Safety protection method and system for cascade mutual trust of industrial Ethernet switches

Abstract

The invention discloses a security protection method for cascade mutual trust of industrial Ethernet switches. A communication path is ensured to be clear and controllable through physical connection and logic networking configuration; a unique identity label is provided for the switch by using the information label of the main device, and illegal access is prevented; a management port is monitored in real time through an equipment load security mirror image, and illegal equipment is found and processed in time; constructing a logic security chain model, and realizing a unified mutual trust mechanism of network equipment; and distributed decentralized storage is carried out by adopting a block chain technology, so that the data is ensured to be safe and cannot be tampered. The system comprises a device connection configuration module, a main device information label generation module, a trusted edge device access management module, a device load security mirror image management module, a device security portrait and logic security chain construction module, a data storage and security module and the like, provides comprehensive security protection for industrial Ethernet switch cascading, and ensures network stability and security.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a security protection method and system for cascading mutual trust of industrial Ethernet switches. Background Art

[0002] The power grid is currently expanding rapidly, and industrial Ethernet switches are responsible for important services such as power grid dispatching automation and relay protection. Due to the access of massive devices running in the distribution network, it is difficult to efficiently establish reliable interconnection and interoperability security for massive devices. Massive devices usually communicate through industrial Ethernet switches from multiple manufacturers. Various Ethernet switch devices are distributed in various power distribution rooms, roadside ring network cabinets, and street power boxes. They are exposed outdoors for a long time and face various security risks such as easy attacks by hackers and inadequate security protection.

[0003] The service ports of industrial Ethernet switches currently used in the network are mainly used for data exchange. Port management only provides basic console management port protection and web management functions. The main security threats are:

[0004] 1. After a normally functioning port service terminal is unplugged, it is easy for other illegal devices to access and continue to use it;

[0005] 2. After the upper and lower level cables of the running switch are replaced by illegal devices, the entire switch connection network is uncontrollable;

[0006] 3. There is no unified mutual trust mechanism between equipment models from multiple manufacturers.

[0007] Therefore, there is an urgent need for a new industrial Ethernet switch cascade mutual trust security protection method and security protection system. Summary of the invention

[0008] In order to solve the above problems, the present invention provides a security protection method and system for cascading mutual trust of industrial Ethernet switches, which realizes distributed identity authentication and authorization management of power Internet of Things devices based on blockchain technology, and uploads summaries of key data such as device interconnection relationships, operation records, linkage records, etc. to the chain, realizing port MAC, IP security binding, port timeout automatic shutdown and other functions.

[0009] A first aspect of an embodiment of the present invention discloses a security protection method for cascading mutual trust of industrial Ethernet switches, comprising the following steps:

[0010] Step S1: multiple industrial Ethernet switch devices are interconnected through physical media, and the switch devices are configured according to requirements to support a ring and / or chain logical networking structure;

[0011] Step S2: automatically generating a plurality of master device intelligence tags based on the device configuration information and status information of a plurality of industrial Ethernet switches;

[0012] Step S3: Generate a device load security image, and use the device load security image to monitor and record the status changes of the management port in real time;

[0013] Step S4: Establish a device security profile, which includes the main device intelligence tag generated in step S2 and the load security image generated in step S3, and build a logical security chain model of a ring network or a chain network based on the information of the device security profile, wherein the logical security chain model includes the evidence tag of the trusted data in the security profile;

[0014] Step S5: Based on the evidence tag of the trusted data generated in step S4, a mapping logic security chain is formed, and blockchain technology is used for distributed decentralized storage to ensure the security and non-tamperability of the data;

[0015] Step S6: Build a secure and trusted edge device access management system that can verify the identity and permissions of edge devices and establish a comprehensive security protection solution based on the system.

[0016] Preferably, the generation of the master device intelligence tag in step S2 includes the following steps:

[0017] The factory code, CPU, and motherboard information of the switch equipment are automatically collected through the equipment system, and the main equipment intelligence label is generated based on the universal national secret coding system.

