Industrial firewall isolation method of DCS system

Abstract

The invention discloses an industrial firewall isolation method of a DCS (Distributed Control System). The objective of the invention is to solve the problem that existing industrial network security protection has defects for a DCS system. According to the method, firstly, DCS architecture analysis and risk assessment are carried out, and protection key points and data flow directions are accurately determined; then, a firewall strategy fitting the characteristics of each area (such as a core control unit, an operation station and an external network interface) is customized, and mechanisms such as multiple data encryption are covered; and then firewall deployment and configuration optimization are carried out to ensure protection continuity and rule timeliness. And abnormal conditions are timely handled through a real-time monitoring and dynamic adjustment mechanism, and system recovery under a security event is guaranteed through an emergency response and backup recovery mechanism. And a regular safety drill and evaluation mechanism is arranged to continuously strengthen the protection capability. According to the method, the network security level of the DCS is comprehensively improved, stable and safe operation of industrial production is guaranteed, and the method has remarkable practical value.

Description

Technical Field

[0001] The invention relates to the field related to the communication between an enterprise network of a DCS system and a remote router device, and in particular to an industrial firewall isolation method for a DCS system. Background Art

[0002] With the rapid development of industrial automation and informatization, distributed control systems (DCS) have been widely used in many industrial fields, such as chemical, electric power, petroleum, manufacturing and other industries. The DCS system is responsible for centralized monitoring, control and management of various equipment in the industrial production process, and its stable operation is directly related to the continuity, safety and efficiency of the entire industrial production.

[0003] However, in recent years, the industrial network environment has faced increasingly severe cybersecurity threats. On the one hand, the number of connections between industrial control systems and external networks is increasing. For example, in order to achieve functions such as remote monitoring, equipment maintenance, and data interaction, it is inevitable to connect to the corporate office network or even the Internet to a certain extent. This has made the originally relatively closed industrial network boundaries gradually open, and external malicious attackers have more opportunities to take advantage of. For example, hacker organizations and cybercrime gangs may exploit network vulnerabilities to launch illegal access, malicious code injection, data tampering, and denial of service attacks against DCS systems.

[0004] On the other hand, the complexity and particularity of industrial control systems themselves also increase the difficulty of security protection. The DCS system contains many control units with different functions, operation stations and complex communication links. The data interaction between components is frequent and has strict real-time and accuracy requirements. Traditional network security protection methods are often difficult to fully adapt to industrial scenarios. For example, most general firewall products are designed based on general network environments. They lack deep customization for industrial protocols and industrial control process characteristics. They cannot accurately identify and prevent attacks specifically targeting industrial control systems. They are prone to misjudgment or protection loopholes, resulting in potential security risks for industrial production, which may cause serious consequences such as production accidents, equipment damage, and product quality decline, and even endanger the safety of people's lives. Summary of the invention

[0005] The purpose of the present invention is to provide an industrial firewall isolation method for a DCS system to solve the problems raised in the above background technology.

[0006] To achieve the above object, the present invention provides the following technical solution: an industrial firewall isolation method for a DCS system, comprising the following steps: Step 1: System architecture analysis and risk assessment Comprehensively analyze the target DCS system and accurately identify key components such as control units, operation stations, communication links, and interfaces with external networks; use professional industrial network security risk assessment tools combined with manual audits to deeply investigate potential security threats, including illegal access, malicious code injection, data tampering, denial of service attacks, etc.; quantify and classify risks based on the likelihood of occurrence and the degree of harm, and identify key protection areas and key data flows; Step 2: Customize firewall policy Access is limited to a specific pre-authorized IP address range and based on a specific communication protocol, using an improved ModbusTCP protocol security version; this version uses an asymmetric encryption algorithm to authenticate the identities of both communicating parties. The connection initiator uses the receiver's public key to encrypt the identity and key parameter transmission, and the receiver's private key decrypts and verifies; after identity authentication, the data packet uses a symmetric encryption algorithm to encrypt the data content with a symmetric key that is dynamically generated and regularly updated by the system. At the same time, the data packet is accompanied by a check code based on the key. The receiving end verifies with the same key. If the check fails, it is discarded to prevent illegal data from entering; Differentiate the accounts of operators with different permissions to formulate strategies; when a high-privilege account operates key parameter adjustments and other behaviors, the operation records are backed up to an independent security audit server, and the hash encryption algorithm is used to generate a hash value to verify the integrity, and the AES algorithm is used to encrypt the details of the operation behavior; low-privilege accounts are limited to basic operations such as viewing regular data, and the non-critical data transmission they access uses a lightweight stream cipher encryption algorithm to ensure confidentiality; Set strict inbound and outbound traffic filtering rules, set a whitelist based on the legitimate business transactions of the DCS system, and only allow data that meets the whitelist rules to pass; for external unknown source traffic, enable deep packet inspection technology, disassemble and analyze data packets, and immediately block and alarm when anomalies are encountered; when data is transmitted to and from the interface, first encrypt the key header information with the RSA algorithm, and then encrypt the main content with the symmetric encryption algorithm to ensure the security of cross-internal and external network interactions; Step 3: Firewall deployment and configuration optimization Deploy industrial firewall equipment with redundant design at key network nodes of the DCS system, and adopt dual-machine hot standby mode to ensure protection continuity; reasonably allocate hardware processing resources according to the network traffic load of each node, such as allocating more CPU cores and memory to link nodes with large data traffic; initialize the firewall software rule base, enter customized policies and other information, and set up an automatic update mechanism that is linked to the industrial network security intelligence platform in real time to ensure the timeliness of the policy; at the same time, the rule base adopts blockchain encryption technology for distributed encryption storage to prevent the rules from being tampered with and ensure its security; Step 4: Real-time monitoring and dynamic adjustment Build a real-time monitoring system, collect key indicator information such as network traffic, connection requests, security alarms, etc. through multiple sensors on the firewall and transmit it to the monitoring platform in real time; the monitoring platform uses intelligent analysis algorithms based on machine learning anomaly detection models, trained based on historical normal network behavior data, and accurately identifies current abnormal behavior patterns; once an anomaly is found, the dynamic adjustment mechanism is triggered, and the firewall policy is automatically and temporarily adjusted according to the specific situation and the system business status, such as blocking suspicious IPs, tightening traffic restrictions, etc., and the anomalies and response measures are recorded and pushed to security management personnel for them to evaluate whether permanent optimization and adjustment are needed, so as to achieve dynamic optimization of protection and ensure the network security and stable operation of the system; throughout the process, the data interactions involved are transmitted through encrypted communication channels built by SSL / TLS protocols to ensure the confidentiality, integrity and authentication of communications; Step 5: Emergency response and backup recovery Establish an emergency response plan. When the firewall detects a serious security incident, such as a large-scale attack or internal sabotage that causes partial functional failure, immediately initiate the emergency response process. On the one hand, cut off the connection with the external network through the emergency blocking function, limit internal non-critical communications, and retain the core control command transmission channel; on the other hand, notify the security team and operation and maintenance personnel to investigate, trace the source, and repair according to the division of labor in the plan, and use backup firewall configuration files and system data with multiple encryption protections (such as encryption with a combination of symmetric and asymmetric encryption algorithms, and stored in pieces on different secure media) to restore functions and communications; review and summarize after the incident is handled, improve the plan and daily protection strategies, enhance the system's resistance and recovery capabilities, and ensure the continuity and stability of industrial production.

