Ship industrial control system safety protection method

Abstract

The invention discloses a safety protection method for a ship industrial control system, and the method comprises the following steps: 1, access control and authority management: carrying out the identity verification, carrying out the identity verification of a user of the ship industrial control system, allowing the access if the identity verification is passed, and carrying out the collection and analysis of the collected user authority information, and carrying out the user authority control; 2, data encryption: carrying out transmission encryption on data in the industrial control system; step 3, vulnerability repair: checking vulnerabilities of the ship industrial control system, updating patches, and repairing the vulnerabilities; 4, performing intrusion detection and protection on the control system; 5, carrying out safety training and management on system users; and 6, collecting safety related information of the ship industrial control system regularly, and analyzing the safety related information to obtain safety warning information. According to the invention, more comprehensive safety protection of the ship industrial control system can be realized, and safe and stable operation of the ship industrial control system is ensured.

Description

Technical Field

[0001] The present invention relates to the field of security protection, and in particular to a security protection method for a ship industry control system. Background Art

[0002] Ship industrial control system refers to a set of automated and intelligent control systems used in ship manufacturing, operation and management. These systems cover all aspects of ships, from ship design, construction to navigation and maintenance, to ensure the safe, efficient and environmentally friendly operation of ships; During actual use, the ship's industrial control system needs to be protected to ensure its information security, thereby further ensuring the stable operation of the ship's industrial control system. During the security protection process, security protection methods will be used.

[0003] The existing security protection methods have a single protection type, resulting in poor overall protection effect and failing to meet actual protection needs, which has a certain impact on the use of security protection methods. Therefore, a ship industrial control system security protection method is proposed. Summary of the invention

[0004] The technical problem to be solved by the present invention is: how to solve the problem that the existing security protection method has a single protection type, resulting in poor overall protection effect and failure to meet actual protection needs, which has a certain impact on the use of the security protection method. A ship industrial control system security protection method is provided.

[0005] The present invention solves the above technical problems through the following technical solutions, and the present invention comprises the following steps: Step 1: Access control and authority management: identity authentication, to authenticate the users of the ship industrial control system. If the identity authentication is passed, access is allowed. At the same time, the user authority information is collected and analyzed to control the user authority. Step 2: Data encryption, encrypting the data in the industrial control system during transmission; Step 3: Vulnerability repair, check the vulnerabilities of the ship industrial control system, update the patches, and repair the vulnerabilities; Step 4: Perform intrusion detection and protection on the control system; Step 5: Provide security training and management for system users; Step 6: Regularly collect information related to the safety of ship industrial control systems, analyze the safety-related information, and obtain safety warning information.

[0006] Furthermore, the authentication method for authenticating the user of the ship industrial control system includes: user name and password, fingerprint recognition, smart card / token and biometric recognition; The specific process of the identity authentication is as follows: the user selects any one of the following according to the actual situation: a user name and password, fingerprint recognition, smart card / token and biometric recognition for initial recognition; After the initial identification is passed, a second identification method other than the initial identification method is selected from the user name and password, fingerprint identification, smart card / token and biometric identification. If the second verification is passed, the identity authentication information is generated to allow the user to use the ship industrial control system; The specific process of the user authority control is as follows: extracting the collected user authority information, the user authority information including the user authority level information and the number of identity authentication failures within the preset time period, calculating the ratio of the number of identity authentication failures within the preset time period to the preset time period, and obtaining the evaluation parameters; User levels include primary users, secondary users, and tertiary users; When the user level is a first-level user and the evaluation parameter is greater than the preset value, the user will be downgraded to a second-level user; When the user level is a level 2 user and the evaluation parameter is greater than the preset value, the user will be downgraded to a level 3 user; When the user level is a third-level user and the evaluation parameter is continuously greater than the preset value for more than the preset number of times, the authorization will be stopped.

[0007] Furthermore, when the second verification fails, no matter what the first two verification methods are, the biometric method is selected to perform identity authentication again. When the identity authentication passes, the user is allowed to use the ship industrial control system. When the identity authentication fails, a personnel abnormal warning message is generated to issue a warning.

