A security management system for the entire life cycle of industrial control data

Abstract

The present application provides a full life cycle security management and control system for industrial control data, which relates to the field of industrial control data security technology. The industrial control data is collected through a data acquisition module; the synchronization log record is extracted through a data synchronization and backup module, the synchronization urgency when performing synchronization backup is determined through the synchronization log record, and the industrial control data is synchronized and backed up according to the synchronization urgency; the transmission response of the industrial control data during encrypted transmission is extracted through a data encryption transmission module, the encryption response feature vector is determined through the transmission response, the industrial control pseudo-coding matrix is ​​determined according to the encryption response feature vector, and the industrial control data is encrypted using the industrial control pseudo-coding matrix; the received encrypted industrial control data is security verified through a data security verification module; the encrypted industrial control data that has passed the security verification is stored through a data storage module. The present application can balance the real-time responsiveness and data security of the industrial control data in the full life cycle to improve the robustness of the security management and control system.

Description

Technical Field

[0001] The present application relates to the field of industrial control data security technology, and more specifically, to a full life cycle security management and control system for industrial control data. Background Art

[0002] Industrial control data usually refers to the data generated in industrial control systems. Industrial control systems are used to monitor and control industrial equipment or production processes, and are commonly found in key infrastructure fields such as energy, manufacturing, and transportation.

[0003] The full life cycle security control of industrial control data refers to the comprehensive security protection of the entire process from data generation to destruction in industrial control systems. The full life cycle of industrial control data usually involves five stages: data collection, backup, transmission, verification and storage. Different security measures need to be taken at each stage to ensure the confidentiality, integrity and availability of industrial control data. Among them, in the data backup stage, it is necessary to back up the industrial control data with higher priority and urgency in a timely manner to avoid security risks such as industrial control data loss. In the data transmission stage, it is necessary to prevent data leakage and tampering during transmission through means such as encrypted transmission, network segmentation and access control. However, the conflict between real-time requirements and security in the existing technology is also a common problem. The security control system usually needs to process and respond to industrial control data in real time to ensure the continuity and security of production. However, security measures such as encryption, identity authentication and logging operations often increase the delay of the security control system and affect its real-time performance. In some cases, enterprises may have to compromise between security and real-time performance, thereby reducing the overall security of the system. Therefore, how to balance the real-time responsiveness and data security in the full life cycle of industrial control data to improve the robustness of the security control system is a difficult problem faced by the industry. Summary of the invention

[0004] The present application provides a full life cycle security management and control system for industrial control data, which can balance the real-time responsiveness and data security of industrial control data throughout its life cycle to improve the robustness of the security management and control system.

[0005] In a first aspect, the present application provides a full life cycle security management and control system for industrial control data, the management and control system comprising:

[0006] Data acquisition module, used to collect industrial control data in industrial control systems;

[0007] A data synchronization and backup module, used to extract synchronization log records of the industrial control data in the industrial control system database, determine the synchronization urgency of the industrial control data when performing synchronization and backup through the synchronization log records, and perform synchronization and backup of the industrial control data according to the synchronization urgency;

[0008] A data encryption transmission module, used to extract the transmission response of the industrial control data during encrypted transmission, determine the encryption response feature vector of the industrial control data during the encrypted transmission process through the transmission response, determine the industrial control pseudo-coding matrix corresponding to the industrial control data according to the encryption response feature vector, and use the industrial control pseudo-coding matrix to encrypt the industrial control data during the encrypted transmission process;

[0009] A data security verification module is used to perform security verification on the received encrypted industrial control data;

[0010] The data storage module is used to store encrypted industrial control data that has passed security verification.

[0011] In this embodiment, the industrial control data in the industrial control system is collected through a programmable logic controller.