[0007] Furthermore, in the system architecture analysis and risk assessment steps, the manual audit process also includes an in-depth analysis of historical security event records, collecting information on types of attacks on the DCS system that have occurred in the past, sources of attacks, and specific functional modules affected; through data mining technology, key security-related features are extracted from massive historical log data, such as abnormal IP access behaviors that frequently occur in a specific time period, and patterns of tampering with specific control instructions; at the same time, combined with the security vulnerability notification information released in the industrial control system industry, areas in this DCS system that may have the same or similar vulnerabilities are marked, and these analysis results are used as an important supplementary basis for risk assessment, and the quantitative classification of risks is further refined, so that the determination of key protection areas and key data flows is more accurate, providing more reliable and comprehensive data support for the formulation of subsequent customized firewall strategies, which is different from the existing method of relying solely on general risk assessment tools for evaluation, and enhancing the adaptability and effectiveness of the entire firewall isolation method for the characteristics of this DCS system.

[0008] Furthermore, in the step of formulating the customized firewall policy, the generation and update mechanism of the symmetric key used for data encryption in the area where the core control unit is located has a high degree of security and dynamic adaptability; specifically, the key generation process introduces hardware encryption technology based on physically unclonable functions (PUFs), and uses the physical characteristics of specific hardware chips in the DCS system, such as the process deviation of the chip and the inherent properties of random noise to generate unique and non-replicable initial key information, which is then transformed by a specific encryption algorithm to generate a symmetric key for actual data encryption; and the key update cycle is dynamically adjusted according to the real-time operating status of the system. For example, when the system detects that a new device is connected, an important software upgrade occurs, or a key event such as a change in the network topology occurs, the key update process is automatically triggered to regenerate a new symmetric key, ensuring that even in a complex and changeable industrial network environment, the data encryption in the core control area always maintains a high degree of confidentiality, effectively preventing the risk of being cracked due to key leakage or long-term non-update, and significantly improving the security and reliability of data encryption compared to the traditional fixed period or simple random key update method; For the generation algorithm of the check code during the data transmission process in this area, a composite check method that integrates hash function and error correction coding technology is adopted; first, the hash function is used to perform a summary calculation on the data content in the data packet to obtain a hash value of a fixed length. The hash value can uniquely identify the original content of the data packet to ensure the integrity of the data; then the hash value is encoded using error correction coding technology to add certain redundant information, so that when the receiving end verifies the check code, even if a small number of bit errors occur in the data packet during transmission, the error correction coding mechanism can be used to correct them and accurately verify the integrity of the data, greatly improving the accuracy and anti-interference capability of data transmission, and ensuring the stability and reliability of data interaction in the core control area. This is also the innovation that is different from the conventional single check method.

[0009] Furthermore, when the operation station distinguishes different permission operator accounts to formulate data access and operation permission strategies, the operation behavior records of high-authority accounts are backed up to an independent security audit server, which further optimizes the data storage structure and index mechanism; in the security audit server, a distributed database architecture is used for data storage, and the operation behavior records are stored in multiple dimensions according to time sequence, operation type, and control modules involved. Each shard data is accompanied by detailed metadata information when it is stored, such as the specific timestamp of the operation, the IP address of the initiator of the operation, and the corresponding operator identification, which is convenient for subsequent rapid retrieval and accurate query; In order to improve the query efficiency and security of data, an index system based on blockchain technology was established. The index system uses the distributed ledger characteristics of blockchain to store the index information of operation behavior records in the form of encrypted blockchain nodes. Each index node is connected by a hash pointer to form an unalterable index chain. When it is necessary to query the operation behavior records of a specific high-privilege account, the corresponding shard data storage location can be quickly found by quickly locating and traversing the blockchain index chain, and then the corresponding detailed record content can be obtained according to the permission verification mechanism. This not only effectively improves the data query speed, but also ensures the security and unalterability of data storage, avoiding the risk of tampering or data loss of traditional centralized database indexes, making the audit supervision of high-privilege account operation behaviors more efficient and reliable, which is significantly innovative compared to the existing ordinary audit server storage and query methods.

[0010] Furthermore, in terms of the deep packet inspection technology set up at the interface connected to the external network, a deep semantic analysis model based on artificial intelligence is used to disassemble and analyze the data packet; this model is pre-trained with a large number of known malicious code samples and normal industrial network data packet samples, and can accurately understand the semantic information of data instructions and protocol field content in the data packet, not just limited to simple format and feature matching detection; When detecting external data traffic from unknown sources, the deep semantic analysis model will perform semantic analysis on the data packet layer by layer, for example, to determine whether the data instructions conform to the normal logic of the industrial production process and whether the parameter settings in the protocol field are within a reasonable industrial control range; if it is found that the semantic content in the data packet is inconsistent with the normal industrial operation logic, even if its surface format conforms to the requirements of conventional communication protocols, it will be judged as abnormal and the connection will be blocked immediately and an accurate security alarm will be issued to indicate possible new forms of malicious attacks, such as covert attacks disguised as normal instructions; this deep packet detection method based on semantic analysis can more effectively detect complex and changeable new network attack methods than traditional detection technology that relies solely on feature code matching, significantly enhances the security prevention capabilities of external network data transmission, and builds a more solid line of defense for the network security boundary of the DCS system.

[0011] Furthermore, in the firewall deployment and configuration optimization step, in addition to adopting the dual-machine hot standby working mode, the redundant design of the industrial firewall equipment also further implements a multi-path redundancy mechanism; in the communication link setting between the key network nodes of the DCS system and the external network and various important internal areas, multiple physically independent communication lines with different routing paths are constructed, and each line is connected to the corresponding firewall device port; When one of the communication lines fails, for example, due to line damage, network congestion or external attack, the system can automatically detect the link failure and quickly switch the network traffic to other normal communication lines based on the pre-set intelligent routing switching strategy to ensure that data transmission is not affected and to ensure the continuity and stability of the DCS system network communication. At the same time, under the multi-path redundancy mechanism, communication lines on different paths use load balancing technology when transmitting data, and dynamically allocate data traffic according to the real-time bandwidth and delay network performance indicators of each line to avoid the situation where a line is overloaded while other lines are idle, making full use of network resources and improving the efficiency of the entire network communication. Compared with the simple dual-machine hot standby mode, this has further improved the network reliability and provided stronger support for the stable operation of the DCS system in the industrial production environment.

[0012] Furthermore, in the automatic update mechanism of the firewall software rule base, in addition to real-time linkage with the professional industrial network security intelligence platform, an internal feedback optimization module is also set up; this module is based on the monitoring and analysis of the actual network security events that occur during the operation of the DCS system itself and the execution of firewall policies, and collects feedback information such as false positives and missed negatives caused by unreasonable rules, as well as the deficiencies of existing rules in dealing with specific attack scenarios; Then, the feedback information is deeply analyzed through the built-in intelligent analysis algorithm to automatically generate optimization suggestions for the rule base, such as adding or adjusting specific access control rules and refining traffic filtering conditions. These optimization suggestions will be reviewed and confirmed by the system security management personnel and applied to the update of the rule base in a timely manner, so that the rule base can continuously adapt to the internal business changes of the DCS system and the dynamic evolution of external network security threats, and realize a two-way driven update mode from external intelligence introduction to internal feedback optimization. Compared with the traditional method of updating the rule base based on external intelligence alone, it can improve the firewall strategy more accurately and timely, enhance the ability of the entire firewall isolation method to cope with actual network security challenges, and ensure that the DCS system is always in an efficient security protection state.