[0008] Furthermore, the specific process of data encryption is as follows: Select a secure transmission protocol. Select a suitable secure transmission protocol based on the needs and security requirements of the ship's industrial control system; Key generation and exchange, asymmetric key generation: Each of the communicating parties generates a pair of public and private keys; Key exchange: Through a secure key exchange protocol, both parties can exchange key information securely, ensuring the security of subsequent encrypted communications; Data encryption: content encryption, using the encryption algorithm agreed upon by both parties to encrypt the data to be transmitted. The encrypted content includes control instructions, status information, and sensor data; Integrity protection: In addition to data encryption, message authentication code or digital signature technology is also used to protect the integrity of data; Establish an encrypted channel for data transmission: Based on the SSL / TLS protocol, after an encrypted communication channel is established between the two communicating parties, the sender sends the encrypted data to the receiver through the encrypted channel; Perform data decryption and verification, receive encrypted data, the receiver receives the encrypted data from the encrypted channel, and then decrypts the data. Using its own private key and the previously negotiated encryption algorithm, the receiver decrypts the received encrypted data, restores the original data, and finally verifies the data: the receiver can also verify the integrity and source reliability of the data based on the message authentication code or digital signature.

[0009] Furthermore, the specific process of the vulnerability repair is as follows: First, vulnerability identification and vulnerability classification are carried out: the vulnerabilities in industrial control systems are divided into two categories: software vulnerabilities and hardware vulnerabilities; Vulnerability assessment: Evaluate identified vulnerabilities to determine their severity and scope of impact; Use vulnerability repair software to repair vulnerabilities and promptly install patches and updates released by vendors for known software vulnerabilities; Hardware vulnerability repair: Firmware updates are performed for firmware issues of hardware devices; Hardware replacement: When the hardware has design defects that cannot be fixed by firmware updates, the hardware device is replaced; Reinforcement measures Security isolation: Use security isolation devices to isolate industrial control systems from external networks such as the Internet; Verification and testing verify the repair effect: verify and test the repaired system, and complete the vulnerability repair process after the verification test passes.

[0010] Furthermore, the specific process of intrusion detection and protection of the control system is as follows: First, deploy the intrusion detection system and select IDS technology. Based on the characteristics and needs of the ship industrial control system, select the intrusion detection technology. The intrusion detection technology includes host-based IDS, network-based IDS or hybrid IDS. Deploy IDS: Deploy IDS at the preset location of the system; Information collection: IDS collects information from multiple sources, including system and network logs, unexpected changes in directories and files, unexpected behavior in program behavior, and physical intrusion information; Data analysis: IDS analyzes the collected information to look for anomalies or signs of attack, which may include pattern matching, statistical analysis, or machine learning techniques; In anomaly detection and misuse detection, anomaly detection: by establishing a model of normal system access behavior, detect behaviors that do not conform to the model; Misuse detection: Detects possible attacks by matching known unacceptable behavior patterns; Intrusion response, alert generation: When the IDS detects an intrusion, it generates an alert to notify the administrator; Response strategy: The administrator takes appropriate response strategies based on the alarm information; Protection strategy update and maintenance: Regularly update the IDS rule base and engine; Network isolation: Use network isolation technology to isolate the ship's industrial control system from the external network; Security Audit: Regularly conduct security audits on ship industrial control systems to identify potential security vulnerabilities and risks, and make repairs and improvements.

[0011] Furthermore, the specific process of conducting safety training for system users is as follows: Conduct security protection tests on system users regularly to obtain their security test scores. Continuously collect x security test scores of system users, remove the maximum and minimum values ​​of the x security test scores of system users, and then calculate the average of the remaining security test scores of system users, that is, obtain the security training assessment score of a single person. When the security training assessment score of a single person is less than the preset value, generate personnel training information and send it to the person to prompt him or her to undergo security training.

[0012] Furthermore, the specific process of analyzing the security related information and obtaining the security warning information is as follows: extracting the collected security related information, the security related information including the number of abnormal network fluctuations of the ship industrial control system within a preset time period, the number of attacks on the ship industrial control system network and the number of attacks on the ship industrial control system database; Extract and mark the number of abnormal network fluctuations of the ship industrial control system within a preset time as U1, the number of times the ship industrial control system network is attacked as U2, and the number of times the ship industrial control system database is attacked as U3; Assign a correction value Q1 to U1, a correction value Q2 to U2, and a correction value Q3 to U3, Q1+Q2+Q3=1, Q3>Q1>Q2; Through the formula U1*Q1+U2*Q2+U3*Q3=Uu, the protection assessment parameter Uu is obtained; When the protection assessment parameter Uu is greater than the preset value, a safety warning message is generated.

