Underwater network intelligent security control situation system and method

Abstract

The invention relates to the technical field of underwater information networks, in particular to an underwater network intelligent security control situation system and method. Comprising node management and control, security isolation, network security reconstruction and comprehensive situation and threat situation analysis, and the node management and control is used for carrying out classification and basic information management on nodes under the whole underwater network, formulating a standard protocol interface and carrying out formatting processing on accessed node equipment data; the security isolation realizes identity authentication, terminal protection, isolation filtering and monitoring early warning capabilities based on a security policy configuration technology of a network node with the characteristics of low power consumption, resource scarcity and the like in an underwater network multi-service scene; according to the network security reconstruction, under the condition that network nodes are subjected to security isolation, fault-caused isolation or physical blocking, a dynamic planning technology of a physical link and a network communication link realizes security reconstruction and interconnection and intercommunication of an underwater network; and the comprehensive situation and the threat situation are analyzed and displayed.

Description

Technical Field

[0001] The present invention relates to the technical field of underwater information networks, and in particular to an underwater network intelligent safety management and control situation system and method. Background Art

[0002] my country has vast sea areas, and it is necessary to use the marine Internet of Things to interconnect underwater monitoring, economic, scientific research and other instruments, platforms and facilities, promote the rapid interconnection and integration of information of various marine elements, improve the level of intelligence of marine activities, and enhance the vitality of the marine economy. The traditional marine Internet of Things realizes the interconnection of underwater equipment through underwater docking equipment, but with limited underwater resources, the underwater information network architecture is relatively basic, with poor security and reconfigurability, and there are problems such as underwater network security, chaotic resource management, and high maintenance costs.

[0003] Therefore, people are conducting research on underwater network security. On the one hand, they are proposing system construction research, such as the "Research on Underwater Information Network System Construction" published in the Journal of Naval University of Engineering, Vol. 14, No. 2, which mainly proposes to construct a system of underwater information security systematization including information acquisition, transmission, processing and support systems for underwater information acquisition and transmission. On the other hand, security defense is carried out by studying transmission encryption. For example, Chinese patent document CN112672347A provides "A Design of Underwater Wireless Sensor Network Data Transmission Security Defense Framework", which includes four parts: general nodes, sink nodes, hidden underwater acoustic communication channels and high-speed underwater acoustic communication channels. The invention is based on the encryption mechanism, and constructs an underwater network data security defense framework by establishing a network model, channel model, modulation and demodulation, key transmission, key verification, and ciphertext transmission. In addition, the status of the underwater network can also be monitored by improving the reliability and connectivity of the underwater network infrastructure. For example, Chinese patent document CN112291508B provides "An Intelligent Underwater Security Barrier Net System and Intrusion Warning Method", which uses high-strength composite materials to protect network cables and uses optical fiber disturbance analysis in optical cables to achieve early warning and hinder the delay of intrusion speed.

[0004] However, the above methods, "Research on the Construction of Underwater Information Network System", remain at the conception or small-scale experiment, and have not been implemented on a large scale. "A Design of a Security Defense Framework for Data Transmission of Underwater Wireless Sensor Networks" builds network security defense based on the encryption principle in the traditional sense, and lacks systematic security control of the entire underwater network. "An Intelligent Underwater Security Interception Network System and Intrusion Warning Method" uses traditional physical means and optical fiber monitoring and warning methods for security defense, and lacks detailed security management of the entire network node. The existing underwater network lacks a control method for the entire network system to ensure its reliability. For this reason, it is necessary to provide a highly reliable underwater network control system. Summary of the invention

[0005] The problem to be solved by the present invention is to provide a management and control system with high reliability for an underwater network.