[0013] Furthermore, in the real-time monitoring and dynamic adjustment steps, the intelligent analysis algorithm adopts an integrated learning method to improve the detection accuracy and generalization ability when performing abnormal behavior pattern recognition based on the anomaly detection model in machine learning; specifically, it integrates a variety of different types of machine learning algorithms, such as support vector machines, random forests, and deep neural networks, to build an integrated anomaly detection model framework; During the training phase, each basic algorithm model is trained independently using historical normal network behavior data, and then the prediction results of each model are comprehensively processed through weighted voting and averaging integration strategies to obtain the final anomaly detection results. This integrated learning method can make full use of the advantages of different algorithm models to make up for the detection blind spots and misjudgment problems that may exist when a single algorithm faces complex and diverse industrial network behavior data. For example, the deep neural network has a strong fitting ability for complex nonlinear relationship data and the support vector machine has good classification performance under small sample data. Through synergy, the identification of abnormal fluctuations in network traffic and abnormal behavior of illegal access requests is more accurate and reliable, and various potential network security threats can be captured in a timely manner, thereby more effectively triggering the dynamic adjustment mechanism to ensure the dynamic protection effect of DCS system network security.

[0014] Furthermore, in the emergency response and backup recovery steps, the multiple encryption protection mechanisms for the backup firewall configuration files and system data have more sophisticated designs in terms of encryption algorithm selection and key management. In terms of encryption algorithms, in addition to the combination of symmetric encryption and asymmetric encryption algorithms, encryption algorithm combinations of different strengths are selected according to the importance level and sensitivity classification of the data. For example, highly sensitive data including core control instructions and key system parameters are encrypted using a high-level AES-256 and RSA-4096 algorithm combination, while general system configuration information that is relatively less sensitive is encrypted using a combination of AES-128 and RSA-2048 algorithms. This ensures data security while reasonably optimizing the consumption of encryption computing resources. In terms of key management, a centralized key management system has been established. The system uses a hardware security module to store and protect keys, and utilizes the physical protection mechanism of HSM and the built-in encryption algorithm engine to ensure the security of keys during generation, storage, distribution and use. At the same time, the key management system has strict authority control and auditing functions. Only authorized specific security managers can perform key-related operations under strict identity authentication conditions, and all key operations will be recorded and audited in detail to prevent the risk of data leakage caused by poor key management. Through this refined encryption protection and key management mechanism, the security of backup data is further enhanced, providing a solid guarantee for the reliable use of system data during emergency recovery.

[0015] Furthermore, during the implementation of the entire method, a regular security drill and evaluation mechanism is also set up; at regular intervals, the relevant system security team, operation and maintenance personnel, and some operators are organized to simulate different types of network security attack scenarios, and respond according to the preset emergency response process and firewall isolation strategy to test the collaborative working ability of each link when facing actual security threats and the effectiveness of the strategy; After the security drill is completed, based on the evaluation indicators collected during the drill, such as response time, operation accuracy, and policy execution effect, a comprehensive evaluation and analysis of the entire firewall isolation method is conducted to find out the existing weak links and problems that may arise in actual operations, such as insufficient operational proficiency of personnel and the lack of flexibility of certain strategies in specific scenarios; then targeted improvement measures are formulated, personnel are trained to improve their skills, and emergency response plans and firewall strategies are optimized and adjusted. Through this periodic security drill and evaluation mechanism, the overall ability of the DCS system to respond to network security threats is continuously strengthened, ensuring that firewall isolation protection measures can be implemented efficiently and accurately when actual security incidents occur, thereby ensuring the stable operation of industrial production.

[0016] Compared with the prior art, the present invention has the following beneficial effects: Through comprehensive and in-depth system architecture analysis and risk assessment, we can accurately identify potential security threats faced by different areas and business modules in the DCS system, and quantify and classify them, making the subsequent firewall strategies more targeted. It can effectively protect against various common network security threats such as illegal access, malicious code injection, data tampering, and denial of service attacks, and build a solid first line of defense for the DCS system.

[0017] In terms of data encryption, a variety of advanced data encryption technologies that are suitable for industrial scenarios are adopted, such as the use of double encryption mechanism in the core control unit area, classified encrypted storage of operation station data, and hybrid encryption mode for external network interface data, etc., to ensure the confidentiality, integrity and authentication of data during transmission and storage, greatly reducing the risk of data leakage and tampering. Even in the face of complex network attack environments, key data can be properly protected to ensure that the core instructions and important parameters of industrial production are not damaged.

[0018] This method customizes firewall strategies according to the different control levels, business function modules and actual communication characteristics between components within the DCS system. From the core control unit to the operation station, and then to the interface connected to the external network, each link has access control, traffic filtering and security detection rules that fit its functional requirements and security requirements, avoiding the "incompatibility" phenomenon of general firewall strategies in industrial scenario applications, and can better adapt to the complex and unique industrial network architecture of the DCS system, ensuring normal data interaction between various parts while minimizing security risks.

[0019] For example, at the operation station, different permission accounts are distinguished to formulate detailed data access and operation permission strategies, which not only meets the normal work needs of operators in different positions, but also strictly limits the scope of high-risk operations. The operation behavior of high-privilege accounts is recorded and encrypted for storage in detail to facilitate audit supervision and ensure that the entire operation process complies with industrial safety regulations and internal enterprise management requirements.

[0020] With the help of real-time monitoring and dynamic adjustment mechanism, the intelligent analysis algorithm is used to continuously monitor the operation status of the industrial firewall and the network communication of the DCS system, which can timely discover abnormal behavior patterns in the network and automatically trigger temporary adjustments to the firewall strategy to quickly respond to potential security threats and achieve dynamic optimization of protection. This dynamic adjustment mechanism is based on advanced technologies such as machine learning and can adapt to the ever-changing characteristics of the industrial network environment. As the system operation time increases and the external network attack methods evolve, it continuously ensures the effectiveness of the firewall isolation method, so that the DCS system is always in a safe and controllable state.

[0021] At the same time, the firewall rule library is equipped with an automatic update mechanism, which can not only link with the external professional industrial network security intelligence platform in real time to obtain the latest security threat information, but also improve the rules according to the actual operation of the system through the internal feedback optimization module, thereby ensuring the timeliness and accuracy of the protection strategy, keeping up with the changes in the network security situation in a timely manner, and continuously improving the ability to resist new network attacks.

[0022] A comprehensive emergency response plan and a supporting backup and recovery mechanism have been established. When encountering serious security incidents, such as large-scale distributed denial of service attacks or internal malicious sabotage that cause some firewall functions to fail, the emergency process can be quickly initiated to effectively curb the spread of attacks by cutting off external network connections, limiting internal non-critical communications and other measures, ensuring the basic operation of key equipment and minimizing the impact of security incidents on industrial production.

[0023] Moreover, by using backup firewall configuration files and system data with multiple encryption protections, the normal functions of the firewall and the network communications of the DCS system can be quickly restored while ensuring safety. Combined with the post-incident review and strategy improvement work, the system's recovery capabilities in the face of sudden security incidents are comprehensively improved, ensuring that industrial production can return to normal as soon as possible and reducing the economic losses and social impacts caused by safety accidents.

[0024] By implementing the industrial firewall isolation method of the present invention, the network security protection level of the DCS system is improved as a whole, the occurrence of production interruptions and equipment failures due to network security issues is reduced, the continuity and stability of industrial production is guaranteed, and it helps enterprises to improve production efficiency and ensure product quality. At the same time, it also complies with the increasingly stringent production safety and network security supervision requirements in the industrial field, creates a safe and reliable network environment for the digital and intelligent transformation of the industrial industry, and promotes the healthy and sustainable development of the industrial industry. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 It is a flow chart of the present invention. DETAILED DESCRIPTION

[0026] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0027] See also Figure 1 The present invention provides an industrial firewall isolation method for a DCS system, and its specific implementation process will be described in detail below. 1. System architecture analysis and risk assessment Analyze DCS system architecture and identify key components First, a professional technical team is formed, which must include engineers familiar with the principles of industrial control systems and network security experts. Team members conduct a comprehensive and in-depth architecture analysis of the target DCS system. By reviewing system design documents, communicating with system operation and maintenance personnel, and checking the device connection status on site, key components such as control units, operation stations, communication links, and interfaces connected to external networks contained in the DCS system are accurately identified.