[0012] In this embodiment, extracting the synchronization log record of the industrial control data in the industrial control system database specifically includes:

[0013] For each industrial control data node in the industrial control data, obtaining the synchronization log information corresponding to the industrial control data node in the industrial control system database, and then obtaining the synchronization log information corresponding to each industrial control data node in the industrial control system database;

[0014] The collection of all synchronization log information is used as a synchronization log record of the industrial control data in the industrial control system database.

[0015] In this embodiment, determining the synchronization urgency of the industrial control data during synchronization backup through the synchronization log record specifically includes:

[0016] Obtaining an operation type identifier for each synchronization log information in the synchronization log record;

[0017] Extracting all synchronization operation records in the synchronization log record based on all operation type identifiers;

[0018] Determine the data synchronization delay of the corresponding synchronization operation record according to the synchronization request time of each synchronization operation record;

[0019] Determining the synchronization delay of the industrial control data according to all data delays;

[0020] Obtaining a read record of each industrial control data node in the industrial control data;

[0021] Determining the synchronization conflict coefficient of the industrial control data through the reading records of each industrial control data node;

[0022] The synchronization delay and the synchronization conflict coefficient are used to determine the synchronization urgency of the industrial control data when performing synchronous backup.

[0023] In this embodiment, synchronously backing up the industrial control data according to the synchronization urgency means that when the synchronization urgency is greater than or equal to a set threshold, each industrial control data node in the industrial control data is synchronously backed up.

[0024] In this embodiment, extracting the transmission response of the industrial control data during encrypted transmission refers to performing spectrum analysis on the transmission signal of the industrial control data during encrypted transmission, thereby obtaining the transmission response of the industrial control data during encrypted transmission.

[0025] In this embodiment, determining the encryption response feature vector of the industrial control data during the encrypted transmission process through the transmission response specifically includes:

[0026] Determining the response attenuation of the transmission response at different time points;

[0027] Determine the response attenuation characteristics through the response attenuation at each time point;

[0028] determining transmission response peaks of the transmission response in different frequency ranges;

[0029] The encryption response feature vector of the industrial control data during the encryption transmission process is determined according to the response attenuation characteristics and the transmission response peaks in different frequency ranges.

[0030] In this embodiment, encrypting the industrial control data using the industrial control pseudo-coding matrix during the encrypted transmission process specifically includes:

[0031] During the data encryption process, the industrial control data is converted into an industrial control coding matrix;

[0032] An XOR operation is performed on the industrial control coding matrix and the industrial control pseudo coding matrix to obtain encrypted industrial control data, thereby completing the encryption of the industrial control data.

[0033] In this embodiment, the security verification of the received encrypted industrial control data specifically includes:

[0034] Decrypting the received encrypted industrial control data to obtain the decrypted industrial control data;

[0035] Verify the identity and log records of the industrial control data to complete security verification.

[0036] In this embodiment, storing the encrypted industrial control data that has passed security verification refers to storing the encrypted industrial control data that has passed security verification in partitions.

[0037] The technical solution provided by the embodiments disclosed in this application has the following beneficial effects:

[0038] The industrial control data in the industrial control system is collected through the data collection module; the synchronization log records of the industrial control data in the industrial control system database are extracted through the data synchronization and backup module, the synchronization urgency of the industrial control data during synchronization and backup is determined through the synchronization log records, and the industrial control data is synchronized and backed up according to the synchronization urgency; the transmission response of the industrial control data during encrypted transmission is extracted through the data encryption and transmission module, the encryption response feature vector of the industrial control data during encrypted transmission is determined through the transmission response, the industrial control pseudo-coding matrix corresponding to the industrial control data is determined according to the encryption response feature vector, and the industrial control pseudo-coding matrix is ​​used to encrypt the industrial control data during encrypted transmission; the received encrypted industrial control data is security verified through the data security verification module; the encrypted industrial control data that has passed the security verification is stored through the data storage module.