[0006] In view of the shortcomings of the prior art, the technical solution adopted by the present invention to solve the technical problems is: an underwater network intelligent security management and control situation system, including node management and control, security isolation, network security reconstruction, comprehensive situation and threat situation analysis, wherein:

[0007] The node control is used to classify the nodes in the entire underwater network, formulate standard protocol interfaces, format the data of the connected node devices, and perform processing technologies such as packaging, distribution, and storage to achieve a unified protocol interface and flexible processing of application layer data;

[0008] The security isolation described above implements identity authentication, terminal protection, isolation filtering, and monitoring and early warning capabilities based on the security policy configuration technology of network nodes with low power consumption and scarce resources in underwater network multi-service scenarios;

[0009] The network security reconstruction mentioned above realizes the safe reconstruction and interconnection of the underwater network by using the dynamic planning technology of physical links and network communication links when the network nodes are safely isolated, isolated due to faults or physically blocked;

[0010] The comprehensive situation and threat situation described above constructs a security analysis model for multi-source heterogeneous nodes in a large-bandwidth and high-real-time underwater network environment, studies an intelligent analysis model based on multimodal learning, anomaly discovery, threat source association, and attack intent analysis, and realizes comprehensive situation and threat situation analysis and presentation.

[0011] Preferably, the node control specifically includes:

[0012] Node management, which is used to manage the basic information of access nodes in the underwater network, configure relevant attribute strategies, and control the working status of nodes;

[0013] Data standardization is used to standardize incoming and outgoing data and implement a unified protocol interface.

[0014] Preferably, the safety isolation specifically includes:

[0015] Identity authentication, used to identify and verify the identity of accessing users;

[0016] Terminal protection, used to identify and protect against external malicious attacks;

[0017] Isolation filtering is used to isolate and shield information from illegal users and malicious attacks;

[0018] Monitoring and early warning are used to record and report abnormal information encountered by the node, upload and synchronize abnormal information in the shore station platform, and update the protection strategy of this node.

[0019] Preferably, the network security reconstruction specifically includes:

[0020] Physical link reorganization, used for dynamic control of underwater physical nodes and physical communication links based on power control;

[0021] Network communication link planning is used to dynamically adjust the communication link based on the properties of each node underwater (such as traffic load, information importance, etc.).

[0022] Preferably, the comprehensive situation and threat situation analysis specifically includes: comprehensive situation and threat situation analysis and display.

[0023] A method for an underwater network intelligent safety management and control situation system comprises the following steps:

[0024] Step 1: The shore station platform establishes a basic node information database in the node management and control module based on the actual information of various underwater nodes, including the physical address of each node, node type, associated nodes, node access device type, node load, etc.;

[0025] Step 2: Each underwater node device deploys and installs the system, and downloads and updates the security isolation strategy through the network; during the operation of the node, security isolation protects the information of external access to the node, and reports abnormal information to the shore station platform;

[0026] Step 3: When a link or node is found to be abnormal (such as external devices monitoring or attacking), isolate the physical link or node through power control;

[0027] Step 4: When each node is just connected to the network or the node needs to readjust the communication link, the system plans the communication link by combining the node attributes (traffic load, node priority, etc.) through the optimization algorithm;

[0028] Step 5: The shore station platform collects and summarizes all nodes and network load conditions in the entire network to form a comprehensive situation map; and analyzes the anomalies that occur in the network, and finally forms and displays a threat situation analysis through abnormal threat association and attack intent classification.

[0029] The beneficial effects of the present invention are as follows:

[0030] (1) The present invention uses the underwater node control function to orderly control underwater network nodes and underwater monitoring equipment, improves the dynamic monitoring of nodes and different types of equipment in the underwater network, and standardizes underwater data to achieve unified protocols and flexible interfaces;

[0031] (2) The present invention uses security policy configuration technology for securely isolated network nodes and a multi-attribute cross-domain authentication hierarchical system to achieve dynamic isolation security from application, terminal, access to network level; based on lightweight isolation protection of physical machines, virtual machines and containers, a complex business network security access control system with low power consumption, high accuracy, high reliability and low latency is formed;