[0028] For example, in a DCS system of a chemical production enterprise, the control unit may include modules for controlling key parameters such as reactor temperature, pressure, and flow; the operation stations are distributed in different control rooms for operators to issue instructions and view data; the communication link includes wired network lines for data exchange between control units and between control units and operation stations; and the interface for connecting to the external network may be set up to enable remote experts to diagnose system faults and transmit some production data to the office network of the enterprise management.

[0029] Use tools and manual audits to identify potential threats Tool detection Use professional industrial network security risk assessment tools, such as network vulnerability scanning tools with deep protocol analysis capabilities, industrial network traffic analysis tools, etc. Use vulnerability scanning tools to scan each network node in the DCS system. The tool will check whether the system has known vulnerabilities related to common industrial protocols such as Modbus and OPC based on the built-in industrial protocol vulnerability library. For example, for the Modbus protocol, check whether its function code is at risk of being maliciously exploited for unauthorized access or data tampering; for the OPC protocol, check whether there are weak links in the authentication mechanism during its communication process.

[0030] The network traffic analysis tool captures data packets in the DCS system network in real time, analyzes the flow direction, size, frequency and other characteristics of the data packets, and determines whether there is abnormal traffic by comparing them with the preset normal traffic model. For example, whether there are a large number of IP addresses from unknown sources sending abnormally frequent connection requests to key control units, or whether the data traffic sent by a certain operating station exceeds the traffic range corresponding to its normal business operations.

[0031] At the same time, manual auditing is carried out. Manual auditors carefully review the system configuration files to check whether the permission settings of each control unit and operation station are reasonable, and whether there are redundant and unnecessary open ports or shared folders that may cause security risks. For example, if an operation station is found to have enabled the anonymous file sharing function, this may be used by external attackers to implant malicious files.

[0032] In addition, manual audits also include in-depth analysis of historical security event records, collecting information on the types of attacks that have occurred against DCS systems in the past, the sources of attacks, and the specific functional modules affected. Through data mining technology, key security-related features are extracted from massive amounts of historical log data, such as abnormal IP access behaviors that frequently occur within a specific time period, and patterns in which specific control instructions are tampered with. At the same time, combined with security vulnerability notification information released within the industrial control system industry, areas in this DCS system that may have the same or similar vulnerabilities are highlighted.

[0033] Determine key protection areas and key flow directions based on risk quantification and classification Based on the results obtained from the above tool detection and manual audit, the identified risks are quantitatively graded according to the possibility of risk occurrence and the degree of harm that may be caused. Risks can be divided into high, medium and low levels using methods such as risk matrix.

[0034] For example, for control units that directly control key production equipment and involve core process parameters, if there are risk vulnerabilities that can be directly accessed from the outside, this type of risk is usually assessed as a high risk level because once attacked, it may cause the entire production process to get out of control, causing significant economic losses or even casualties. For operation stations that are only used for operators to view general production data, if there is a slightly unreasonable configuration of permissions, the risk level may be relatively low.

[0035] According to the classification of risk levels, key protection areas are identified, such as the area where the core control unit is located and the communication links involving key production data transmission. At the same time, key data flows are sorted out, such as the data flow paths from the raw material transportation control unit to the reactor control unit, and then to the product processing control unit and other key production links, providing comprehensive and reliable data support for the formulation of subsequent customized firewall strategies.

[0036] 2. Customized Firewall Policy Development Core control unit regional strategy formulation 1. Limit IP and specific protocol access For the area where the core control unit is located, it is strictly set that only pre-authorized specific IP address ranges and access requests based on specific communication protocols are allowed to pass. For example, in a DCS system for power production, only the IP addresses of specific monitoring servers within the enterprise and the remote operation terminal IP addresses of a few certified maintenance engineers are allowed to access the control unit of the core power generation equipment.

[0037] The communication protocol is limited to protocols with high reliability and low latency that have been optimized and verified for industrial scenarios, such as the specific security version of the ModbusTCP protocol. This security version is improved on the basis of the original protocol, which not only ensures the efficient transmission of industrial control data, but also enhances the security protection capability.

[0038] 2. Use asymmetric encryption to authenticate identity Before data transmission, an asymmetric encryption algorithm is used to authenticate the identities of both communicating parties. The communication initiator uses the public key disclosed by the receiver to encrypt and transmit its own identity information and key parameters related to the connection request. After receiving the data, the receiver uses the private key to decrypt and verify the legitimacy of the identity. For example, when the operation terminal of a remote maintenance engineer initiates an access request to the core control unit, the operation terminal will use the public key pre-configured and disclosed by the core control unit to encrypt the engineer's account information, operation authority level, and key content such as the device number involved in this access, and send it to the core control unit. After receiving the data packet, the core control unit will decrypt it with its own private key to confirm the legitimacy of the source of the access request.

[0039] 3. Symmetric encryption data and checksum mechanism After the identity authentication is passed, the subsequent transmitted data packets are encrypted using a symmetric encryption algorithm, and the data content in the data packets is encrypted using the system's built-in dynamically generated and regularly updated symmetric key. For example, taking a reactor temperature control unit in a chemical production as an example, each time the temperature setting value, current actual temperature feedback value and other data sent to the actuator are encrypted with a symmetric key before transmission, to prevent the data from being stolen or tampered with during transmission.

[0040] At the same time, each data packet is accompanied by a check code generated based on the symmetric key. The receiving end will verify the check code based on the same key. If the verification fails, the data packet will be discarded directly to prevent illegal data from entering the core control area. The generation of the check code adopts a composite check method that integrates hash functions and error correction coding technology. First, the hash function is used to perform a summary calculation on the data content in the data packet to obtain a hash value of a fixed length. The hash value can uniquely identify the original content of the data packet and ensure the integrity of the data; then the hash value is encoded using error correction coding technology to add certain redundant information, so that when the receiving end verifies the check code, even if a small number of bit errors occur in the data packet during transmission, the error correction coding mechanism can be used to correct and accurately verify the integrity of the data.

[0041] Operation station authority and data-related strategy formulation 1. Distinguish between high- and low-authority account operation permissions For the operation station, according to the operator's job responsibilities and work requirements, the operator accounts with different permission levels are distinguished, and different data access and operation permission strategies are formulated respectively. For example, in a DCS system operation station of a manufacturing plant, the process engineer's account is set as a high-authority account, which can perform operations such as key parameter adjustment and production process change; while the ordinary monitoring personnel's account is a low-authority account, which can only perform routine data viewing, such as equipment operation status parameters, real-time production data and other basic operations, and the data range that can be accessed is limited to non-critical data related to the business module.

[0042] 2. Backup and storage optimization of high-authority account operation records High-authority accounts can perform operations such as adjusting key parameters, but at the same time, their operations will be recorded in real time and backed up to an independent security audit server. In the security audit server, a distributed database architecture is used for data storage, and operation behavior records are stored in slices according to multiple dimensions such as time sequence, operation type, and control modules involved. Each slice of data is accompanied by detailed metadata information when it is stored, such as the specific timestamp of the operation, the IP address of the operation, the corresponding operator identification, etc., to facilitate subsequent rapid retrieval and accurate query.