[0039] It can be seen that in the present application, the real-time responsiveness and data security of the industrial control data throughout its life cycle can be balanced; wherein, by real-time monitoring and analysis of synchronization log records, the synchronization urgency of the industrial control data can be accurately evaluated, thereby ensuring that the security management system can respond to changes in the industrial control data in a timely manner and ensure the real-time nature of the industrial control data, and that industrial control data with high synchronization urgency often involves important or volatile data, and timely backup of such data can significantly reduce the risk of industrial control data loss; then, by spectrally analyzing the transmission response to obtain the encrypted response feature vector, the changes in the transmission environment can be understood in real time, thereby dynamically adjusting the industrial control pseudo-coding matrix, making it difficult for the industrial control data to be decrypted or tampered with by unauthorized third parties during transmission, thereby improving the security of the industrial control data; finally, the received encrypted industrial control data is security verified, and partitioned storage is performed after passing the security verification, thereby ensuring the security of the industrial control data and improving the reliability of the security management system.

[0040] In summary, the technical solution adopted in this application can balance the real-time responsiveness and data security throughout the entire life cycle of industrial control data to improve the robustness of the security management and control system. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0042] Figure 1 It is a module structure diagram of the industrial control data full life cycle security management and control system provided in accordance with this application;

[0043] Figure 2is a schematic diagram of a process for determining synchronization urgency according to the present application;

[0044] Figure 3 It is a schematic diagram of the process of determining the encryption response feature vector provided by this application. DETAILED DESCRIPTION

[0045] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0046] The embodiment of the present application provides a full life cycle security management and control system for industrial control data, the core of which is to collect industrial control data in the industrial control system through a data acquisition module; extract the synchronization log records of the industrial control data in the industrial control system database through a data synchronization and backup module, determine the synchronization urgency of the industrial control data when performing synchronization backup through the synchronization log records, and perform synchronization backup on the industrial control data according to the synchronization urgency; extract the transmission response of the industrial control data during encrypted transmission through a data encryption transmission module, determine the encryption response feature vector of the industrial control data during the encrypted transmission process through the transmission response, determine the industrial control pseudo-coding matrix corresponding to the industrial control data according to the encryption response feature vector, and encrypt the industrial control data using the industrial control pseudo-coding matrix during the encrypted transmission process; perform security verification on the received encrypted industrial control data through a data security verification module; and store the encrypted industrial control data that has passed the security verification through a data storage module. The above scheme can balance the real-time responsiveness and data security in the full life cycle of industrial control data, so as to improve the robustness of the security management and control system.

[0047] In order to better understand the above technical solution, the above technical solution will be described in detail below in conjunction with the accompanying drawings and specific implementation methods. Figure 1 As shown, this figure is a module structure diagram of an industrial control data full life cycle security management and control system according to this embodiment of the present application. The management and control system includes: a data acquisition module 100, a data synchronization backup module 200, a data encryption transmission module 300, a data security verification module 400 and a data storage module 500, which are described as follows:

[0048] The data acquisition module 100 is used to acquire industrial control data in an industrial control system.

[0049] In specific implementation, the industrial control data in the industrial control system is collected through a programmable logic controller, and the input module of the programmable logic controller receives the industrial control data from the industrial control system, so that the received industrial control data can be stored in the internal memory of the programmable logic controller for subsequent industrial control data processing; it should be noted that in the present application, the industrial control data is a data set composed of information of multiple industrial control data nodes, wherein the industrial control data node can be an individual data unit corresponding to a specific device, sensor, controller or other data source in the industrial control system. For example, an industrial control data node can represent the temperature reading of a specific sensor or the switch state of a valve.

[0050] The data synchronization and backup module 200 is used to extract the synchronization log records of the industrial control data in the industrial control system database, determine the synchronization urgency of the industrial control data when performing synchronization and backup through the synchronization log records, and synchronize and backup the industrial control data according to the synchronization urgency.

[0051] In this embodiment, the synchronization log record of the industrial control data in the industrial control system database may be extracted in the following manner, namely:

[0052] For each industrial control data node in the industrial control data, obtaining the synchronization log information corresponding to the industrial control data node in the industrial control system database, and then obtaining the synchronization log information corresponding to each industrial control data node in the industrial control system database;

[0053] The collection of all synchronization log information is used as a synchronization log record of the industrial control data in the industrial control system database.