[0013] Compared with the prior art, the present invention has the following advantages: the ship industrial control system security protection method can greatly improve the security and stability of the ship industrial control system and prevent unauthorized access by implementing an effective identity authentication strategy: identity authentication can ensure that only authorized and verified users can access the ship industrial control system. By verifying the identity of the user, the system can ensure that only legitimate users can access and operate the user's personal data and the key assets of the ship industrial control system. This helps prevent data leakage, tampering or destruction, protects the core interests of the enterprise, and improves system security. The setting of encrypted transmission can ensure that the data in the ship industrial control system is protected during the transmission process. Even if the data is intercepted, unauthorized users cannot decrypt and obtain sensitive information therein. This greatly improves the security of the data and reduces the risk of data leakage. This helps to improve the security of the entire ship industrial control system; Intrusion detection is carried out to monitor the network activities of the ship's industrial control system in real time, and detect and identify any potential malicious behavior or threats. This real-time monitoring can ensure that the threat is responded to as soon as it occurs, thereby reducing the impact of security incidents. Through intrusion detection, the system can identify and block unauthorized access, malware, phishing and other attack methods, thereby effectively protecting the data security and system stability of the ship's industrial control system. This can not only prevent data leakage and destruction, but also ensure the normal operation of the control system, making this method more worthy of promotion and use. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 It is the overall flow chart of the present invention. DETAILED DESCRIPTION

[0015] The following is a detailed description of an embodiment of the present invention. This embodiment is implemented on the premise of the technical solution of the present invention, and a detailed implementation method and a specific operation process are given, but the protection scope of the present invention is not limited to the following embodiment.

[0016] like Figure 1 As shown, this embodiment provides a technical solution: a ship industrial control system security protection method, comprising the following steps: Step 1: Access control and authority management: identity authentication, to authenticate the users of the ship industrial control system. If the identity authentication is passed, access is allowed. At the same time, the user authority information is collected and analyzed to control the user authority. Step 2: Data encryption, encrypting the data in the industrial control system during transmission; Step 3: Vulnerability repair, check the vulnerabilities of the ship industrial control system, update the patches, and repair the vulnerabilities; Step 4: Perform intrusion detection and protection on the control system; Step 5: Provide security training and management for system users; Step 6: Regularly collect information related to the safety of ship industrial control systems, analyze the safety-related information, and obtain safety warning information.

[0017] The authentication methods for authenticating the user of the ship industrial control system include: user name and password, fingerprint recognition, smart card / token and biometric recognition; The specific process of the identity authentication is as follows: the user selects any one of the following according to the actual situation: a user name and password, fingerprint recognition, smart card / token and biometric recognition for initial recognition; After the initial identification is passed, a second identification method other than the initial identification method is selected from the user name and password, fingerprint identification, smart card / token and biometric identification. If the second verification is passed, the identity authentication information is generated to allow the user to use the ship industrial control system; The specific process of the user authority control is as follows: extracting the collected user authority information, the user authority information including the user authority level information and the number of identity authentication failures within the preset time period, calculating the ratio of the number of identity authentication failures within the preset time period to the preset time period, and obtaining the evaluation parameters; User levels include primary users, secondary users, and tertiary users; When the user level is a first-level user and the evaluation parameter is greater than the preset value, the user will be downgraded to a second-level user; When the user level is a level 2 user and the evaluation parameter is greater than the preset value, the user will be downgraded to a level 3 user; When the user level is a level 3 user and the evaluation parameter exceeds the preset value for more than the preset number of times, the authorization will be stopped; Authentication is the process of confirming the identity of a user, ensuring that only authorized users can access the system. In industrial control systems, authentication usually uses the following methods: Username and password: The most common authentication method. Users need to provide a pre-set username and password to log in to the system. To improve security, passwords should be changed regularly and require a certain level of complexity.

[0018] Fingerprint recognition: Utilizes the user's fingerprint for authentication. This method is more secure than username and password because fingerprints are unique and difficult to copy.

[0019] Smart Card / Token: The user needs to carry a physical device (such as a smart card or token) containing specific information for authentication. The device can interact with the system to verify the user's identity.