[0018] Preferably, in step S3, "generating a device load security image, and using the device load security image to monitor and record the state changes of the management port in real time" includes the following steps:

[0019] Step S31: Automatically collect IP address and MAC address information of the connected load terminal on the industrial Ethernet switch device through ARP and broadcast technology;

[0020] Step S32: Based on the collected IP address and MAC address information, a device load security image is generated on the industrial Ethernet switch, where the security image is used to record and manage the network identity information of the access device;

[0021] Step S33: collecting and recording the status information of the device on the practical port in real time through the port monitoring mechanism, wherein the status information at least includes the data transmission status and the connection status;

[0022] Step S34: For ports that have not been used for a long time, the ports are automatically closed according to a preset configuration to save resources and enhance network security.

[0023] Preferably, the information of the device security portrait in step S4 includes at least the main intelligence tag, device security access, control, and cascade port information.

[0024] Preferably, the safety protection scheme in step S6 includes:

[0025] S61. When the load device of a port of the industrial Ethernet switch is replaced, the management system detects that the MAC address of the device connected to the port has changed, and actively stops the data interaction between the port and the switch; after the application for continued use is confirmed and verified by the management, the data transmission channel of the port is reopened;

[0026] S62. When a node device in a chain or ring is replaced, the upper device of the node automatically senses the change in the cascaded device information and automatically compares it with the logical security chain in the edge system. If illegal access is detected, other related devices are notified to prevent illegal device access;

[0027] S63. When the device does not interact with data within the set time period, the switch stops the data interaction of the port; when it is used again, the data transmission channel of the port is reopened after application and management confirmation and verification.

[0028] A second aspect of an embodiment of the present invention discloses a security protection system for cascading mutual trust of industrial Ethernet switches, characterized in that the system adopts the security protection method according to any one of claims 1 to 5, including:

[0029] The device connection and configuration module 100 is used to interconnect multiple industrial Ethernet switch devices through physical media, and configure the switch devices according to requirements to support a ring and / or chain logical networking structure;

[0030] The main device intelligence label generation module 200 automatically generates multiple main device intelligence labels based on the configuration information and status information of multiple industrial Ethernet switch devices, wherein the factory code, CPU, and motherboard information of the switch device are automatically collected through the device system, and the main device intelligence label is generated based on the universal national secret coding system;

[0031] The device load security image and management module 300 is used to generate a device load security image and use the image to monitor and record the status changes of the management port in real time

[0032] The device security portrait and logical security chain building module 400 is used to establish a device security portrait, which includes a main device intelligence tag and a load security image, and build a logical security chain model of a ring network or a chain network based on the information of the device security portrait, wherein the logical security chain model includes a storage tag of trusted data in the security portrait;

[0033] The data storage and security module 500 forms a mapping logic security chain based on the evidence tags of the trusted data, and uses blockchain technology for distributed decentralized storage to ensure the security and non-tamperability of the data;

[0034] The trusted edge device access management and security protection module 600 is used to build a secure trusted edge device access management system, which can verify the identity and authority of the edge device, and when illegal access or device replacement is detected, it will actively stop data interaction with illegal or unconfirmed devices, and reopen the data transmission channel after the application for continued use is confirmed and verified by the management.

[0035] Preferably, the trusted edge device access management and security protection module 600 is also used for: when a chain or ring node device is replaced, the upper-level device of the node automatically senses the change in the cascaded device information and automatically compares it with the logical security chain in the edge system. If illegal access is detected, other related devices are notified to prevent illegal device access; in addition, when the device has no data interaction within a set time period, the switch stops the data interaction of the port, and when it is used again, the data transmission channel of the port is reopened after application and management confirmation and verification.

[0036] Preferably, the main device intelligence label generation module 200 includes: an information management unit 201 for collecting and processing switch device information, and a coding unit 22 for generating a main device intelligence label based on a universal national secret coding system.

[0037] Preferably, the device load security image and management module 300 includes an ARP and broadcast unit 301 for collecting IP address and MAC address information, an image generation unit 302 for generating a device load security image, a port monitoring unit 303 for real-time monitoring and recording port status information, and a port management unit 304 for managing ports that have not been used for a long time.

