Industrial data security protection system of industrial internet technology

Abstract

The invention discloses an industrial data security protection system of an industrial internet technology, which belongs to the technical field of industrial data protection, and comprises a data storage library for storing industrial data; the data protection module is used for encrypting the stored industrial data by adopting a data encryption technology; the updating module is used for collecting related information generated by the data protection module and updating encryption software and algorithms in the data protection module according to the related information; and the user risk judgment module is used for acquiring user login information of the access user, judging the risk of the access user and preventing the access of the risk user. When the user logs in to access the data, the login information of the user is obtained through the user risk judgment module, so that whether the login risk of the user exists or not is obtained, access of the user with the high risk is prevented, and therefore the occurrence that lawbreakers steal industrial data by stealing the login information of the user can be reduced, and the user experience is improved. And the safety of industrial data is ensured.

Description

Technical Field

[0001] The present invention belongs to the technical field of industrial data protection, and specifically relates to an industrial data security protection system of industrial Internet technology. Background Art

[0002] Industrial Internet technology refers to the emerging business forms and application models formed by the deep integration of the new generation of information and communication technology and advanced manufacturing. It builds a new manufacturing and service system covering the entire industrial system, the entire industrial chain, and the entire value chain through the comprehensive connection of people, machines, objects, and systems. It is highly intelligent, efficient, reliable, and flexible, and is widely used in smart factories and other fields. Industrial data refers to the data generated and collected in the process of R&D design, production and manufacturing, business management, operation and maintenance, and platform operation in various industries and fields of industry. These data are widely distributed and may come from various links such as machinery and equipment, industrial products, management systems, and the Internet.

[0003] With the deep integration of informatization and industrialization, the importance of industrial data has become increasingly prominent. Some lawless elements will steal industrial data to obtain the data of enterprises or factories, thereby causing huge losses to enterprises or factories. Therefore, it is necessary to protect industrial data securely.

[0004] The existing methods for protecting industrial data are generally to restrict the access rights to industrial data, or to encrypt industrial data using data encryption technology to prevent data from being stolen or maliciously tampered with. However, due to the advancement of technology, hackers still have the possibility of stealing user login information or cracking encrypted data, thereby invading data systems to steal industrial data and causing losses of industrial data. Summary of the invention

[0005] The purpose of the present invention is to provide an industrial data security protection system based on industrial Internet technology to solve the problems faced by the above-mentioned background technology.

[0006] The purpose of the present invention can be achieved through the following technical solutions:

[0007] An industrial data security protection system of industrial Internet technology, the system comprising:

[0008] A data storage repository, the data storage repository is used to receive the generated industrial data and store the industrial data;

[0009] A data protection module, wherein the data protection module uses data encryption technology to encrypt the stored industrial data;

[0010] An update module, the update module is used to collect relevant information generated by the data protection module and update the encryption software and algorithm in the data protection module according to the relevant information;

[0011] A login terminal, which is used to access the user's login;

[0012] The user risk judgment module is used to obtain the user login information of the accessing user, and to judge the risk of the accessing user according to the obtained user login information, so as to prevent the risky user from accessing.

[0013] Furthermore, the updating module performs updating in the following manner:

[0014] The encryption software and algorithms in the data protection module are updated regularly according to the update cycle interval pre-set in the data protection module.

[0015] Furthermore, the method for updating the update module further includes:

[0016] During the non-update period, every ΔT time, obtain the number of vulnerabilities generated q, the type of vulnerabilities generated n, and the time T for each vulnerability to be repaired i And the interval between each vulnerability occurrence T j ;

[0017] At the same time, during the non-update period, the number of abnormalities x and the number of errors y in the log of the update module are counted every ΔT time;

[0018] By formula Calculate the dangerous status value P of the update module;

[0019] The obtained dangerous condition value P is compared with the dangerous condition threshold value P preset in the update module bt For comparison:

[0020] When P>P bt When the update instruction is generated, the update module is updated;

[0021] Among them, a1 and a2 are weight coefficients, is the standard repair time of the i-th vulnerability type preset by the system, i∈[1,n], T bt is the standard interval time for each vulnerability occurrence preset by the system, j∈[1,q-1].

