Service control method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention provides a service control method and device, electronic equipment and a storage medium, and relates to the technical field of industrial network security, and the method comprises the steps: obtaining a plurality of white list rules corresponding to services between at least two pieces of equipment in an industrial control network; all the white list rules are optimized in a plurality of preset dimensions, a plurality of optimized white list rules corresponding to all the preset dimensions are obtained, and the optimized white list rules comprise the white list rules; and controlling a target service between any two pieces of equipment in the industrial control network based on each optimized white list rule corresponding to each preset dimension. Through the multiple optimized white list rules corresponding to the preset dimensions, the target service between any two devices in the industrial control network is controlled, and the influence of a strict control mode of a basic white list on the service is avoided.

Description

Technical Field

[0001] The present invention relates to the technical field of industrial network security, and in particular to a service control method, device, electronic device and storage medium. Background Art

[0002] In the industrial intelligent manufacturing industry, industrial control whitelist technology is often needed. In the production network, the control equipment learns the industrial control whitelist for a period of time, and then applies the whitelist, using a strict whitelist control method, for example, based on the Internet Protocol (IP) address, Media Access Control (MAC) address, function code, parameters, etc., the business that matches the whitelist is passed, and the business that does not match the whitelist is blocked.

[0003] In actual use, the whitelist cannot be strictly matched due to the fact that new equipment may be put online, the equipment address may be changed, and there is insufficient learning time. Strict whitelist control methods cannot make customers feel at ease. Customers will worry that strict whitelist control methods will cause business interruptions and network disconnections, which will affect their business. Summary of the invention

[0004] In view of the problems in the prior art, embodiments of the present invention provide a service control method, device, electronic device and storage medium.

[0005] Specifically, the embodiment of the present invention provides the following technical solutions:

[0006] In a first aspect, an embodiment of the present invention provides a service control method, including:

[0007] Obtain multiple whitelist rules corresponding to services between at least two devices in an industrial control network;

[0008] Optimizing each of the whitelist rules in a plurality of preset dimensions respectively, to obtain a plurality of optimized whitelist rules corresponding to each of the preset dimensions, wherein the optimized whitelist rules include the whitelist rules;

[0009] Based on the optimized whitelist rules corresponding to the preset dimensions, target services between any two devices in the industrial control network are controlled.

[0010] Furthermore, the preset dimension is a network dimension, and each of the whitelist rules is optimized in multiple preset dimensions to obtain multiple optimized whitelist rules corresponding to each of the preset dimensions, including:

[0011] For devices within a preset network address range, the whitelist rules corresponding to the devices within the preset network address range are merged to obtain the optimized whitelist rules corresponding to the network dimension.

[0012] Furthermore, the preset dimension is an asset dimension, and each of the whitelist rules is optimized in a plurality of preset dimensions to obtain a plurality of optimized whitelist rules corresponding to each of the preset dimensions, including:

[0013] For devices of the same asset type, the whitelist rules corresponding to the devices of the same asset type are merged to obtain the optimized whitelist rules corresponding to the asset dimension.

[0014] Furthermore, the preset dimension is a protocol dimension, and each of the whitelist rules is optimized in multiple preset dimensions to obtain multiple optimized whitelist rules corresponding to each of the preset dimensions, including:

[0015] For devices with the same protocol and performing the same operation, the numerical parameters in each of the whitelist rules corresponding to the devices with the same protocol and performing the same operation are unified in the form of intervals to obtain the optimized whitelist rules corresponding to the protocol dimension.

[0016] Furthermore, the controlling of the target service between any two devices in the industrial control network based on each of the optimized whitelist rules corresponding to each of the preset dimensions includes:

[0017] Matching the target whitelist rule corresponding to the target business with each of the optimized whitelist rules corresponding to each of the preset dimensions;

[0018] In the case where the target whitelist rule corresponding to the target service matches any rule in each of the optimized whitelist rules, the target service between any two devices in the industrial control network is not blocked;

[0019] When the target whitelist rule corresponding to the target service does not match any of the optimized whitelist rules, the target service between any two devices in the industrial control network is blocked.

[0020] Furthermore, the method further comprises:

[0021] Obtaining target service traffic of the target service between any two devices in the industrial control network;

[0022] The target service is controlled based on the target service flow.

[0023] Further, the controlling the target service based on the target service flow includes:

[0024] Comparing the target service flow with the preset threshold; the preset threshold is used to determine whether to block the target service;

[0025] When the target service flow is less than or equal to the preset threshold, the target service is not blocked;

[0026] When the target service flow is greater than the preset threshold, the target service is blocked.

