Industrial network security protection method, system, terminal and storage medium

Abstract

The present application relates to an industrial network security protection method, system, terminal and storage medium, and relates to the field of communication technology. The method comprises: obtaining message data sent by any subsystem in an industrial network system or a message sent by an external network; the message includes verification data and message data; after verifying the verification data in the message, calling the decryption method of the corresponding verification data to decrypt the message data to obtain the decrypted message data; compiling the decrypted message data with the protocol type of the target end of the message data, and encrypting it according to the encryption method of the target end to obtain the encrypted message; sending the encrypted message to the target end and obtaining a reception report fed back by the target end, and changing the encryption method pointing to the target end according to the reception report. The present application has the effect of improving the security of industrial network communication.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to an industrial network security protection method, system, terminal and storage medium. Background Art

[0002] In industrial automation control, it is necessary to use an industrial network to interconnect two or more control systems in order to transmit industrial control data such as images and voice.

[0003] Since industrial networks use dedicated industrial control protocols, there are many types of industrial control protocols. Usually different control systems run different industrial control protocols. This requires the deployment of protocol converters between different control systems to achieve data transmission between control systems with different industrial control protocols.

[0004] During the transmission process of industrial networks, network attacks are often encountered, resulting in abnormal communication between industrial networks, which ultimately affects the production efficiency of the industrial system. Summary of the invention

[0005] In order to solve the communication security problem in the process of industrial network communication, the present application provides an industrial network security protection method, system, terminal and storage medium.

[0006] In a first aspect of the present application, an industrial network security protection method is provided, which is applied to an industrial network system, comprising:

[0007] Obtaining a message sent by any subsystem in the industrial network system or a message sent by an external network device; the message includes verification data and message data;

[0008] After verifying the verification data in the message, calling the decryption method corresponding to the verification data to decrypt the message data to obtain the decrypted message data;

[0009] Compiling the decrypted message data according to the protocol type of the message data target end, and encrypting it according to the encryption method of the target end to obtain an encrypted message;

[0010] The encrypted message is sent to the target end and a reception report fed back by the target end is obtained, and according to the reception report, the encryption method directed to the target end is changed.

[0011] By adopting the above-mentioned technical approach, during the industrial network communication process, multiple control systems or external network devices within the industrial system will first encrypt and package the messages when communicating, and then hand them over to the industrial network system for decryption. After verification, the industrial network system will compile, encrypt and forward them, thereby improving the security of industrial network communication.

[0012] In a possible implementation, after verifying the verification data in the message, calling a decryption method corresponding to the verification data to decrypt the message data to obtain the decrypted message data includes:

[0013] Retrieving a pre-stored verification program to verify the verification data, and determining whether the verification key in the verification data matches the number of the target end in the industrial network system; the verification key corresponds to a number of a target end and a decryption method;

[0014] When the verification key matches the serial number of the target end, the corresponding decryption method is retrieved according to the verification key;

[0015] The message data is decrypted using the decryption method corresponding to the verification key.

[0016] In a possible implementation, the decrypted message data is compiled according to the protocol type of the message data target end, and encrypted according to the encryption method of the target end to obtain the encrypted message, including:

[0017] Get the protocol type of the message data sender and the protocol type of the message data target;

[0018] Converting the message data into message data of a corresponding target end protocol type according to the protocol type of the sending end of the message data;

[0019] After obtaining the encryption method of the target end of the message data, the message data after the protocol type conversion is encrypted to obtain the encrypted message.

[0020] In a possible implementation, the encrypted message is sent to the target end and a reception report fed back by the target end is obtained, and according to the reception report, the encryption method directed to the target end is changed, including:

[0021] Read the address of the target end of the message data, and send the encrypted message data to the address of the target end, so that the target end generates a receiving report after receiving the encrypted message data and sends it to the industrial network system;

[0022] After obtaining the reception report, the encryption method is sequentially changed once from the pre-stored encryption method library.