[0038] Preferably, the trusted edge device access management and security protection module 600 includes a detection unit 601 for detecting and processing changes in the MAC address of the port-connected device, a perception and comparison unit 602 for automatically sensing and comparing device information changes, and an interaction status management unit 603 for managing the device data interaction status.

[0039] Compared with the prior art, the embodiments of the present invention have the following beneficial effects:

[0040] 1. Step S1 of the first embodiment of the present case ensures that the communication paths between switches are clear and controllable, thereby reducing potential security vulnerabilities, through the configuration of physical connections and logical networking structures. Step S2 provides each switch device with a unique identity through the automatically generated master device intelligence tag, which helps to identify and prevent illegal device access. Step S3 can promptly detect and handle the access of illegal devices through the generation and real-time monitoring of device load security images, preventing other illegal devices from accessing the port service terminal that is operating normally after being unplugged. Step S4 provides a unified mutual trust mechanism for ring or chain networks based on the information of device security portraits through the construction of a logical security chain model, solving the problem of no unified mutual trust mechanism between equipment models from multiple manufacturers. Moreover, the use of the evidence label and mapping logical security chain of trusted data in step S5 ensures the security and non-tamperability of the data, and enhances the mutual trust between network nodes.

[0041] 2. Through ARP (Address Resolution Protocol) and broadcast technology, the IP address and MAC address information of the load terminal connected to the industrial Ethernet switch can be automatically and quickly collected without manual intervention, which greatly saves time and labor costs. By automatically collecting the IP address and MAC address information of the access device and generating a device load security image, the legitimacy and security of the access device can be ensured. Through the port monitoring mechanism, the status information of the device on the practical port can be collected and recorded in real time, and abnormal status can be discovered and handled in time. By automatically closing ports that have not been used for a long time, resources are saved and network security is enhanced.

[0042] 3. The second embodiment of this case connects multiple switch devices through physical media through the setting of the device connection and configuration module, and supports ring and / or chain logical networking structures, providing a flexible and reliable connection foundation for the network. Through the setting of the main device intelligence label generation module, the factory code, CPU, motherboard information and other hardware features of the switch device are used, combined with the general national secret coding system to generate a unique main device intelligence label, which effectively prevents device impersonation and illegal access. Through the setting of the trusted edge device access management and security protection module, the identity and authority of the edge device can be verified, and illegal access or device replacement can be detected and prevented in time, ensuring the security of the network edge. Through the setting of the device load security image and management module, by generating the device load security image, real-time monitoring and recording the status changes of the management port, a comprehensive device status monitoring and management means is provided for the administrator. Through the setting of the device security portrait and logical security chain construction module, a device security portrait containing the main device intelligence label and the load security image is established, and a logical security chain model is constructed based on this information, so that the administrator can intuitively understand the status and security of the network device. Through the setting of data storage and security modules, blockchain technology is used for distributed decentralized storage to ensure the security and non-tamperability of data. At the same time, the mapping logic security chain is formed based on the evidence tags of trusted data, which provides strong support for data tracing and auditing. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0044] Figure 1 This is a schematic diagram of the logical networking structure described in step S1 of the first embodiment of the present invention;

[0045] Figure 2 This is a schematic diagram of the logical networking structure after a new switch G is illegally connected in accordance with the first embodiment of the present invention.

[0046] Figure 3 It is a structural block diagram of the second embodiment of the present invention. DETAILED DESCRIPTION

[0047] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0048] It should be noted that the terms "first", "second", "third", "fourth", etc. in the specification and claims of the present invention are used to distinguish different objects rather than to describe a specific order. The terms "including" and "having" in the embodiments of the present invention and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device including a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0049] The embodiment of the present invention discloses a security protection method and system for cascade mutual trust of industrial Ethernet switches, which can simplify the construction process of identification and improve identification efficiency, and is conducive to accurate tuning of the identification method in the later stage.

[0050] Embodiment 1

[0051] like Figure 1 to Figure 2 As shown, a security protection method for cascading mutual trust of industrial Ethernet switches includes the following steps:

[0052] Step S1: Connect multiple industrial Ethernet switch devices to each other through physical media such as Ethernet cables or optical fibers, and configure the switches to support ring and / or chain logical networking structures as required. At the same time, ensure that these switches establish communication connections with servers so that the servers can manage, control or process data from the industrial Ethernet.

