Nuclear facility-oriented security network terminal security access control system, method and device

Abstract

The invention belongs to the technical field of nuclear power, and particularly relates to a security network terminal security access control system, method and device for nuclear facilities. According to the security network terminal security admission control method for the nuclear facilities, the problems that a traditional firewall using method cannot adapt to a distributed network architecture and the equipment deployment is relatively dispersed are solved by performing distributed deployment on the edge controllers in a scene that the nuclear facilities such as a nuclear power station are relatively wide in range and relatively dispersed in equipment deployment; and the problems of limited equipment access quantity, low processing speed and the like exist. Aiming at the characteristics of multiple varieties, multiple brands and multiple quantity of pre-access equipment at the edge end, the pre-access equipment is allowed to access the nuclear security network after the security access check of the edge controller is passed at the edge end, so that the problem that the pre-access equipment cannot access the nuclear security network under the condition that the general IP phenomena of the nuclear security related equipment are increasingly common can be solved. The problem that network terminal equipment is accessed from an edge end and extends to a whole entity security boundary, is easily utilized by lawbreakers, attacks, intrudes and destroys a network and a system, and causes failure of a nuclear security system is solved.

Description

Technical Field

[0001] The present invention belongs to the field of nuclear power technology, and in particular relates to a security network terminal security access control system, method and device for nuclear facilities. Background Art

[0002] With the rapid development of various technologies in the field of nuclear security, the number of network terminal devices of different manufacturers and models used in nuclear power plants has increased day by day, and the phenomenon of equipment pan-IP has emerged. Since network terminal devices are accessed from the edge and extend to the boundaries of the entire physical protection and management area, and each network terminal device does not have physical protection, it is easy for criminals to use this to attack, invade, and destroy the network and physical protection system, ultimately causing the nuclear security system to fail. Therefore, when network terminal devices access the network in the field of nuclear security, security access is required to ensure the security of the security system.

[0003] At present, the traditional firewall method used in the nuclear security system cannot adapt to the distributed network architecture. There are also problems such as limited number of network terminal equipment access and slow processing speed. Therefore, effective nuclear facility security network terminal security access control is urgently needed. Summary of the invention

[0004] In order to overcome the problems existing in the related technologies, a security network terminal security access control system, method and device for nuclear facilities are provided.

[0005] According to one aspect of an embodiment of the present disclosure, there is provided a security network terminal security access control system for nuclear facilities, the system comprising: an edge controller and a nuclear security network;

[0006] The edge controller provides a physical interface for realizing the physical connection between the pre-access device and the nuclear security network. The edge controller includes: a device whitelist preset module, a behavior security baseline module, a device identification module, a device comparison module, a behavior analysis module, and a behavior comparison module;

[0007] The device whitelist preset module is used to obtain data of security devices that are known to be able to securely access the nuclear security network to form a device whitelist;

[0008] The behavior security baseline module is used to obtain the security behaviors performed by known security devices to form a behavior security baseline;

[0009] The device identification module is used to identify the device according to the information report of the pre-access device submitted to the edge controller for authentication and the device data characteristics. If the device information can be identified, the identified device information is pushed to the device comparison module for information comparison with the device whitelist. If the device information cannot be identified, the information of the pre-access device is pushed to the behavior analysis module for behavior analysis.

[0010] The device comparison module is used to compare the device information of the identifiable pre-access device with the device information in the device whitelist. If the device information of the pre-access device matches the device whitelist, the pre-access device is allowed to access the nuclear security network through the edge controller. If the device information of the pre-access device does not match the device whitelist, the information of the pre-access device is pushed to the behavior analysis module for behavior analysis;

[0011] The behavior analysis module is used to perform behavior analysis on the received behavior information of the pre-access device, analyze, split, and identify the behavior of the pre-access device within a preset period to obtain a behavior analysis result, and send the behavior analysis result to the behavior comparison module, the behavior analysis result includes multiple split behaviors;

[0012] The behavior comparison module is used to compare the received behavior analysis results with the behavior security baseline. If each split behavior included in the behavior analysis result completely passes the behavior security baseline detection, the pre-access device corresponding to the behavior analysis result is allowed to access the nuclear security network through the edge controller. If one or more split behaviors included in the behavior analysis result fail to pass the behavior security baseline detection, the pre-access device corresponding to the behavior analysis result is denied access to the nuclear security network.

[0013] In a possible implementation, the system further includes: a device whitelist updating module;

[0014] The device whitelist update module is used to add the device information of the pre-access device to the device whitelist when the pre-access device is determined to be able to access the nuclear security network through the edge controller and the device whitelist does not contain the device information of the pre-access device.