[0023] An industrial network security protection method, characterized in that it is applied to any subsystem in an industrial network system, comprising:

[0024] Obtaining an encrypted message forwarded by the industrial network system; the message includes verification data and message data;

[0025] According to the verification data, the decryption method corresponding to the verification data is retrieved to decrypt the message to obtain the decrypted message data;

[0026] Change the decryption method after sending a reception report to the industrial network system.

[0027] In a second aspect of the present application, an industrial network security protection system is provided, comprising:

[0028] An external network device, the external network device being communicatively connected to the industrial network system;

[0029] An industrial network system includes a plurality of subsystems, each of which is communicatively connected to the industrial network system.

[0030] In a possible implementation, the industrial network system includes:

[0031] A first acquisition module, used to acquire a message sent by any subsystem in the industrial network system or a message sent by an external network device; the message includes verification data and message data;

[0032] A first verification module, after verifying the verification data in the message, calls a decryption method corresponding to the verification data to decrypt the message data to obtain the decrypted message data;

[0033] A compiling module compiles the decrypted message data according to the protocol type of the message data target end;

[0034] A first encryption module performs encryption according to the encryption method of the target end to obtain an encrypted message;

[0035] The encrypted message is sent to the target end and a reception report fed back by the target end is obtained, and according to the reception report, the encryption method directed to the target end is changed.

[0036] In a possible implementation, the industrial network subsystem includes:

[0037] A second acquisition module is used to acquire a message forwarded and encrypted by the industrial network system; the message includes verification data and message data;

[0038] A second verification module is used to call a decryption method corresponding to the verification data to decrypt the message according to the verification data to obtain decrypted message data;

[0039] The second encryption module is used to encrypt the message data and change the decryption method after sending the reception report.

[0040] In a third aspect of the present application, a terminal is provided, which has the feature of secure communication.

[0041] The third application objective of this application is achieved through the following technical solutions:

[0042] A terminal includes a memory and a processor, wherein the memory stores a computer program that can be loaded by the processor and execute the above-mentioned industrial network security protection method.

[0043] In a fourth aspect of the present application, a computer storage medium is provided, which can store corresponding programs and has the characteristic of facilitating secure communication.

[0044] The fourth application objective of this application is achieved through the following technical solutions:

[0045] A computer-readable storage medium stores a computer program that can be loaded by a processor and execute any of the above industrial network security protection methods.

[0046] To summarize, the present application includes the following beneficial technical effects: during the industrial network communication process, when multiple control systems or external network devices within the industrial system communicate, the messages are first encrypted and packaged, and then handed over to the industrial network system for decryption. After verification, the industrial network system compiles, encrypts and forwards the messages, thereby improving the security of industrial network communication. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 It is a flowchart of an industrial network security protection method according to one embodiment of the present application.

[0048] Figure 2 It is a schematic diagram of an industrial network security protection system according to one embodiment of the present application.

[0049] Figure 3 It is a schematic diagram of an industrial network system according to one embodiment of the present application.

[0050] Figure 4 It is a schematic diagram of a subsystem of one embodiment of the present application.

[0051] Figure 5 It is a schematic diagram of the structure of a terminal according to an embodiment of the present application.

[0052] Explanation of the accompanying drawings: 201, external network device; 202, industrial network system; 2021, first acquisition module; 2022, first verification module; 2023, compilation module; 2024, first encryption module; 203, subsystem; 2031, second acquisition module; 2032, second verification module; 2033, second encryption module; 301, CPU; 302, ROM; 303, RAM; 304, bus; 305, I / O interface; 306, input part; 307, output part; 308, storage part; 309, communication part; 310, drive; 311, removable medium. DETAILED DESCRIPTION

[0053] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0054] In addition, the term "and / or" in this article is only a description of the association relationship between the associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0055] The following is combined with Figures 1 to 5 This application is described in further detail.