[0032] (3) The present invention can ensure the security and stability of core services through the network topology reconstruction technology of adaptive networking through network security reconstruction, and accurately identify all services in multiple scenarios based on pre-trained models, as well as the business behavior perception technology based on abnormal discovery of transfer learning, to achieve the trusted transmission of core services in different scenarios and at different levels, forming a secure exchange integrated enhancement device;

[0033] (4) The present invention uses a security analysis model and intelligent analysis model technology for multi-source heterogeneous nodes that comprehensively analyzes the situation and threat situation. It can discover anomalies in underwater networks, associate threat sources, and analyze attack intentions. It can effectively display the comprehensive situation and threat situation in the network transmission process and support command decisions for underwater activities. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 It is a schematic diagram of the structure of the present invention;

[0035] Figure 2 It is a schematic diagram of the application connection of the present invention;

[0036] Figure 3 is a security isolation interaction diagram involved in the present invention;

[0037] Figure 4 It is a safety isolation flow chart involved in the present invention;

[0038] Figure 5 The invention is a schematic diagram of network security reconstruction. DETAILED DESCRIPTION

[0039] The present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. The embodiments of the present invention are provided for the purpose of illustration and description, and are not intended to be exhaustive or to limit the present invention to the disclosed forms. Many modifications and variations will be apparent to those of ordinary skill in the art. The embodiments are selected and described in order to better illustrate the principles and practical applications of the present invention, and to enable those of ordinary skill in the art to understand the present invention and thereby design various embodiments with various modifications suitable for specific uses.

[0040] Taking into account factors such as cost, underwater network nodes, equipment, and future economic benefits, a lightweight intelligent security management and control situation system based on low energy consumption, limited bandwidth, and decentralization is designed and researched, and effective management of nodes and equipment in the underwater network is achieved through interface standard planning, data standard planning, and other means. By simulating terminal nodes, which can also be based on actual physical machines, the nodes mainly simulate the nodes participating in the entire underwater network main line, and the scene simulation is performed through simulation data or simulators to perform system verification. The technical problem to be solved by the present invention is to ensure high reliability in the underwater information network, while ensuring the information security of each node and device in the network. The method of the present invention has the ability to configure security policies and can reconstruct network security models. Figure 1 The figure shows the overall architecture of the underwater network intelligent security management and control situation system of the present invention, which specifically includes underwater node management and control, security isolation, network security reconstruction, comprehensive situation and threat situation analysis.

[0041] The underwater node control classifies the nodes under the entire underwater network, formulates a standard protocol interface, formats the data of the connected node devices, and performs processing technologies such as packaging, distribution, and storage to achieve a unified protocol interface and flexible processing of application layer data. Allocate policies to all underwater nodes, set all nodes connected to the nodes according to the actual scenario, and set the connected pipeline information to provide information support for the network security reconstruction. At the same time, formulate data transmission protocols and standard interfaces between nodes and nodes, and between nodes and the main network in the entire network, standardize the data of various device sensors connected to the nodes, and transmit the processed data according to the standard protocol. Node control specifically includes node management and data standardization. Node management is used to manage the basic information of the access nodes in the underwater network, configure relevant attribute strategies, and control the working status of the nodes; data standardization is used to standardize the access and output data to achieve a unified protocol interface.

[0042] The security isolation, in the underwater network multi-service scenario, is based on the security policy configuration technology of network nodes with characteristics such as low power consumption and scarce resources, to achieve identity authentication, terminal protection, isolation filtering and monitoring and early warning capabilities. Identity authentication is used to identify and verify the identity of accessing users; terminal protection is used to identify and protect external malicious attacks; isolation filtering is used to isolate and shield information of illegal users and malicious attacks; monitoring and early warning is used to record and report abnormal information encountered by the node, and also upload and synchronize abnormal information in the shore station platform, and update the protection strategy of this node. Security isolation is applied to all nodes and the shore station main system. Each node has an independent security isolation configuration, and each node has a unique identity card (the identity card is related to the node level and is dynamically changed and updated). When interactive access is performed between nodes and between nodes and the main network, fine-grained multi-level identity cards are implemented through cross-domain authentication, attribute encryption, dynamic permissions, etc. to perform mutual verification and authentication. If the verification fails, filtering does not allow access. When a node or main network receives high-frequency illegal access or attacks, it will isolate and filter the visitors, record relevant information, and send warning information to the main network through monitoring and warning. At the same time, all nodes in the network will obtain isolation and filtering information of malicious attacks through the main network, and update local isolation strategies to isolate and filter external illegal information.

