Industrial control security isolation device and method suitable for industrial control network

Abstract

The invention discloses an industrial control security isolation device and method suitable for an industrial control network, and relates to the technical field of industrial control system network security. The objective of the invention is to solve the problems of complex deployment, insufficient detection depth and lack of intelligent behavior learning ability of an existing general protection product at an industrial control terminal. The method is deployed between an operation host and a terminal controller, and a port sniffing and protocol identification module is used for automatically identifying a controller protocol and loading an analysis method; analyzing message characteristics through a communication learning and trust value modeling module, and establishing a dynamic trust value model; the risk identification agent module takes over communication in an agent mode, carries out grading processing on messages according to a trust value model, and carries out application layer deep protocol analysis and risk identification on low-trust-value messages. According to the technical scheme, targeted and intelligent safety isolation and protection of the industrial control terminal are realized.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of industrial control system network security, and particularly relates to an industrial control security isolation device and method suitable for an industrial control network. BACKGROUND

[0002] Industrial control systems (ICS) are widely used in power, transportation, manufacturing and other national critical infrastructure fields, and the security thereof is directly related to the stability of production operation and public safety. Therefore, standards such as “Information Security Technology Network Security Level Protection Basic Requirements Part 5: Industrial Control System Security Extension Requirements” clearly stipulate that industrial control devices need to have security capabilities such as identity authentication, security audit, and intrusion prevention. However, the industrial control network has the characteristics of strong protocol specificity, high real-time requirement, and long device life cycle, which makes the traditional IT network security protection means face significant inadaptability and limitations when directly applied to the industrial control environment.

[0003] At present, the boundary protection devices (such as traditional firewalls, industrial gateways, etc.) commonly used in industrial environments mainly have the following problems: First, the limitations of deployment location and policy configuration. The traditional firewall is usually based on a powerful general-purpose operating system (such as Linux) and is designed to be deployed at the network boundary to isolate different security domains through complex access control policies. If it is deployed at the end of the industrial control network (such as before the programmable logic controller PLC), on the one hand, the high-performance hardware is a waste of resources, and on the other hand, in order to ensure the continuity and real-time performance of the industrial control business, extremely fine and complex policy configurations need to be made for the specific industrial control protocol, which is difficult to deploy and has high maintenance costs, and is likely to affect the transmission of normal production instructions due to improper configuration.

[0004] Second, the security detection depth is insufficient. The security filtering mechanism of the traditional firewall is mainly based on the “five-tuple” (source IP, destination IP, source port, destination port, protocol) information of the network layer and the transmission layer. However, the security threats of the industrial control network are often hidden in the specific instructions (function codes) of the application layer protocol, such as illegal start and stop of PLC, parameter tampering, etc. Only checking the network layer information cannot identify and block these malicious operations targeting the content of the industrial control protocol, resulting in a blind area in protection.

[0005] Third, there is a lack of learning and intelligent judgment based on behavior. Most existing products use static “allow / reject” policies and cannot learn the normal communication mode between the controller and the operation host, making it difficult to establish a dynamic trust benchmark. For IP / MAC address spoofing attacks, although some mechanisms can be used for prevention, there is a lack of a comprehensive risk assessment model combining communication frequency, message characteristics, operation timing, etc., and the protection means is single and rigid.

[0006] Fourth, the lack of identity verification brought by network mode. In order to reduce the impact on the existing network topology, the traditional firewall often adopts "transparent mode" deployment, which is invisible in the network. Although this mode simplifies the deployment, it cannot effectively identify the access initiator (operation host) as a communication endpoint, and it is difficult to resist illegal access or camouflage attacks from the inside of the network.

[0007] In summary, the prior art lacks a lightweight special isolation device that can be deployed in the end terminal of the industrial control network, deeply understand the industrial control protocol, have autonomous learning communication behavior and intelligent risk identification. Therefore, a new technical solution is urgently needed to ensure high availability of industrial control business while achieving targeted and deep security protection for end terminal controllers. SUMMARY

[0008] The technical problem to be solved and the technical task proposed by the present application are to perfect and improve the prior art, and to provide an industrial control security isolation device and method suitable for industrial control network, to solve the problems of complex deployment, insufficient detection depth, lack of intelligent behavior learning ability, etc. of existing industrial control security protection products, and to achieve the purpose of targeted and deep security isolation and protection for the end terminal controller of the industrial control network. To this end, the present application adopts the following technical solutions.