[0054] In the specific implementation, first, it is necessary to obtain all the industrial control data nodes in the industrial control data, which can be obtained by querying the database structure of the industrial control system; then, for each industrial control data node, the corresponding synchronization log information can be queried in the database of the industrial control system, and the synchronization log information includes a synchronization timestamp, a synchronization status, data volume information and an operation type identifier, wherein the operation type identifier is used to describe a specific synchronization operation type, such as data writing, data reading, data updating, data deletion, etc., so as to obtain the corresponding synchronization log information of each industrial control data node in the industrial control system database; finally, the collection of all synchronization log information can be used as a synchronization log record of the industrial control data in the industrial control system database.

[0055] Preferably, in this embodiment, the synchronization urgency of the industrial control data during synchronization backup is determined by the synchronization log record, referring to Figure 2 As described above, the figure is a schematic diagram of a process for determining synchronization urgency in some embodiments of the present application. In this embodiment, the synchronization urgency can be determined by the following steps:

[0056] In step S21, the operation type identifier of each synchronization log information in the synchronization log record is obtained;

[0057] In step S22, all synchronization operation records in the synchronization log record are extracted based on all operation type identifiers;

[0058] In step S23, the data synchronization delay of the corresponding synchronization operation record is determined according to the synchronization request time of each synchronization operation record;

[0059] In step S24, the synchronization delay of the industrial control data is determined according to all data delays;

[0060] In step S25, a read record of each industrial control data node in the industrial control data is obtained;

[0061] In step S26, the synchronization conflict coefficient of the industrial control data is determined through the read records of each industrial control data node;

[0062] In step S27, the synchronization delay and the synchronization conflict coefficient are used to determine the synchronization urgency of the industrial control data when performing synchronous backup.

[0063] It should be noted that, in the present application, the synchronization delay degree indicates the degree of delay generated in the process of synchronous backup of industrial control data; the synchronization conflict coefficient indicates the conflict generated between various industrial control data nodes in the industrial control data during the synchronous backup. The larger the synchronization conflict coefficient, the higher the degree of conflict; the synchronization urgency indicates the urgency of synchronous backup of industrial control data.

[0064] In the specific implementation, first, the operation type identifier corresponding to each synchronization log information is extracted from the synchronization log record, which can be achieved by parsing the synchronization log information; then, based on all the extracted operation type identifiers, all log records related to the synchronization operation are screened out, and the extracted log records are used as synchronization operation records. The synchronization operation record mainly contains the request time, operation type, data node ID, data volume and other information of each synchronization, so that the difference between the request time and the actual execution time in the synchronization operation record can be used as the data synchronization delay, and the data synchronization delay of each synchronization operation record can be obtained; then, the standard deviation of all data delays can be used as the synchronization delay degree of industrial control data.

[0065] In this embodiment, the read records of each industrial control data node in the industrial control data can be obtained. The read record refers to the read operation log of the industrial control data node by the security management system, including the read time, read frequency, whether the read is successful, etc. The read record of each industrial control data node can be obtained by querying the database; then, the synchronization conflict coefficient of the industrial control data can be determined by the read records of each industrial control data node. The synchronization conflict usually occurs when data synchronization and read operations are performed simultaneously, which may cause inconsistency of industrial control data, synchronization failure or increased delay. For each read record, the time overlap between the read record and the synchronization operation record can be analyzed, so that the time overlap degree is used as the synchronization conflict value between the read record and the synchronization operation record, so that the synchronization conflict value between each read record and the synchronization operation record can be obtained, and the average of all synchronization conflict values ​​is used as the synchronization conflict coefficient of the industrial control data; finally, a synchronization model is initialized, and the synchronization delay and data freshness are used as synchronization parameters in the synchronization model. The financial data in the data node is synchronized and verified using a linear synchronization model. The synchronization urgency verification result can be used as the synchronization urgency of the industrial control data when performing synchronous backup. In other embodiments, other models can also be used for determination, which is not limited here.