[0053] Step S2: Industrial Ethernet switch devices A, B, C, D, K... automatically generate main device intelligence labels; generation method: the factory code, CPU, motherboard information and other information of the switch device are automatically collected through the device system, and the main device intelligence labels are generated based on the general national secret coding system. For example, the main intelligence label of device A: A-ID-d61 d6b69c7ee, the main intelligence label of device B: B-ID-55b11 dd1 c7b8....

[0054] Step S3: Generate a device load security image. Through ARP and broadcast technology, the industrial Ethernet switch automatically collects the IP address and MAC address of the connected load terminal to establish a device security image. Through the port monitoring mechanism, the status of the device in the practical port is collected. For ports that have not been used for a long time, they are automatically closed, such as supporting the configuration of a 1-minute timeout.

[0055] Step S4: Establish a device security profile and construct a logical security chain model of a ring network or a chain network. The device security profile contains the main device intelligence tag and the load security image, which describes important contents such as the main intelligence tag, device security access, control, and cascade port information. The logical security chain model mainly contains the evidence tag of the trusted data in the security profile. The device security profile contains information such as the identity information, operating status, and load status of the device, providing comprehensive data support for the security management of the device. In specific implementation, according to the topology of the network and the connection relationship between the devices, the trusted data evidence tags in the device security profile are connected to form one or more logical security chains. These security chains can be ring-shaped or chain-shaped, depending on the actual situation of the network and the security management requirements. Regularly verify the logical security chain to ensure that each evidence tag in the chain is authentic and valid. If a certain evidence tag in the chain is found to be tampered with or invalid, take corresponding measures to repair or replace it immediately. At the same time, the logical security chain needs to be regularly updated and maintained to adapt to changes in the network environment and device status. Among them, the attestation tag of trusted data is a special data identifier, which is generated based on the original information of the data and the attestation technology, and is used to prove the authenticity and integrity of the data.

[0056] Step S5: Based on the evidence tag of the trusted data, a mapping logical security chain is formed and managed on the chain. The logical security chain adopts distributed decentralized storage using blockchain technology to ensure the security and immutability of the data;

[0057] Step S6: Through the above steps, a secure and trusted edge device access management system is constructed. Based on this system, a security protection solution for industrial Ethernet switches based on a chain or ring network structure is established.

[0058] In the specific implementation, the collected main device intelligence tags and load security images are integrated to form a preliminary framework for the device security portrait. Through further data processing and analysis, the system can extract the key features of the device, such as the type, performance, and operating status of the device. These features will serve as the basis for the subsequent construction of the logical safety chain model. Based on the results of the above data processing and analysis, the system finally generates a security portrait of the device. This portrait not only contains the basic information and operating status of the device, but also reflects the overall safety and reliability of the device.

[0059] The logical safety chain model consists of multiple nodes, each of which represents an industrial Ethernet switch device. The nodes form a ring or chain network structure through physical connections and logical associations.

[0060] As described above, step S1 of this case ensures that the communication paths between switches are clear and controllable through the configuration of physical connections and logical networking structures, thereby reducing potential security vulnerabilities. Step S2 provides each switch device with a unique identity through the automatically generated master device intelligence tag, which helps to identify and prevent illegal device access. Step S3 can promptly detect and handle the access of illegal devices through the generation and real-time monitoring of device load security images, preventing other illegal devices from accessing the port service terminal that is operating normally after being unplugged. Step S4 provides a unified mutual trust mechanism for ring or chain networks based on the information of device security portraits through the construction of a logical security chain model, solving the problem of no unified mutual trust mechanism between equipment models from multiple manufacturers. Moreover, the use of the evidence label and mapping logical security chain of trusted data in step S5 ensures the security and non-tamperability of the data and enhances the mutual trust between network nodes.

[0061] The construction of a secure and trusted edge device access management system in step S6 can verify the identity and authority of edge devices, prevent access by illegal devices, and improve the stability and security of the network.