[0009] An industrial control security isolation device suitable for industrial control network is deployed between an operation host and an end terminal controller in an industrial control network, and the industrial control security isolation device comprises: A port configuration module is configured to configure an upstream port and a downstream port, wherein the upstream port is connected to the operation host, and the downstream port is connected to the end terminal controller; A port sniffing and protocol identification module is configured to run silently after deployment, sniff data packets passing through the industrial control security isolation device, automatically identify the business communication port of the end terminal controller and the industrial control protocol used by the end terminal controller, and load the corresponding protocol analysis method from the built-in protocol library; A communication learning and trust value modeling module is configured to record, classify and count the packet information sent to the end terminal controller through the industrial control security isolation device in the learning stage, extract communication data features including packet length features, packet arrival time features and packet frequency features, establish a trust value model based on the communication data features, and assign different trust value levels to different types of operations; The risk assessment agent module is used to start running in the agent mode after the port sniffing and protocol identification module and the communication learning and trust value modeling module are ready, to take over the communication between the operation host and the end controller; the risk assessment agent module matches the received data packet according to the trust value model, allows the passage of the packet with a high trust value level, and performs risk assessment based on protocol analysis on the packet with a low trust value level, identifies the risk operation and generates an alarm information.

[0010] The technical scheme pushes the protection position to the final end, extends the protection depth to the application layer instruction, and upgrades the protection strategy to a dynamic behavior model, thereby providing the industrial control system with more accurate and intelligent active isolation protection that is more in line with the business characteristics of the industrial control system. Specifically, the device is directly deployed between the operation host and the final end controller, forming the last line of defense close to the protected object. Compared with the traditional firewall deployed at the network boundary, the protection of the technical scheme can more directly monitor and control all operation instructions sent to the controller, eliminating the threat of horizontal movement attacks within the network, and the protection target is extremely clear and more targeted. Through the port sniffing and protocol identification module, the device can learn silently and automatically identify the business port and dedicated industrial protocol used by the controller without manually pre-configuring the protocol type and port strategy, achieving "plug and learn", and greatly reducing the technical threshold and implementation cycle of deploying security products in a heterogeneous and complex industrial environment. The communication learning and trust value modeling module learns from historical normal traffic, extracts communication behavior characteristics, and establishes a dynamic trust value model, enabling the device to distinguish between high-frequency normal operations and low-frequency abnormal or malicious operations, achieving a leap from static rule matching to dynamic behavior analysis, and the protection strategy is generated based on the system's own historical behavior, which is more in line with the actual industrial control business and reduces false positives and false negatives. In the proxy mode, the device not only filters at the network layer, but also deeply analyzes the application layer content of the data packet based on the loaded protocol analysis method, and makes a comprehensive judgment based on the trust value model, enabling it to identify malicious instructions hidden in the format of legitimate protocols that cannot be detected by traditional firewalls, significantly enhancing the detection depth and security capabilities. Unlike traditional transparent bridge mode, the device operates in proxy mode as an independent network node that takes over communication, enabling it to actively manage communication sessions, laying the foundation for subsequent strong identity authentication (verifying the legitimacy of the operation host); at the same time, the proxy mode also enables it to more thoroughly analyze and intervene in the communication process, effectively defending against IP / MAC spoofing attacks, and improving the controllability and security of the communication link. The device ensures that high-frequency, normal business instructions verified through learning are forwarded with low latency through the mechanism of passing high-trust-value packets directly, meeting the real-time requirements of industrial control systems, while starting a more stringent risk assessment for "low-trust-value packets"; the differentiated processing mechanism introduces advanced security capabilities while prioritizing the smoothness of core business, reflecting the balance between security and usability.

[0011] As a preferred technical means: the port sniffing and protocol identification module executes the steps of port sniffing, which include: grabbing data packets passing through the industrial control security isolation device within a preset time period, extracting the destination port of each data packet and performing frequency statistics, and marking the destination port with the highest frequency as a suspected business port; The suspected service port is compared with a built-in known industrial control service port library, if the comparison is successful, the suspected service port is determined as a service port, and a corresponding protocol library is matched; If the port comparison fails, the field of the specific offset position of the data packet is further analyzed, and the protocol characteristic value in the built-in protocol library is compared, if the comparison is successful, the industrial control protocol and the service port used are determined; If the automatic sniffing fails, manual configuration of the service port and the protocol type is supported.

[0012] The technical solution intelligently infers the most possible service port through packet capture and frequency statistics, changes the deployment mode of traditional industrial control security devices relying on manual entry of port and protocol information, simplifies the initial setting work, and avoids business interruption caused by configuration errors. A multi-level verification mechanism with port priority and feature backup is adopted to improve the identification accuracy and reliability; the first stage is port matching, and high-frequency ports are quickly matched with known industrial control port libraries; the second stage is feature comparison, when the port is not standard or unknown, the protocol characteristic value of the specific offset position of the data packet is analyzed, realizing deep identification of non-standard ports or private protocols, avoiding misjudgment or omission caused by single dependence on port number; the above two mechanisms ensure that the protocol can be effectively identified in various scenarios. Through the built-in known industrial control service port library and protocol characteristic value library, mainstream industrial control protocols are compatible; moreover, the second stage identification method based on protocol characteristics enables it to identify and adapt to non-standard ports or customized industrial control protocols, enhancing the universality and flexibility in different industrial environments. The technical solution retains manual configuration as the final guarantee, when facing extremely special or new protocols that cause automatic identification failure, administrators can intervene through manual methods to ensure that the device can be successfully deployed and run, ensuring the final availability of the scheme.