[0043] The network security reconstruction physical link reorganization and network communication link planning, physical link reorganization is used for dynamic control of underwater physical nodes and physical communication links based on power control; network communication link planning is used to dynamically adjust the communication link based on the attributes of each node in the water (such as traffic load, information importance, etc.). When the network node is safely isolated, isolated due to a fault, or physically blocked, the physical link and network communication link dynamic planning technology are used to achieve the safe reconstruction and interconnection of the underwater network. In the entire underwater network, the connection between nodes and nodes and between nodes and the main network is a redundant design. First, when a physical failure is detected in a connection channel, the transmission channel of the node will follow the information of the associated node, combined with the situation on the associated network path, and use the multi-group intelligent placement algorithm model of hierarchical optimization to re-plan and match the optimal link, and finally achieve communication with the main network and other nodes. Second, if the communication link currently allocated to a node is monitored to be congested or abnormal, the physical link will be isolated and blocked, and the abnormal information will be uploaded to the main network, and various nodes will update the information synchronously, so as to achieve dynamic planning.

[0044] The comprehensive situation and threat situation constructs a security analysis model for multi-source heterogeneous nodes in a large-bandwidth and high-real-time underwater network environment, studies an intelligent analysis model based on multimodal learning, anomaly discovery, threat source association, and attack intent analysis, and realizes comprehensive situation and threat situation analysis and presentation.

[0045] like Figure 2 The diagram shows the application structure of the system of the present invention. The data center is connected to no less than two shore base stations. No less than two shore base stations communicate with each other through optoelectronic cables. The shore base station and the data center form a shore station platform. Several branching devices are arranged between the connected shore base stations, and repeaters are arranged between adjacent branching devices. Each branching device is connected to a main docking box, and the adjacent main docking boxes communicate with each other. Each main docking box is connected to at least two secondary docking boxes, and each secondary docking box is connected to two adjacent main docking boxes. At the same time, each secondary docking box collects data from the observation instrument. The main docking box is also connected to the hydroacoustic communication relay and the seabed array. The hydroacoustic communication relay collects and transmits data from the buoy. The observation instrument includes underwater beacons, underwater submersibles, ocean observation instruments and buoys, and the seabed array includes a seabed listening array and a sonar array. A secondary docking box is used as a secondary node, and a main docking box is used as a primary node. Node management and control is to formulate unified interface standards and data standards, and uniformly classify and manage the secondary nodes and primary node devices in the entire underwater network, so that each node device can be managed and monitored throughout the life cycle. Node control controls the nodes in the entire network, controls whether they can enter the network system, and deploys security isolation and network security reconstruction for each secondary node and main node. Security isolation mainly provides identity authentication, terminal protection, isolation filtering and monitoring and early warning, through identity authentication and information filtering of external devices connected to each secondary node and main node network, and upward security authentication when the node itself is connected to the main network. Network security reconstruction mainly allows all nodes controlled by node control to form an interconnected network, and combines all nodes through physical link reorganization and network communication link planning. The comprehensive situation and threat situation are based on the data of the entire life cycle of node control, security isolation and network security reconstruction, and are analyzed using security analysis models and intelligent analysis model technologies for multi-source heterogeneous nodes, anomaly discovery and threat sources are associated, and attack intent analysis is performed to form a comprehensive situation.