[0015] According to another aspect of an embodiment of the present disclosure, there is provided a security network terminal security access control system for nuclear facilities, the system comprising: a plurality of edge controllers, a central server and a nuclear security network;

[0016] Each edge controller provides a physical interface for realizing the physical connection between the pre-access device and the nuclear security network; the central server is connected to multiple edge controllers respectively, and each edge controller includes: a first device whitelist preset module, a first device identification module, a first device comparison module, and a first device whitelist update module; the central server includes: a second device whitelist preset module, a second device identification module, a second device comparison module, a behavioral security baseline module, a behavioral analysis module, a behavioral comparison module, and a second device whitelist update module;

[0017] A first device whitelist preset module of each edge controller is used to obtain data of security devices known by the edge controller to be securely connected to the nuclear security network to form a local device whitelist;

[0018] The second device whitelist preset module is used to obtain data of security devices that are known to be able to securely access the nuclear security network to form a global device whitelist;

[0019] The behavior security baseline module is used to obtain the security behaviors performed by known security devices to form a behavior security baseline;

[0020] The first device identification module of each edge controller is used to identify the device according to the information report of the pre-access device submitted to the edge controller for authentication and the device data characteristics. If the device information can be identified, the identified device information is pushed to the first device comparison module for information comparison with the local device whitelist; if the device information cannot be identified, the information of the pre-access device is pushed to the device identification module of the central server for device identification;

[0021] The first device comparison module of each edge controller is used to compare the received device information of the pre-access device with the local device whitelist. If the device information of the pre-access device matches the local device whitelist, the pre-access device is connected to the nuclear security network through the edge controller. If the device information of the pre-access device does not match the local device whitelist, the information of the pre-access device is pushed to the second device comparison module;

[0022] The device identification module of the central server is used to identify the information reported by the pre-access device and the device data characteristics that the edge controller cannot identify. If the device information can be identified, the identified device information is pushed to the device comparison module of the central server for information comparison with the global device whitelist; if the device information cannot be identified, the information of the pre-access device is pushed to the behavior analysis module for behavior analysis;

[0023] The second device comparison module is used to compare the device information of the identifiable pre-access device with the device information in the global device whitelist. If the device information of the pre-access device matches the global device whitelist, the pre-access device is connected to the nuclear security network through the edge controller. If the device information of the pre-access device does not match the global device whitelist, the information of the pre-access device is pushed to the behavior analysis module for behavior analysis;

[0024] The behavior analysis module is used to perform behavior analysis on the received behavior information of the pre-access device, analyze, split, and identify the behavior of the pre-access device within a preset period to obtain a behavior analysis result, and send the behavior analysis result to the behavior comparison module, the behavior analysis result includes multiple split behaviors;

[0025] The behavior comparison module is used to compare the received behavior analysis result with the behavior security baseline. If each split behavior included in the behavior analysis result completely passes the behavior security baseline detection, the pre-access device corresponding to the behavior analysis result is connected to the nuclear security network through the edge controller submitted for authentication by the pre-access device. If one or more split behaviors included in the behavior analysis result fail to pass the behavior security baseline detection, the pre-access device corresponding to the behavior analysis result is denied access to the nuclear security network.

[0026] In a possible implementation, each edge controller in the system further includes a first device whitelist update module, and the central server further includes a second device whitelist update module;

[0027] A first device whitelist updating module is configured to add the device information of the pre-access device to the local device whitelist when the pre-access device is determined to be able to access the nuclear security network through the edge controller and the local device whitelist of the edge controller for which the pre-access device applies for authentication does not include the device information of the pre-access device;

[0028] The second device whitelist update module is used to add the device information of the pre-access device to the global device whitelist when the pre-access device is determined to be able to access the nuclear security network through the edge controller and the global device whitelist does not contain the device information of the pre-access device.

[0029] According to another aspect of an embodiment of the present disclosure, a security network terminal security access control method for nuclear facilities is provided, the method is implemented based on the system according to claim 1 or 2, and the method includes:

[0030] Step 11, obtaining data of security devices that are known to be able to securely access the nuclear security network and forming a device whitelist;

[0031] Step 12, obtaining the security behaviors performed by known security devices to form a behavioral security baseline;

[0032] Step 13: perform device identification based on the information reported by the pre-access device and the device data characteristics. If the device information can be identified, compare the identified device information with the device whitelist. If the device information cannot be identified, perform behavior analysis on the behavior information of the pre-access device.

[0033] Step 14, comparing the device information of the identifiable pre-access device with the device information in the device whitelist. If the device information of the pre-access device matches the device whitelist, the pre-access device is allowed to access the nuclear security network through the edge controller. If the device information of the pre-access device does not match the device whitelist, a behavior analysis is performed on the behavior information of the pre-access device.

[0034] Step 15, performing behavior analysis on the received behavior information of the pre-access device, analyzing, splitting, and identifying the behavior of the pre-access device within a preset period to obtain a behavior analysis result, and sending the behavior analysis result to the behavior comparison module, the behavior analysis result includes multiple split behaviors;

[0035] Step 16, compare the received behavior analysis results with the behavior security baseline. If all the split behaviors contained in the behavior analysis results pass the behavior security baseline detection, the pre-access device corresponding to the behavior analysis results is allowed to access the nuclear security network through the edge controller. If one or more split behaviors contained in the behavior analysis results fail to pass the behavior security baseline detection, the pre-access device corresponding to the behavior analysis results is denied access to the nuclear security network.

[0036] In a possible implementation, the method further includes:

[0037] Step 17: When the pre-access device is determined to be able to access the nuclear security network through the edge controller and the device whitelist does not contain the device information of the pre-access device, the device information of the pre-access device is added to the device whitelist.

