection rules corresponding to the Modbus protocol are called the first protection rules. This embodiment can use the first protection rules to protect the business flow of the downhole sensor device. Specifically, the first protection rule detects information such as the Modbus message format, verification function code, register value, and connection status to determine data packets with format errors, verification code errors, etc. as abnormal data packets; and the first protection rule can also determine whether the downhole terminal is a specific device based on a preset whitelist, thereby limiting the communication between the downhole terminal and the server, etc. For example, for the Modbus protocol, only specific devices (such as PLC, RTU) are allowed to use the Modbus protocol to communicate with the control server; and the first protection rule can also detect and alarm abnormal behaviors of the business flow of the sensor device, for example, self-learning of the Modbus flow industrial control behavior and protocol rules, and automatically issuing an alarm if frequent read and write requests, device behavior that does not conform to the normal working mode, etc. are found; and the first protection rule can also configure DOS attack prevention, configure an upper limit on the number of connections from the same address for the downhole terminal (sensor device), and limit the number of concurrent connections of a single device.

[0044] For another example, when the downhole terminal is downhole automation equipment (such as conveyor belts, hoists, etc.), its corresponding target industrial protocol is the Profibus protocol used for communication between field devices. The protection rule corresponding to the Profibus protocol is called the second protection rule. In this embodiment, the second protection rule can be used to protect the business flow of downhole automation equipment. Specifically, the second protection rule can, for example, check the Profibus message, verify the format and integrity of the message, and use the format error or incomplete data packet as an abnormal data packet; and the second protection rule can also determine whether the downhole terminal is a characteristic device based on a preset white list. For the Profibus protocol, it restricts specific devices (such as conveyor belt actuators) from using the Profibus protocol; and the second protection rule can also detect and alarm abnormal behavior of the downhole terminal's business flow, for example, self-learn the Profibus flow industrial control behavior and protocol rules, and detect and alarm abnormal behavior; and the second protection rule can also configure DOS attack prevention, configure the upper limit of the number of connections from the same address for automation equipment, and limit the number of concurrent connections of a single device.

[0045] For another example, when the downhole terminal is an underground power system device (such as a relay), its corresponding target industrial protocol is the IEC 61850 protocol for power system automation, and the protection rule corresponding to the IEC 61850 protocol is called the third protection rule. In this embodiment, the third protection rule can be used to protect the business flow of the underground power system equipment. Specifically, the third protection rule can, for example, check the messages of IEC 61850 such as GOOSE and SV to prevent the spread of malicious or erroneous messages, so as to determine malicious or erroneous data packets as abnormal data packets; and, based on the preset white list, determine whether the downhole terminal is a characteristic device, and only allow specific devices (such as protection relays) to use the IEC 61850 protocol; and, it is also possible to detect and alarm abnormal behavior of the business flow of the downhole terminal, for example, self-learn the industrial control behavior and protocol rules of the IEC 61850 flow, and detect and alarm abnormal behavior; and, it is also possible to configure DOS attack prevention, configure the upper limit of the number of connections from the same address for the downhole terminal (power system equipment), and limit the number of concurrent connections of a single device.

[0046] For another example, when the downhole terminal is an downhole media device (such as a camera), its corresponding target industrial protocol is the RTSP protocol used for media stream transmission. The protection rule corresponding to the RTSP protocol is called the fourth protection rule. This embodiment can use the fourth protection rule to protect the business flow of the downhole media device. Specifically, the fourth protection rule can, for example, parse and check RTSP messages, verify the format and integrity of RTSP requests and responses, and treat data packets with abnormal or incomplete request and response formats as abnormal data packets; and determine whether the downhole terminal is a feature device based on a preset whitelist. For the RTSP protocol, only specific devices (such as surveillance cameras and monitoring centers) are allowed to use the RTSP protocol. Other devices, such as ordinary workstations, are not allowed to send or receive RTSP streams; and, it can also perform abnormal behavior detection and alarm on the business flow of the downhole terminal, for example, self-learning of RTSP stream industrial control behavior and protocol rules. If abnormal RTSP behavior is detected, such as frequent playback requests, or playback speeds beyond the normal range, an alarm is immediately issued; and, it can also configure DOS attack prevention, configure an upper limit on the number of connections from the same address for the downhole terminal, and limit the number of concurrent connections for a single device.

[0047] In some embodiments, when the target industrial protocol is a protocol for video stream transmission (i.e., RTSP), the third protection device of this embodiment can also perform bandwidth management to limit the bandwidth of the terminal transmitting the video stream to prevent it from occupying too many network resources and affecting other important businesses.

[0048] In addition, if Figure 6 As shown, the third protection device of this embodiment can also be configured with address mapping, industrial template management, security policies (i.e., the above-mentioned packet filtering), encrypted channel management, report generation and other functions, among which address mapping refers to routing, which allows devices in a specified network segment to communicate with each other; industrial template management refers to configuring specific protection strategies for various industrial protocols and saving them as templates for easy calling, and also includes self-learning of industrial control protocol operating behaviors and rules, which can establish a security detection model and automatically identify abnormal behaviors; encrypted channel management refers to a VPN virtual private network, which can create an encrypted tunnel, remotely access a server, and access the internal network through a server proxy.

