Comprehensive bridge system with network security

Abstract

The invention discloses a comprehensive bridge system with network security, and the system is characterized in that two network switches and a firewall are in communication connection with each other to form a looped network, and the two network switches are in network line redundancy connection with a radar station, ship comprehensive data display equipment and a sea chart station; the sensor adapter and the antenna transceiver are both in communication connection with the same network switch, and the firewall comprises an intrusion detection system, an intrusion prevention system, a packet filtering system and a state detection system. According to the comprehensive bridge system with the network security, the stability of the comprehensive bridge system is ensured, and defense enhancement is performed on the boundary of the comprehensive bridge system, so that the comprehensive bridge system forms a multi-mode, multi-layer and functional complementary network security protection capability.

Description

Technical Field

[0001] The present invention relates to the technical field of ship network security, and in particular to an integrated bridge system with network security. Background Art

[0002] In international trade, most goods are transported by sea. As the world's largest supply chain structure, the digitalization of the shipping industry is becoming more and more perfect, but at the same time it is also subject to more and more cyber attacks and ransomware. As the core equipment of ship automation, the integrated bridge system has been widely used, but the existing integrated bridge system often has imperfect network security and is vulnerable to cyber attacks, which seriously affects the navigation safety of ships and asset security. Summary of the invention

[0003] In view of the defects existing in the prior art, the present application provides an integrated bridge system with network security to solve the technical problems in the prior art that the integrated bridge system is vulnerable to network attacks, seriously affecting the navigation safety of ships and asset security.

[0004] In order to achieve the purpose of the above invention, the technical solution provided by the present invention is as follows:

[0005] An integrated bridge system with network security, including two network switches, firewall, radar station, ship integrated data display equipment, chart station, sensor adapters and antenna transceiver;

[0006] The two network switches and the firewall are connected to each other in communication to form a ring network. The two network switches are redundantly connected to the radar station, the ship integrated data display device and the chart station network cable. The sensor adapter and the antenna transceiver are both connected to the same network switch in communication;

[0007] The firewall includes an intrusion detection system, an intrusion prevention system, a packet filtering system and a state detection system; the intrusion detection system can monitor network traffic and detect possible signs of attacks, and can provide real-time alarms and record attack activities; after detecting a potential network attack, the intrusion prevention system can automatically block the potential network attack and take emergency measures for the affected system; the packet filtering system can check the header information of each data packet and decide whether to allow the data packet to pass according to a predefined set of rules. If the data packet meets the rules for allowing passage, it will be forwarded; if the data packet does not meet the rules for allowing passage, it will be discarded; the state detection system distinguishes between legitimate network connections and malicious connections by tracking the connection status.

[0008] In one embodiment, the possible signs of attack include abnormal traffic patterns, known attack features, and behaviors that violate security policies; the potential network attacks include malicious traffic; and the header information includes source IP address, destination IP address, port number, and transport layer protocol.

[0009] In one embodiment, the switch and firewall are both configured to increase account management and password restrictions.

[0010] In one embodiment, the added account management and password restrictions include requiring customized accounts and password changes for switches and firewalls after installation; changing all default identity authentication information installed in the control system, with the password being a random number sequence; supporting the change and / or refresh of all identity authentication information, requiring the user to change the password the next time the user logs into the current account; and encrypting the authentication information during storage and transmission, to protect all authentication information from unauthorized disclosure and modification.

[0011] In one embodiment, the operating system of the integrated bridge system is accessible only to specific personnel, including maintainers and administrators.

[0012] In one embodiment, the external interface of the integrated bridge system is arranged inside the ship's control console, and the external interface is physically blocked.

[0013] In one embodiment, the physical blockage includes a lock disposed at the exit of the driving console, and only authenticated users can use a key to open the lock of the driving console and enter the driving console to use the mobile device.

[0014] In one embodiment, the external interface includes an external USB interface, which can intelligently identify and connect to a specific mobile device.

[0015] In one embodiment, the integrated bridge system includes an unlogged in state and a default state. When the user is not logged in, the integrated bridge system is in the unlogged in state. After the user logs in, the integrated bridge system is in the default state. In the default state, the integrated bridge system can only use basic functions within the specified time when the user is logged in. After the specified time, the integrated bridge system returns to the unlogged in state.

[0016] In one embodiment, the user can adjust the duration of the specified time when the integrated bridge system is in the default state, and the user can also manually log out of the current user through the interface to lock the session when the integrated bridge system is in the default state.