[0013] As a preferred technical means: the trust value model established by the communication learning and trust value modeling module is divided into at least the following elements: specific security time period, overall average length range of data packets, and operation frequency; wherein, the operation type with the highest frequency within the specific security time period and meeting the overall average length range of data packets is assigned the highest trust value level, and the operation deviating from the overall average length range of data packets or occurring in a non-specific security time period is assigned a lower trust value level.

[0014] The technical solution fuses and analyzes three key dimensions of time sequence (specific safety time period), data characteristics (overall average length range of data packets) and statistical characteristics (operation frequency), improves the identification sensitivity and distinction of abnormal operations (such as initiation in non-working period, abnormal data packet size, sudden increase or decrease in frequency), and defines the operation with the highest frequency in the specific safety time period and in line with the overall average length range of data packets as the highest trust value level. In subsequent protection, such operation can obtain fast release, thereby fundamentally ensuring the extremely low delay transmission of key production instructions, meeting the requirements of real-time and continuity of industrial control, and realizing the optimal balance of safety protection and business efficiency. The safety time period, average packet length and typical frequency are not pre-set statically, but are dynamically counted and analyzed from the actual historical communication data of the current deployment environment in the early learning stage of the device, so that the device can automatically adapt to the unique working mode of different factories, different production lines and different controllers, form a customized safety benchmark, reduce the dependence on the experience and complex configuration of safety administrators, and improve the universality and ease of use of the scheme. By defining the rule that deviation length range or occurrence in a non-specific time period leads to a decrease in trust value, a decision basis is provided for subsequent differentiated response measures, and more refined safety control is realized.

[0015] As a preferred technical means: when the risk assessment agent module performs risk assessment, it can analyze the application layer content of the data packet, extract the function code characteristics of the industrial control protocol, and comprehensively judge the operation risk in combination with the trust value level.

[0016] The risk assessment agent module can analyze the application layer content of the data packet, extract the function code characteristics of the industrial control protocol, and extend the depth of safety detection to the operation intention level of industrial control, so that the device can directly identify malicious instructions initiated by using a legal protocol channel and targeting a specific function of the controller, thereby discovering and preventing attacks that pose a substantial threat to production safety. Through extraction of the application layer function code and association with the trust value level, high-quality and understandable risk alarm information can be generated, making subsequent emergency response, event investigation and strategy optimization more efficient and accurate.

[0017] As a preferred technical means: when the industrial control safety isolation device operates in the proxy mode, the upstream port and the downstream port thereof are configured with independent IP addresses, act as visible nodes in the network, and can perform identity verification on the operation host attempting to connect to the upstream port.

[0018] As a visible proxy node, the industrial control security isolation device can actively initiate and complete the identity authentication of the operation host, changing the passive forwarding and undiscriminating working mode of the traditional transparent bridge device. By verifying the legal identity of the connected host, the access attempt of illegal or unauthorized devices can be blocked before the communication session is established, greatly moving the security line forward and effectively resisting network layer attacks such as IP / MAC address forgery and illegal device access. By configuring independent IP addresses for the upstream and downstream ports, the device becomes a clear and addressable security gateway in the network topology, and the network administrator can clearly define and manage the boundary between the operation host domain and the controller domain; all communication traffic must pass through the proxy node, making the network access path clear and controllable and eliminating the bypass risk that may exist in the transparent mode; and the proxy mode combined with identity authentication enables the device to strictly distinguish and authenticate each internal host that attempts to access the controller, so that even if an attacker has invaded a host in the internal network, the attacker cannot directly communicate with the controller if the identity authentication of the proxy node fails, thereby setting an identity access control for the controller and increasing the difficulty of network lateral movement for the attacker, effectively containing the spread of internal threats. The technical solution does not rely on the traditional network location trust, but requires verification of the source of each access request; the controller itself does not need to be exposed to the open network, and the attacker cannot directly scan or attack the controller, and must first break through the authentication and authorization of the proxy node, thereby building a minimized and controlled access path, enhancing the controllability, auditability and ability to defend against internal threats of the entire industrial control network access link.