[0066] In this embodiment, synchronously backing up the industrial control data according to the synchronization urgency means that when the synchronization urgency is greater than or equal to a set threshold, each industrial control data node in the industrial control data is synchronously backed up; in specific implementation, first, a threshold is set according to historical experiments to measure the synchronization urgency. If the synchronization urgency of the industrial control data reaches or exceeds the set threshold, the security management and control system will trigger a synchronous backup operation; then, the synchronization urgency of the industrial control data is compared with the set threshold. When the synchronization urgency is greater than or equal to the set threshold, it indicates that the synchronization backup demand of the industrial control data is urgent, and the security management and control system will immediately perform a synchronous backup of the industrial control data. When the synchronization urgency is less than the set threshold, only a regular backup is required.

[0067] It should be noted that through real-time monitoring and analysis of synchronization log records, the synchronization urgency of industrial control data can be accurately assessed, thereby ensuring that the security management system can respond to changes in industrial control data in a timely manner and ensure the real-time nature of industrial control data. Industrial control data with high synchronization urgency often involves important or volatile data. Timely backup of this data can significantly reduce the risk of industrial control data loss.

[0068] The data encryption transmission module 300 is used to extract the transmission response of the industrial control data during encrypted transmission, determine the encryption response feature vector of the industrial control data during the encrypted transmission process through the transmission response, determine the industrial control pseudo-coding matrix corresponding to the industrial control data according to the encryption response feature vector, and use the industrial control pseudo-coding matrix to encrypt the industrial control data during the encrypted transmission process.

[0069] In this embodiment, extracting the transmission response of the industrial control data during encrypted transmission refers to performing spectrum analysis on the transmission signal of the industrial control data during encrypted transmission, and then obtaining the transmission response of the industrial control data during encrypted transmission; in specific implementation, first, when the industrial control data is encrypted, the industrial control data is transmitted as a signal in the network, and the transmission signal of the industrial control data during encrypted transmission can be obtained through a network monitoring tool; then, the transmission signal of the industrial control data during encrypted transmission can be processed and analyzed by spectrum analysis to extract the transmission response of the industrial control data during encrypted transmission, and the transmission response is composed of response attenuation amounts at different time points when the industrial control data is encrypted, wherein the response attenuation amount represents the amplitude attenuation value at the corresponding time point.

[0070] Preferably, in this embodiment, the encryption response feature vector of the industrial control data in the encrypted transmission process is determined by the transmission response, referring to Figure 3 The figure is a schematic diagram of a process for determining an encrypted response feature vector in some embodiments of the present application. In this embodiment, determining the encrypted response feature vector can be implemented by the following steps:

[0071] In step S31, determining the response attenuation of the transmission response at different time points;

[0072] In step S32, the response attenuation characteristic is determined by the response attenuation at each time point;

[0073] In step S33, transmission response peaks of the transmission response in different frequency ranges are determined;

[0074] In step S34, an encryption response feature vector of the industrial control data during encryption transmission is determined according to the response attenuation characteristics and transmission response peaks in different frequency ranges.

[0075] It should be noted that in the present application, the response attenuation characteristic represents the typical characteristics of all response attenuation amounts; the transmission response peak represents the maximum value of the transmission response in the corresponding frequency range; the encrypted response feature vector is a vector composed of the encrypted response characteristics, wherein the encrypted response characteristic represents the degree of deviation of the transmission response in the corresponding frequency range.