[0056] In order to improve the security of industrial network systems, the present application provides an industrial network security protection method.

[0057] Reference Figure 1 , an industrial network security protection method, comprising the following steps:

[0058] S101: Acquire a message sent by any subsystem in the industrial network system or a message sent by an external network device.

[0059] First, a message sent by a subsystem 203 or an external network device 201 is obtained. The message in the embodiment of the present application includes verification data and message data. The verification data is used to verify the security of the message, and the message data is used to carry the sender address, the target address and the specific information to be sent of the message.

[0060] When a subsystem 203 or an external network device 201 sends a message to another subsystem 203, it needs to be sent to the industrial network system 202 first, and then forwarded by the industrial network system 202 to the target subsystem 203. In order to ensure the security of the message during the forwarding process, the message needs to be security verified.

[0061] S102: Verify the verification data in the message, and retrieve the decryption method corresponding to the verification data to decrypt the message data.

[0062] First, the industrial network system 202 needs to determine the security of the message based on the verification data. The method for determining the security of the message based on the verification data is: the verification data includes a verification key, and the verification key corresponds to a target terminal number and a decryption method. First, call the pre-stored verification program to verify the verification data, and determine whether the verification key in the verification data matches the target terminal number in the industrial network system 202. When the verification key matches the target terminal number, call the corresponding decryption method based on the verification key. Then use the decryption method corresponding to the verification key to decrypt the message data to obtain the decrypted message data.

[0063] At this time, the message data is in the state before encryption at the sender, and the protocol type used is the protocol type of the sender. Before forwarding, the message data needs to be further compiled into the protocol type that conforms to the target end and encrypted again.

[0064] S103: compile the decrypted message data according to the protocol type of the target end of the message data, and encrypt it according to the encryption method of the target end.

[0065] After decrypting the message data, because the protocol types between the two devices are usually different, it is necessary to first determine whether the protocol type conversion is required, and then encrypt the message data for transmission.

[0066] Specifically, the industrial network system 202 obtains the protocol type of the message data sending end and the protocol type of the message data target end. According to the protocol type of the message data sending end, the message data is converted into message data of the corresponding target end protocol type. After obtaining the encryption method of the message data target end, the message data after the protocol type conversion is encrypted to obtain an encrypted message.

[0067] S104: Send the encrypted message to the target end and obtain a reception report fed back by the target end, and change the encryption method directed to the target end according to the reception report.

[0068] In order to improve security, in the embodiment of the present application, the encryption method will be changed after each communication.

[0069] The industrial network system 202 reads the address of the target end of the message data and sends the encrypted message data to the address of the target end, so that the target end generates a reception report after receiving the encrypted message data and sends it to the industrial network system 202. After the industrial network system 202 obtains the reception report, it sequentially changes the encryption method from the pre-stored encryption method library. The subsystem changes the decryption method after sending the reception report.

[0070] This application provides an industrial network security protection system, which adopts the following technical solutions:

[0071] Reference Figure 2 , Figure 3 and Figure 4 , an industrial network security protection system, comprising:

[0072] The external network device 201 is communicatively connected with the industrial network system 202 .

[0073] The industrial network system 202 includes a plurality of subsystems 203 , and each subsystem 203 is communicatively connected to the industrial network system 202 .

[0074] The industrial network system 202 is configured as follows:

[0075] The first acquisition module 2021 is used to acquire a message sent by any subsystem 203 in the industrial network system or a message sent by the external network device 201. The message includes verification data and message data.

[0076] The first verification module 2022 verifies the verification data in the message, and then retrieves the decryption method corresponding to the verification data to decrypt the message data to obtain the decrypted message data.

[0077] The compiling module 2023 compiles the decrypted message data according to the protocol type of the message data target end.

[0078] The first encryption module 2024 performs encryption according to the encryption method of the target end to obtain an encrypted message.

[0079] The encrypted message is sent to the target end and a reception report fed back by the target end is obtained, and the encryption method pointing to the target end is changed according to the reception report.