[0022] Furthermore, the method by which the user risk judgment module judges the risk of the accessing user is:

[0023] Get the user's login information and determine whether the user is a user with permission to log in;

[0024] If the user is not authorized to log in, the user is blocked from accessing.

[0025] If the user is a user with permission to log in, proceed to the next step.

[0026] Furthermore, the method for the next step of judgment is:

[0027] According to the user's historical login information and current login information, obtain the number of times the user's login IP has changed within a period of time (s) and the time it takes for each login (t) k , and the number of errors that occurred during login c;

[0028] By formula Calculate the login risk value E;

[0029] when When the user logs in, the risk is considered high and the user is blocked from accessing.

[0030] Otherwise, allow the user access;

[0031] Where r is the number of logins, and k∈[1, r], E th The login risk threshold preset for the system.

[0032] Furthermore, a blocking unit is provided in the data storage library, and the blocking unit is used to collect access information of access users entering the database, and obtain the user's access abnormality value according to the access information, so as to force the user with access abnormality to exit.

[0033] Furthermore, the blocking unit works as follows:

[0034] Obtain the data permission range that the accessing user is allowed to access, and obtain the number of clicks d that the user attempts to make outside the permission range during the access process, and obtain the curve V(x) of the data download volume changing over time during the access process;

[0035] By formula Find out the access outliers;

[0036] When B>1, the access user is forced to exit;

[0037] Among them, x1 is the detection start time, x2 is the detection end time, V0(x) is the system preset standard download volume change curve over time, B th is the critical threshold for forced exit set by the system, g is the judgment function, when hour, when hour,

[0038] Beneficial effects of the present invention:

[0039] When a user logs in to access data, the present invention obtains the user's login information through the user risk judgment module, thereby obtaining whether the user's login is risky, and blocking access to users with higher risks. This can reduce the occurrence of criminals stealing industrial data by stealing user login information, thereby ensuring the security of industrial data; at the same time, the present invention can also encrypt and protect the stored industrial data through the data protection module, and analyze and judge through the update module, and continuously update the encryption software and algorithms in the update module, which can greatly reduce the occurrence of encrypted data being cracked by hackers, thereby ensuring the security of industrial data.

[0040] The present invention adopts the formula A comprehensive analysis is conducted based on the occurrence of vulnerabilities and log changes, thereby analyzing the dangerous conditions of the update module, and timely updating the encryption software and algorithms in the update module to reduce the occurrence of encrypted data cracking.

[0041] The present invention can conduct a comprehensive analysis based on the IP changes, login time, login errors and login time fluctuations of the accessing user, so as to accurately derive the account risk of the accessing user, thereby preventing risky users from logging in and browsing data, and ensuring the security of industrial data.

[0042] Of course, any product implementing the present invention does not necessarily need to achieve all of the advantages described above at the same time. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for describing the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0044] Figure 1 It is a system block diagram of the present invention. DETAILED DESCRIPTION

[0045] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0046] In one embodiment, an industrial data security protection system of industrial Internet technology is disclosed, such as Figure 1 As shown, the protection system includes:

[0047] A data repository, the data repository is used to receive the generated industrial data and store the industrial data;

[0048] Data protection module: The data protection module uses data encryption technology to encrypt stored industrial data;

[0049] An update module, which is used to collect relevant information generated by the data protection module and update the encryption software and algorithm in the data protection module according to the relevant information;

[0050] Login terminal, which is used to access the user's login;

[0051] The user risk judgment module is used to obtain the user login information of the accessing user, and judge the risk of the accessing user based on the obtained user login information, and prevent risky users from accessing.

[0052] Through the above technical scheme, when a user logs in to access data, the present application obtains the user's login information through the user risk judgment module, thereby obtaining whether there is a risk in the user's login, and blocking access to users with higher risks. This can reduce the occurrence of criminals stealing industrial data by stealing user login information, thereby ensuring the security of industrial data; at the same time, the present application can also encrypt and protect the stored industrial data through the data protection module, and analyze and judge through the update module, and continuously update the encryption software and algorithms in the update module, which can greatly reduce the occurrence of encrypted data being cracked by hackers, thereby ensuring the security of industrial data.