[0076] In specific implementation, first, the amplitude of the initial transmission signal can be obtained. For each time point, the amplitude of the initial transmission signal and the amplitude corresponding to the transmission response at the time point are used as the response attenuation of the transmission response at that time point, thereby obtaining the response attenuation of the transmission response at different time points; then, the average of the response attenuation at all time points can be used as the response attenuation feature; secondly, the transmission response peaks of the transmission response in different frequency ranges are determined by spectrum analysis, and the spectrum diagram is obtained using spectrum analysis technology (such as fast Fourier transform FFT), and then the transmission response peaks in each frequency range are identified; finally, for the transmission response peaks in different frequency ranges, the absolute difference between the transmission response peak and the response attenuation feature is used as the encryption response feature, thereby obtaining multiple encryption response features, and the feature vector composed of all encryption response features is used as the encryption response feature vector of the industrial control data during the encrypted transmission process.

[0077] In this embodiment, the industrial control pseudo-coding matrix corresponding to the industrial control data may be determined according to the encrypted response feature vector in the following manner, namely:

[0078] Discretizing the encrypted response features in the encrypted response feature vector to obtain a plurality of encrypted discrete values;

[0079] The industrial control pseudo-coding matrix corresponding to the industrial control data is constructed through all encrypted discrete values.

[0080] In the specific implementation, first, the mean of all encrypted response features in the encrypted response feature vector is calculated, the encrypted response features smaller than the mean are discretized to 0, and the encrypted response features larger than the mean are discretized to 1, and the discretized encrypted response features are used as encrypted discrete values, thereby obtaining multiple encrypted discrete values; then, all encrypted discrete values ​​are converted to decimal, and all the converted encrypted discrete values ​​are arranged and combined, thereby obtaining an industrial control pseudo-coding matrix corresponding to the industrial control data, and the industrial control pseudo-coding matrix is ​​a coding matrix containing multiple encrypted discrete values.

[0081] In this embodiment, the industrial control data is encrypted using the industrial control pseudo-coding matrix in the encrypted transmission process in the following manner:

[0082] During the data encryption process, the industrial control data is converted into an industrial control coding matrix;

[0083] An XOR operation is performed on the industrial control coding matrix and the industrial control pseudo coding matrix to obtain encrypted industrial control data, thereby completing the encryption of the industrial control data.

[0084] In specific implementation, during the data encryption process, first, the industrial control data (such as sensor data, control instructions, etc.) are converted into a matrix form according to certain rules (such as data block size, row and column structure, etc.), thereby obtaining an industrial control coding matrix; then, the dimensions of the industrial control coding matrix and the industrial control pseudo-coding matrix are ensured to be consistent so that element-by-element XOR operations can be performed, and XOR operations are performed on each pair of corresponding elements in the industrial control coding matrix and the industrial control pseudo-coding matrix to generate an encrypted industrial control matrix. The encrypted industrial control matrix can be used as encrypted industrial control data, thereby completing the encryption of the industrial control data and ensuring the security of the industrial control data during transmission.

[0085] It should be noted that by obtaining the encrypted response feature vector through spectrum analysis of the transmission response, the changes in the transmission environment can be understood in real time, thereby dynamically adjusting the industrial control pseudo-coding matrix, making it difficult for the industrial control data to be decrypted or tampered with by unauthorized third parties during transmission, thereby improving the security of the industrial control data.

[0086] The data security verification module 400 is used to perform security verification on the received encrypted industrial control data.

[0087] In this embodiment, the security verification of the received encrypted industrial control data may be performed in the following manner:

[0088] Decrypting the received encrypted industrial control data to obtain the decrypted industrial control data;

[0089] Verify the identity and log records of the industrial control data to complete security verification.

[0090] In the specific implementation, first, the received encrypted industrial control data is decrypted, and the encrypted industrial control data is processed using the industrial control pseudo-coding matrix used during encryption to restore the decrypted industrial control data; then, identity information is extracted from the decrypted industrial control data, and the extracted identity is compared with a pre-defined valid identity list to confirm the legitimacy of the industrial control data; secondly, log records are extracted from the decrypted industrial control data or related data storage, and the extracted log records are compared with the original log information to confirm that the industrial control data has not been tampered with during transmission and complies with the expected operating procedures.