[0027] In a second aspect, an embodiment of the present invention further provides a service control device, including:

[0028] A first acquisition module is used to acquire multiple whitelist rules corresponding to services between at least two devices in the industrial control network;

[0029] An optimization module, used to optimize each of the whitelist rules in multiple preset dimensions respectively, to obtain multiple optimized whitelist rules corresponding to each of the preset dimensions, wherein the optimized whitelist rules include the whitelist rules;

[0030] The first control module is used to control the target service between any two devices in the industrial control network based on the optimized whitelist rules corresponding to the preset dimensions.

[0031] In a third aspect, an embodiment of the present invention further provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of the service control method described in the first aspect are implemented.

[0032] In a fourth aspect, an embodiment of the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the service control method described in the first aspect.

[0033] In a fifth aspect, an embodiment of the present invention further provides a computer program product having executable instructions stored thereon, which, when executed by a processor, enables the processor to implement the steps of the service control method described in the first aspect.

[0034] The service control method, device, electronic device and storage medium provided by the embodiments of the present invention obtain multiple whitelist rules corresponding to the service between at least two devices in the industrial control network; then optimize each whitelist rule in multiple preset dimensions to obtain multiple optimized whitelist rules corresponding to each preset dimension; because the optimized whitelist rules include whitelist rules, the target service between any two devices in the industrial control network is controlled based on the multiple optimized whitelist rules corresponding to each preset dimension, thereby avoiding the impact of the strict control method of the basic whitelist on the service and improving the performance of the industrial control network. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0036] Figure 1 It is one of the flow charts of the service control method provided by the present invention;

[0037] Figure 2 It is a schematic diagram of the process of generating a target whitelist provided by the present invention;

[0038] Figure 3 This is the second flow chart of the service control method provided by the present invention;

[0039] Figure 4 It is a structural schematic diagram of the service control device provided by the present invention;

[0040] Figure 5 It is a schematic diagram of the physical structure of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0041] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0042] In order to facilitate a clearer understanding of the various embodiments of the present application, some relevant background technical knowledge is first introduced as follows.

[0043] In the prior art, a strict whitelist control method is adopted, which is based on a strict control method of IP address, MAC address, function code and parameters. If the whitelist is matched, the service is passed, and if the whitelist is not matched, the service is blocked.

[0044] However, it is not possible to control the situation in combination with the characteristics of factory use in the industrial manufacturing industry. After the factory learns the whitelist, the factory business enters the protection mode and may encounter the following scenarios:

[0045] Scenario 1: The factory may use the Dynamic Host Configuration Protocol (DHCP) scenario deployment, and the IP of the device changes every time. In this case, after the device reallocates the IP, the whitelist match fails and normal services are blocked.

[0046] Scenario 2: The factory may replace equipment, causing the MAC address of the device to change, whitelist matching to fail, and normal services to be blocked.

[0047] Scenario 3: Adding new equipment to the factory may increase the IP address information of the equipment, fail to match the whitelist, and block normal business. However, the customer believes that the business is the same as other nodes and does not accept the result of business being blocked.

[0048] Scenario 4: The whitelist is not learned completely in the early stage. Due to the uncontrollability of the business, a small number of production business processes cannot be learned 100% completely. Some businesses are small and sporadic. In this case, the strict control method of the traditional whitelist will block some businesses. Customers do not expect to block directly, but to give a "chance" to release to avoid business interruption.

[0049] Scenario 5: The factory's business control program may be adjusted within a certain range, allowing the factory's business processes to run only within a range. For example, the business process accesses addresses between 0 and 20, but when actually learning the whitelist, discrete values ​​(such as 0, 5, 7, and 20) may be learned. The customer hopes that this part can be entered in the form of an interval [0-20] for range matching.

[0050] Based on the above description, technical terms involved in the present invention are explained.

[0051] A. Industrial Control Whitelist

[0052] The industrial control whitelist generally includes the following data items: IP address, MAC address, function code, and other parameters (parameter 1, parameter 2, parameter 3, etc.). When the whitelist is used, it is strictly matched to this whitelist. If it matches, it is passed, otherwise it is blocked.

[0053] B. Network dimension optimization control

[0054] For network segments with IP addresses and MAC addresses within a range, function codes and parameters are shared. For example, customers are allowed to use the network segment 10.1.0.0-10.2.255.255 and share the learned function codes and parameters.

[0055] C. Asset dimension optimization control

[0056] For the same assets, share function and parameter learning content. For example, if the original assets are S-200 (Siemens equipment), the learned function codes and parameters are valid for all S-200 equipment in all plant areas, avoiding business interruption when adding or replacing.