[0053] As an implementation manner of the present invention, the method for updating the update module is:

[0054] Regularly update the encryption software and algorithms in the data protection module according to the update cycle interval pre-set in the data protection module;

[0055] During the non-update period, every ΔT time, obtain the number of vulnerabilities generated q, the type of vulnerabilities generated n, and the time T for each vulnerability to be repaired i And the interval between each vulnerability occurrence T j ;

[0056] At the same time, during the non-update period, the number of abnormalities x and the number of errors y in the log of the update module are counted every ΔT time;

[0057] By formula Calculate the dangerous status value P of the update module;

[0058] The obtained dangerous condition value P is compared with the dangerous condition threshold value P preset in the update module bt For comparison:

[0059] When P>P bt When the update instruction is generated, the update module is updated;

[0060] Among them, a1 and a2 are weight coefficients, is the standard repair time of the i-th vulnerability type preset by the system, i∈[1,n], T bt is the standard interval time for each vulnerability occurrence preset by the system, j∈[1,q-1].

[0061] Through the above technical solution, this embodiment provides a method for updating the update module. Since encryption technology is used to encrypt data to ensure data security, hackers may try to use powerful computing resources to continuously calculate, which may cause the encrypted data to be cracked, thereby stealing the stored data. Therefore, it is necessary to update the encryption algorithm and software to reduce the possibility of encrypted data being cracked. Specifically, first, according to the update cycle interval pre-set in the data protection module, the encryption software and algorithm in the data protection module are regularly updated. For example, the update module is updated once every 20 hours, and then in the non-update cycle, every ΔT time, the number of vulnerabilities generated q, the type of vulnerability generated n, and the time T for each vulnerability to be repaired are obtained. i And the interval between each vulnerability occurrence T j At the same time, in the non-update cycle, the number of abnormalities x and the number of errors y in the log of the update module are counted every ΔT time, and the formula is used Calculate the dangerous status value P of the update module, the formula is It indicates the cumulative ratio of the time to repair each vulnerability to the standard repair time when the system has a vulnerability, and the formula It indicates the cumulative ratio of the interval time of each vulnerability occurrence to the standard interval time. From the formula It can be seen that the longer the time for each vulnerability repair, or the shorter the interval between each vulnerability occurrence, the greater the dangerous status value P, indicating that the update module needs to be updated more urgently. Similarly, the more times q the vulnerabilities are generated, the more types n of vulnerabilities are generated, the greater the dangerous status value P, and the more urgent the update module needs to be updated. Formula e x+y Indicates the dangerous situation of log changes generated by the update module. When the number of abnormalities x and the number of errors y in the log are higher, the dangerous situation value P is greater; so through the formula A comprehensive analysis is performed based on the vulnerability occurrence and log changes to obtain the dangerous status value P of the update module, and the obtained dangerous status value P is compared with the dangerous status threshold P preset in the update module.bt Compare: When P>P bt When , it means that the risk status value of the update module is relatively large at this time, and the encrypted data is easy to be cracked. In order to ensure the security of internal data, an update instruction is generated at this time to update the encryption software and algorithm in the update module to reduce the occurrence of encrypted data being cracked.

[0062] In the above technical solution, the interval time ΔT is set according to the actual situation, and the standard repair time of the i-th vulnerability type preset by the system is The standard interval between each vulnerability occurrence is T bt , Dangerous condition threshold P bt The weight coefficients a1 and a2 can be obtained based on empirical data combined with historical data, and will not be elaborated on again.

[0063] As an implementation mode of the present invention, the method for the user risk judgment module to judge the risk of the accessing user is as follows:

[0064] Get the user's login information and determine whether the user is a user with permission to log in;

[0065] If the user is not authorized to log in, the user is blocked from accessing.