[0046] Figure 3 is a security isolation interaction diagram involved in the present invention, Figure 4This is a workflow diagram for security isolation; security isolation includes identity authentication, isolation filtering, and monitoring and early warning. The nodes in the entire network system can communicate and access each other. The nodes include primary nodes and secondary nodes, and each node can access the main network through a link. The main network and each node contain identity authentication, isolation filtering, and monitoring and early warning. Whether between nodes or between nodes and the main network, they all need to go through internal identity authentication, and then go through isolation filtering for information filtering and isolation. Each node monitors its own node in all directions through monitoring and early warning, and simultaneously transmits the monitoring and early warning information to the main network. Among them, identity authentication mainly verifies and checks the legitimacy and validity of identity cards and data that have been dynamically encrypted by multiple times through symmetric encryption algorithms. Among them, isolation filtering mainly blocks and refuses to receive malicious attacks (such as traffic attacks, tampering of data, etc.), records the identity of illegal access, and performs isolation and shielding. The monitoring and early warning mainly classifies and collects information on illegal access (such as malicious high-frequency attacks, high-frequency verification of the same IP or different identities, etc.) and access anomaly information, and transmits the collected anomaly information to the shore station platform. When the shore station platform issues an early warning, it forms an abnormal information database, and each node is synchronized to the local security policy at a regular interval.

[0047] Figure 5 The network security reconstruction diagram of the present invention includes physical connection link reorganization and network communication link planning. Figure 5 In the example, physical link channel ① is physically damaged. At this time, the secondary node 2 can communicate with the physical connection channel ② of the primary node 2. At the same time, the network communication link of the secondary node 2 to the entire network will be dynamically adjusted and replanned. In the physical link reorganization, when the communication link currently allocated to a node is detected to be abnormal (for example, abnormal link length is detected, link channel is congested, etc.), the link power supply is isolated and blocked by controlling power management and controlling node access technology. At the same time, the current node uploads the abnormal information to the main network, and various nodes update the information synchronously, so as to realize the physical link reorganization. In the network communication link planning, the network communication link is planned through the gateway and the router. In the physical link reorganization and network communication link planning, the multi-group intelligent deployment algorithm of hierarchical optimization is used to perform safe reconstruction in combination with the amount of data transmitted by each node, the shortest communication path of the node, and the load balancing of the communication link.

[0048] A method for an underwater network intelligent safety management and control situation system comprises the following steps:

[0049] Step 1: The shore station platform establishes a basic node information database in the node management and control module based on the actual information of various underwater nodes, including the physical address of each node, node type, associated nodes, node access device type, node load, etc.;

[0050] Step 2: Each underwater node device deploys and installs the system, and downloads and updates the security isolation strategy through the network; during the operation of the node, security isolation protects the information of external access to the node, and reports abnormal information to the shore station platform;

[0051] The process of security isolation to protect the information of external access nodes is as follows: when data accesses the node, determine whether the traffic is abnormal; if the data is abnormal, isolate and filter it, monitor and warn after isolation and filtering, and report to the shore station platform, and the shore station platform synchronizes the abnormal data to other nodes; if the data is not abnormal, identity authentication is performed, and identity authentication includes identity verification and data verification. If identity verification and data verification are verified to be legal in turn, the information is exchanged normally. If the identity verification or data verification is illegal, the data is isolated and filtered, and then monitored and warned and reported to the shore station platform, and the shore station platform synchronizes the abnormal data to other nodes.

[0052] Step 3: When a link or node is found to be abnormal (such as external devices monitoring or attacking), isolate the physical link or node through power control;

[0053] Step 4: When each node is just connected to the network or the node needs to readjust the communication link, the system plans the communication link by combining the node attributes (traffic load, node priority, etc.) through the optimization algorithm;

[0054] Step 5: The shore station platform collects and summarizes all nodes and network load conditions in the entire network to form a comprehensive situation map; and analyzes the anomalies that occur in the network, and finally forms and displays a threat situation analysis through abnormal threat association and attack intent classification.