[0057] D. Protocol Dimension Optimization Control

[0058] For a range of parameter values, a range match is automatically generated. For example, if the learned discrete values ​​are 0, 5, 7, and 20 addresses, the [0-20] range value matching method is used for whitelist matching.

[0059] E. Business dimension optimization and control

[0060] Content that is not on the whitelist is allowed to pass through a certain quota (set threshold). In protection mode, for the part within the quota, an early warning method is used; for the part outside the quota, a blocking method is used.

[0061] In view of the above problems, and targeting the special scenarios of industrial customers and the characteristics of whitelist usage, the present invention proposes an optimization solution based on the original strict whitelist control method, allowing customers to choose to optimize and control their services based on networks, assets, protocols, and services. It implements optimization control that allows setting IP addresses or MAC address network segment dimensions, optimization control of the same asset types, optimization control of parameters of the same protocol and performing the same operations, and optimization control of business quotas, thereby avoiding the impact of the original strict whitelist control method on the business.

[0062] The service control method provided by the present invention is described in detail below through some embodiments and application scenarios in conjunction with the accompanying drawings.

[0063] Figure 1 It is one of the flow charts of the service control method provided by the present invention, such as Figure 1 As shown, the method includes: step 101 to step 103; wherein,

[0064] Step 101: Acquire multiple whitelist rules corresponding to services between at least two devices in an industrial control network.

[0065] It should be noted that the service control method provided by the present invention can be applicable to the service control scenario in the field of industrial control. The execution subject of the method can be a service control device, such as an electronic device, or a control module in the service control device for executing the service control method. The electronic device is a control device.

[0066] Specifically, the whitelist rules can be obtained based on the basic whitelist, and the basic whitelist includes at least one of the following: network address (for example, IP address and MAC address), protocol, asset type, device code, function code and other parameters (for example, parameter 1, parameter 2, parameter 3, etc.), and the basic whitelist includes multiple whitelist rules corresponding to the business between at least two devices in the industrial control network. In this embodiment, the basic whitelist corresponding to the business between at least two devices in the industrial control network can be obtained first, and then the whitelist rules can be obtained based on the basic whitelist.

[0067] In an industrial control network, a control device captures the business traffic between at least two devices in the industrial control network, and parses the captured business traffic, that is, learns the basic whitelist, learns multiple whitelist rules, and organizes the network address, protocol, asset type, device code, function code and other parameters to determine which network addresses are the same, which asset types are the same, or which protocols are the same, and obtains basic whitelist association information.

[0068] Step 102, optimizing each of the whitelist rules in a plurality of preset dimensions respectively, to obtain a plurality of optimized whitelist rules corresponding to each of the preset dimensions, wherein the optimized whitelist rules include the whitelist rules.

[0069] Specifically, according to the obtained multiple whitelist rules, each whitelist rule can be optimized in multiple preset dimensions respectively to obtain multiple optimized whitelist rules corresponding to each preset dimension. The multiple optimized whitelist rules can constitute an optimized whitelist.

[0070] Step 103: Control the target service between any two devices in the industrial control network based on the optimized whitelist rules corresponding to the preset dimensions.

[0071] Specifically, since the optimized whitelist rules contain whitelist rules, the target business between any two devices in the industrial control network can be controlled according to the optimized whitelist rules corresponding to each preset dimension, avoiding interruption of the target business or network disconnection accidents, thereby avoiding the impact on the target business.

[0072] The service control method provided by the embodiment of the present invention obtains multiple whitelist rules corresponding to the service between at least two devices in the industrial control network; then optimizes each whitelist rule in multiple preset dimensions to obtain multiple optimized whitelist rules corresponding to each preset dimension; since the optimized whitelist rules include whitelist rules, the target service between any two devices in the industrial control network is controlled based on the multiple optimized whitelist rules corresponding to each preset dimension, thereby avoiding the impact of the strict control method of the basic whitelist on the service and improving the performance of the industrial control network.

[0073] The present invention proposes three preset dimension whitelist rule optimization solutions, including: network dimension, asset dimension, and protocol dimension, to optimize the whitelist rules. Next, each solution is described in detail.

[0074] 1. Network Dimension

[0075] Optionally, the preset dimension is a network dimension, and a specific implementation of step 102 includes:

[0076] For devices within a preset network address range, the whitelist rules corresponding to the devices within the preset network address range are merged to obtain the optimized whitelist rules corresponding to the network dimension.