[0062] As a preferred implementation, the generation of the master device intelligence tag in step S2 includes the following steps:

[0063] The factory code, CPU, and motherboard information of the switch device are automatically collected through the device system, and the main device intelligence label is generated based on the universal national secret coding system. In this way, by collecting the hardware characteristics of the device such as the factory code, CPU, and motherboard information, and combining them with the universal national secret coding system for encryption processing, it can be ensured that each switch device has a unique main device intelligence label, which helps to accurately identify and track devices in the network and improve the accuracy and efficiency of device management. In addition, encryption technology is used in the generation process of the main device intelligence label, which increases the difficulty for illegal devices to forge or tamper with the label.

[0064] As a preferred implementation, further, in step S3, "generating a device load security image, and using the device load security image to monitor and record the state change of the management port in real time" includes:

[0065] S31: Automatically collect IP address and MAC address information of connected load terminals on the industrial Ethernet switch device through ARP (Address Resolution Protocol) and broadcast technology;

[0066] S32: Based on the collected IP address and MAC address information, a device load security image is generated on the industrial Ethernet switch. The security image is used to record and manage the network identity information of the access device. The device load security image reflects the current operating status and load conditions of the device, which helps to detect abnormal behavior of the device in a timely manner.

[0067] S33: collecting and recording the status information of the device on the practical port in real time through the port monitoring mechanism, wherein the status information at least includes data transmission status and connection status;

[0068] S34: For ports that have not been used for a long time, the port will be automatically closed according to the preset configuration, such as supporting the configuration of a 1-minute timeout shutdown, to save resources and enhance network security.

[0069] As mentioned above, through ARP (Address Resolution Protocol) and broadcast technology, the IP address and MAC address information of the load terminal connected to the industrial Ethernet switch can be automatically and quickly collected without manual intervention, which greatly saves time and labor costs. By automatically collecting the IP address and MAC address information of the access device and generating a device load security image, the legitimacy and security of the access device can be ensured. Through the port monitoring mechanism, the status information of the device on the practical port can be collected and recorded in real time, and abnormal status can be discovered and handled in time. By automatically closing ports that have not been used for a long time, resources are saved and the security of the network is enhanced.

[0070] As a preferred implementation, the information of the device security portrait in step S4 at least includes the main intelligence tag, device security access, control, and cascade port information. In this way, the main intelligence tag of the device is generated based on its factory code, CPU, motherboard information and other hardware features, ensuring that the identity of each device is unique, which helps to quickly identify and track devices in the network and prevent illegal devices from accessing and impersonating. The device security portrait contains the control information of the device, such as the configuration parameters and operating status of the device, which helps network administrators to carry out refined control and management of the device to ensure the normal operation and safety of the device. Through the cascade port information in the device security portrait, the connection relationship and topology of the device in the network can be clearly understood, which helps network administrators to promptly discover and solve potential problems in the network.

[0071] As a preferred implementation, the main contents of the security protection solution package in step S6 are as follows:

[0072] Step S61: When the load device of a port of the industrial Ethernet switch is replaced, the system detects that the MAC address of the device connected to the port has changed, and actively stops the data interaction between the port and the switch. After the application for continued use is confirmed and verified by the management, the data transmission channel of the port is reopened.

[0073] Step S62: When a chain or ring node device is replaced, the upper-level device of the node automatically senses the change in the cascaded device information and automatically compares it with the logical security chain in the edge system; Figure 2As shown in the figure, when the new switch G is illegally connected, the ports of industrial switch C and industrial switch D automatically detect that the access switch is illegal. They notify the edge node industrial switches A and B to prevent illegal devices from accessing, which reflects the system's strong emergency response and collaborative working capabilities.

[0074] Step S63: The device can set a time period for a period of time when no data interaction occurs, and the switch stops the data interaction of the port. When it is used again, after application and management confirmation and verification, the data transmission channel of the port is reopened.