[0017] Compared with the prior art, this application has at least the following beneficial effects:

[0018] The integrated bridge system in this application is a ring network formed by two network switches and a firewall communicating with each other, and the equipment is redundantly connected to the two network switches through dual network cables. All devices in the ring network can obtain data from the integrated network, back up each other and switch functions in time. Even if there is a single point failure in the system, it will not affect the stability of the entire system, thus ensuring the stability of the integrated bridge system; the firewall in this application is equipped with an intrusion detection system, an intrusion prevention system, a packet filtering system and a status detection system to strengthen the defense of the integrated bridge system boundary. This application adds account management and password restrictions to the main equipment of the integrated bridge system, physically blocks the external interface, and sets the operation time and usage functions after the user logs into the system, reducing the possibility of damage to the integrated bridge system by personnel on board, so that the integrated bridge system forms a multi-mode, multi-level, and functionally complementary network security protection capability. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 It is a schematic diagram of the structure of an integrated bridge system with network security in an embodiment of the present application;

[0020] Figure numerals: 1. Network switch; 2. Firewall; 3. Radar station; 4. Ship integrated data display equipment; 5. Chart station; 6. Sensor adapter; 7. Antenna transceiver. DETAILED DESCRIPTION

[0021] In order to make the purpose, technical scheme and advantages of the present invention clearer, the present invention is described below by the specific embodiments shown in the accompanying drawings. However, it should be understood that these descriptions are only exemplary and are not intended to limit the scope of the present invention. In addition, in the following description, the description of well-known structures and technologies is omitted to avoid unnecessary confusion of the concept of the present invention.

[0022] The terms used in this disclosure are for the purpose of describing specific embodiments only and are not intended to limit the disclosure. The singular forms of "a", "said" and "the" used in this disclosure and the appended claims are also intended to include plural forms unless the context clearly indicates otherwise. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0023] It should be understood that although the terms first, second, third, etc. may be used in the present disclosure to describe various information, such information should not be limited to these terms and should not be understood as indicating or implying relative importance. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the present disclosure, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0024] In the description of the present invention, unless otherwise specified and limited, it should be noted that the terms "installed", "connected" and "connected" should be understood in a broad sense. For example, it can be a mechanical connection or the internal connection between two components. It can be a direct connection or an indirect connection through an intermediate medium. For ordinary technicians in this field, the specific meanings of the above terms can be understood according to the specific circumstances.

[0025] In order to better understand the technical solution of the present invention, the present invention is described in detail below with reference to the accompanying drawings.

[0026] like Figure 1 As shown, this embodiment provides an integrated bridge system with network security, including two network switches 1, a firewall 2, a radar station 3, a ship integrated data display device 4, a chart station 5, a sensor adapter 6 and an antenna transceiver 7, wherein the two network switches 1 and the firewall 2 communicate with each other to form a ring network, and the two network switches 1 are redundantly connected to the radar station 3, the ship integrated data display device 4 and the chart station 5 through network cables. In the ring network, the device is redundantly connected to the two network switches through dual network cables to ensure that there is still a backup line even if the network between the device and a switch fails, which will not affect the normal operation of the device. The entire system is connected in a ring under the premise of an integrated network to ensure the stability of information transmission. The key network components adopt a redundant design, and all devices in the ring network can obtain data from the integrated network, back up each other and switch functions in time to ensure that a single point failure will not affect the stability of the entire system. Among them, both dual network cables are gigabit network cables to transmit large communication data between devices.

[0027] In this embodiment, the firewall 2 includes an intrusion detection system, an intrusion prevention system, a packet filtering system and a state detection system. The intrusion detection system can monitor network traffic and detect possible signs of attacks, and can alarm and record attack activities in real time. Among them, possible signs of attacks include abnormal traffic patterns, known attack features and behaviors that violate security policies. After detecting potential network attacks, the intrusion prevention system can automatically block potential network attacks and take emergency measures for the affected systems. Among them, potential network attacks include malicious traffic. The packet filtering system can check the header information of each data packet and decide whether to allow the data packet to pass according to a predefined set of rules. Among them, the header information includes the source IP address, the destination IP address, the port number, the transport layer protocol, etc. If the data packet meets the rules for allowing passage, it is forwarded; if it does not meet the rules, it is discarded. The state detection system distinguishes between legitimate network connections and malicious connections by tracking the connection status.

[0028] In view of the dense and complex situation on the ship, the switch 1 and the firewall 2 in this embodiment are both provided with increased account management and password restrictions. The increased account management and password restrictions specifically include the need to customize accounts and modify passwords after the switch and firewall are installed; change all default identity authentication information installed by the control system, and the password is a random number sequence, thereby reducing the risk of malicious attacks on the integrated bridge system; support the change and / or refresh of all identity authentication information, and will require the user to change the password when the user logs in to the current account next time; the authentication information is encrypted when stored and transmitted, and the user account information is encrypted to protect all authentication information from unauthorized disclosure and modification.