[0019] Another object of the present application is to provide an industrial control security isolation method suitable for an industrial control network, applied to a security isolation device deployed between an operation host and a final end controller, the industrial control security isolation method comprising: Deployment and port configuration step: deploying the security isolation device between the operation host and the final end controller, configuring its upstream port to connect the operation host and its downstream port to connect the final end controller; Port sniffing and protocol identification step: after deployment, the security isolation device enters a silent running state, sniffs data packets flowing through its upstream and downstream ports, automatically identifies the business communication port of the final end controller and the type of industrial control protocol used, and loads the corresponding protocol analysis method from the built-in protocol library according to the identification result; The communication learning and trust value modeling step: the security isolation device enters a learning stage, records and analyzes the messages sent to the final end controller, extracts the communication data characteristics of the messages, and the communication data characteristics at least include a packet length characteristic, a packet arrival time characteristic, and a packet frequency characteristic; a trust value model is established based on the extracted communication data characteristics, and different types of communication operations are assigned corresponding trust value levels; The risk identification agent running step: after completing the protocol identification and trust value modeling, the security isolation device switches to an agent running mode, takes over the communication link between the operation host and the final end controller; for the received data messages, the trust value level thereof is matched according to the trust value model, the messages with a high trust value level are directly forwarded, and the messages with a low trust value level are subjected to application layer risk identification based on the loaded protocol analysis method, risk operations are identified, and alarm information is generated.

[0020] The method enables the security isolation device to autonomously identify a network environment and a business protocol after deployment through the port sniffing and protocol identification step, eliminates the cumbersome and complex manual strategy pre-configuration requirement in the traditional scheme, makes the deployment process like inserting an intelligent device, greatly reduces the dependence on the professional knowledge of the operation personnel and the implementation threshold, and realizes fast and accurate initial secure access. The risk identification agent running step directly forwards the messages with a high trust value, and only starts the deep application layer identification for the messages with a low trust value, while introducing the deep security capability, the real-time performance and the low delay of the high-frequency normal business traffic are preferentially guaranteed, and the inherent contradiction between security reinforcement and business continuity in the industrial scene is perfectly solved. The method integrates multiple security capabilities: first, the communication is taken over through the agent mode, and a controllable access path is forcibly established at the network layer; second, the malicious operation instructions are identified at the application layer through deep protocol analysis and function code analysis. This combined network control and content detection method can cope with diversified threats from illegal access to advanced semantic attacks, and the protection coverage is more comprehensive.

[0021] As a preferred technical means: the port sniffing and protocol identification step specifically includes: The frequency of the data packets flowing through the security isolation device in a preset time period is counted, and the destination port with the highest frequency is marked as a suspected business port; The suspected business port is matched with a pre-stored industrial control business port library, if the matching is successful, the suspected business port is determined as a business port and is associated with a corresponding protocol library; If the port matching fails, the field at a specific offset position in the data message is extracted, and the extracted field is compared with a pre-stored protocol characteristic value, and the protocol type and the business port are determined according to the comparison result; If the automatic identification is not successful, the protocol type and the business port information configured manually are received.

[0022] The port sniffing and protocol identification step locks the suspected service port by counting the destination port frequency of the data packet within a preset time period, which can cover the periodic and repetitive traffic characteristics of industrial control services, exclude transient interference data, adapt to non-standard port deployment scenarios, rely on the pre-stored industrial control service port library, quickly match the standard service ports of mainstream industrial control controllers, significantly shorten the identification and deployment cycle in common scenarios, and reduce the dependence on the professional ability of on-site operation and maintenance personnel. When the port matching fails, the field at a specific offset position in the data packet is extracted and compared with the pre-stored protocol characteristic value, breaking through the limitation of traditional port-based protocol judgment, accurately identifying the special scenario of "non-standard port + standard protocol", and avoiding protocol misjudgment. At the same time, when automatic identification is unsuccessful, manual configuration information can be received, which can cover extreme niche scenarios such as old or customized industrial control systems, and balance the automatic efficiency of most scenarios and the compatibility of extreme scenarios, improving the adaptability and reliability of the step in different industrial control environments.

[0023] As a preferred technical means: in the communication learning and trust value modeling step, when establishing the trust value model, the basis for dividing the trust value level includes whether the operation occurs within a specific safe time period, whether the data packet length corresponding to the operation is within the overall average length range of the data packet, and the execution frequency of the operation; wherein the operation occurring within a specific safe time period, the data packet length being within the overall average length range of the data packet, and the highest execution frequency is assigned the highest trust value level.

[0024] In the communication learning and trust value modeling step, the "specific safe time period" matches the time regularity of industrial control operations that are more likely to be associated with risks (such as operations during normal production time are more likely to be legal business, and operations during non-production time are more likely to be associated with risks), the "data packet overall average length range" matches the characteristics of business data packet length in industrial control data interaction (abnormal length data packet is often accompanied by malicious tampering or invalid instructions), and the "operation execution frequency" corresponds to the characteristics of legal industrial control operations (such as the fixed frequency of regular parameter interaction between controllers and hosts). The three combined form a multi-dimensional judgment standard, which can more accurately distinguish between legal and risky operations than a single-dimensional judgment, significantly reducing the probability of misjudging legal operations as risky or missing risky operations; at the same time, the operation within the specific safe time period, with the data packet length being compliant and the execution frequency being the highest, is assigned the highest trust value level, which can prioritize the release of high-frequency legal operations, avoid redundant detection of routine business, and ensure real-time requirements, and can also strictly screen high-trust operations through multi-dimensional thresholds to reduce the possibility of risky operations passing from the source, achieving a precise balance between security and business smoothness, and adapting to the dual core needs of stable operation and risk prevention of industrial control networks.