[0077] Specifically, the preset network address is a preset IP address or MAC address. For devices in a preset network address range, multiple whitelist rules corresponding to the devices in the preset network address range are merged to obtain multiple optimized whitelist rules corresponding to the network dimension, so that a target whitelist can be obtained according to the multiple optimized whitelist rules. The target whitelist includes multiple optimized whitelist rules, thereby realizing the sharing of whitelist rules of the basic whitelist. For example, for the learning of the traditional basic whitelist, the learned whitelist rules are shown in Tables 1 and 2 below respectively.

[0078] Table 1. Basic whitelist for Layer 3 devices

[0079]

[0080] Table 2. Basic whitelist for Layer 2 devices

[0081]

[0082] It should be noted that the network dimension optimization solution is generally aimed at a factory building, a factory area or a sub-production line business, and uses DHCP to assign IP addresses to devices. When new equipment is added or changed, and the business is in this production line, users hope to achieve shared learning of the whitelist rules of the basic whitelist for devices in a certain network address range.

[0083] The network dimension optimization solution enables devices within the preset IP address or MAC address range to share multiple whitelist rules of the basic whitelist and obtain multiple optimized whitelist rules. For example, if the devices of the specified IP address segment [10.1.0.0-10.1.0.255] share multiple whitelist rules of the basic whitelist, the target whitelist including multiple optimized whitelist rules is shown in Table 3, which is the target whitelist corresponding to Table 1. The devices of the specified preset MAC address segment share multiple whitelist rules of the basic whitelist, and the target whitelist obtained is shown in Table 4, which is the target whitelist corresponding to Table 2.

[0084] Table 3. Target whitelist for layer 3 devices

[0085]

[0086] Table 4. Target whitelist for layer 2 devices

[0087]

[0088]

[0089] By sharing multiple whitelist rules of the basic whitelist of devices with each IP address or MAC address, the "union" of multiple whitelist rules of the basic whitelist corresponding to all IP addresses and MAC addresses in the network segment with the specified IP address or MAC address is achieved for each specified IP address or MAC address, thereby merging multiple whitelist rules of the basic whitelist to obtain the target whitelist, making the application of the target whitelist more efficient. Even when new equipment is put online at the customer site, the equipment address is changed, or there is insufficient learning time, the application of the target whitelist can reasonably control the target business, avoiding the impact of the strict control method of the basic whitelist on the business.

[0090] 2. Asset Dimension

[0091] Optionally, the preset dimension is an asset dimension, and the specific implementation of step 102 includes:

[0092] For devices of the same asset type, the whitelist rules corresponding to the devices of the same asset type are merged to obtain the optimized whitelist rules corresponding to the asset dimension.

[0093] It should be noted that in the process of using the basic whitelist, there are scenarios where devices are added. For this scenario, some services can be solved through network dimension optimization solutions. However, in some cases where network address segments are difficult to manage and different devices are not effectively standardized on the same network address, a whitelist optimization control solution based on the asset dimension can be used to merge multiple whitelist rules of the basic whitelist for devices of the same asset type.

[0094] Specifically, for devices of the same asset type, multiple whitelist rules corresponding to devices of the same asset type are merged, that is, multiple whitelist rules that share the basic whitelist are used to obtain multiple optimized whitelist rules corresponding to the asset dimension, and then the target whitelist is obtained based on the multiple optimized whitelist rules.

[0095] For example, multiple whitelist rules of the learned basic whitelist are shown in Table 5 below. The whitelist rules of the basic whitelist of the same asset are merged to obtain a target whitelist including multiple optimized whitelist rules as shown in Table 6.

[0096] Table 5. Basic whitelist

[0097]

[0098] Table 6. Target whitelist in asset dimension

[0099]

[0100] By merging the whitelist rules of the basic whitelist of the same asset, multiple whitelist rules of the basic whitelist are optimized to obtain the optimized whitelist rules, thereby obtaining the target whitelist, making the application of the target whitelist more efficient. Even if the same type of asset equipment is added at the customer site, the whitelist rules can be shared. The application of the target whitelist can reasonably control the target business and avoid the impact of the strict control method of the basic whitelist on the business.

[0101] 3. Protocol Dimension

[0102] Optionally, the preset dimension is a protocol dimension, and a specific implementation of step 102 includes:

[0103] For devices with the same protocol and performing the same operation, the numerical parameters in each of the whitelist rules corresponding to the devices with the same protocol and performing the same operation are unified in the form of intervals to obtain the optimized whitelist rules corresponding to the protocol dimension.