[0020] Biometrics: more advanced authentication methods including facial recognition, iris recognition, etc. These methods use the user's biometrics for authentication and have higher security.

[0021] Permission management is the process of assigning appropriate access rights and resource usage rights to users based on their identities and roles. In industrial control systems, permission management should follow the following principles: The principle of least privilege: users are granted only the minimum permissions required to complete their tasks. This reduces the risk of potential attacks because even if an attacker successfully breaks into the system, they will only have access to limited resources.

[0022] Role separation: Separate the permissions of different roles (such as operators, engineers, administrators, etc.). This can prevent abuse of permissions and misoperation and improve the security of the system.

[0023] Permissions review: Regularly review user permission settings to ensure they still meet the organization's security policies and business needs. If a user's role or responsibilities change, their permission settings should be updated in a timely manner.

[0024] Access audit: Record user access activities and operation logs to track and investigate when security incidents occur. This helps to identify potential security issues and take corrective measures in a timely manner.

[0025] By implementing effective authentication and permission management strategies, industrial control systems can greatly improve their security and stability. At the same time, in order to cope with increasingly complex network security threats, organizations should also take other security measures, such as regularly updating software patches, using secure communication protocols, deploying firewalls and intrusion detection systems, etc. Prevent unauthorized access: Authentication ensures that only authorized and verified users can access the ship's industrial control system. This prevents unauthorized personnel, such as hackers, malicious users, or unauthorized internal employees, from accessing sensitive information or performing malicious actions.

[0026] Improve system security: Authentication is an important part of system security. By verifying the user's identity, the system can detect and prevent intrusion by malicious users or attackers, reduce security vulnerabilities and potential security risks. This helps improve the security of the entire ship industrial control system.

[0027] When the secondary verification fails, no matter what the first two verification methods are, the biometric method is selected to perform identity authentication again. When the identity authentication passes, the user is allowed to use the ship industrial control system. When the identity authentication fails, a personnel abnormality warning message is generated to issue a warning.

[0028] The specific process of data encryption is as follows: Select a secure transmission protocol First, according to the needs and security requirements of the ship industrial control system, select a suitable secure transmission protocol, such as SSL / TLS (Secure Sockets Layer / Transport Layer Security Protocol).

[0029] Key generation and exchange Asymmetric key generation: A pair of public and private keys is generated by each of the communicating parties (such as the ship control center and the remote terminal).

[0030] Key exchange: Through secure key exchange protocols (such as Diffie-Hellman key exchange), the communicating parties can securely exchange key information to ensure the security of subsequent encrypted communications.

[0031] Data encryption Content encryption: Use the encryption algorithm (such as AES) agreed upon by both parties to encrypt the data to be transmitted. The data here can include control instructions, status information, sensor data, etc.

[0032] Integrity protection: In addition to data encryption, message authentication code (MAC) or digital signature technology can also be used to ensure data integrity and source authenticity.

[0033] Data Transfer Establish an encrypted channel: Based on the SSL / TLS protocol, an encrypted communication channel is established between the two communicating parties. This channel will ensure the confidentiality and integrity of the data during transmission.

[0034] Sending encrypted data: Through the encrypted channel, the sender sends the encrypted data to the receiver.

[0035] Data decryption and verification Receiving encrypted data: The receiver receives the encrypted data from the encrypted channel.

[0036] Decrypting data: Using its own private key and the previously negotiated encryption algorithm, the recipient decrypts the received encrypted data and restores the original data.

[0037] Data Authentication: The receiver can also verify the integrity and source authenticity of the data based on a message authentication code or digital signature.

[0038] Key update and management Update keys regularly: To further improve security, both parties should update keys regularly to avoid security risks caused by long-term use of the same key.

[0039] Key management: Use secure key management methods to ensure secure storage, transmission, and update of keys.

[0040] Security audit and monitoring Conduct security audits and monitoring on the entire encrypted transmission process to ensure the compliance and security of encrypted transmission.

[0041] Detect and respond to potential security threats and attacks in a timely manner.

[0042] Through the above steps, the ship industrial control system can realize data encryption transmission, ensure the confidentiality, integrity and source reliability of data during transmission, thereby improving the security of the entire system.