[0075] As described above, through the setting of step S61, when the load device of a port of the industrial Ethernet switch is replaced, the system can detect the change of the MAC address and actively stop data interaction, effectively preventing the access of illegal devices and potential network attacks. Through the setting of step S62, when the node device in the chain or ring network is replaced, the upper device can automatically sense and respond, reflecting the system's powerful real-time monitoring and emergency response capabilities; and by automatically comparing with the logical security chain in the edge system, and notifying other related devices to prevent illegal access, the coordinated defense of network devices is achieved, and the overall security is enhanced, so that the access of illegal devices can be discovered and blocked in time, preventing potential network attacks and data leakage risks. Through the setting of step S63, for device ports that have not had data interaction for a long time, network resources can be saved and resource utilization can be improved by automatically stopping data interaction.

[0076] Embodiment 2

[0077] like Figure 3 As shown, a security protection system for cascading mutual trust of industrial Ethernet switches, the system adopts the security protection method described in the first embodiment of the claim, including:

[0078] The device connection and configuration module 100 is used to interconnect multiple industrial Ethernet switch devices through physical media, and configure the switch devices according to requirements to support a ring and / or chain logical networking structure;

[0079] The main device intelligence label generation module 200 automatically generates multiple main device intelligence labels based on the configuration information and status information of multiple industrial Ethernet switch devices, wherein the factory code, CPU, and motherboard information of the switch device are automatically collected through the device system, and the main device intelligence label is generated based on the universal national secret coding system;

[0080] The device load security image and management module 300 is used to generate a device load security image and use the image to monitor and record the status changes of the management port in real time

[0081] The device security portrait and logical security chain building module 400 is used to establish a device security portrait, which includes a main device intelligence tag and a load security image, and build a logical security chain model of a ring network or a chain network based on the information of the device security portrait, wherein the logical security chain model includes a storage tag of trusted data in the security portrait;

[0082] The data storage and security module 500 forms a mapping logic security chain based on the evidence tags of the trusted data, and uses blockchain technology for distributed decentralized storage to ensure the security and non-tamperability of the data;

[0083] The trusted edge device access management and security protection module 600 is used to build a secure trusted edge device access management system, which can verify the identity and authority of the edge device, and when illegal access or device replacement is detected, it will actively stop data interaction with illegal or unconfirmed devices, and reopen the data transmission channel after the application for continued use is confirmed and verified by the management.

[0084] As described above, in the second embodiment of the present case, multiple switch devices are connected through physical media through the setting of the device connection and configuration module, and a ring and / or chain logical networking structure is supported, providing a flexible and reliable connection foundation for the network. Through the setting of the main device intelligence label generation module, the factory code, CPU, motherboard information and other hardware features of the switch device are used, combined with the general national secret coding system to generate a unique main device intelligence label, which effectively prevents device impersonation and illegal access. Through the setting of the trusted edge device access management and security protection module, the identity and authority of the edge device can be verified, and illegal access or device replacement can be detected and prevented in time, ensuring the security of the network edge. Through the setting of the device load security image and management module, by generating the device load security image, the status changes of the management port are monitored and recorded in real time, providing administrators with comprehensive device status monitoring and management means. Through the setting of the device security portrait and logical security chain construction module, a device security portrait containing the main device intelligence label and the load security image is established, and a logical security chain model is constructed based on this information, so that administrators can intuitively understand the status and security of network devices. Through the setting of data storage and security modules, blockchain technology is used for distributed decentralized storage to ensure the security and non-tamperability of data. At the same time, the mapping logic security chain is formed based on the evidence tags of trusted data, which provides strong support for data tracing and auditing.

[0085] As a specific implementation method, the trusted edge device access management and security protection module 600 is also used for: when a chain or ring node device is replaced, the upper device of the node automatically senses the change in the cascaded device information and automatically compares it with the logical security chain in the edge system. If illegal access is detected, other related devices are notified to prevent illegal device access; in addition, when the device does not interact with data within a set time period, the switch stops the data interaction of the port, and when it is reused, it reopens the data transmission channel of the port after application and management confirmation and verification. In this way, the real-time perception capability can be realized so that the system can quickly identify and respond to illegal access, effectively prevent potential security threats, thereby enhancing the overall security of the network, so that the illegal access of a single device cannot have a serious impact on the entire network.