[0038] According to another aspect of an embodiment of the present disclosure, a security access control method for security network terminals of nuclear facilities is provided, the method being implemented based on each edge controller in the system of claim 3 or 4, the method comprising:

[0039] Step 21, the edge controller obtains data of security devices known by the edge controller to be securely connected to the nuclear security network, and forms a local device whitelist;

[0040] Step 22, the edge controller identifies the device according to the information reported by the pre-access device submitted to the edge controller for authentication and the device data characteristics. If the device information can be identified, the identified device information is compared with the local device whitelist; if the device information cannot be identified, the information of the pre-access device is pushed to the central server for device identification;

[0041] In step 23, each edge controller compares the device information of the received pre-access device with the local device whitelist. If the device information of the pre-access device matches the local device whitelist, the pre-access device is connected to the nuclear security network through the edge controller. If the device information of the pre-access device does not match the local device whitelist, the information of the pre-access device is pushed to the central server.

[0042] In a possible implementation, the method further includes:

[0043] Step 24: When the pre-access device is determined to be able to access the nuclear security network through the edge controller and the local device whitelist of the edge controller for which the pre-access device applies for authentication does not include the device information of the pre-access device, the edge controller adds the device information of the pre-access device to the local device whitelist.

[0044] According to another aspect of an embodiment of the present disclosure, a security access control method for security network terminals of nuclear facilities is provided. The method is implemented based on a central server in the system of claim 3 or 4, and the method comprises:

[0045] Step 31, the central server obtains data of security devices that are known to be able to securely access the nuclear security network, and forms a global device whitelist;

[0046] Step 32, the central server obtains the security behaviors performed by the known security devices to form a behavior security baseline;

[0047] Step 33, the central server performs device identification on the information reported by the pre-access device that the edge controller cannot identify and the device data characteristics. If the device information can be identified, the identified device information is compared with the global device whitelist; if the device information cannot be identified, the behavior information of the pre-access device is analyzed;

[0048] Step 34, the central server compares the device information of the identifiable pre-access device with the device information in the global device whitelist. If the device information of the pre-access device matches the global device whitelist, the pre-access device is connected to the nuclear security network through the edge controller. If the device information of the pre-access device does not match the global device whitelist, the behavior information of the pre-access device is analyzed;

[0049] Step 35, the central server performs behavior analysis on the behavior information of the pre-access device that cannot be included in the global device whitelist, analyzes, splits, and identifies the behavior of the pre-access device within a preset period to obtain a behavior analysis result, and sends the behavior analysis result to the behavior comparison module, the behavior analysis result includes multiple split behaviors;

[0050] Step 36, compare the received behavior analysis results with the behavior security baseline. If the split behaviors contained in the behavior analysis results completely pass the behavior security baseline detection, the pre-access device corresponding to the behavior analysis result is connected to the nuclear security network through the edge controller to which the pre-access device submits authentication. If one or more split behaviors contained in the behavior analysis results fail to pass the behavior security baseline detection, the pre-access device corresponding to the behavior analysis result is denied access to the nuclear security network.

[0051] In a possible implementation, the method further includes:

[0052] Step 37: When the pre-access device is determined to be able to access the nuclear security network through the edge controller and the global device whitelist does not contain the device information of the pre-access device, the central server adds the device information of the pre-access device to the global device whitelist.

[0053] According to another aspect of an embodiment of the present disclosure, a security network terminal security access control device for nuclear facilities is provided, the device comprising:

[0054] processor;

[0055] a memory for storing processor-executable instructions;

[0056] Wherein, the processor is configured to execute the above method.

[0057] According to another aspect of an embodiment of the present disclosure, a non-volatile computer-readable storage medium is provided, on which computer program instructions are stored, and the computer program instructions implement the above method when executed by a processor.

[0058] The beneficial effects of the present disclosure are as follows: the security access control method for security network terminals for nuclear facilities disclosed in the present disclosure is aimed at scenarios where the scope of nuclear facilities is wide and the equipment is deployed in a dispersed manner, such as nuclear power plants. By distributing the edge controller, it solves the problems that the traditional firewall method cannot adapt to the distributed network architecture, and there are problems such as the limited number of device accesses and slow processing speed. In view of the characteristics of the large number of pre-access devices at the edge, such as many varieties, brands, and quantities, at the edge, the pre-access devices are first passed through the security access check of the edge controller before being allowed to access the nuclear security network. This can solve the problem that in the case of the increasingly common phenomenon of pan-IP of nuclear security-related equipment, network terminal devices extend from edge access to the entire physical defense boundary, which is easily exploited by criminals to attack, invade, and destroy the network and system, resulting in the failure of the nuclear security system. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] Figure 1 It is a block diagram of a security network terminal security access control system for nuclear facilities shown in an embodiment of the present disclosure.

[0060] Figure 2 It is a block diagram of another security network terminal security access control system for nuclear facilities shown in an embodiment of the present disclosure.

[0061] Figure 3 It is a flow chart of a security access control method for security network terminals of nuclear facilities shown in an embodiment of the present disclosure.

[0062] Figure 4 It is a flow chart of another method for secure access control of security network terminals for nuclear facilities shown in an embodiment of the present disclosure.

[0063] Figure 5 It is a block diagram of another security network terminal security access control device for nuclear facilities shown in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0064] The present disclosure is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0065] Unless otherwise defined, the technical and scientific terms used in the present disclosure have the same meanings as those generally understood by those skilled in the art to which the present disclosure belongs; the terms used in the present disclosure are only for the purpose of describing specific embodiments and are not intended to limit the present disclosure; the term "including" and any variations thereof in the present disclosure are intended to cover non-exclusive inclusions. Obviously, the embodiments described in the present disclosure are only part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in the field without making creative efforts are within the scope of protection of the present disclosure.