[0104] It should be noted that in actual operation, devices with the same protocol will perform different operations, such as coil reading operations, and different operations will have different numerical parameters, such as the start address and the end address. Based on statistical experience, customers believe that parameter values ​​that have appeared in the numerical parameter range may also appear in devices in the same area (specified using address ranges or device interface ranges).

[0105] Specifically, for devices with the same protocol and performing the same operation, the numerical parameters in multiple whitelist rules corresponding to the devices with the same protocol and performing the same operation are unified in the form of intervals to obtain the optimized whitelist rules corresponding to the protocol dimension, and thus the target whitelist is obtained based on the optimized whitelist rules.

[0106] For example, the learned whitelist rules of the basic whitelist are shown in Table 7 below.

[0107] Table 7. Basic whitelist

[0108]

[0109] The ranges of the numerical parameters (starting address and ending address) in Table 7 are unified in the form of intervals. On each device, the parameter values ​​of the numerical parameters are changed to a starting address of 0 and an ending address of 6000. The resulting target whitelist is shown in Table 8.

[0110] Table 8. Target whitelist in protocol dimension

[0111]

[0112] It should be noted that, for numerical parameters, the optimization solution of the protocol dimension can be used to optimize multiple whitelist rules of the basic whitelist to obtain each optimized whitelist rule corresponding to the protocol dimension.

[0113] By unifying the numerical parameters in the rules of the basic whitelist corresponding to devices with the same protocol and performing the same operation in the form of intervals, the sharing of whitelist rules can be achieved. The application of the target whitelist can reasonably control the target business, avoiding the impact of the strict control method of the basic whitelist on the business.

[0114] Figure 2 It is a schematic diagram of the process of generating the target whitelist provided by the present invention, such as Figure 2 As shown, it includes: step 201-step 209; wherein,

[0115] Step 201 , learning a basic whitelist corresponding to services between at least two devices in an industrial control network to obtain a basic whitelist; the basic whitelist includes a plurality of whitelist rules.

[0116] Step 202: record the associated information of the basic whitelist.

[0117] Step 203, determine whether to enable network dimension optimization. If the network dimension optimization is enabled, go to step 204; if the network dimension optimization is not enabled, go to step 209.

[0118] Step 204: Optimize multiple whitelist rules in the basic whitelist in the network dimension. Specifically, for devices in a preset network address range, merge the whitelist rules corresponding to the devices in the preset network address range to obtain the optimized whitelist rules corresponding to the network dimension, thereby obtaining a target whitelist including multiple optimized whitelist rules.

[0119] Step 205, determine whether to enable asset dimension optimization. If the asset dimension optimization is enabled, go to step 206; if the asset dimension optimization is not enabled, go to step 209.

[0120] Step 206: Optimize multiple whitelist rules in the basic whitelist in the asset dimension. Specifically, for devices of the same asset type, merge the whitelist rules corresponding to the devices of the same asset type to obtain the optimized whitelist rules corresponding to the asset dimension, thereby obtaining a target whitelist including multiple optimized whitelist rules.

[0121] Step 207, determine whether to enable protocol dimension optimization. If the protocol dimension optimization is enabled, go to step 208; if the protocol dimension optimization is not enabled, go to step 209.

[0122] Step 208: Optimize multiple whitelist rules in the basic whitelist in the protocol dimension. Specifically, for devices with the same protocol and performing the same operation, the numerical parameters in the whitelist rules corresponding to the devices with the same protocol and performing the same operation are unified in the form of intervals to obtain the optimized whitelist rules corresponding to the protocol dimension, thereby obtaining a target whitelist including multiple optimized whitelist rules.

[0123] Step 209, end.

[0124] The business control method provided by the present invention allows customers to arbitrarily select a whitelist rule optimization method of at least one preset dimension according to the actual situation of the production line, and optimize multiple whitelist rules of the learned basic whitelist, thereby improving the flexibility of whitelist rule optimization and, at the same time, being able to improve the application efficiency of the target whitelist.

[0125] Optionally, the specific implementation of step 103 includes:

[0126] The target whitelist rule corresponding to the target business is matched with each of the optimized whitelist rules corresponding to each of the preset dimensions; when the target whitelist rule corresponding to the target business matches any of the optimized whitelist rules, the target business between any two devices in the industrial control network is not blocked; when the target whitelist rule corresponding to the target business does not match any of the optimized whitelist rules, the target business between any two devices in the industrial control network is blocked.

[0127] Specifically, the control device can obtain the target business traffic corresponding to the target business, parse the target business traffic, and obtain the target whitelist rules corresponding to the target business. The target whitelist rules corresponding to the target business are matched with the optimized whitelist rules corresponding to each preset dimension. If the target whitelist rules corresponding to the target business match any of the optimized whitelist rules, the target business between any two devices in the industrial control network will not be blocked; if the target whitelist rules corresponding to the target business do not match any of the optimized whitelist rules, the target business between any two devices in the industrial control network will be blocked.