[0025] As a preferred technical means: in the risk judgment agent running step, when the message with a low trust value level is subjected to risk judgment, the application layer data of the message is parsed, the specific function code of the industrial control protocol is extracted, the operation risk is comprehensively evaluated by combining the characteristics of the function code with the trust value level of the message.

[0026] The technical solution breaks through the limitation of traditional risk judgment relying only on transmission layer information (such as IP and port), and can directly reach the core nature of industrial control operation by parsing the application layer data of the message and extracting the specific function code of the industrial control protocol. The industrial control protocol function code directly corresponds to the key operation of the controller (such as device start-stop, parameter modification, forced output, etc.), and the risk levels of different function codes are essentially different (such as the “forced shutdown” function code naturally has a high risk attribute, and the “data reading” function code has a lower risk). The risk properties of the operation itself can be accurately located by combining the characteristics of the function code. At the same time, the scheme is not isolatedly dependent on the function code or the single dimension of the trust value level, but is comprehensively evaluated by combining the two, which can avoid the misinterception of the message with a low trust value level but a regular and legal operation function code (such as accidental non-safety period low-frequency data reading) due to only looking at the low trust value level, and can also prevent the omission of abnormal operation (such as non-safety period high-frequency repeated sending of regular parameter modification instructions) due to only looking at the function code regularity, so as to realize the balance between the accuracy and flexibility of risk judgment, effectively prevent and control the potential risk behind the low trust value message, and avoid excessive interception of legal low trust operation, which adapts to the dual core needs of “risk accurate prevention and control” and “business continuous operation” of the industrial control network.

[0027] As a preferred technical means: in the risk judgment agent running step, the security isolation device runs as a proxy node in the network with independent IP addresses of its upstream and downstream ports, and performs identity verification on the operation host attempting to communicate through its upstream port. After verification, the communication proxy link with the final end controller can be established.

[0028] The security isolation device runs as a proxy node visible to the network through the independent IP addresses configured by the upstream and downstream ports. Compared with the traditional design of node invisibility in transparent mode, it can form a clear communication relay node in the industrial control network, making it easy for operation and maintenance personnel to clearly master the network topology relationship of "operation host-isolation device-end controller", and reducing the difficulty of fault positioning and daily monitoring. At the same time, the operation host trying to communicate through the upstream port is first subjected to identity verification, which can intercept unauthorized hosts (such as illegally accessed external devices) or malicious hosts with fake IP / MAC from the source of communication, completely avoiding the security vulnerability of traditional IP / MAC filtering that is easily bypassed, and avoiding illegal hosts from establishing a connection with the controller. The logic that "communication proxy link with the controller can be enabled only after verification" builds a strict pre-admission barrier for the controller, ensuring that only authorized operation hosts can initiate operation requests to the controller, meeting the core needs of "strict control of controller operation permissions" in industrial control scenarios, and effectively preventing the risks of controller misoperation, data tampering or business interruption caused by illegal operations.

[0029] Advantages: The technical solution designs a security isolation device for the controller in view of the current situation of industrial control network security, and provides risk assessment while physically isolating the controller through trust value model based on communication data characteristics, port sniffing and risk assessment proxy mode and other technical means, thereby improving the security of the end controller. Specifically as follows: First, the technical solution is directly positioned at the end of the industrial control environment, and focuses on protecting the end controller of the industrial equipment. Compared with conventional network security protection products (traditional firewalls, gateways, etc.), the protection is more targeted and more in line with the needs of industrial control security.

[0030] Second, the technical solution is used for targeted isolation of the controller, so its protocol is relatively simple (for example, for Siemens controllers, only the corresponding S7comm control protocol needs to be supported, and for Schneider controllers, only the Modbus control protocol needs to be supported). Through port sniffing and trust value model based on communication data characteristics, the targeted protocol can be quickly processed and responded, and at the same time has risk assessment capability, directly records and alarms non-security message data, has business isolation capability while maintaining business smoothness, and has security risk control.

[0031] Third, the technical solution can deeply analyze the function code and other characteristic information of the targeted protocol. Compared with the conventional network security protection product (firewall) which is limited to the transport layer five-tuple (i.e. source IP, destination IP, source port, destination port and protocol), the device also analyzes the application layer of the data packet and extracts the corresponding protocol characteristic information, compares it to generate a trust value and decides whether to forward it to the controller or to alarm.