[0029] The operating system of the integrated bridge system can only be accessed by specific personnel, including maintainers and administrators.

[0030] The external interface of the integrated bridge system is set inside the ship's control console, and the external interface is physically blocked. In this embodiment, the physical blockage includes a lock set at the exit of the control console. Only authenticated users can use the key to open the lock of the control console to enter the control console and use the mobile device. The external interface includes an external USB interface, which can intelligently identify and connect specific mobile devices, and the external USB interface can automatically filter unidentified mobile devices. Mobile devices include USB flash drives.

[0031] The integrated bridge system includes a non-logged in state and a default state. When the user is not logged in, the integrated bridge system is in the non-logged in state. After the user logs in, the integrated bridge system is in the default state. In the default state, the integrated bridge system can only use basic functions within the specified time of the user's login. After the specified time, the integrated bridge system returns to the non-logged in state. When the integrated bridge system is in the default state, the user can adjust the length of the specified time to complete the operation. The user can also manually log out of the current user through the interface when the integrated bridge system is in the default state to lock the session, so as to continue to complete the operation when logging in next time. In this embodiment, the length of the specified time is 30 minutes.

[0032] Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, ordinary technicians in the field should understand that the specific implementation methods of the invention can still be modified or some technical features can be replaced by equivalents without departing from the spirit of the technical solution of the present invention, which should be included in the scope of the technical solution for protection of the present invention.

Claims

1. An integrated bridge system with network security, characterized in that, Includes two network switches, firewall, radar station, ship integrated data display equipment, chart station, sensor adapter and antenna transceiver; The two network switches and the firewall are connected to each other in communication to form a ring network. The two network switches are redundantly connected to the radar station, the ship integrated data display device and the chart station network cable. The sensor adapter and the antenna transceiver are both connected to the same network switch in communication; The firewall includes an intrusion detection system, an intrusion prevention system, a packet filtering system and a state detection system; the intrusion detection system can monitor network traffic and detect possible signs of attacks, and can provide real-time alarms and record attack activities; after detecting a potential network attack, the intrusion prevention system can automatically block the potential network attack and take emergency measures for the affected system; the packet filtering system can check the header information of each data packet and decide whether to allow the data packet to pass according to a predefined set of rules. If the data packet meets the rules for allowing passage, it will be forwarded; if the data packet does not meet the rules for allowing passage, it will be discarded; the state detection system distinguishes between legitimate network connections and malicious connections by tracking the connection status.

2. The integrated bridge system according to claim 1, characterized in that: The possible signs of attack include abnormal traffic patterns, known attack features, and behaviors that violate security policies; the potential network attacks include malicious traffic; and the header information includes source IP address, destination IP address, port number, and transport layer protocol.

3. The integrated bridge system according to claim 1, characterized in that: The switch and firewall are both configured to increase account management and password restrictions.

4. The integrated bridge system according to claim 3, characterized in that: The added account management and password restrictions include the need to customize accounts and modify passwords after switches and firewalls are installed; change all default identity authentication information installed by the control system, and the password is a random number sequence; support changing and / or refreshing all identity authentication information, and will require the user to change the password the next time the user logs into the current account; Identification information is encrypted during storage and transmission, and user account information is encrypted to protect all identification information from unauthorized disclosure and modification.

5. The integrated bridge system according to claim 1, characterized in that: The operating system of the integrated bridge system can only be accessed by specific personnel, including maintainers and administrators.

6. The integrated bridge system according to claim 1, characterized in that: The external interface of the integrated bridge system is arranged inside the ship's control console, and the external interface is physically blocked.

7. The integrated bridge system according to claim 6, characterized in that: The physical blockage includes a lock arranged at the exit of the driving console. Only authenticated users can use a key to open the lock of the driving console and enter the driving console to use the mobile device.

8. The integrated bridge system according to claim 6, characterized in that: The external interface includes an external USB interface, and the external USB interface can intelligently identify and connect to a specific mobile device.

9. The integrated bridge system according to claim 8, characterized in that: The integrated bridge system includes an unlogged in state and a default state. When the user is not logged in, the integrated bridge system is in the unlogged in state. After the user logs in, the integrated bridge system is in the default state. In the default state, the integrated bridge system can only use basic functions within the specified time when the user logs in. After the specified time, the integrated bridge system returns to the unlogged in state.

10. The integrated bridge system according to claim 8, characterized in that: When the integrated bridge system is in the default state, the user can adjust the duration of the specified time. The user can also manually log out of the current user through the interface to lock the session when the integrated bridge system is in the default state.

Images