[0066] If the user is a user with the permission to log in, the next step is to make the judgment:

[0067] According to the user's historical login information and current login information, obtain the number of times the user's login IP has changed within a period of time (s) and the time it takes for each login (t) k , and the number of errors that occurred during login c;

[0068] By formula Calculate the login risk value E;

[0069] when When the user logs in, the risk is considered high and the user is blocked from accessing.

[0070] Otherwise, allow the user access;

[0071] Where r is the number of logins, and k∈[1, r], E th The login risk threshold preset for the system.

[0072] Through the above technical solution, this embodiment provides a specific method for the user risk judgment module to judge the risk of the access user. First, the user login information is obtained to determine whether the user is a user with permission to log in. When it is determined that the system is not a user with permission to log in, the user is blocked from accessing. When the user is a user with permission to log in, the next step of judgment is performed. Generally speaking, when the login IP of the access user changes frequently, or the actual time of each login is longer, the possibility of the account being stolen is greater. Therefore, according to the user's historical login information and current login information, the number of times s that the user's login IP changes within a period of time and the time t used for each login are obtained. k , and the number of errors during login c, and through the formula Calculate the login risk value E, formula It can show the account risk status of the accessing user. The larger the value, the higher the risk. It shows the fluctuation of the login time of the accessing user's account. The greater the fluctuation, the more dangerous the accessing user's account is. Therefore, the formula Perform a comprehensive analysis to determine the login risk value E, and compare it with the login risk threshold preset by the system. When the value is greater than 1, the account of the accessing user is considered abnormal and the login risk is high, so the user is blocked from accessing. Otherwise, the user is allowed to access. In this way, a comprehensive analysis can be performed based on the IP changes, login time, login errors, and login time fluctuations of the accessing user, so as to accurately determine the account risk of the accessing user, thereby blocking risky users from logging in and browsing data, and ensuring the security of industrial data.

[0073] In the above technical solution, the system preset login risk threshold E th It can be obtained based on empirical data and will not be described in detail here.

[0074] As an embodiment of the present invention, a blocking unit is also provided in the data storage library, and the blocking unit is used to collect access information of access users entering the database, and obtain the user's access abnormality value according to the access information, so as to force the user with access abnormality to exit;

[0075] The working method of the blocking unit is: obtain the data permission range allowed to be accessed by the accessing user, obtain the number of clicks d that the user attempts to make outside the permission range during the access process, and obtain the curve V(x) of the data download amount changing over time during the access process;

[0076] By formula Find out the access outliers;

[0077] When B>1, the access user is forced to exit;

[0078] Among them, x1 is the detection start time, x2 is the detection end time, V0(x) is the system preset standard download volume change curve over time, B th is the critical threshold for forced exit set by the system, g is the judgment function, when hour, when hour,

[0079] Through the above technical solution, this embodiment provides a specific method for a blocking unit in a data storage library to obtain the user's access abnormality value according to the access information, thereby forcing the user with abnormal access to exit. If a hacker successfully invades the data storage library through various means, a large amount of industrial data in the database will be stolen. In order to ensure the security of the data, this embodiment is provided with a blocking unit in the data storage library to obtain the data permission range allowed to be accessed by the accessing user, and obtain the number of clicks d that the user attempts to access outside the permission range during the access process, and at the same time obtain the download volume of data during the access process. Time change curve V(x), and through the formula Calculate the access abnormality value; generally, normal authorized users will only access data within the scope of the data permission they are allowed to access. If the access user who enters the database attempts to access data outside the scope of the permission and clicks many times, it means that the access user is likely to have abnormal behavior. Similarly, the greater the difference between the change in the amount of data downloaded during the access process and the change in the historical preset standard download amount, it means that the data is being downloaded crazily at this time, and the access user is likely to have abnormal behavior. Therefore, through the formula Calculate the access abnormality value B. When B>1, it means that the user's access is abnormal and the possibility of theft is high. In this case, the accessing user is forced to exit immediately to ensure data security.