[0049] Some embodiments, such as Figure 1As shown, the host security subsystem of this embodiment carries the functions of the host security subsystem by deploying host guard software on the target server in the business management network and the server area. Among them, the host security subsystem can implement strict control over the data interface (for example, USB interface) of the target server to prevent unauthorized device access and reduce the risk of virus transmission; and implement read and write permission control on external devices to prevent peripheral abuse and data leakage; and protect the core parameter configuration of the target server to prevent illegal operation or malicious software from tampering with it, which helps to ensure the normal operation of the industrial host and maintain the stability and security of the production process.

[0050] In some embodiments, the application security subsystem of this embodiment is designed to use an application security management program to carry the functions of the application security subsystem, integrate the application security management program on the host guard software, and install it on the target server of the coal mine network. When the application security management program is running, the application data will be uploaded to the server and configured uniformly by the administrator to achieve centralized management of the security of each application. Among them, the application security subsystem can use application whitelist technology to ensure that only trusted programs in the whitelist are allowed to execute on the target server, which better adapts to the single operation of industrial applications and isolates illegal programs such as Trojans and viruses; and, through the signature mechanism, it can ensure that the signed trusted programs can be updated normally to prevent the update patches from being illegally tampered with; and perform comprehensive security management of the application, including setting management, patch management, vulnerability management and version management, which helps to timely discover and repair security vulnerabilities and ensure the safe and stable operation of the application.

[0051] Some embodiments, such as Figure 1 As shown, the data security subsystem of this embodiment carries the functions of the data security subsystem by deploying servers such as data asset management, data desensitization, and data backup in the server area. The data security subsystem can uniformly configure and manage network security equipment and software in the industrial control network and provide database support for them; and perform desensitization, labeling, watermarking and other processing in the process of data sharing to ensure the security of data disclosure; and perform data backup management, adopt strategies such as scheduled backup and incremental backup to ensure that data can be restored in time.

[0052] The present disclosure also provides a method for protecting mining information security, which is applied to the mining information security protection system of the above embodiment. The method includes:

[0053] Control the network security subsystem to partition and protect the coal mine network;

[0054] Control the host security subsystem to protect the access rights of the target server;

[0055] Control the application security subsystem to protect the applications in the target server;

[0056] Control the data security subsystem to protect the data in the target server.

[0057] In this embodiment, the mining information security protection system and method include a network security subsystem, a host security subsystem, an application security subsystem, and a data security subsystem. Among them, the network security subsystem is configured to perform partition protection on the coal mine network; the host security subsystem is deployed on the target server in the business management network and the server area, and is configured to protect the access rights of the target server; the application security subsystem is deployed on the target server and is configured to protect the application programs in the target server; the data security subsystem is deployed on the target server and is configured to protect the data in the target server. The coal mine information system can be protected from multiple angles such as network security, host security, application security, and data security to ensure the security of the coal mine information system.

[0058] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. The present disclosure is intended to cover any variations, uses or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The description and examples are to be considered exemplary only, and the true scope and spirit of the present disclosure are indicated by the following claims.

[0059] It should be understood that the present disclosure is not limited to the exact structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

[0060] It should be noted that, in the description of the present disclosure, the terms "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or implying relative importance. In addition, in the description of the present disclosure, unless otherwise specified, the meaning of "plurality" is two or more.

[0061] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, segment or portion of code that includes one or more executable instructions for implementing the steps of a specific logical function or process, and the scope of the preferred embodiments of the present disclosure includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in the reverse order depending on the functions involved, which should be understood by those skilled in the art to which the embodiments of the present disclosure belong.

[0062] It should be understood that the various parts of the present disclosure can be implemented in hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, multiple steps or methods can be implemented in software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0063] A person skilled in the art may understand that all or part of the steps in the method for implementing the above-mentioned embodiment may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, which, when executed, includes one or a combination of the steps of the method embodiment.

[0064] In addition, each functional unit in each embodiment of the present disclosure may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium.

[0065] The storage medium mentioned above can be a read-only memory, a magnetic disk or an optical disk, etc.

[0066] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present disclosure. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0067] Although the embodiments of the present disclosure have been shown and described above, it is to be understood that the above embodiments are exemplary and are not to be construed as limitations of the present disclosure. A person skilled in the art may change, modify, replace and vary the above embodiments within the scope of the present disclosure.