[0043] At the same time, in order to improve the query efficiency and security of data, an index system based on blockchain technology has been established. This index system uses the distributed ledger characteristics of blockchain to store the index information of operation behavior records in the form of encrypted blockchain nodes. Each index node is connected by a hash pointer to form an index chain that cannot be tampered with. When it is necessary to query the operation behavior records of a specific high-authority account, the corresponding shard data storage location can be quickly found by quickly locating and traversing the blockchain index chain, and then the corresponding detailed record content can be obtained according to the permission verification mechanism.

[0044] Policy formulation at external network interfaces 1. Set inbound and outbound traffic filtering rules For interfaces connected to external networks, strict inbound and outbound traffic filtering rules are set to allow only communication data that conforms to the preset whitelist rules to pass through. The whitelist rules are precisely set based on the legal external IP addresses, ports, and data formats involved in the daily business transactions of the DCS system. For example, in the DCS system of an oil refining enterprise, if it is agreed with an external equipment supplier to transmit equipment operating status data through a specific port every Tuesday for after-sales analysis, then only data traffic that conforms to the established data format and comes from the supplier's designated IP address and corresponding port on Tuesdays will be allowed to pass through the firewall and enter the DCS system, and other data traffic that does not conform to the whitelist rules will be directly blocked.

[0045] 2. Deep Packet Inspection At the same time, for data traffic from unknown sources that may be transmitted from the external network, deep packet inspection technology is enabled to disassemble and analyze the data packets to determine whether they contain malicious code features or abnormal data instructions. Here, a deep semantic analysis model based on artificial intelligence is used. The model is pre-trained and learned through a large number of known malicious code samples and normal industrial network data packet samples. It can accurately understand the semantic information of data instructions, protocol fields and other contents in the data packet, not just limited to simple format and feature matching detection.

[0046] When detecting external data traffic from unknown sources, the deep semantic analysis model will perform semantic analysis on the data packet layer by layer, such as determining whether the data instructions conform to the normal logic in the industrial production process, whether the parameter settings in the protocol field are within the reasonable industrial control range, etc. If the semantic content in the data packet is found to be inconsistent with the normal industrial operation logic, even if its surface format conforms to the requirements of the conventional communication protocol, it will be judged as abnormal and the connection will be immediately blocked and an accurate security alarm will be issued, indicating the possible existence of new forms of malicious attacks, such as covert attacks disguised as normal instructions.

[0047] 3. Firewall deployment and configuration optimization Deploy redundant firewall devices at key nodes According to the formulated firewall strategy, industrial firewall equipment is deployed at the key network nodes of the DCS system. The industrial firewall equipment has a redundant design and adopts a dual-machine hot standby working mode to ensure that when one device fails, the other can seamlessly take over the network protection work, thereby ensuring the continuity of network protection.

[0048] For example, in the DCS system of a large steel plant, two industrial firewall devices are installed on the key communication link nodes between the ironmaking blast furnace control unit and other related control units and operation stations. During normal operation, one is the main firewall responsible for processing network traffic and executing protection strategies, and the other is in hot standby state, synchronizing the configuration and status information of the main firewall in real time. When the main firewall fails to work properly due to hardware failure, software crash, or attack, the hot standby firewall can automatically switch to take over the network protection work in a very short time to ensure that network communication is not affected.

[0049] In addition, a multi-path redundancy mechanism is further implemented. In the communication link setting between the key network nodes of the DCS system and the external network and various important internal areas, multiple physically independent communication lines with different routing paths are constructed, and each line is connected to the corresponding firewall device port. When one of the communication lines fails, such as due to line damage, network congestion or interruption caused by external attacks, the system can automatically detect the link failure and quickly switch the network traffic to other normal communication lines according to the pre-set intelligent routing switching strategy to ensure that data transmission is not affected and to ensure the continuity and stability of the DCS system network communication. At the same time, under the multi-path redundancy mechanism, the communication lines of different paths use load balancing technology when transmitting data, and dynamically allocate data traffic according to the network performance indicators such as real-time bandwidth and delay of each line, so as to avoid the situation where a line is overloaded while other lines are idle, making full use of network resources and improving the efficiency of the entire network communication.

[0050] Configuring Hardware Resource Allocation During the deployment process, the hardware parameters of the firewall are optimized and configured, and the processing resources are reasonably allocated according to the network traffic load of different nodes. Network security technicians use network traffic monitoring tools to analyze the historical traffic data and real-time traffic conditions of each key node to determine which nodes have larger data traffic and which have relatively smaller data traffic.

[0051] For example, for the communication link nodes between the control unit and the operation station with large data flow, more CPU processing cores and memory resources are allocated to quickly process massive data packets. For those backup control unit connection nodes with small data flow, fewer hardware resources are appropriately allocated to ensure that the firewall equipment can operate efficiently as a whole, avoiding the situation where some node resources are idle while some node resources are tight, resulting in network congestion or low protection efficiency.

[0052] Initialize software rule base and update mechanism Initialize the firewall's software rule base, accurately enter customized access control policies, traffic filtering rules, and security detection rules into the rule base, and set up an automatic rule update mechanism. This mechanism is linked to a professional industrial network security intelligence platform in real time. Once new security threat intelligence is released or the system's own business rules change, the firewall's rule base can be updated in a timely manner to ensure the timeliness and accuracy of the protection strategy.

[0053] At the same time, the rule base uses blockchain encryption technology for distributed encrypted storage to ensure the security of the rule base and prevent the rules from being maliciously tampered with and causing protection failure. Specifically, each rule information will be divided into multiple data blocks when stored, and each data block will be encrypted through the blockchain encryption algorithm, and then these encrypted data blocks will be distributed and stored on multiple different storage nodes. The storage nodes are interconnected through an encrypted chain structure. Only authorized firewall devices can obtain complete rule information and perform corresponding update operations after verification.

[0054] In addition, an internal feedback optimization module is also set up. This module is based on the monitoring and analysis of network security events that actually occur during the operation of the DCS system itself and the execution of firewall policies. It collects feedback information such as false positives and missed positives caused by unreasonable rules, as well as the shortcomings of existing rules in dealing with specific attack scenarios. Then, these feedback information is deeply analyzed through the built-in intelligent analysis algorithm to automatically generate optimization suggestions for the rule base, such as adding or adjusting specific access control rules, refining traffic filtering conditions, etc. These optimization suggestions will be reviewed and confirmed by the system security management personnel and applied to the update of the rule base in a timely manner, so that the rule base can continuously adapt to the internal business changes of the DCS system and the dynamic evolution of external network security threats.

[0055] 4. Real-time monitoring and dynamic adjustment Build a real-time monitoring system to collect key indicators A real-time monitoring system is built to continuously monitor the operating status of the industrial firewall and the network communication status of the DCS system under its protection. Multiple sensors set on the firewall collect key indicator information such as network traffic data, connection request data, and security alarm data, and transmit this information in real time to a centralized monitoring platform.

[0056] For example, in terms of network traffic data collection, the sensor will record detailed information such as the number, size, transmission rate, etc. of data packets sent and received on each network interface; for connection request data, it will record the source IP address of the request, the destination port of the request, the timestamp of the request, and the protocol used by the request; security alarm data will record detailed descriptions of various abnormal events detected by the firewall, such as the malicious IP addresses discovered, characteristic information of suspected malicious code, and the alarm level of abnormal traffic.