[0086] As a specific implementation, the main device intelligence label generation module 200 includes: an information management unit 201 for collecting and processing switch device information, and a coding unit 22 for generating a main device intelligence label based on a universal national secret coding system. In this way, the uniqueness and security of the device identity are ensured, and device impersonation and illegal access are effectively prevented. At the same time, the module improves the accuracy and efficiency of device management.

[0087] As a specific implementation method, the device load security image and management module 300 includes an ARP and broadcast unit 301 for collecting IP address and MAC address information, an image generation unit 302 for generating a device load security image, a port monitoring unit 303 for real-time monitoring and recording port status information, and a port management unit 304 for managing ports that have not been used for a long time. In this way, the precision of device management is improved and the security of the network is strengthened, ensuring that resources are used efficiently, and at the same time, it can respond to potential security threats in a timely manner, providing a strong guarantee for the stable operation of the network.

[0088] As a specific implementation, the trusted edge device access management and security protection module 600 includes a detection unit 601 for detecting and processing changes in the MAC address of a port-connected device, a perception and comparison unit 602 for automatically sensing and comparing changes in device information, and an interaction status management unit 603 for managing the device data interaction status.

[0089] As described above, the setting of the detection unit 601 can monitor the MAC address changes of the port-connected device in real time, effectively prevent network attacks such as MAC address spoofing, and ensure the security of the network edge. The setting of the perception comparison unit 602 can automatically perceive the changes in device information and compare them with the logical security chain, timely identify and prevent illegal access, and further enhance the security of the network. The setting of the interaction status management unit 603 can manage the data interaction status of the device. For devices that have not interacted with data for a long time, their data channels can be automatically closed to save network resources and reduce potential security risks. When the device needs to re-access, the data channel can be reopened through a simple application and confirmation process, which improves management efficiency; in addition, when illegal access or device information changes are detected, the system can respond quickly and take measures, such as closing the access channel of illegal devices or notifying the administrator for further processing, thereby effectively preventing potential security threats.

[0090] In summary, the original switch only has simple and general security functions. The first and second embodiments of this case use blockchain technology to implement distributed identity authentication and authorization management of industrial Ethernet switching equipment, and upload the summary of key data such as device cascade relationship and subordinate port load terminals to the chain. By adding a port security access module, the security risks in the switch transmission process are greatly improved.

[0091] The above is a detailed introduction to a security protection method and system for cascade mutual trust of industrial Ethernet switches disclosed in an embodiment of the present invention. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea; at the same time, for general technicians in this field, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A security protection method for cascading mutual trust of industrial Ethernet switches, characterized in that: The following steps are involved: Step S1: multiple industrial Ethernet switch devices are interconnected through physical media, and the switch devices are configured according to requirements to support a ring and / or chain logical networking structure; Step S2: automatically generating a plurality of master device intelligence tags based on the device configuration information and status information of a plurality of industrial Ethernet switches; Step S3: Generate a device load security image, and use the device load security image to monitor and record the status changes of the management port in real time; Step S4: Establish a device security profile, which includes the main device intelligence tag generated in step S2 and the load security image generated in step S3, and build a logical security chain model of a ring network or a chain network based on the information of the device security profile, wherein the logical security chain model includes the evidence tag of the trusted data in the security profile; Step S5: Based on the evidence tag of the trusted data generated in step S4, a mapping logic security chain is formed, and blockchain technology is used for distributed decentralized storage to ensure the security and non-tamperability of the data; Step S6: Build a secure and trusted edge device access management system that can verify the identity and permissions of edge devices and establish a comprehensive security protection solution based on the system.

2. The safety protection method according to claim 1, characterized in that The generation of the master device intelligence tag in step S2 includes the following steps: The factory code, CPU, and motherboard information of the switch equipment are automatically collected through the equipment system, and the main equipment intelligence label is generated based on the universal national secret coding system.