[0080] The industrial network subsystem 203 is configured as follows:

[0081] The second acquisition module 2031 is used to acquire the encrypted message forwarded by the industrial network system 202; the message includes verification data and message data.

[0082] The second verification module 2032 is used to retrieve the decryption method corresponding to the verification data to decrypt the message according to the verification data to obtain the decrypted message data.

[0083] The second encryption module 2033 is used to encrypt the message data and change the decryption method after sending the reception report.

[0084] Figure 5 A schematic diagram of the structure of a terminal suitable for implementing an embodiment of the present application is shown.

[0085] like Figure 5As shown, the terminal includes a central processing unit (CPU) 301, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM) 302 or the program loaded from the storage part to the random access memory (RAM) 303. In the RAM 303, various programs and data required for system operation are also stored. The CPU 301, the ROM 302 and the RAM 303 are connected to each other through a bus 304. An input / output (I / O) interface 305 is also connected to the bus 304.

[0086] The following components are connected to the I / O interface 305: an input section 306 including a keyboard, a mouse, etc.; an output section 307 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker; a storage section 308 including a hard disk, etc.; and a communication section 309 including a network interface card such as a LAN card, a modem, etc. The communication section 309 performs communication processing via a network such as the Internet. A drive 310 is also connected to the I / O interface 305 as needed. A removable medium 311, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 310 as needed so that a computer program read therefrom is installed into the storage section 308 as needed.

[0087] In particular, according to the embodiments of the present application, the above reference process Figure 1 The described process can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a machine-readable medium, and the computer program contains program code for executing the method shown in the flow chart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 309, and / or installed from the removable medium 311. When the computer program is executed by the central processing unit (CPU) 301, the above-mentioned functions defined in the system of the present application are executed.

[0088] It should be noted that the computer-readable medium shown in the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate, or transmit programs for use by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, register file (RF), etc., or any suitable combination of the above.

[0089] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the aforementioned module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0090] The units or modules involved in the embodiments of the present application may be implemented by software or hardware. The units or modules described may also be provided in a processor, for example, may be described as: a processor includes AAAA, BBBB, CCCC. The names of these units or modules do not, in some cases, constitute limitations on the units or modules themselves.

[0091] As another aspect, the present application further provides a computer-readable storage medium, which may be included in the terminal described in the above embodiment; or may exist independently and not be assembled into the terminal. The above computer-readable storage medium stores one or more programs, and when the above programs are used by one or more processors to execute the industrial network security protection method described in the present application.

[0092] The above description is only a preferred embodiment of the present application and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the present application is not limited to the technical solution formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the aforementioned disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in this application (but not limited to) by each other to form a technical solution.

Claims

1. An industrial network security protection method, applied to an industrial network system, characterized in that: include: Acquiring a message sent by any subsystem (203) in the industrial network system (202) or a message sent by an external network device (201); the message includes verification data and message data; After verifying the verification data in the message, the decryption method corresponding to the verification data is retrieved to decrypt the message data to obtain the decrypted message data; the industrial network system (202) needs to determine the security of the message based on the verification data; the method for determining the security of the message based on the verification data is as follows: the verification data includes a verification key, the verification key corresponds to a target terminal number and a decryption method, firstly a pre-stored verification program is retrieved to verify the verification data, and it is determined whether the verification key in the verification data matches the target terminal number in the industrial network system (202); when the verification key matches the target terminal number, the corresponding decryption method is retrieved based on the verification key, and then the message data is decrypted using the decryption method corresponding to the verification key to obtain the decrypted message data; Compiling the decrypted message data according to the protocol type of the message data target end, and encrypting it according to the encryption method of the target end to obtain an encrypted message; Sending the encrypted message to the target end and obtaining a reception report fed back by the target end, and changing the encryption method pointing to the target end according to the reception report, including: Reading the address of the target end of the message data, and sending the encrypted message data to the address of the target end, so that the target end generates a reception report after receiving the encrypted message data and sends it to the industrial network system (202); After obtaining the reception report, the encryption method is sequentially changed once from the pre-stored encryption method library.