[0043] Encrypted transmission can ensure that the data in the ship industrial control system is protected during transmission. Even if the data is intercepted, unauthorized users cannot decrypt and obtain sensitive information. This greatly improves data security and reduces the risk of data leakage.

[0044] The specific process of remediating the vulnerability is as follows: First, vulnerability identification and vulnerability classification are carried out: the vulnerabilities in industrial control systems are divided into two categories: software vulnerabilities and hardware vulnerabilities; Vulnerability assessment: Evaluate identified vulnerabilities to determine their severity and scope of impact; Use vulnerability repair software to repair vulnerabilities and promptly install patches and updates released by vendors for known software vulnerabilities; Hardware vulnerability repair: Firmware updates are performed for firmware issues of hardware devices; Hardware replacement: When the hardware has design defects that cannot be fixed by firmware updates, the hardware device is replaced; Reinforcement measures Security isolation: Use security isolation devices to isolate industrial control systems from external networks such as the Internet; Verification and testing verify the repair effect: verify and test the repaired system, and complete the vulnerability repair process after the verification test passes.

[0045] The specific process of intrusion detection and protection of the control system is as follows: Intrusion Detection System (IDS) Deployment Select IDS technology: Based on the characteristics and requirements of the ship's industrial control system, select the appropriate intrusion detection technology. This may include host-based IDS, network-based IDS or hybrid IDS.

[0046] Deploy IDS: Deploy IDS at key locations in the system, such as gateways, behind firewalls, or network segments directly connected to important servers.

[0047] Intrusion Detection Process Information collection: IDS collects information from multiple sources, including system and network logs, unexpected changes in directories and files, unexpected behavior in program behavior, and physical intrusion information.

[0048] Data analysis: The IDS analyzes the collected information, looking for possible anomalies or signs of an attack. This may include pattern matching, statistical analysis, or machine learning techniques.

[0049] Anomaly detection and misuse detection: Anomaly detection: By establishing a model of normal system access behavior, it detects behaviors that do not conform to the model.

[0050] Misuse detection: Detects possible attacks by matching known unacceptable behavior patterns.

[0051] Intrusion Response Alert generation: When the IDS detects a possible intrusion, an alert is generated to notify the administrator.

[0052] Response strategy: Based on the alert information, the administrator takes appropriate response strategies, such as disconnecting, logging, notifying relevant personnel, or executing other automated response measures.

[0053] Protection strategy Updates and maintenance: Regularly update the IDS rule base and engine to ensure that it can detect the latest threats.

[0054] Network isolation: Use firewalls, VPNs or other network isolation technologies to isolate the ship's industrial control system from external networks to reduce potential attack surfaces.

[0055] Encrypted transmission: Encrypt key data for transmission to ensure the confidentiality and integrity of the data during transmission.

[0056] Access Control: Implement strict access control policies, including authentication, authorization, and auditing, to prevent unauthorized access and operations.

[0057] Security Audit: Regularly conduct security audits on ship industrial control systems to identify potential security vulnerabilities and risks, and make timely repairs and improvements.

[0058] Through the comprehensive application of the above steps, effective intrusion detection and protection of ship industrial control systems can be achieved, improving the security and stability of the system; Real-time threat detection: The intrusion detection system can monitor the network activities of the ship's industrial control system in real time, detect and identify any potential malicious behavior or threats. This real-time monitoring can ensure that the threat is responded to as soon as it occurs, thereby reducing the impact of security incidents.

[0059] Improve system security: Through intrusion detection, the system can identify and block unauthorized access, malware, phishing and other attack methods, thereby effectively protecting the data security and system stability of the ship's industrial control system. This can not only prevent data leakage and destruction, but also ensure the normal operation of the control system.

[0060] The specific process of conducting safety training for system users is as follows: Conduct security protection tests on system users regularly to obtain security test scores of system users. Continuously collect security test scores of system users x times, remove the maximum and minimum values ​​of the security test scores of system users x times, and calculate the average of the remaining security test scores of system users, that is, obtain the security training assessment score of a single person. When the security training assessment score of a single person is less than the preset value, generate personnel training information and send it to the person to prompt the person to undergo security training, x ≥ 10; Through the above process, we can understand whether the safety awareness of system users is in place, discover abnormalities in time and provide training reminders, thereby ensuring the information security protection of the ship industrial control system.