[0128] In the business control method provided by the present invention, accurate control of the target business is achieved by matching the target whitelist rules corresponding to the target business with the optimized whitelist rules corresponding to each preset dimension, thereby avoiding the impact of the strict control method of the basic whitelist on the business and improving the performance of the industrial control network.

[0129] Optionally, in addition to controlling the target service from the network dimension, the asset dimension and the protocol dimension, the present invention can also control the target service from the service dimension. The control method of the target service from the service dimension is described below.

[0130] Optionally, a target service flow of the target service between any two devices in the industrial control network is obtained; and based on the target service flow, the target service is controlled.

[0131] Specifically, the control device obtains the target service flow of the target service between any two devices in the industrial control network, and then controls the target service according to the target service flow.

[0132] Optionally, the controlling the target service based on the target service flow includes:

[0133] (1) Comparing the target service flow with the preset threshold; the preset threshold is used to determine whether to block the target service.

[0134] It should be noted that in the actual process of learning the basic whitelist, even if the learning time is long enough, or the above-mentioned network dimension, asset dimension and protocol dimension optimization methods are used, it is still possible that the whitelist learning is incomplete or the optimization is incomplete. Therefore, this application provides a preset threshold solution, which allows in the actual protection mode, the business corresponding to the industrial control business traffic that appears in small quantities can be alarmed, or the business corresponding to the industrial control business traffic that exceeds the preset threshold can be blocked, forming a "grayscale-like" control method.

[0135] Specifically, the preset threshold is used to determine whether to block the target service. The preset threshold can be set in two modes: the first is the absolute value mode. Set a digital unit byte (MB or KB), for example, the preset threshold is 5MB; the second is the percentage mode. Set the percentage value n%, where n is (0, 100), and the preset threshold is (n% * total service flow); where total service flow = service flow that matches the whitelist + service flow that does not match the whitelist.

[0136] (2) When the target service traffic is less than or equal to the preset threshold, the target service is not blocked.

[0137] Specifically, for target services that do not match the whitelist, the target service traffic corresponding to the target service is compared with the preset threshold. When the industrial control service traffic is less than or equal to the preset threshold, the target service will not be blocked and the target service can pass, but an alarm will be issued for the target service.

[0138] (3) When the target service traffic is greater than the preset threshold, the target service is blocked.

[0139] Specifically, when the target service flow is greater than a preset threshold, the target service is blocked and cannot pass.

[0140] For example, for target services that do not match the whitelist, when the target service traffic corresponding to the target service is less than or equal to 5MB, the target service will not be blocked, but an alarm will be issued for the target service; when the target service traffic corresponding to the target service is greater than 5MB, the target service will be blocked and the target service will be interrupted.

[0141] For another example, for the target service that does not match the whitelist, when the target service traffic corresponding to the target service is less than or equal to (n%*total service traffic), the target service will not be blocked, but an alarm will be issued for the target service; when the target service traffic corresponding to the target service is greater than (n%*total service traffic), the target service will be blocked and the target service will be interrupted.

[0142] Optionally, when a service that does not match the whitelist appears in the early stage, timely manual intervention is performed to determine whether the service is a special case. If the actual service is normal, the content corresponding to the service traffic can be added to the rules of the basic whitelist to implement the update of the basic whitelist while ensuring that the service will not be interrupted. If the service traffic corresponding to the actual service is malicious traffic, direct intervention is performed to block the service operation (in the judgment of service traffic and quota (preset threshold), if this service traffic is encountered, no alarm is issued for this service, but it is directly blocked).

[0143] The control scheme of the business dimension can be divided into multiple levels for control, among which:

[0144] a. Security policy level. For each security policy, the traffic range of statistical data and comparison data is the business traffic that matches this security policy.

[0145] b. Global configuration: Control the devices in the entire industrial control network. The total business traffic and the business traffic that does not match the whitelist are all the business traffic flowing through the device.

[0146] The service control method provided by the present invention can warn or directly block the target service by comparing the target service flow with a preset threshold value for the service that does not match the white list, thereby improving the efficiency of service control.

[0147] Optionally, the control schemes for the above-mentioned network dimension, asset dimension, protocol dimension and business dimension may be used in combination, or one or more of them may be used. The specific method for business control shall be determined based on the user's scenario and actual needs.