[0091] The data storage module 500 is used to store encrypted industrial control data that has passed security verification.

[0092] In this embodiment, storing the encrypted industrial control data that has passed security verification refers to partitioning the storage of the encrypted industrial control data that has passed security verification; in specific implementation, partitioning is performed according to the source of the industrial control data (such as different devices or systems), and a partition structure and storage solution are designed to complete the storage of the encrypted industrial control data that has passed security verification, thereby partitioning the industrial control data and isolating industrial control data of different types or importance, thereby reducing the risk of industrial control data in a certain partition being attacked or leaked.

[0093] It can be seen that in the present application, the real-time responsiveness and data security of the industrial control data throughout its life cycle can be balanced; wherein, by real-time monitoring and analysis of synchronization log records, the synchronization urgency of the industrial control data can be accurately evaluated, thereby ensuring that the security management system can respond to changes in the industrial control data in a timely manner and ensure the real-time nature of the industrial control data, and that industrial control data with high synchronization urgency often involves important or volatile data, and timely backup of such data can significantly reduce the risk of industrial control data loss; then, by spectrally analyzing the transmission response to obtain the encrypted response feature vector, the changes in the transmission environment can be understood in real time, thereby dynamically adjusting the industrial control pseudo-coding matrix, making it difficult for the industrial control data to be decrypted or tampered with by unauthorized third parties during transmission, thereby improving the security of the industrial control data; finally, the received encrypted industrial control data is security verified, and partitioned storage is performed after passing the security verification, thereby ensuring the security of the industrial control data and improving the reliability of the security management system.

[0094] In summary, the technical solution adopted in this application can balance the real-time responsiveness and data security throughout the entire life cycle of industrial control data to improve the robustness of the security management and control system.

[0095] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0096] A person skilled in the art may understand that all or part of the steps in the various methods of the above embodiments may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, the storage medium including a read-only memory (ROM), a random access memory (RAM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), a one-time programmable read-only memory (OTPROM), an electronically-erasable programmable read-only memory (EEPROM), a compact disc (CD-ROM) or other optical disc storage, magnetic disk storage, magnetic tape storage, or any other computer-readable medium that can be used to carry or store data.

[0097] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

Claims

1. A full life cycle security management and control system for industrial control data, characterized in that: The control system includes: Data acquisition module, used to collect industrial control data in industrial control systems; A data synchronization and backup module, used to extract synchronization log records of the industrial control data in the industrial control system database, determine the synchronization urgency of the industrial control data when performing synchronization and backup through the synchronization log records, and perform synchronization and backup of the industrial control data according to the synchronization urgency; A data encryption transmission module, used to extract the transmission response of the industrial control data during encrypted transmission, determine the encryption response feature vector of the industrial control data during the encrypted transmission process through the transmission response, determine the industrial control pseudo-coding matrix corresponding to the industrial control data according to the encryption response feature vector, and use the industrial control pseudo-coding matrix to encrypt the industrial control data during the encrypted transmission process; A data security verification module is used to perform security verification on the received encrypted industrial control data; A data storage module, used to store encrypted industrial control data that has passed security verification; Wherein, determining the synchronization urgency of the industrial control data during synchronization backup through the synchronization log record specifically includes: Obtaining an operation type identifier for each synchronization log information in the synchronization log record; Extracting all synchronization operation records in the synchronization log record based on all operation type identifiers; Determine the data synchronization delay of the corresponding synchronization operation record according to the synchronization request time of each synchronization operation record; Determine the synchronization delay of the industrial control data according to all data delays, wherein the standard deviation of all data delays is used as the synchronization delay of the industrial control data; Obtaining a read record of each industrial control data node in the industrial control data; Determine the synchronization conflict coefficient of the industrial control data through the read records of each industrial control data node, wherein the time overlap between the read record and the synchronization operation record is used as the synchronization conflict value between the read record and the synchronization operation record, and then obtain the synchronization conflict value between each read record and the synchronization operation record, and the average of all synchronization conflict values ​​is used as the synchronization conflict coefficient of the industrial control data; The synchronization delay and the synchronization conflict coefficient are used to determine the synchronization urgency of the industrial control data when performing synchronous backup, wherein a synchronization model is initialized, the synchronization delay and the synchronization conflict coefficient are used as synchronization parameters in the synchronization model, the synchronization urgency is verified using the synchronization model, and the synchronization urgency verification result can be used as the synchronization urgency of the industrial control data when performing synchronous backup; Among them, synchronously backing up the industrial control data according to the synchronization urgency means that when the synchronization urgency is greater than or equal to a set threshold, each industrial control data node in the industrial control data is synchronously backed up, wherein the set threshold is set according to historical experiments, and the set threshold is used to measure the synchronization urgency.