[0066] Reference to "embodiments" in this disclosure means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the disclosure. The appearance of the phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0067] Figure 1 is a block diagram of a security network terminal security access control system for nuclear facilities shown in an embodiment of the present disclosure, such as Figure 1 As shown, the system includes: an edge controller and a nuclear security network.

[0068] The edge controller provides a physical interface (the physical interface can be, for example, RS-232, RS-485, RJ-45, etc.) for realizing the physical connection of pre-access equipment and nuclear security network. The edge controller includes: a device whitelist preset module, a behavioral security baseline module, a device identification module, a device comparison module, a behavior analysis module, a behavior comparison module, and a device whitelist update module.

[0069] The device whitelist preset module is used to obtain data of known security devices that can securely access the nuclear security network to form a device whitelist. The device whitelist may include device information such as device model and device manufacturer.

[0070] The behavior security baseline module is used to obtain the security behaviors performed by known security devices to form a behavior security baseline. The behavior security baseline may include: initiating network connection, sending protocol data, receiving protocol data and other behaviors.

[0071] The device identification module is used to identify the device based on the information reported by the pre-access device and the device data characteristics. If the device information can be identified, the identified device information is pushed to the device comparison module for information comparison with the device whitelist. If the device information cannot be identified, the information of the pre-access device is pushed to the behavior analysis module for behavior analysis.

[0072] The device comparison module is used to compare the device information of the identifiable pre-access device with the device information in the device whitelist. If the device information of the pre-access device matches the device whitelist, the pre-access device is allowed to access the nuclear security network through the edge controller. If the device information of the pre-access device does not match the device whitelist, the information of the pre-access device is pushed to the behavior analysis module for behavior analysis.

[0073] The behavior analysis module is used to perform behavior analysis on the received behavior information of the pre-access device, analyze, split, and identify the behavior of the pre-access device within a preset period (a preset period of any length can be selected according to analysis needs) to obtain a behavior analysis result, and send the behavior analysis result to the behavior comparison module, and the behavior analysis result includes multiple split behaviors.

[0074] The behavior comparison module is used to compare the received behavior analysis results with the behavior security baseline. If each split behavior included in the behavior analysis result completely passes the behavior security baseline detection, the pre-access device corresponding to the behavior analysis result is allowed to access the nuclear security network through the edge controller. If one or more split behaviors included in the behavior analysis result fail to pass the behavior security baseline detection, the pre-access device corresponding to the behavior analysis result is denied access to the nuclear security network.

[0075] The device whitelist update module is used to add the device information of the pre-access device to the device whitelist when the pre-access device is determined to be able to access the nuclear security network through the edge controller and the device whitelist does not contain the device information of the pre-access device, so that when a pre-access device with the same device information applies for access subsequently, it can be directly allowed to access the nuclear security network through the edge controller.

[0076] The present disclosure provides a method of realizing efficient secure device access and identification of risky devices on an edge controller by pre-definition, splitting behaviors, access analysis, behavior identification, and security baseline checks, and automatically and dynamically updating the device whitelist. When an unknown device is connected, the legitimacy of the behavior of the access device is determined by analyzing the data and behavior within the cycle, and whether to allow or deny access is determined to realize the security access function. In terms of the network, the present disclosure distributes the terminal access pressure by distributing edge controllers at the edge, and each edge controller only processes the behavior analysis and security access of the terminal connected to the local machine, which significantly increases the total number of network accesses and the processing speed.

[0077] Figure 2 FIG. 1 is a block diagram of another security network terminal security access control system for nuclear facilities shown in an embodiment of the present disclosure. Figure 2 As shown, the system includes: multiple edge controllers, a central server and a nuclear security network.

[0078] Each edge controller provides a physical interface (the physical interface can be, for example, RS-232, RS-485, RJ-45, etc.) for realizing the physical connection of the pre-access equipment and the nuclear security network. The central server is connected to multiple edge controllers respectively, and each edge controller includes: a first device whitelist preset module, a first device identification module, a first device comparison module, and a first device whitelist update module; the central server includes: a second device whitelist preset module, a second device identification module, a second device comparison module, a behavioral security baseline module, a behavioral analysis module, a behavioral comparison module, and a second device whitelist update module.

[0079] A first device whitelist preset module of each edge controller is used to obtain data of security devices known by the edge controller to be securely connected to the nuclear security network to form a local device whitelist;

[0080] The second device whitelist preset module is used to obtain data of security devices that are known to be able to securely access the nuclear security network to form a global device whitelist;

[0081] The behavior security baseline module is used to obtain the security behaviors performed by known security devices to form a behavior security baseline;

[0082] The first device identification module of each edge controller is used to identify the device according to the information report of the pre-access device submitted to the edge controller for authentication and the device data characteristics. If the device information can be identified, the identified device information is pushed to the first device comparison module for information comparison with the local device whitelist; if the device information cannot be identified, the information of the pre-access device is pushed to the device identification module of the central server for device identification;

[0083] The first device comparison module of each edge controller is used to compare the received device information of the pre-access device with the local device whitelist. If the device information of the pre-access device matches the local device whitelist, the pre-access device is connected to the nuclear security network through the edge controller. If the device information of the pre-access device does not match the local device whitelist, the information of the pre-access device is pushed to the second device comparison module;