[0057] Detect anomalies using intelligent analysis algorithms On the monitoring platform, the collected data is analyzed using intelligent analysis algorithms. The intelligent analysis algorithms are based on the anomaly detection model in machine learning. Through the training of historical normal network behavior data, they can accurately identify abnormal behavior patterns in current network activities. Here, an integrated learning method is used to improve the accuracy and generalization ability of detection. Specifically, it integrates a variety of different types of machine learning algorithms, such as support vector machines, random forests, deep neural networks, etc., to build an integrated anomaly detection model framework.

[0058] During the training phase, each basic algorithm model is trained independently using historical normal network behavior data, and then the prediction results of each model are processed comprehensively through integrated strategies such as weighted voting and averaging to obtain the final anomaly detection results. For example, when the network traffic suddenly increases significantly at a certain moment, it may be difficult to accurately determine whether it is caused by a normal business peak or an attack using only a single support vector machine model. However, through integrated learning, combined with the analysis of complex patterns of traffic data by deep neural networks and the advantages of comprehensive judgment of multiple features by random forests, it is possible to more accurately determine whether such traffic changes are abnormal behavior.

[0059] Trigger dynamic adjustment mechanism and record feedback Once abnormal fluctuations in network traffic, frequent illegal access requests or other behaviors that do not conform to preset rules are detected, the dynamic adjustment mechanism will be triggered immediately. The dynamic adjustment mechanism will automatically make temporary adjustments to the firewall's relevant policies based on the specific abnormal situation and the current business operation status of the DCS system, such as temporarily blocking access rights of suspicious IP addresses, tightening traffic restrictions in specific areas, and other measures. At the same time, the abnormal situation and the response measures taken will be recorded in detail and pushed to the system security manager. The security manager can further evaluate whether the firewall policy needs to be permanently optimized and adjusted based on the pushed information, so as to achieve dynamic optimization of the industrial firewall isolation protection of the DCS system and continuously ensure the network security and stable operation of the system.

[0060] During the entire process, all data interactions involved are transmitted through an encrypted communication channel built with the SSL / TLS protocol to ensure the confidentiality, integrity, and authentication of the communication. For example, when the sensor transmits the collected data to the monitoring platform, the data will be encrypted first and then sent through the secure channel established with the SSL / TLS protocol. After receiving the data, the monitoring platform will perform decryption verification to ensure that the data is not stolen or tampered with during transmission, and to prevent the monitoring information from being leaked and used by attackers to circumvent the protection mechanism.

[0061] V. Emergency Response and Backup and Recovery Detect serious security incidents and initiate emergency response procedures Establish a comprehensive emergency response plan and immediately initiate the emergency response process when the industrial firewall detects a serious security incident, such as a large-scale distributed denial of service attack or suspected deliberate sabotage by internal malicious personnel that causes some functions of the firewall to fail.

[0062] According to the preset emergency response plan, on the one hand, the emergency blocking function of the firewall is used to quickly cut off all connections with the external network to prevent the attack from further spreading to the core area inside the DCS system. At the same time, non-critical communications between internal areas are restricted, and only the transmission channels of core control instructions are retained to ensure the basic operation of key equipment. For example, in a DCS system of an automated assembly line, when encountering such an attack, non-essential data interactions between various production links will be temporarily stopped, and information transmission such as production progress reports and non-critical equipment status feedback will be suspended, but core control information such as motor speed control and operating instructions for key processing procedures can still be transmitted between internal security areas to ensure that the main equipment of the production line can maintain basic operation and avoid the complete paralysis of the entire production process.

[0063] On the other hand, the system security team and relevant operation and maintenance personnel are notified in time. The security team and operation and maintenance personnel will quickly carry out troubleshooting, source tracing analysis and repair work according to the division of responsibilities set in the plan. The security team will use professional network security detection tools to conduct detailed investigations on the source of the attack, the attack path and the vulnerabilities exploited by the attack. The operation and maintenance personnel will focus on checking the operating status of the affected devices, network nodes and software modules in the system to see if there is hardware damage, software failure or configuration anomalies. For example, the security team analyzes the firewall logs and network traffic records to trace the source IP address range of the attack to determine whether it is an external hacker organization or a terminal controlled by malicious means in the internal network; the operation and maintenance personnel will check the indicator light status of hardware devices such as servers and switches on site, check the error logs of the operating system and control software, and determine whether there are problems such as system crashes and abnormal process terminations caused by attacks.

[0064] Communication using encrypted backup data recovery function Use the backed-up firewall configuration files and system data to restore the normal functions of the firewall and the network communication of the DCS system as soon as possible while ensuring safety. In the process of storing the backed-up firewall configuration files and system data, multiple encryption methods are used for protection, such as combining symmetric encryption and asymmetric encryption algorithms to encrypt the data, and the encrypted data is stored in different secure storage media in pieces to avoid data leakage due to the breach of a single storage medium.

[0065] Specifically, for the backed-up firewall configuration files, first use the high-level AES-256 and RSA-4096 algorithm combination to encrypt them. When encrypting, the configuration files are divided into multiple data blocks, and each data block is encrypted using the AES-256 algorithm. Then, the RSA-4096 algorithm is used to encrypt and protect the key used for AES encryption. After that, these encrypted data blocks are dispersed and stored in different disk arrays, tape libraries and other secure storage media. These storage media are placed in a computer room environment with strict physical access control, such as access control systems, surveillance cameras, and temperature and humidity control equipment. Only authorized specific personnel can access operations under strict identity authentication conditions.

[0066] The same is true for the backup and recovery of system data. Encryption algorithm combinations of different strengths are selected according to the importance level and sensitivity classification of the data. Highly sensitive data such as core control instructions and key system parameters are encrypted with the above-mentioned high-level encryption algorithm combination, while relatively less sensitive data such as general system configuration information is encrypted with the AES-128 and RSA-2048 algorithm combination. While ensuring data security, it reasonably optimizes the consumption of encryption computing resources.

[0067] After the emergency incident is handled, the entire incident is reviewed and summarized, the cause of the incident and the weak links in the existing firewall isolation method are analyzed, and the emergency response plan and the daily protection strategy of the firewall are improved in a targeted manner to prevent similar security incidents from happening again, thereby comprehensively improving the DCS system's resistance and recovery capabilities in the face of various network security threats and ensuring the continuity and stability of industrial production. For example, if it is found that the attack was successful due to a loophole in a firewall access control rule, the rule will be re-evaluated and revised, and the processing flow of such attack scenarios in the emergency response plan will be optimized, such as shortening the time to notify relevant personnel, adding optional solutions for temporary emergency strategies, etc., so that the next time a similar situation occurs, it can be responded to more quickly and effectively, minimizing the impact of security incidents on industrial production.