2. The industrial network security protection method according to claim 1, characterized in that: After verifying the verification data in the message, the decryption method corresponding to the verification data is called to decrypt the message data to obtain the decrypted message data, including: Retrieving a pre-stored verification program to verify the verification data, and determining whether a verification key in the verification data matches a number of a target end in the industrial network system (202); the verification key corresponds to a number of a target end and a decryption method; When the verification key matches the serial number of the target end, the corresponding decryption method is retrieved according to the verification key; The message data is decrypted using the decryption method corresponding to the verification key.

3. The industrial network security protection method according to claim 2 is characterized in that: Compiling the decrypted message data according to the protocol type of the message data target end, and encrypting according to the encryption method of the target end to obtain an encrypted message, including: Get the protocol type of the message data sender and the protocol type of the message data target; Converting the message data into message data of a corresponding target end protocol type according to the protocol type of the sending end of the message data; After obtaining the encryption method of the target end of the message data, the message data after the protocol type conversion is encrypted to obtain the encrypted message.

4. An industrial network security protection method, characterized in that: Applicable to any subsystem in industrial network system, including: Acquire an encrypted message forwarded by the industrial network system (202); the message includes verification data and message data; According to the verification data, the decryption method corresponding to the verification data is retrieved to decrypt the message to obtain the decrypted message data; the industrial network system (202) needs to determine the security of the message according to the verification data; the method for determining the security of the message according to the verification data is as follows: the verification data includes a verification key, the verification key corresponds to a target terminal number and a decryption method, firstly a pre-stored verification program is retrieved to verify the verification data, and it is determined whether the verification key in the verification data matches the target terminal number in the industrial network system (202); when the verification key matches the target terminal number, the corresponding decryption method is retrieved according to the verification key, and then the message data is decrypted using the decryption method corresponding to the verification key to obtain the decrypted message data; After sending a reception report to the industrial network system (202), the decryption method is changed, including: Reading the address of the target end of the message data, and sending the encrypted message data to the address of the target end, so that the target end generates a reception report after receiving the encrypted message data and sends it to the industrial network system (202); After obtaining the reception report, the encryption method is sequentially changed once from the pre-stored encryption method library.

5. An industrial network security protection system, characterized in that: include: An external network device (201), the external network device (201) being communicatively connected to the industrial network system (202); An industrial network system (202), the industrial network system (202) comprising a plurality of subsystems (203), each of the subsystems (203) being communicatively connected to the industrial network system (202); The industrial network system further includes: A first acquisition module (221) is used to acquire a message sent by any subsystem (203) in the industrial network system (202) or a message sent by an external network device (201); the message includes verification data and message data; A first verification module (222), after verifying the verification data in the message, retrieves a decryption method corresponding to the verification data to decrypt the message data, thereby obtaining decrypted message data; A compiling module (223) compiles the decrypted message data according to the protocol type of the message data target end; The first encryption module (2024) encrypts according to the encryption method of the target end to obtain an encrypted message; sends the encrypted message to the target end and obtains a reception report fed back by the target end, and changes the encryption method directed to the target end according to the reception report; The industrial network subsystem includes: A second acquisition module (2031) is used to acquire a message forwarded and encrypted by the industrial network system; the message includes verification data and message data; A second verification module (2032) is used to retrieve a decryption method corresponding to the verification data according to the verification data to decrypt the message and obtain decrypted message data; The second encryption module (2033) is used to encrypt the message data and change the decryption method after sending the reception report.

6. A terminal comprising a memory and a processor, wherein a computer program is stored in the memory, characterized in that: When the processor executes the program, the method according to any one of claims 1 to 4 is implemented.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 4 is implemented.

Images