[0084] The device identification module of the central server is used to identify the information reported by the pre-access device and the device data characteristics that the edge controller cannot identify. If the device information can be identified, the identified device information is pushed to the device comparison module of the central server for information comparison with the global device whitelist; if the device information cannot be identified, the information of the pre-access device is pushed to the behavior analysis module for behavior analysis;

[0085] The second device comparison module is used to compare the device information of the identifiable pre-access device with the device information in the global device whitelist. If the device information of the pre-access device matches the global device whitelist, the pre-access device is connected to the nuclear security network through the edge controller. If the device information of the pre-access device does not match the global device whitelist, the information of the pre-access device is pushed to the behavior analysis module for behavior analysis;

[0086] The behavior analysis module is used to perform behavior analysis on the received behavior information of the pre-access device, analyze, split, and identify the behavior of the pre-access device within a preset period to obtain a behavior analysis result, and send the behavior analysis result to the behavior comparison module, the behavior analysis result includes multiple split behaviors;

[0087] The behavior comparison module is used to compare the received behavior analysis result with the behavior security baseline. If each split behavior included in the behavior analysis result completely passes the behavior security baseline detection, the pre-access device corresponding to the behavior analysis result is connected to the nuclear security network through the edge controller submitted for authentication by the pre-access device. If one or more split behaviors included in the behavior analysis result fail to pass the behavior security baseline detection, the pre-access device corresponding to the behavior analysis result is denied access to the nuclear security network.

[0088] The present disclosure is aimed at scenarios where nuclear facilities such as nuclear power plants are wide and equipment is deployed in a dispersed manner. By distributing multiple edge controllers, it solves the problems that the traditional firewall method cannot adapt to the distributed network architecture, and there are problems such as the limited number of device access and slow processing speed. In view of the characteristics of the large number of pre-access devices at the edge, including many varieties, brands, and quantities, only the local device whitelist of historical access devices is stored at the edge. When the edge storage device cannot identify or authenticate the pre-access device, the pre-access device is sent to the central server for security access inspection. The central server is responsible for the storage and update of the global whitelist and the behavior analysis and comparison functions. This can not only effectively ensure the system authentication efficiency, but also significantly reduce the storage and computing pressure of the edge controller.

[0089] Figure 3 1 is a flow chart of a security access control method for security network terminals of nuclear facilities shown in an embodiment of the present disclosure. The method can be applied to the application scenario of single-machine authentication of edge controllers, such as Figure 3 As shown, the method may include:

[0090] The stand-alone method process begins. The pre-connected device is connected to the edge controller through a physical interface.

[0091] Step 11, obtain data on security devices that are known to be able to securely access the nuclear security network and form a device whitelist.

[0092] Step 12: Obtain the security behaviors performed by known security devices to form a behavioral security baseline.

[0093] Step 13, perform device identification based on the information reported by the pre-access device and the device data characteristics. If the device information can be identified, compare the identified device information with the device whitelist. If the device information cannot be identified, perform behavior analysis on the behavior information of the pre-access device.

[0094] Step 14, compare the device information of the identifiable pre-access device with the device information in the device whitelist. If the device information of the pre-access device matches the device whitelist, the pre-access device is allowed to access the nuclear security network through the edge controller. If the device information of the pre-access device does not match the device whitelist, a behavioral analysis is performed on the behavior information of the pre-access device.

[0095] Step 15, performing behavior analysis on the received behavior information of the pre-access device, analyzing, splitting, and identifying the behavior of the pre-access device within a preset period to obtain a behavior analysis result, and sending the behavior analysis result to the behavior comparison module, the behavior analysis result includes multiple split behaviors.

[0096] Step 16, compare the received behavior analysis results with the behavior security baseline. If all the split behaviors contained in the behavior analysis results pass the behavior security baseline detection, the pre-access device corresponding to the behavior analysis results is allowed to access the nuclear security network through the edge controller. If one or more split behaviors contained in the behavior analysis results fail to pass the behavior security baseline detection, the pre-access device corresponding to the behavior analysis results is denied access to the nuclear security network.

[0097] Step 17: When the pre-access device is determined to be able to access the nuclear security network through the edge controller and the device whitelist does not contain the device information of the pre-access device, the device information of the pre-access device is added to the device whitelist.

[0098] The stand-alone method process ends.

[0099] Figure 4 is a flowchart of another security access control method for security network terminals of nuclear facilities shown in an embodiment of the present disclosure. This method can be applied to the application scenario of edge controller combined with central server authentication. Figure 4 , the method comprising:

[0100] The central server method process begins; the pre-access device is connected to the edge controller through the physical interface;

[0101] In step 21, the edge controller obtains data of security devices known by the edge controller to be securely connected to the nuclear security network, and forms a local device whitelist.

[0102] In step 31, the central server obtains data of security devices that are known to be able to securely access the nuclear security network and forms a global device whitelist.

[0103] In step 32, the central server obtains the security behaviors performed by known security devices to form a behavioral security baseline.

[0104] Step 22, the edge controller identifies the device according to the information reported by the pre-access device submitted to the edge controller for authentication and the device data characteristics. If the device information can be identified, the identified device information is compared with the local device whitelist; if the device information cannot be identified, the information of the pre-access device is pushed to the central server for device identification;

[0105] In step 23, each edge controller compares the device information of the received pre-access device with the local device whitelist. If the device information of the pre-access device matches the local device whitelist, the pre-access device is connected to the nuclear security network through the edge controller. If the device information of the pre-access device does not match the local device whitelist, the information of the pre-access device is pushed to the central server.