Claims

1. An industrial firewall isolation method for a DCS system, characterized in that: The following steps are involved: Step 1: System architecture analysis and risk assessment Comprehensively analyze the target DCS system and accurately identify key components such as control units, operation stations, communication links, and interfaces with external networks; use professional industrial network security risk assessment tools combined with manual audits to deeply investigate potential security threats, including illegal access, malicious code injection, data tampering, denial of service attacks, etc.; quantify and classify risks based on the likelihood of occurrence and the degree of harm, and identify key protection areas and key data flows; Step 2: Customize firewall policy It is limited to a specific pre-authorized IP address range and access based on a specific communication protocol, and adopts an improved ModbusTCP protocol security version; this version uses an asymmetric encryption algorithm to authenticate the identities of both communicating parties. The connection initiator uses the receiver's public key to encrypt the identity and key parameter transmission, and the receiver's private key decrypts and verifies; After identity verification, the data packet uses a symmetric encryption algorithm to encrypt the data content with a symmetric key that is dynamically generated and regularly updated by the system. At the same time, the data packet is accompanied by a verification code based on the key. The receiving end verifies with the same key. If the verification fails, it will be discarded to prevent illegal data from entering. Differentiate the accounts of operators with different permissions to formulate strategies; when a high-privilege account operates key parameter adjustments and other behaviors, the operation records are backed up to an independent security audit server, and the hash encryption algorithm is used to generate a hash value to verify the integrity, and the AES algorithm is used to encrypt the details of the operation behavior; low-privilege accounts are limited to basic operations such as viewing regular data, and the non-critical data transmission they access uses a lightweight stream cipher encryption algorithm to ensure confidentiality; Set strict inbound and outbound traffic filtering rules, set up a whitelist based on the legitimate business transactions of the DCS system, and only allow data that meets the whitelist rules to pass; for external unknown source traffic, enable deep packet inspection technology, disassemble and analyze data packets, and immediately block and alarm when anomalies are encountered; When data is transmitted to and from the interface, the key header information is first encrypted with the RSA algorithm, and then the main content is encrypted with the symmetric encryption algorithm to ensure the security of cross-internet and intranet interactions; Step 3: Firewall deployment and configuration optimization Deploy industrial firewall equipment with redundant design at key network nodes of the DCS system, and adopt dual-machine hot standby mode to ensure protection continuity; reasonably allocate hardware processing resources according to the network traffic load of each node, such as allocating more CPU cores and memory to link nodes with large data traffic; initialize the firewall software rule base, enter customized policies and other information, and set up an automatic update mechanism that is linked to the industrial network security intelligence platform in real time to ensure the timeliness of the policy; at the same time, the rule base adopts blockchain encryption technology for distributed encryption storage to prevent the rules from being tampered with and ensure its security; Step 4: Real-time monitoring and dynamic adjustment Build a real-time monitoring system to collect key indicator information such as network traffic, connection requests, and security alerts through multiple sensors on the firewall and transmit it to the monitoring platform in real time; the monitoring platform uses an intelligent analysis algorithm based on a machine learning anomaly detection model, trained based on historical normal network behavior data, to accurately identify current abnormal behavior patterns; Once an anomaly is found, the dynamic adjustment mechanism is triggered to automatically and temporarily adjust the firewall policy according to the specific situation and the system business status, such as blocking suspicious IPs, tightening traffic restrictions, etc., and record the anomaly and the response measures and push them to the security management personnel for them to evaluate whether permanent optimization and adjustment are needed, so as to achieve dynamic optimization of protection and ensure the network security and stable operation of the system. During the whole process, the data interaction involved is transmitted through the encrypted communication channel built by the SSL / TLS protocol to ensure the confidentiality, integrity and authentication of the communication. Step 5: Emergency response and backup recovery Establish an emergency response plan. When the firewall detects a serious security incident, such as a large-scale attack or internal sabotage that causes partial functional failure, immediately initiate the emergency response process. On the one hand, cut off the connection with the external network through the emergency blocking function, limit internal non-critical communications, and retain the core control command transmission channel; on the other hand, notify the security team and operation and maintenance personnel to investigate, trace the source, and repair according to the division of labor in the plan, and use backup firewall configuration files and system data with multiple encryption protections (such as encryption with a combination of symmetric and asymmetric encryption algorithms, and stored in pieces on different secure media) to restore functions and communications; review and summarize after the incident is handled, improve the plan and daily protection strategies, enhance the system's resistance and recovery capabilities, and ensure the continuity and stability of industrial production.

2. The industrial firewall isolation method of a DCS system according to claim 1 is characterized in that: In the system architecture analysis and risk assessment steps, the manual audit process also includes an in-depth analysis of historical security event records, collecting information on the types of attacks that have occurred in the past against the DCS system, the sources of attacks, and the specific functional modules affected; through data mining technology, key security-related features are extracted from massive historical log data, such as abnormal IP access behaviors that frequently occur in a specific time period, and patterns of tampering with specific control instructions; at the same time, combined with the security vulnerability notification information released in the industrial control system industry, areas in this DCS system that may have the same or similar vulnerabilities are marked, and these analysis results are used as an important supplementary basis for risk assessment, and the quantitative classification of risks is further refined, so that the determination of key protection areas and key data flows is more accurate, providing more reliable and comprehensive data support for the formulation of subsequent customized firewall strategies, which is different from the existing method of relying solely on general risk assessment tools for evaluation, and enhancing the adaptability and effectiveness of the entire firewall isolation method for the characteristics of this DCS system.

3. The industrial firewall isolation method of a DCS system according to claim 1 is characterized in that: In the step of formulating the customized firewall strategy, the generation and update mechanism of the symmetric key used for data encryption in the area where the core control unit is located has high security and dynamic adaptability; specifically, the key generation process introduces hardware encryption technology based on physically unclonable functions (PUFs), and uses the physical characteristics of specific hardware chips in the DCS system, such as the process deviation of the chip and the inherent properties of random noise to generate unique and non-replicable initial key information, which is then transformed by a specific encryption algorithm to generate a symmetric key for actual data encryption; and the key update cycle is dynamically adjusted according to the real-time operating status of the system. For example, when the system detects that a new device is connected, an important software upgrade occurs, or a key event such as a change in the network topology occurs, the key update process is automatically triggered to regenerate a new symmetric key, ensuring that even in a complex and changeable industrial network environment, the data encryption in the core control area always maintains a high degree of confidentiality, effectively preventing the risk of being cracked due to key leakage or long-term non-update, and significantly improving the security and reliability of data encryption compared to the traditional fixed period or simple random key update method; For the generation algorithm of the check code during the data transmission process in this area, a composite check method that integrates hash function and error correction coding technology is adopted; first, the hash function is used to perform a summary calculation on the data content in the data packet to obtain a hash value of a fixed length. The hash value can uniquely identify the original content of the data packet to ensure the integrity of the data; then the hash value is encoded using error correction coding technology to add certain redundant information, so that when the receiving end verifies the check code, even if a small number of bit errors occur in the data packet during transmission, the error correction coding mechanism can be used to correct them and accurately verify the integrity of the data, greatly improving the accuracy and anti-interference capability of data transmission, and ensuring the stability and reliability of data interaction in the core control area. This is also the innovation that is different from the conventional single check method.

4. The industrial firewall isolation method of a DCS system according to claim 1 is characterized in that: When the operation station distinguishes different permission operator accounts to formulate data access and operation permission strategies, the operation behavior records of high-authority accounts are backed up to an independent security audit server, which further optimizes the data storage structure and index mechanism. In the security audit server, a distributed database architecture is used for data storage, and the operation behavior records are stored in multiple dimensions according to time sequence, operation type, and control modules involved. Each shard data is accompanied by detailed metadata information when it is stored, such as the specific timestamp of the operation, the IP address of the operation initiator, and the corresponding operator identification, which is convenient for subsequent rapid retrieval and accurate query. In order to improve the query efficiency and security of data, an index system based on blockchain technology was established. This index system uses the distributed ledger characteristics of blockchain to store the index information of operation behavior records in the form of encrypted blockchain nodes. Each index node is connected by a hash pointer to form an index chain that cannot be tampered with. When it is necessary to query the operation behavior records of a specific high-authority account, the corresponding shard data storage location can be quickly found by quickly locating and traversing the blockchain index chain, and then the corresponding detailed record content can be obtained based on the permission verification mechanism. This not only effectively improves the data query speed, but also ensures the security and non-tamperability of data storage, avoids the risk of traditional centralized database indexes being easily tampered with or data loss, and makes the audit supervision of high-authority account operation behaviors more efficient and reliable. This is significantly innovative compared to the existing ordinary audit server storage and query methods.