Claims

1. A mining information security protection system, characterized in that: The mining information system is composed of a coal mine network, which is connected to the public network. The coal mine network is divided into an above-ground network and an underground network. The above-ground network includes an industrial control network composed of multiple core switches, a business management network that interacts with the industrial control network, and a server area. The underground network includes an optical fiber ring network and an underground terminal business network. It includes: a network security subsystem, a host security subsystem, an application security subsystem, and a data security subsystem. The network security subsystem is configured to perform partition protection on the coal mine network; The host security subsystem is deployed on the target server in the business management network and the server area, and is configured to protect the access rights of the target server; The application security subsystem is deployed on the target server and is configured to protect the application program in the target server; The data security subsystem is deployed on the target server and is configured to protect the data in the target server; The network security subsystem includes at least one of the following modules: A public network and coal mine network partition protection module, including a first protection device deployed at the coal mine network traffic outlet, configured to filter and process the interactive data between the coal mine network and the public network; The business management network and the industrial control network partition protection module comprises a network gate and a first transmission device connected in sequence, wherein the network gate is connected to the switch of the business management network and is configured to ferry the interactive data transmitted between the business management network and the industrial control network; the first transmission device is connected to the switch of the industrial control network and is configured to encrypt the interactive data transmitted by the business management network and decrypt the interactive data transmitted by the industrial control network; The industrial network and server partition protection module comprises a second transmission device and a second protection device connected in sequence, wherein the second transmission device is connected to the switch of the industrial control network, the second protection device is connected to the switch of the server area, and the second transmission device is configured to decrypt the encrypted interactive data to be received by the server area and encrypt the interactive data sent by the server area; the second protection device is configured to filter the interactive data between the industrial control network and the server area; and The above-ground and underground partition protection modules include a third transmission device and a third protection device connected in sequence, wherein the third transmission device is connected to the underground optical fiber ring network, the third protection device is connected to the underground terminal, and the third transmission device is configured to decrypt the encrypted interactive data to be received by the underground terminal and encrypt the interactive data sent by the underground terminal; the third protection device is configured to filter the interactive data between the optical fiber ring network and the underground terminal; Wherein, the above-ground and underground partition protection modules are integrated into the switch of the underground optical fiber ring network; The above-ground and underground partition protection modules are independently deployed at the flow exits of different service networks underground; Furthermore, the above-ground and underground zoning protection modules are designed to adopt a third transmission device of both explosion-proof and intrinsically safe type or intrinsically safe type, and are designed to adopt a third protection device of both explosion-proof and intrinsically safe type or intrinsically safe type.

2. The system according to claim 1, characterized in that The third protective device is specifically used for: Determining a target industrial protocol based on a data packet header sent by the downhole terminal; and Based on the protection rules corresponding to the target industrial protocol, the business flow of the downhole terminal is protected.

3. The system according to claim 2, characterized in that The protecting the service flow of the downhole terminal based on the protection rule corresponding to the target industrial protocol includes at least one of the following: In the case where the target industrial protocol is used for data collection, the first protection rule is used to protect the service flow of the downhole sensor device; or In the case where the target industrial protocol is used for communication between field devices, the second protection rule is used to protect the business flow of the underground automation equipment; or In the case where the target industrial protocol is used for power system automation, the third protection rule is used to protect the business flow of the underground power system equipment; or In the case where the target industrial protocol is used for media stream transmission, the fourth protection rule is used to protect the business stream of the underground media device.

4. The system according to claim 3, characterized in that The first protection rule, the second protection rule, the third protection rule, and the fourth protection rule include at least one of the following: Determining whether the downhole terminal is a feature device based on a preset white list; and / or Detect and warn of abnormal behavior of business flows at underground terminals; and / or Configure the upper limit of the number of connections from the same address to limit the number of concurrent connections from a single device.

5. The system according to claim 1, wherein: The above-hole and underground partition protection modules are specifically used for: The third transmission device is configured to decrypt the encrypted interactive data to be received by the multiple downhole terminals, and to encrypt the interactive data sent by the multiple downhole terminals; The third protection device is configured to filter the interactive data between the optical fiber ring network and multiple downhole terminals.

6. The system according to claim 1, wherein: The host security subsystem is specifically used for: Authorizing a device that accesses the target server through a data interface; and / or Set read and write permissions for external devices; and / or The core parameter configuration of the target server is protected from tampering.

7. The system according to claim 1, characterized in that The application security subsystem is specifically used for: Based on a preset program whitelist, controlling the trusted programs in the target server to be allowed to execute; Controls which signed trusted programs are allowed to update.

8. The system of claim 1, wherein: The data security subsystem is specifically used for: Centrally configure and manage network security devices in industrial control networks; and / or Desensitize, annotate, and watermark the shared data in the server area; and / or Perform scheduled and incremental backup of data stored in the service area.

9. The system according to claim 3, characterized in that The fourth protection rule also includes: In response to the target industrial protocol being a protocol for media stream transmission, the bandwidth of the media stream of the downhole terminal is limited.

10. A mine information security protection method, characterized in that: The mining information security protection system applied to any one of 1-9 above includes a network security subsystem, a host security subsystem, an application security subsystem, and a data security subsystem. The method includes: Control the network security subsystem to perform partition protection on the coal mine network; Controlling the host security subsystem to protect access rights to the target server; Controlling the application security subsystem to protect the application program in the target server; Control the data security subsystem to protect the data in the target server.

Images