[0106] Step 33, the central server performs device identification on the information reported by the pre-access device that the edge controller cannot identify and the device data characteristics. If the device information can be identified, the identified device information is compared with the global device whitelist; if the device information cannot be identified, the behavior information of the pre-access device is analyzed;

[0107] Step 34, the central server compares the device information of the identifiable pre-access device with the device information in the global device whitelist. If the device information of the pre-access device matches the global device whitelist, the pre-access device is connected to the nuclear security network through the edge controller. If the device information of the pre-access device does not match the global device whitelist, the behavior information of the pre-access device is analyzed;

[0108] Step 35, the central server performs behavior analysis on the behavior information of the pre-access device that cannot be included in the global device whitelist, analyzes, splits, and identifies the behavior of the pre-access device within a preset period to obtain a behavior analysis result, and sends the behavior analysis result to the behavior comparison module, the behavior analysis result includes multiple split behaviors;

[0109] Step 36, compare the received behavior analysis results with the behavior security baseline. If the split behaviors contained in the behavior analysis results completely pass the behavior security baseline detection, the pre-access device corresponding to the behavior analysis result is connected to the nuclear security network through the edge controller to which the pre-access device submits authentication. If one or more split behaviors contained in the behavior analysis results fail to pass the behavior security baseline detection, the pre-access device corresponding to the behavior analysis result is denied access to the nuclear security network.

[0110] Step 37: When the pre-access device is determined to be able to access the nuclear security network through the edge controller and the global device whitelist does not contain the device information of the pre-access device, the central server adds the device information of the pre-access device to the global device whitelist.

[0111] Step 24: When the pre-access device is determined to be able to access the nuclear security network through the edge controller and the local device whitelist of the edge controller for which the pre-access device applies for authentication does not include the device information of the pre-access device, the edge controller adds the device information of the pre-access device to the local device whitelist.

[0112] The method flow of the central server mode ends.

[0113] Figure 5 1900 is a block diagram of another security network terminal security access control device for nuclear facilities shown in an embodiment of the present disclosure. For example, the device 1900 can be provided as a server. Figure 5 , the apparatus 1900 includes a processing component 1922, which further includes one or more processors, and a memory resource represented by a memory 1932 for storing instructions, such as an application, that can be executed by the processing component 1922. The application stored in the memory 1932 may include one or more modules, each corresponding to a set of instructions. In addition, the processing component 1922 is configured to execute instructions to perform the above method.

[0114] The device 1900 may also include a power supply component 1926 configured to perform power management of the device 1900, a wired or wireless network interface 1950 configured to connect the device 1900 to a network, and an input / output (I / O) interface 1958. The device 1900 may operate based on an operating system stored in the memory 1932, such as Windows Server™, MacOS X™, Unix™, Linux™, FreeBSD™, or the like.

[0115] In an exemplary embodiment, a non-volatile computer-readable storage medium is also provided, such as a memory 1932 including computer program instructions, which can be executed by the processing component 1922 of the device 1900 to perform the above method.

[0116] The present disclosure may be a system, a method and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for causing a processor to implement various aspects of the present disclosure.

[0117] A computer-readable storage medium may be a tangible device that can hold and store instructions used by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples of computer-readable storage media (a non-exhaustive list) include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disk read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device, such as a punch card or a raised structure in a groove on which instructions are stored, and any suitable combination of the foregoing. As used herein, a computer-readable storage medium is not to be interpreted as a transient signal per se, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse through a fiber optic cable), or an electrical signal transmitted through a wire.

[0118] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0119] The computer program instructions for performing the operation of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages, such as Smalltalk, C++, etc., and conventional procedural programming languages, such as "C" language or similar programming languages. Computer-readable program instructions may be executed completely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or completely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect via the Internet). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may be customized by utilizing the state information of the computer-readable program instructions, and the electronic circuit may execute the computer-readable program instructions, thereby realizing various aspects of the present disclosure.

[0120] Various aspects of the present disclosure are described herein with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer-readable program instructions.

[0121] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the processor of the computer or other programmable data processing device, a device that implements the functions / actions specified in one or more boxes in the flowchart and / or block diagram is generated. These computer-readable program instructions can also be stored in a computer-readable storage medium, and these instructions cause the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable medium storing the instructions includes a manufactured product, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0122] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operating steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to implement the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0123] The flow chart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to multiple embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a part of a module, program segment or instruction, and a part of the module, program segment or instruction includes one or more executable instructions for realizing the specified logical function. In some alternative implementations, the function marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous square boxes can actually be executed substantially in parallel, and they can sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or action, or can be implemented with a combination of special hardware and computer instructions.