5. The industrial firewall isolation method of a DCS system according to claim 1 is characterized in that: In terms of deep packet inspection technology set up at the interface connected to the external network, a deep semantic analysis model based on artificial intelligence is used to disassemble and analyze the data packet; this model is pre-trained with a large number of known malicious code samples and normal industrial network data packet samples, and can accurately understand the semantic information of data instructions and protocol field content in the data packet, not just limited to simple format and feature matching detection; When detecting external data traffic from unknown sources, the deep semantic analysis model will perform semantic analysis on the data packet layer by layer, for example, to determine whether the data instructions conform to the normal logic of the industrial production process and whether the parameter settings in the protocol field are within a reasonable industrial control range; if it is found that the semantic content in the data packet is inconsistent with the normal industrial operation logic, even if its surface format conforms to the requirements of conventional communication protocols, it will be judged as abnormal and the connection will be blocked immediately and an accurate security alarm will be issued to indicate possible new forms of malicious attacks, such as covert attacks disguised as normal instructions; this deep packet detection method based on semantic analysis can more effectively detect complex and changeable new network attack methods than traditional detection technology that relies solely on feature code matching, significantly enhances the security prevention capabilities of external network data transmission, and builds a more solid line of defense for the network security boundary of the DCS system.

6. The industrial firewall isolation method of a DCS system according to claim 1 is characterized in that: In the firewall deployment and configuration optimization steps, in addition to the dual-machine hot standby working mode, the redundant design of the industrial firewall equipment also further implements a multi-path redundancy mechanism; in the communication link setting between the key network nodes of the DCS system and the external network and various important internal areas, multiple physically independent communication lines with different routing paths are constructed, and each line is connected to the corresponding firewall device port; When one of the communication lines fails, for example, due to line damage, network congestion or external attack, the system can automatically detect the link failure and quickly switch the network traffic to other normal communication lines based on the pre-set intelligent routing switching strategy to ensure that data transmission is not affected and to ensure the continuity and stability of the DCS system network communication. At the same time, under the multi-path redundancy mechanism, communication lines on different paths use load balancing technology when transmitting data, and dynamically allocate data traffic according to the real-time bandwidth and delay network performance indicators of each line to avoid the situation where a line is overloaded while other lines are idle, making full use of network resources and improving the efficiency of the entire network communication. Compared with the simple dual-machine hot standby mode, this has further improved the network reliability and provided stronger support for the stable operation of the DCS system in the industrial production environment.

7. The industrial firewall isolation method of a DCS system according to claim 1 is characterized in that: In the automatic update mechanism of the firewall software rule base, in addition to real-time linkage with the professional industrial network security intelligence platform, an internal feedback optimization module is also set up; this module is based on the monitoring and analysis of the actual network security events that occur during the operation of the DCS system itself and the execution of firewall policies, and collects feedback information such as false positives and missed negatives caused by unreasonable rules, as well as the deficiencies of existing rules in dealing with specific attack scenarios; Then, the feedback information is deeply analyzed through the built-in intelligent analysis algorithm to automatically generate optimization suggestions for the rule base, such as adding or adjusting specific access control rules and refining traffic filtering conditions. These optimization suggestions will be reviewed and confirmed by the system security management personnel and applied to the update of the rule base in a timely manner, so that the rule base can continuously adapt to the internal business changes of the DCS system and the dynamic evolution of external network security threats, and realize a two-way driven update mode from external intelligence introduction to internal feedback optimization. Compared with the traditional method of updating the rule base based on external intelligence alone, it can improve the firewall strategy more accurately and timely, enhance the ability of the entire firewall isolation method to cope with actual network security challenges, and ensure that the DCS system is always in an efficient security protection state.

8. The industrial firewall isolation method of a DCS system according to claim 1 is characterized in that: In the real-time monitoring and dynamic adjustment steps, the intelligent analysis algorithm uses an integrated learning method to improve the accuracy and generalization ability of detection when performing abnormal behavior pattern recognition based on the anomaly detection model in machine learning; specifically, it integrates a variety of different types of machine learning algorithms, such as support vector machines, random forests, and deep neural networks, to build an integrated anomaly detection model framework; During the training phase, each basic algorithm model is trained independently using historical normal network behavior data, and then the prediction results of each model are comprehensively processed through weighted voting and averaging integration strategies to obtain the final anomaly detection results. This integrated learning method can make full use of the advantages of different algorithm models to make up for the detection blind spots and misjudgment problems that may exist when a single algorithm faces complex and diverse industrial network behavior data. For example, the deep neural network has a strong fitting ability for complex nonlinear relationship data and the support vector machine has good classification performance under small sample data. Through synergy, the identification of abnormal fluctuations in network traffic and abnormal behavior of illegal access requests is more accurate and reliable, and various potential network security threats can be captured in a timely manner, thereby more effectively triggering the dynamic adjustment mechanism to ensure the dynamic protection effect of DCS system network security.

9. The industrial firewall isolation method of a DCS system according to claim 1, characterized in that: In the emergency response and backup recovery steps, the multiple encryption protection mechanisms for the backup firewall configuration files and system data have more sophisticated designs in encryption algorithm selection and key management. In terms of encryption algorithms, in addition to the combination of symmetric encryption and asymmetric encryption algorithms, encryption algorithm combinations of different strengths are selected according to the importance level and sensitivity classification of the data. For example, the highly sensitive data including core control instructions and key system parameters are encrypted with the high-level AES-256 and RSA-4096 algorithm combination, while the relatively less sensitive data of general system configuration information is encrypted with the AES-128 and RSA-2048 algorithm combination. While ensuring data security, the consumption of encryption computing resources is reasonably optimized. In terms of key management, a centralized key management system has been established. The system uses a hardware security module to store and protect keys, and utilizes the physical protection mechanism of HSM and the built-in encryption algorithm engine to ensure the security of keys during generation, storage, distribution and use. At the same time, the key management system has strict authority control and auditing functions. Only authorized specific security managers can perform key-related operations under strict identity authentication conditions, and all key operations will be recorded and audited in detail to prevent the risk of data leakage caused by poor key management. Through this refined encryption protection and key management mechanism, the security of backup data is further enhanced, providing a solid guarantee for the reliable use of system data during emergency recovery.

10. The industrial firewall isolation method of a DCS system according to claim 1, characterized in that: During the implementation of the entire method, a regular security drill and evaluation mechanism is also set up. At regular intervals, the relevant system security team, operation and maintenance personnel, and some operators are organized to simulate different types of network security attack scenarios, and respond according to the preset emergency response process and firewall isolation strategy to test the collaborative working ability of each link when facing actual security threats and the effectiveness of the strategy. After the security drill is completed, based on the evaluation indicators collected during the drill, such as response time, operation accuracy, and policy execution effect, a comprehensive evaluation and analysis of the entire firewall isolation method is conducted to find out the existing weak links and problems that may arise in actual operations, such as insufficient operational proficiency of personnel and the lack of flexibility of certain strategies in specific scenarios; then targeted improvement measures are formulated, personnel are trained to improve their skills, and emergency response plans and firewall strategies are optimized and adjusted. Through this periodic security drill and evaluation mechanism, the overall ability of the DCS system to respond to network security threats is continuously strengthened, ensuring that firewall isolation protection measures can be implemented efficiently and accurately when actual security incidents occur, thereby ensuring the stable operation of industrial production.

Images