3. The safety protection method according to claim 1, characterized in that In step S3, "generating a device load security image, and using the device load security image to monitor and record the state changes of the management port in real time" includes the following steps: Step S31: Automatically collect IP address and MAC address information of the connected load terminal on the industrial Ethernet switch device through ARP and broadcast technology; Step S32: Based on the collected IP address and MAC address information, a device load security image is generated on the industrial Ethernet switch, where the security image is used to record and manage the network identity information of the access device; Step S33: collecting and recording the status information of the device on the practical port in real time through the port monitoring mechanism, wherein the status information at least includes the data transmission status and the connection status; Step S34: For ports that have not been used for a long time, the ports are automatically closed according to a preset configuration to save resources and enhance network security.

4. The safety protection method according to claim 1, characterized in that The information of the device security portrait in step S4 includes at least the main intelligence tag, device security access, control, and cascade port information.

5. The safety protection method according to claim 3, characterized in that The security protection scheme in step S6 includes: S61. When the load device of a port of the industrial Ethernet switch is replaced, the management system detects that the MAC address of the device connected to the port has changed, and actively stops the data interaction between the port and the switch; after the application for continued use is confirmed and verified by the management, the data transmission channel of the port is reopened; S62. When a node device in a chain or ring is replaced, the upper device of the node automatically senses the change in the cascaded device information and automatically compares it with the logical security chain in the edge system. If illegal access is detected, other related devices are notified to prevent illegal device access; S63. When the device does not interact with data within the set time period, the switch stops the data interaction of the port; when it is used again, the data transmission channel of the port is reopened after application and management confirmation and verification.

6. A security protection system for cascading mutual trust of industrial Ethernet switches, characterized in that: The system adopts the safety protection method according to any one of claims 1 to 5, including: A device connection and configuration module (100), used to interconnect multiple industrial Ethernet switch devices via physical media, and configure the switch devices according to requirements to support a ring and / or chain logical networking structure; A main device intelligence label generation module (200) automatically generates a plurality of main device intelligence labels based on the configuration information and status information of a plurality of industrial Ethernet switch devices, wherein the factory code, CPU, and motherboard information of the switch device are automatically collected through the device system, and the main device intelligence label is generated based on the universal national secret coding system; The device load security image and management module (300) is used to generate a device load security image and use the image to monitor and record the status changes of the management port in real time The device security portrait and logical security chain building module (400) is used to build a device security portrait, which includes a main device intelligence tag and a load security image, and to build a logical security chain model of a ring network or a chain network based on the information of the device security portrait, wherein the logical security chain model includes a storage tag of the trusted data in the security portrait; The data storage and security module (500) forms a mapping logic security chain based on the storage tag of the trusted data, and uses blockchain technology for distributed decentralized storage to ensure the security and non-tamperability of the data; The trusted edge device access management and security protection module (600) is used to build a secure trusted edge device access management system, which can verify the identity and authority of the edge device and actively stop data interaction with the illegal or unconfirmed device when illegal access or device replacement is detected, and reopen the data transmission channel after the application for continued use is confirmed and verified by the management.

7. The safety protection system according to claim 6, characterized in that: The trusted edge device access management and security protection module (600) is also used for: when a chain or ring node device is replaced, the upper-level device of the node automatically senses the change in the cascaded device information and automatically compares it with the logical security chain in the edge system. If illegal access is detected, other related devices are notified to prevent illegal device access; in addition, when the device does not interact with data within a set time period, the switch stops the data interaction of the port, and when it is used again, the data transmission channel of the port is reopened after application and management confirmation and verification.

8. The safety protection system according to claim 6, characterized in that: The main device intelligence label generation module (200) comprises: an information management unit (201) for collecting and processing switch device information, and a coding unit (22) for generating a main device intelligence label based on a universal national secret coding system.

9. The safety protection system according to claim 6, characterized in that: The device load security image and management module (300) comprises an ARP and broadcast unit (301) for collecting IP address and MAC address information, an image generation unit (302) for generating a device load security image, a port monitoring unit (303) for real-time monitoring and recording port status information, and a port management unit (304) for managing ports that have not been used for a long time.

10. The safety protection system according to claim 6, characterized in that: The trusted edge device access management and security protection module (600) comprises a detection unit (601) for detecting and processing changes in the MAC address of a port connection device, a perception and comparison unit (602) for automatically sensing and comparing changes in device information, and an interaction state management unit (603) for managing the device data interaction state.

Images