[0148] The business control method provided by the present invention optimizes the strict whitelist control method from multiple dimensions such as network dimension, asset dimension, protocol dimension and business dimension. In the actual application of the whitelist, it can be combined with the characteristics of its own production line to make the whitelist application more efficient, thereby improving the usability of the whitelist in the actual factory. At the same time, it will not cause business interruption of the production line due to whitelist mismatch, thereby avoiding the occurrence of production accidents.

[0149] Figure 3 This is a second flow chart of the service control method provided by the present invention, such as Figure 3 As shown, it includes steps 301 to 304; wherein,

[0150] Step 301: Acquire target service traffic of a target service between at least two devices in an industrial control network.

[0151] Step 302, determine whether the target service flow is greater than a preset threshold, the preset threshold is used to determine whether to block the target service. If the target service flow is not greater than the preset threshold, go to step 303; if the target service flow is greater than the preset threshold, go to step 304.

[0152] Step 303: Do not block the target service, but issue an alarm for the target service.

[0153] Step 304: Block the target service.

[0154] Figure 4 is a schematic diagram of the structure of the service control device provided by the present invention, such as Figure 4 As shown, the service control device 400 includes: a first acquisition module 401, an optimization module 402 and a first control module 403; wherein,

[0155] A first acquisition module 401 is used to acquire multiple whitelist rules corresponding to services between at least two devices in an industrial control network;

[0156] An optimization module 402 is used to optimize each of the whitelist rules in multiple preset dimensions to obtain multiple optimized whitelist rules corresponding to each of the preset dimensions, wherein the optimized whitelist rules include the whitelist rules;

[0157] The first control module 403 is used to control the target service between any two devices in the industrial control network based on the optimized whitelist rules corresponding to the preset dimensions.

[0158] The service control device provided by the embodiment of the present invention obtains multiple whitelist rules corresponding to the service between at least two devices in the industrial control network; then optimizes each whitelist rule in multiple preset dimensions to obtain multiple optimized whitelist rules corresponding to each preset dimension; since the optimized whitelist rules include whitelist rules, the target service between any two devices in the industrial control network can be controlled based on the multiple optimized whitelist rules corresponding to each preset dimension, thereby avoiding the impact of the strict control method of the basic whitelist on the service and improving the performance of the industrial control network.

[0159] Optionally, the preset dimension is a network dimension, and the optimization module 402 is specifically configured to:

[0160] For devices within a preset network address range, the whitelist rules corresponding to the devices within the preset network address range are merged to obtain the optimized whitelist rules corresponding to the network dimension.

[0161] Optionally, the preset dimension is an asset dimension, and the optimization module 402 is further used to:

[0162] For devices of the same asset type, the whitelist rules corresponding to the devices of the same asset type are merged to obtain the optimized whitelist rules corresponding to the asset dimension.

[0163] Optionally, the preset dimension is a protocol dimension, and the optimization module 402 is further configured to:

[0164] For devices with the same protocol and performing the same operation, the numerical parameters in each of the whitelist rules corresponding to the devices with the same protocol and performing the same operation are unified in the form of intervals to obtain the optimized whitelist rules corresponding to the protocol dimension.

[0165] Optionally, the first control module 403 is specifically configured to:

[0166] Matching the target whitelist rule corresponding to the target business with each of the optimized whitelist rules corresponding to each of the preset dimensions;

[0167] In the case where the target whitelist rule corresponding to the target service matches any rule in each of the optimized whitelist rules, the target service between any two devices in the industrial control network is not blocked;

[0168] When the target whitelist rule corresponding to the target service does not match any of the optimized whitelist rules, the target service between any two devices in the industrial control network is blocked.

[0169] Optionally, the service control device 400 further includes:

[0170] A second acquisition module is used to acquire the target service flow of the target service between any two devices in the industrial control network;

[0171] The second control module is used to control the target service based on the target service flow.

[0172] Optionally, the second control module is specifically configured to:

[0173] Comparing the target service flow with the preset threshold; the preset threshold is used to determine whether to block the target service;

[0174] When the target service flow is less than or equal to the preset threshold, the target service is not blocked;

[0175] When the target service flow is greater than the preset threshold, the target service is blocked.

[0176] Figure 5 is a schematic diagram of the physical structure of an electronic device provided by the present invention, such as Figure 5 As shown, the electronic device 500 may include: a processor 510, a communication interface 520, a memory 530 and a communication bus 540, wherein the processor 510, the communication interface 520 and the memory 530 communicate with each other through the communication bus 540. The processor 510 may call the logic instructions in the memory 530 to execute the following service control method: obtaining multiple whitelist rules corresponding to services between at least two devices in the industrial control network; optimizing each of the whitelist rules in multiple preset dimensions respectively, obtaining multiple optimized whitelist rules corresponding to each of the preset dimensions, and the optimized whitelist rules include the whitelist rules; based on each of the optimized whitelist rules corresponding to each of the preset dimensions, controlling the target service between any two devices in the industrial control network.