[0061] The specific process of analyzing the security related information and obtaining the security warning information is as follows: extracting the collected security related information, which includes the number of abnormal network fluctuations of the ship industrial control system within a preset time period, the number of attacks on the ship industrial control system network, and the number of attacks on the ship industrial control system database; Extract and mark the number of abnormal network fluctuations of the ship industrial control system within a preset time as U1, the number of times the ship industrial control system network is attacked as U2, and the number of times the ship industrial control system database is attacked as U3; Assign a correction value Q1 to U1, a correction value Q2 to U2, and a correction value Q3 to U3, Q1+Q2+Q3=1, Q3>Q1>Q2; Through the formula U1*Q1+U2*Q2+U3*Q3=Uu, the protection assessment parameter Uu is obtained; When the protection assessment parameter Uu is greater than the preset value, a safety warning message is generated; Through the above process, abnormalities of the ship industrial control system can be discovered in time and accurate warning prompts can be given.

[0062] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In the description of the present invention, the meaning of "plurality" is at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0063] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0064] Although the embodiments of the present invention have been shown and described above, it is to be understood that the above embodiments are exemplary and are not to be construed as limitations of the present invention. A person skilled in the art may change, modify, replace and vary the above embodiments within the scope of the present invention.

Claims

1. A method for protecting the safety of a ship industrial control system, characterized in that: The following steps are involved: Step 1: Access control and authority management: identity authentication, to authenticate the users of the ship industrial control system. If the identity authentication is passed, access is allowed. At the same time, the user authority information is collected and analyzed to control the user authority. Step 2: Data encryption, encrypting the data in the industrial control system during transmission; Step 3: Vulnerability repair, check the vulnerabilities of the ship industrial control system, update the patches, and repair the vulnerabilities; Step 4: Perform intrusion detection and protection on the control system; Step 5: Provide security training and management for system users; Step 6: Regularly collect information related to the safety of ship industrial control systems, analyze the safety-related information, and obtain safety warning information.

2. A method for protecting the safety of a ship industrial control system according to claim 1, characterized in that: The authentication methods for authenticating the user of the ship industrial control system include: user name and password, fingerprint recognition, smart card / token and biometric recognition; The specific process of the identity authentication is as follows: the user selects any one of the following according to the actual situation: a user name and password, fingerprint recognition, smart card / token and biometric recognition for initial recognition; After the initial identification is passed, a second identification method other than the initial identification method is selected from the user name and password, fingerprint identification, smart card / token and biometric identification. If the second verification is passed, the identity authentication information is generated to allow the user to use the ship industrial control system; The specific process of the user authority control is as follows: extracting the collected user authority information, the user authority information including the user authority level information and the number of identity authentication failures within the preset time period, calculating the ratio of the number of identity authentication failures within the preset time period to the preset time period, and obtaining the evaluation parameters; User levels include primary users, secondary users, and tertiary users; When the user level is a first-level user and the evaluation parameter is greater than the preset value, the user will be downgraded to a second-level user; When the user level is a level 2 user and the evaluation parameter is greater than the preset value, the user will be downgraded to a level 3 user; When the user level is a third-level user and the evaluation parameter is continuously greater than the preset value for more than the preset number of times, the authorization will be stopped.

3. A method for protecting the safety of a ship industrial control system according to claim 2, characterized in that: When the secondary verification fails, no matter what the first two verification methods are, the biometric method is selected to perform identity authentication again. When the identity authentication passes, the user is allowed to use the ship industrial control system. When the identity authentication fails, a personnel abnormality warning message is generated to issue a warning.

4. A method for protecting the safety of a ship industrial control system according to claim 1, characterized in that: The specific process of data encryption is as follows: Select a secure transmission protocol. Select a suitable secure transmission protocol based on the needs and security requirements of the ship's industrial control system; Key generation and exchange, asymmetric key generation: Each of the communicating parties generates a pair of public and private keys; Key exchange: Through a secure key exchange protocol, both parties can exchange key information securely, ensuring the security of subsequent encrypted communications; Data encryption: content encryption, using the encryption algorithm agreed upon by both parties to encrypt the data to be transmitted. The encrypted content includes control instructions, status information, and sensor data; Integrity protection: In addition to data encryption, message authentication code or digital signature technology is also used to protect the integrity of data; Establishing an encrypted channel for data transmission: Based on the SSL / TLS protocol, after an encrypted communication channel is established between the two communicating parties, the sender sends the encrypted data to the receiver through the encrypted channel; Perform data decryption and verification, receive encrypted data, the receiver receives the encrypted data from the encrypted channel, and then decrypts the data. Using its own private key and the previously negotiated encryption algorithm, the receiver decrypts the received encrypted data, restores the original data, and finally verifies the data: the receiver can also verify the integrity and source reliability of the data based on the message authentication code or digital signature.