[0032] Fourth, the technical solution is different from the conventional network security protection product (firewall) and is deployed in a proxy mode. The conventional network security protection product (firewall) generally adopts a transparent mode, i.e. checks and forwards the data packet, and the two business interfaces for entry and exit are not configured with IP and are invisible in the network. The application adopts a proxy mode, and the two business interfaces for entry and exit are configured with IP and are visible in the network. Through the proxy mode, the operating host can be authenticated through the business interface first, and only the authenticated operating host is allowed to communicate, so that the IP / MAC counterfeit device cannot communicate with the device and thus cannot communicate with the controller. BRIEF DESCRIPTION OF DRAWINGS

[0033] Figure 1 is a flowchart of the method of the application. DETAILED DESCRIPTION

[0034] The technical solution of the application will be further described below in combination with the accompanying drawings of the specification.

[0035] Example 1 The industrial control safety isolation device (hereinafter referred to as "device") provided by the embodiment of the application can be a separate hardware device in physics, and its core can include a processor (such as an industrial ARM or x86 CPU), a memory (such as a Flash and a RAM), and at least two network interfaces (NIC). In terms of logical functions, the device mainly includes the following modules: 1. Port configuration module This module runs in the initialization stage of the device and usually completes parameter setting through a local management interface or a remote configuration tool. The administrator or implementation engineer specifies the two physical network ports (e.g. Eth0 and Eth1) of the device as the upstream port (N1) and the downstream port (N2) respectively. The IP address of the upstream port (N1) is configured as an address consistent with the network segment where the operating host is located, and the IP address of the downstream port (N2) is configured as an address consistent with the network segment where the final end controller (such as PLC) is located. This configuration is the basis for the subsequent operation of the device in a proxy mode.

[0036] 2. Port sniffing and protocol identification module The module is mainly composed of sniffing analysis software running on the device and built-in protocol knowledge base.

[0037] Protocol knowledge base: stores the standardized service port numbers (such as 502, 102) of common industrial control protocols (such as Siemens S7comm, Schneider Modbus TCP, Rockwell CIP, etc.) and the characteristic values of specific offset positions in the data frame of each protocol (such as the protocol ID field of S7comm, the function code field of Modbus, etc.).

[0038] Sniffing analysis software: automatically starts after the device completes physical wiring and basic IP configuration, entering the "silent learning" state. The software captures all data packets flowing through ports N1 and N2 in silent operation mode, at this time it is forwarded in the form of data transmission, without any blocking operation. Its workflow is as follows: First, count the frequency of all data packet destination ports in a preset time period (for example, 5 minutes), and mark the highest frequency port (such as TCP 102) as "suspected service port". Then, compare this port with the built-in known industrial port library. If it matches successfully (for example, 102 port matches S7comm), the protocol type is directly determined. If it fails to match (for example, the port is a custom 20010), it enters deep analysis: extract the value of a specific offset (such as bytes 4-5) in the data packet payload, and compare it with the characteristic value in the protocol knowledge base. If the comparison is successful, the protocol is identified (even if the port is not standard). If the above automated methods fail, the system will prompt the administrator to manually specify the protocol type and service port through the management interface.

[0039] 3. Communication learning and trust value modeling module This module starts after protocol recognition is complete, entering the "active learning" phase, with a configurable duration (for example, 24 hours or a complete production cycle).

[0040] Feature extraction unit: performs deep analysis on all legal data messages sent from N1 to N2 during this period. Not only records the source / destination IP and port, but also extracts the application layer operation instruction (function code), and calculates three core features: Packet length feature: statistics the average, standard deviation, minimum and maximum of the data packet length under this operation type.

[0041] Packet arrival time feature: statistics the mean and distribution of the time interval between two consecutive occurrences of the operation instruction.

[0042] Packet frequency feature: statistics the number of occurrences of the operation instruction per unit time.

[0043] Modeling unit: Based on the statistics collected during the learning period, automatically establish a "trust value model". For example, the model identifies that "read operation" from a specific host, with a specific length (such as 70-80 bytes), and occurs about 10 times per minute, is the most typical mode in a specific security time period (such as working hours 08:00-18:00), and is marked as T0 level (highest trust). The same "read operation" that occurs in the early morning, with abnormal length or frequency mutation, is marked as lower T3 or T4 trust value. The model is dynamic and can be continuously fine-tuned according to new normal data in subsequent runs.

[0044] 4. Risk assessment agent module This module is the core of the device entering the formal protection state.

[0045] Proxy service engine: After starting this module, the device formally switches to proxy mode. The upstream port (N1) and downstream port (N2) work as proxy endpoints. At this time, all requests from the operation host to the controller have the device's N1 port IP as the actual TCP connection endpoint. After verifying the request, the device establishes a new connection with the controller using its own identity (using the IP of the N2 port). This process transparently completes the protocol data forwarding for both ends, but the device completely controls the session as the communication hub.