[0177] In addition, the logic instructions in the above-mentioned memory 530 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0178] On the other hand, an embodiment of the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, it is implemented to execute the business control methods provided by the above-mentioned embodiments, for example, including: obtaining multiple whitelist rules corresponding to the business between at least two devices in an industrial control network; optimizing each of the whitelist rules in multiple preset dimensions, respectively, to obtain multiple optimized whitelist rules corresponding to each of the preset dimensions, and the optimized whitelist rules include the whitelist rules; based on each of the optimized whitelist rules corresponding to each of the preset dimensions, controlling the target business between any two devices in the industrial control network.

[0179] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0180] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0181] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A service control method, characterized in that: include: Obtain multiple whitelist rules corresponding to services between at least two devices in an industrial control network; Optimizing each of the whitelist rules in a plurality of preset dimensions respectively, to obtain a plurality of optimized whitelist rules corresponding to each of the preset dimensions, wherein the optimized whitelist rules include the whitelist rules; Based on the optimized whitelist rules corresponding to the preset dimensions, target services between any two devices in the industrial control network are controlled.

2. The service control method according to claim 1, characterized in that: The preset dimension is a network dimension, and each of the whitelist rules is optimized in multiple preset dimensions to obtain multiple optimized whitelist rules corresponding to each of the preset dimensions, including: For devices within a preset network address range, the whitelist rules corresponding to the devices within the preset network address range are merged to obtain the optimized whitelist rules corresponding to the network dimension.

3. The service control method according to claim 1, characterized in that: The preset dimension is an asset dimension, and each of the whitelist rules is optimized in multiple preset dimensions to obtain multiple optimized whitelist rules corresponding to each of the preset dimensions, including: For devices of the same asset type, the whitelist rules corresponding to the devices of the same asset type are merged to obtain the optimized whitelist rules corresponding to the asset dimension.

4. The service control method according to claim 1, characterized in that: The preset dimension is a protocol dimension, and each of the whitelist rules is optimized in multiple preset dimensions to obtain multiple optimized whitelist rules corresponding to each of the preset dimensions, including: For devices with the same protocol and performing the same operation, the numerical parameters in each of the whitelist rules corresponding to the devices with the same protocol and performing the same operation are unified in the form of intervals to obtain the optimized whitelist rules corresponding to the protocol dimension.

5. The service control method according to any one of claims 1 to 4, characterized in that: The controlling of the target service between any two devices in the industrial control network based on the optimized whitelist rules corresponding to the preset dimensions includes: Matching the target whitelist rule corresponding to the target business with each of the optimized whitelist rules corresponding to each of the preset dimensions; In the case where the target whitelist rule corresponding to the target service matches any rule in each of the optimized whitelist rules, the target service between any two devices in the industrial control network is not blocked; When the target whitelist rule corresponding to the target service does not match any of the optimized whitelist rules, the target service between any two devices in the industrial control network is blocked.

6. The service control method according to any one of claims 1 to 4, characterized in that: The method further comprises: Obtaining target service traffic of the target service between any two devices in the industrial control network; The target service is controlled based on the target service flow.

7. The service control method according to claim 6, characterized in that: The controlling the target service based on the target service flow includes: Comparing the target service flow with the preset threshold; the preset threshold is used to determine whether to block the target service; When the target service flow is less than or equal to the preset threshold, the target service is not blocked; When the target service flow is greater than the preset threshold, the target service is blocked.

8. A service control device, characterized in that: include: A first acquisition module is used to acquire multiple whitelist rules corresponding to services between at least two devices in the industrial control network; An optimization module, used to optimize each of the whitelist rules in multiple preset dimensions respectively, to obtain multiple optimized whitelist rules corresponding to each of the preset dimensions, wherein the optimized whitelist rules include the whitelist rules; The first control module is used to control the target service between any two devices in the industrial control network based on the optimized whitelist rules corresponding to the preset dimensions.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of the service control method according to any one of claims 1 to 7 are implemented.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the service control method according to any one of claims 1 to 7 are implemented.

11. A computer program product having executable instructions stored thereon, characterized in that: When the instruction is executed by a processor, the processor implements the steps of the service control method according to any one of claims 1 to 7.

Images