5. A method for protecting the safety of a ship industrial control system according to claim 1, characterized in that: The specific process of remediating the vulnerability is as follows: First, vulnerability identification and vulnerability classification are carried out: the vulnerabilities in industrial control systems are divided into two categories: software vulnerabilities and hardware vulnerabilities; Vulnerability assessment: Evaluate identified vulnerabilities to determine their severity and scope of impact; Use vulnerability repair software to repair vulnerabilities and promptly install patches and updates released by vendors for known software vulnerabilities; Hardware vulnerability repair: Firmware updates are performed for firmware issues of hardware devices; Hardware replacement: When the hardware has design defects that cannot be fixed by firmware updates, the hardware device is replaced; Reinforcement measures Security isolation: Use security isolation devices to isolate the industrial control system from the external network; Verification and testing verify the repair effect: verify and test the repaired system, and complete the vulnerability repair process after the verification test passes.

6. A method for protecting the safety of a ship industrial control system according to claim 1, characterized in that: The specific process of intrusion detection and protection of the control system is as follows: First, deploy the intrusion detection system and select IDS technology. Based on the characteristics and needs of the ship industrial control system, select the intrusion detection technology. The intrusion detection technology includes host-based IDS, network-based IDS or hybrid IDS. Deploy IDS: Deploy IDS at the preset location of the system; Information collection: IDS collects information from multiple sources, including system and network logs, unexpected changes in directories and files, unexpected behavior in program behavior, and physical intrusion information; Data analysis: IDS analyzes the collected information to look for anomalies or signs of attack, which may include pattern matching, statistical analysis, or machine learning techniques; In anomaly detection and misuse detection, anomaly detection: by establishing a model of normal system access behavior, detect behaviors that do not conform to the model; Misuse detection: Detects possible attacks by matching known unacceptable behavior patterns; Intrusion response, alert generation: When the IDS detects an intrusion, it generates an alert to notify the administrator; Response strategy: The administrator takes appropriate response strategies based on the alarm information; Protection strategy update and maintenance: Regularly update the IDS rule base and engine; Network isolation: Use network isolation technology to isolate the ship's industrial control system from the external network; Security Audit: Regularly conduct security audits on ship industrial control systems to identify potential security vulnerabilities and risks, and make repairs and improvements.

7. A method for protecting the safety of a ship industrial control system according to claim 1, characterized in that: The specific process of conducting safety training for system users is as follows: Conduct security protection tests on system users regularly to obtain their security test scores. Continuously collect x security test scores of system users, remove the maximum and minimum values ​​of the x security test scores of system users, and then calculate the average of the remaining security test scores of system users, that is, obtain the security training assessment score of a single person. When the security training assessment score of a single person is less than the preset value, generate personnel training information and send it to the person to prompt him or her to undergo security training.

8. A method for protecting the safety of a ship industrial control system according to claim 1, characterized in that: The specific process of analyzing the security related information and obtaining the security warning information is as follows: extracting the collected security related information, which includes the number of abnormal network fluctuations of the ship industrial control system within a preset time period, the number of attacks on the ship industrial control system network, and the number of attacks on the ship industrial control system database; Extract and mark the number of abnormal network fluctuations of the ship industrial control system within a preset time as U1, the number of times the ship industrial control system network is attacked as U2, and the number of times the ship industrial control system database is attacked as U3; Assign a correction value Q1 to U1, a correction value Q2 to U2, and a correction value Q3 to U3, Q1+Q2+Q3=1, Q3>Q1>Q2; Through the formula U1*Q1+U2*Q2+U3*Q3=Uu, the protection assessment parameter Uu is obtained; When the protection assessment parameter Uu is greater than the preset value, a safety warning message is generated.

Images