[0046] Comprehensive risk decision engine: For each data packet received through the proxy, the engine performs two-step decision: First, behavior matching: quickly extract the timing, length, and frequency characteristics of the packet, and match them with the trust value model to get the preliminary trust value level (T0-T4).

[0047] Second, deep content identification: for packets with lower trust value levels (such as T2 and below), the engine calls the special parser loaded in the protocol recognition stage (such as the S7comm parser) to deeply decode the application layer function code and parameters. Combined with the inherent risk attributes of the function code (such as "write coil" is more risky than "read register") and the behavior trust value, a comprehensive risk assessment is performed.

[0048] Execution and alarm unit: according to the risk assessment results, perform actions: T0 / T1 level packets are directly high-speed forwarded; T2 level packets are recorded and then forwarded; T3 level packets generate low-level alarms and may be delayed in forwarding; T4 level or packets that find explicit malicious instructions (such as illegal shutdown commands) are directly blocked and generate high-risk alarms, notifying the upper monitoring system.

[0049] Embodiment two The embodiment provides an industrial control security isolation method suitable for an industrial control network, and the industrial control security isolation method comprises the following steps: S1. Deployment and port configuration step: Before the deployment starts, the device selects two fixed device network ports and configures them as upstream port N1 and downstream port N2. N1 is connected to the host that needs to operate the final terminal controller, and N2 is connected to the final terminal industrial controller and the like. The device runs in a proxy mode, acting as a controller for the host and acting as a host for the controller.

[0050] After the device is deployed, it will run silently in data transmission mode until it obtains the IP, communication port, and operation instruction of the industrial controller, and then switches to the proxy mode.

[0051] S2. Port sniffing and protocol identification step: After the device is connected to the industrial environment, the business port sniffing behavior is started, the actual business port of the controller is obtained, and then the protocol analysis method library that meets the current industrial control environment is selected from the protocol library built in the device (for example, for the controller of the Siemens brand, the S7comm protocol library is imported; for the controller of the Schneider brand, the Modbus protocol library is imported). The protocol library is used for protocol analysis of the device, which can analyze the application layer data, extract the industrial control operation, and identify whether the industrial control operation is reliable. The specific process is as follows: 1. Through data packet extraction and destination port feature analysis, the destination port passing through the security isolation device within a preset time period is captured.

[0052] 2. The frequency of the destination port is recorded, and the port with the highest frequency in this time period is marked as a suspected business port.

[0053] 3. The suspected business port is compared with the built-in port library of the device. If the comparison is successful, the port is marked as a business port, and the corresponding protocol library is matched.

[0054] 4. If the comparison fails, the field at a specific offset position of the data message is further extracted, and the extracted field is compared with the characteristic value of the built-in protocol library. If the comparison is successful, the business protocol is marked, and the suspected business port is marked as a business port.

[0055] 5. If the specific protocol frame feature comparison still fails, the business port and the corresponding protocol are manually added through manual intervention to complete the port sniffing.

[0056] 6. After the port sniffing is completed, the IP address and business port of the industrial host and the controller are marked according to the sniffing result, and data preparation for starting the proxy mode is performed.

[0057] S3. Communication learning and trust value modeling step: after the port sniffing is completed, the learning function of the device is started, and the security protection system of the device records, classifies and counts the message information of the controller, pays additional attention to high-frequency messages and generates trust values, and at the same time, the trust values are defined by levels. The information message of high trust value level can pass directly to improve the efficiency of high-frequency operation. The extraction of data messages includes but is not limited to the following aspects: 1. Packet length statistical characteristics: including average packet length, standard deviation, minimum packet length and maximum packet length, etc. It can reflect the size distribution of service data packets, and abnormal cases may show unusually large or small packet lengths.

[0058] 2. Packet arrival time characteristics: including statistical characteristics of packet arrival time interval (such as average interval, maximum interval, minimum interval, etc.), under normal circumstances, the arrival time of the packet should be uniformly distributed or interacted according to a certain communication mode, and the abnormal case may show abnormal frequent or irregular packet arrival time interval.

[0059] 3. Packet frequency characteristics: the number of packets per unit time is measured to measure the frequency of data packets arriving in a certain period of time.

[0060] After extracting the above characteristics, a trust value model is established, which involves three elements: a specific security time period, a data packet overall average length range, and an operation frequency. The specific division rule is: the highest frequency packet operation type in a specific security time period that meets the data packet overall average length range is T0 trust value; the next frequency packet operation type in a specific security time period that meets the data packet overall average length range is T1 trust value; the high frequency packet operation type in a specific security time period that deviates from the data packet overall average length range is T2 trust value; the low frequency packet operation type in a specific security time period that deviates from the data packet overall average length range is T3 trust value; the packet operation type in a non-specific security time period that deviates from the data packet overall average length range is T4 trust value.

[0061] The trust value of the operation type is used as the basis for risk assessment.