[0055] In summary, the present invention uses the underwater node management and control function to orderly manage underwater network nodes and underwater monitoring equipment. Security isolation realizes dynamic isolation security from application, terminal, access to network level. Network security reconstruction can ensure the security and stability of core business. The comprehensive situation and threat situation can discover anomalies in underwater networks, associate threat sources, analyze attack intentions, and effectively display the comprehensive situation and threat situation in the network transmission process. It can support the command decision-making of underwater activities. The present invention is an underwater network management and control system with high reliability.

Claims

1. An underwater network intelligent safety management and control situation system, characterized in that: Including node control, security isolation, network security reconstruction, comprehensive situation and threat situation analysis, among which, The node control is used to classify the nodes in the entire underwater network, formulate standard protocol interfaces, format the data of the connected node devices, and perform processing technologies such as packaging, distribution, and storage to achieve a unified protocol interface and flexible processing of application layer data; The security isolation described above implements identity authentication, terminal protection, isolation filtering, and monitoring and early warning capabilities based on the security policy configuration technology of network nodes with low power consumption and scarce resources in underwater network multi-service scenarios; The network security reconstruction mentioned above realizes the safe reconstruction and interconnection of the underwater network by using the dynamic planning technology of physical links and network communication links when the network nodes are safely isolated, isolated due to faults or physically blocked; The comprehensive situation and threat situation described above constructs a security analysis model for multi-source heterogeneous nodes in a large-bandwidth and high-real-time underwater network environment, studies an intelligent analysis model based on multimodal learning, anomaly discovery, threat source association, and attack intent analysis, and realizes comprehensive situation and threat situation analysis and presentation.

2. The underwater network intelligent safety management and control situation system according to claim 1, characterized in that: The node control specifically includes: Node management, which is used to manage the basic information of access nodes in the underwater network, configure relevant attribute strategies, and control the working status of nodes; Data standardization is used to standardize incoming and outgoing data and implement a unified protocol interface.

3. The underwater network intelligent safety management and control situation system according to claim 2, characterized in that: The security isolation specifically includes: Identity authentication, used to identify and verify the identity of accessing users; Terminal protection, used to identify and protect against external malicious attacks; Isolation filtering is used to isolate and shield information from illegal users and malicious attacks; Monitoring and early warning are used to record and report abnormal information encountered by the node, upload and synchronize abnormal information in the shore station platform, and update the protection strategy of this node.

4. The underwater network intelligent safety management and control situation system according to claim 3, characterized in that: The network security reconstruction specifically includes: Physical link reorganization, used for dynamic control of underwater physical nodes and physical communication links based on power control; Network communication link planning is used to dynamically adjust the communication link based on the properties of each node underwater (such as traffic load, information importance, etc.).

5. The underwater network intelligent safety management and control situation system according to claim 4, characterized in that: The comprehensive situation and threat situation analysis specifically includes: comprehensive situation and threat situation analysis and display.

6. A method for an underwater network intelligent safety management and control situation system, characterized in that: The following steps are included: Step 1: The shore station platform establishes a basic node information database in the node management and control module based on the actual information of various underwater nodes, including the physical address of each node, node type, associated nodes, node access device type, node load, etc.; Step 2: Each underwater node device deploys and installs the system, and downloads and updates the security isolation strategy through the network; during the operation of the node, security isolation protects the information of external access to the node, and reports abnormal information to the shore station platform; Step 3: When a link or node is found to be abnormal (such as external devices monitoring or attacking), isolate the physical link or node through power control; Step 4: When each node is just connected to the network or the node needs to readjust the communication link, the system plans the communication link by combining the node attributes (traffic load, node priority, etc.) through the optimization algorithm; Step 5: The shore station platform collects and summarizes all nodes and network load conditions in the entire network to form a comprehensive situation map; and analyzes the anomalies that occur in the network, and finally forms and displays a threat situation analysis through abnormal threat association and attack intent classification.

Images