2. The industrial control data full life cycle security management and control system according to claim 1, characterized in that: Collect industrial control data in industrial control systems through programmable logic controllers.

3. The industrial control data full life cycle security management and control system according to claim 1, characterized in that: Extracting the synchronization log record of the industrial control data in the industrial control system database specifically includes: For each industrial control data node in the industrial control data, obtaining the synchronization log information corresponding to the industrial control data node in the industrial control system database, and then obtaining the synchronization log information corresponding to each industrial control data node in the industrial control system database; The collection of all synchronization log information is used as a synchronization log record of the industrial control data in the industrial control system database.

4. The industrial control data full life cycle security management and control system according to claim 1, characterized in that: Extracting the transmission response of the industrial control data during encrypted transmission refers to performing spectrum analysis on the transmission signal of the industrial control data during encrypted transmission, thereby obtaining the transmission response of the industrial control data during encrypted transmission.

5. The industrial control data full life cycle security management and control system according to claim 1, characterized in that: Determining the encryption response feature vector of the industrial control data during the encrypted transmission process through the transmission response specifically includes: Determining the response attenuation of the transmission response at different time points; Determine the response attenuation characteristics through the response attenuation at each time point; determining transmission response peaks of the transmission response in different frequency ranges; Determining an encryption response feature vector of the industrial control data during encryption transmission according to the response attenuation characteristics and transmission response peaks in different frequency ranges; The ratio of the amplitude of the initial transmission signal to the amplitude corresponding to the transmission response at a time point is taken as the response attenuation of the transmission response at that time point, thereby obtaining the response attenuation of the transmission response at different time points; The mean of the response attenuation at all time points is taken as the response attenuation feature; Using spectrum analysis technology to obtain a spectrum diagram, thereby identifying a transmission response peak in each frequency range, wherein the transmission response peak represents a maximum value of the transmission response in the corresponding frequency range; For the transmission response peaks in different frequency ranges, the absolute difference between the transmission response peak and the response attenuation characteristic is used as the encryption response characteristic, and then multiple encryption response characteristics are obtained. The feature vector composed of all the encryption response characteristics is used as the encryption response feature vector of the industrial control data during the encrypted transmission process.

6. The industrial control data full life cycle security management and control system according to claim 1, characterized in that: Using the industrial control pseudo-coding matrix to encrypt the industrial control data during the encrypted transmission process specifically includes: During the data encryption process, the industrial control data is converted into an industrial control coding matrix; An XOR operation is performed on the industrial control coding matrix and the industrial control pseudo coding matrix to obtain encrypted industrial control data, thereby completing the encryption of the industrial control data.

7. The industrial control data full life cycle security management and control system according to claim 1, characterized in that: The security verification of the received encrypted industrial control data specifically includes: Decrypting the received encrypted industrial control data to obtain the decrypted industrial control data; Verify the identity and log records of the industrial control data to complete security verification.

8. The industrial control data full life cycle security management and control system according to claim 1, characterized in that: Storing the encrypted industrial control data that has passed security verification refers to storing the encrypted industrial control data that has passed security verification in partitions.

Images