[0124] The embodiments of the present disclosure have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and changes will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The selection of terms used herein is intended to best explain the principles of the embodiments, practical applications, or improvements to the technology in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A security network terminal security access control system for nuclear facilities, characterized in that: The system includes: an edge controller and a nuclear security network; The edge controller provides a physical interface for realizing the physical connection between the pre-access device and the nuclear security network. The edge controller includes: a device whitelist preset module, a behavior security baseline module, a device identification module, a device comparison module, a behavior analysis module, and a behavior comparison module; The device whitelist preset module is used to obtain data of security devices that are known to be able to securely access the nuclear security network to form a device whitelist; The behavior security baseline module is used to obtain the security behaviors performed by known security devices to form a behavior security baseline; The device identification module is used to identify the device according to the information report of the pre-access device submitted to the edge controller for authentication and the device data characteristics. If the device information can be identified, the identified device information is pushed to the device comparison module for information comparison with the device whitelist. If the device information cannot be identified, the information of the pre-access device is pushed to the behavior analysis module for behavior analysis. The device comparison module is used to compare the device information of the identifiable pre-access device with the device information in the device whitelist. If the device information of the pre-access device matches the device whitelist, the pre-access device is allowed to access the nuclear security network through the edge controller. If the device information of the pre-access device does not match the device whitelist, the information of the pre-access device is pushed to the behavior analysis module for behavior analysis; The behavior analysis module is used to perform behavior analysis on the received behavior information of the pre-access device, analyze, split, and identify the behavior of the pre-access device within a preset period to obtain a behavior analysis result, and send the behavior analysis result to the behavior comparison module, the behavior analysis result includes multiple split behaviors; The behavior comparison module is used to compare the received behavior analysis results with the behavior security baseline. If each split behavior included in the behavior analysis result completely passes the behavior security baseline detection, the pre-access device corresponding to the behavior analysis result is allowed to access the nuclear security network through the edge controller. If one or more split behaviors included in the behavior analysis result fail to pass the behavior security baseline detection, the pre-access device corresponding to the behavior analysis result is denied access to the nuclear security network.

2. The system according to claim 1, characterized in that The system also includes: a device whitelist update module; The device whitelist update module is used to add the device information of the pre-access device to the device whitelist when the pre-access device is determined to be able to access the nuclear security network through the edge controller and the device whitelist does not contain the device information of the pre-access device.

3. A security network terminal security access control system for nuclear facilities, characterized in that: The system includes: a plurality of edge controllers, a central server and a nuclear security network; Each edge controller provides a physical interface for realizing physical connection between the pre-access equipment and the nuclear security network; the central server is connected to the plurality of edge controllers respectively; Each edge controller includes: a first device whitelist preset module, a first device identification module, a first device comparison module, and a first device whitelist update module; The central server includes: a second device whitelist preset module, a second device identification module, a second device comparison module, a behavior security baseline module, a behavior analysis module, a behavior comparison module, and a second device whitelist update module; A first device whitelist preset module of each edge controller is used to obtain data of security devices known by the edge controller to be securely connected to the nuclear security network to form a local device whitelist; The second device whitelist preset module is used to obtain data of security devices that are known to be able to securely access the nuclear security network to form a global device whitelist; The behavior security baseline module is used to obtain the security behaviors performed by known security devices to form a behavior security baseline; The first device identification module of each edge controller is used to identify the device according to the information report of the pre-access device submitted to the edge controller for authentication and the device data characteristics. If the device information can be identified, the identified device information is pushed to the first device comparison module for information comparison with the local device whitelist; if the device information cannot be identified, the information of the pre-access device is pushed to the device identification module of the central server for device identification; The first device comparison module of each edge controller is used to compare the received device information of the pre-access device with the local device whitelist. If the device information of the pre-access device matches the local device whitelist, the pre-access device is connected to the nuclear security network through the edge controller. If the device information of the pre-access device does not match the local device whitelist, the information of the pre-access device is pushed to the second device comparison module; The device identification module of the central server is used to identify the information reported by the pre-access device and the device data characteristics that the edge controller cannot identify. If the device information can be identified, the identified device information is pushed to the device comparison module of the central server for information comparison with the global device whitelist; if the device information cannot be identified, the information of the pre-access device is pushed to the behavior analysis module for behavior analysis; The second device comparison module is used to compare the device information of the identifiable pre-access device with the device information in the global device whitelist. If the device information of the pre-access device matches the global device whitelist, the pre-access device is connected to the nuclear security network through the edge controller. If the device information of the pre-access device does not match the global device whitelist, the information of the pre-access device is pushed to the behavior analysis module for behavior analysis; The behavior analysis module is used to perform behavior analysis on the received behavior information of the pre-access device, analyze, split, and identify the behavior of the pre-access device within a preset period to obtain a behavior analysis result, and send the behavior analysis result to the behavior comparison module, the behavior analysis result includes multiple split behaviors; The behavior comparison module is used to compare the received behavior analysis result with the behavior security baseline. If each split behavior included in the behavior analysis result completely passes the behavior security baseline detection, the pre-access device corresponding to the behavior analysis result is connected to the nuclear security network through the edge controller submitted for authentication by the pre-access device. If one or more split behaviors included in the behavior analysis result fail to pass the behavior security baseline detection, the pre-access device corresponding to the behavior analysis result is denied access to the nuclear security network.

4. The system according to claim 3, characterized in that Each edge controller in the system further includes a first device whitelist update module, and the central server further includes a second device whitelist update module; A first device whitelist updating module is configured to add the device information of the pre-access device to the local device whitelist when the pre-access device is determined to be able to access the nuclear security network through the edge controller and the local device whitelist of the edge controller for which the pre-access device applies for authentication does not include the device information of the pre-access device; The second device whitelist update module is used to add the device information of the pre-access device to the global device whitelist when the pre-access device is determined to be able to access the nuclear security network through the edge controller and the global device whitelist does not contain the device information of the pre-access device.