[0080] In the above technical solution, the detection start time x1 and the detection end time x2 are set according to actual needs, the system preset standard download volume change curve V0(x) and the system set critical threshold value B for forced exit th It is formulated based on historical data and empirical data. I will not elaborate on it here. When V(x)-V0(x)≤0, it means that the data download volume is small and there is no abnormality in the data download. When V(x)-V0(x)>0, the amount of data downloaded is small.

[0081] The above contents are merely examples and explanations of the concept of the present invention. The technicians in this technical field may make various modifications or additions to the specific embodiments described or replace them in a similar manner. As long as they do not deviate from the concept of the invention or exceed the scope defined by the claims, they should all fall within the protection scope of the present invention.

Claims

1. An industrial data security protection system for industrial Internet technology, characterized in that: The system comprises: A data storage repository, the data storage repository is used to receive the generated industrial data and store the industrial data; A data protection module, wherein the data protection module uses data encryption technology to encrypt the stored industrial data; An update module, the update module is used to collect relevant information generated by the data protection module and update the encryption software and algorithm in the data protection module according to the relevant information; A login terminal, which is used to access the user's login; The user risk judgment module is used to obtain the user login information of the accessing user, and to judge the risk of the accessing user according to the obtained user login information, so as to prevent the risky user from accessing.

2. According to the industrial data security protection system of the industrial Internet technology of claim 1, it is characterized in that: The updating method of the updating module is as follows: The encryption software and algorithms in the data protection module are updated regularly according to the update cycle interval pre-set in the data protection module.

3. The industrial data security protection system of an industrial Internet technology according to claim 2 is characterized in that: The method for updating the update module further includes: During the non-update period, every ΔT time, obtain the number of vulnerabilities generated q, the type of vulnerabilities generated n, and the time T for each vulnerability to be repaired i And the interval between each vulnerability occurrence T j ; At the same time, during the non-update period, the number of abnormalities x and the number of errors y in the log of the update module are counted every ΔT time; By formula Calculate the dangerous status value P of the update module; The obtained dangerous condition value P is compared with the dangerous condition threshold value P preset in the update module bt For comparison: When P>P bt When the update instruction is generated, the update module is updated; Among them, a1 and a2 are weight coefficients, is the standard repair time of the i-th vulnerability type preset by the system, i∈[1,n], T bt is the standard interval time for each vulnerability occurrence preset by the system, j∈[1,q-1].

4. The industrial data security protection system of an industrial Internet technology according to claim 1 is characterized in that: The method by which the user risk judgment module judges the risk of accessing users is: Get the user's login information and determine whether the user is a user with permission to log in; If the user is not authorized to log in, the user is blocked from accessing. If the user is a user with permission to log in, proceed to the next step.

5. The industrial data security protection system of the industrial Internet technology according to claim 4 is characterized in that: The method for the next step of judgment is: According to the user's historical login information and current login information, obtain the number of times the user's login IP has changed within a period of time (s) and the time it takes for each login (t) k , and the number of errors that occurred during login c; By formula Calculate the login risk value E; when When the user logs in, the risk is considered high and the user is blocked from accessing. Otherwise, allow the user access; Where r is the number of logins, and k∈[1, r], E th The login risk threshold preset for the system.

6. The industrial data security protection system of an industrial Internet technology according to claim 1 is characterized in that: The data storage library is also provided with a blocking unit, which is used to collect access information of access users entering the database and obtain the user's access abnormality value according to the access information, so as to force the user with abnormal access to exit.

7. The industrial data security protection system of the industrial Internet technology according to claim 6 is characterized in that: The blocking unit works as follows: Obtain the data permission range that the accessing user is allowed to access, and obtain the number of clicks d that the user attempts to make outside the permission range during the access process, and obtain the curve V(x) of the data download volume changing over time during the access process; By formula Find out the access outliers; When B>1, the access user is forced to exit; Among them, x1 is the detection start time, x2 is the detection end time, V0(x) is the system preset standard download volume change curve over time, B th is the critical threshold for forced exit set by the system, g is the judgment function, when hour, when hour,

Images