5. A security access control method for security network terminals of nuclear facilities, characterized in that: The method is implemented based on the system according to claim 1 or 2, and the method comprises: Step 11, obtaining data of security devices that are known to be able to securely access the nuclear security network and forming a device whitelist; Step 12, obtaining the security behaviors performed by known security devices to form a behavioral security baseline; Step 13: perform device identification based on the information reported by the pre-access device and the device data characteristics. If the device information can be identified, compare the identified device information with the device whitelist. If the device information cannot be identified, perform behavior analysis on the behavior information of the pre-access device. Step 14, comparing the device information of the identifiable pre-access device with the device information in the device whitelist. If the device information of the pre-access device matches the device whitelist, the pre-access device is allowed to access the nuclear security network through the edge controller. If the device information of the pre-access device does not match the device whitelist, a behavior analysis is performed on the behavior information of the pre-access device. Step 15, performing behavior analysis on the received behavior information of the pre-access device, analyzing, splitting, and identifying the behavior of the pre-access device within a preset period to obtain a behavior analysis result, and sending the behavior analysis result to the behavior comparison module, the behavior analysis result includes multiple split behaviors; Step 16, compare the received behavior analysis results with the behavior security baseline. If all the split behaviors contained in the behavior analysis results pass the behavior security baseline detection, the pre-access device corresponding to the behavior analysis results is allowed to access the nuclear security network through the edge controller. If one or more split behaviors contained in the behavior analysis results fail to pass the behavior security baseline detection, the pre-access device corresponding to the behavior analysis results is denied access to the nuclear security network.

6. The method according to claim 5, characterized in that The method further comprises: Step 17: When the pre-access device is determined to be able to access the nuclear security network through the edge controller and the device whitelist does not contain the device information of the pre-access device, the device information of the pre-access device is added to the device whitelist.

7. A security access control method for security network terminals of nuclear facilities, characterized in that: The method is implemented based on each edge controller in the system of claim 3 or 4, and the method comprises: Step 21, the edge controller obtains data of security devices known by the edge controller to be securely connected to the nuclear security network, and forms a local device whitelist; Step 22, the edge controller identifies the device according to the information reported by the pre-access device submitted to the edge controller for authentication and the device data characteristics. If the device information can be identified, the identified device information is compared with the local device whitelist; if the device information cannot be identified, the information of the pre-access device is pushed to the central server for device identification; In step 23, each edge controller compares the device information of the received pre-access device with the local device whitelist. If the device information of the pre-access device matches the local device whitelist, the pre-access device is connected to the nuclear security network through the edge controller. If the device information of the pre-access device does not match the local device whitelist, the information of the pre-access device is pushed to the central server.

8. The method according to claim 7, characterized in that The method further comprises: Step 24: When the pre-access device is determined to be able to access the nuclear security network through the edge controller and the local device whitelist of the edge controller for which the pre-access device applies for authentication does not include the device information of the pre-access device, the edge controller adds the device information of the pre-access device to the local device whitelist.

9. A security access control method for security network terminals of nuclear facilities, characterized in that: The method is implemented based on the central server in the system of claim 3 or 4, and the method comprises: Step 31, the central server obtains data of security devices that are known to be able to securely access the nuclear security network, and forms a global device whitelist; Step 32, the central server obtains the security behaviors performed by the known security devices to form a behavior security baseline; Step 33, the central server performs device identification on the information reported by the pre-access device that the edge controller cannot identify and the device data characteristics. If the device information can be identified, the identified device information is compared with the global device whitelist; if the device information cannot be identified, the behavior information of the pre-access device is analyzed; Step 34, the central server compares the device information of the identifiable pre-access device with the device information in the global device whitelist. If the device information of the pre-access device matches the global device whitelist, the pre-access device is connected to the nuclear security network through the edge controller. If the device information of the pre-access device does not match the global device whitelist, the behavior information of the pre-access device is analyzed; Step 35, the central server performs behavior analysis on the behavior information of the pre-access device that cannot be included in the global device whitelist, analyzes, splits, and identifies the behavior of the pre-access device within a preset period to obtain a behavior analysis result, and sends the behavior analysis result to the behavior comparison module, the behavior analysis result includes multiple split behaviors; Step 36, compare the received behavior analysis results with the behavior security baseline. If the split behaviors contained in the behavior analysis results completely pass the behavior security baseline detection, the pre-access device corresponding to the behavior analysis result is connected to the nuclear security network through the edge controller to which the pre-access device submits authentication. If one or more split behaviors contained in the behavior analysis results fail to pass the behavior security baseline detection, the pre-access device corresponding to the behavior analysis result is denied access to the nuclear security network.

10. The method according to claim 9, characterized in that The method further comprises: Step 37: When the pre-access device is determined to be able to access the nuclear security network through the edge controller and the global device whitelist does not contain the device information of the pre-access device, the central server adds the device information of the pre-access device to the global device whitelist.

11. A security network terminal security access control device for nuclear facilities, characterized in that: The device comprises: processor; a memory for storing processor-executable instructions; The processor is configured to execute the method of claim 5 or 6; or The processor is configured to perform the method of claim 7 or 8; or The processor is configured to perform the method of claim 9 or 10.

12. A non-volatile computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method according to claim 5 or 6 is implemented; or When the computer program instructions are executed by a processor, the method according to claim 7 or 8 is implemented; or When the computer program instructions are executed by a processor, the method according to claim 9 or 10 is implemented.

Images