[0062] S4. Risk assessment agent running step: after the learning of the device is completed, the risk assessment agent running mode is started, first of all, according to the sniffing result, the proxy service is started to take over the communication to the controller, the high trust value operation is allowed to pass, and the low trust value message is subjected to risk assessment, whether there is risk is judged according to the built-in industrial control protocol library, and the characteristics are recorded to alarm and remind the risk operation, the detailed process is as follows: 1. According to the sniffing result record, configure the host IP, controller IP and service port, start the proxy service, so that the device takes over the communication between the controller and the host.

[0063] 2. Analyzing the communication data, and matching its trust value according to time characteristics, length characteristics, and function code characteristics.

[0064] 3. The operation of T0 and T1 with high trust value allows access, the operation of T2 level is low-risk behavior, the operation of T3 level is medium-risk, and the operation of T4 level is high-risk.

[0065] 4. Warning and reminding for risk behavior, and data analysis.

[0066] It should be understood that the above description is only an embodiment of the present application and is not sufficient to limit the technical solutions of the present application. For those skilled in the art, within the spirit and principles of the present application, the above description can be added, replaced, transformed or improved, and all these added, replaced, transformed or improved technical solutions should belong to the protection scope of the appended claims of the present application.

Claims

1. An industrial control security isolation device suitable for an industrial control network, deployed between an operation host and a final end controller in the industrial control network, characterized in that, The industrial control security isolation device comprises: a port configuration module for configuring an upstream port and a downstream port, wherein the upstream port is connected to the operation host, and the downstream port is connected to the final end controller; a port sniffing and protocol identification module for running silently after deployment, automatically identifying the service communication port of the final end controller and the industrial control protocol used by the final end controller by sniffing data packets passing through the industrial control security isolation device, and loading the corresponding protocol analysis method from the built-in protocol library; a communication learning and trust value modeling module for recording, classifying and counting the packet information sent to the final end controller through the industrial control security isolation device in the learning stage, extracting communication data features including packet length features, packet arrival time features and packet frequency features, establishing a trust value model based on the communication data features, and assigning different trust value levels to different types of operations; a risk identification agent module for starting to run in a proxy mode after the port sniffing and protocol identification module and the communication learning and trust value modeling module are ready, taking over the communication between the operation host and the final end controller; the risk identification agent module matches the received data packets with the trust value model, allows the passage of packets with high trust value levels, and performs risk identification based on protocol analysis for packets with low trust value levels, identifies the risk operations and generates alarm information.

2. The industrial control safety isolation device of claim 1, wherein, The steps of port sniffing performed by the port sniffing and protocol identification module include: grabbing data packets passing through the industrial control security isolation device within a preset time period, extracting the destination port of each data packet and performing frequency statistics, and marking the destination port with the highest frequency as a suspected service port; comparing the suspected service port with the built-in known industrial control service port library, and if a match is successful, determining it as a service port and matching the corresponding protocol library; if the port comparison fails, further analyzing the fields at a specific offset position of the data packet, and comparing them with the protocol feature values in the built-in protocol library, if a match is successful, determining the industrial control protocol used and the service port; if automatic sniffing fails, manual configuration of the service port and the protocol type is supported.

3. The industrial control safety isolation device of claim 1, wherein, The trust value model established by the communication learning and trust value modeling module is divided into at least the following elements: a specific security time period, a data packet overall average length range, and an operation frequency; wherein the operation type with the highest frequency within a specific security time period and within the data packet overall average length range is given the highest trust value level, and the operation deviating from the data packet overall average length range or occurring in a non-specific security time period is given a lower trust value level.

4. The industrial control safety isolation device of claim 1, wherein, When the risk identification agent module performs risk identification, it can analyze the application layer content of the data packet, extract the function code features of the industrial control protocol, and make a comprehensive judgment on the operation risk in combination with the trust value level.

5. The industrial control safety isolation device of claim 1, wherein, When the industrial control security isolation device runs in a proxy mode, the upstream port and the downstream port are both configured with independent IP addresses, acting as visible nodes in the network, and can perform identity verification on the operation host attempting to connect the upstream port.

6. An industrial control security isolation method suitable for an industrial control network, applied to a security isolation device deployed between an operation host and a final end controller, characterized in that, The industrial control safety isolation method comprises: A deployment and port configuration step: deploying the safety isolation device between the operation host and the final end controller, configuring its upstream port to connect the operation host and its downstream port to connect the final end controller; A port sniffing and protocol identification step: after deployment, the safety isolation device enters a silent running state, sniffs data packets flowing through its upstream and downstream ports, automatically identifies the business communication port of the final end controller and the type of industrial control protocol used, and loads the corresponding protocol analysis method from the built-in protocol library according to the identification result; A communication learning and trust value modeling step: the safety isolation device enters a learning phase, records and analyzes the packets sent to the final end controller, extracts the communication data features of the packets, which at least include packet length features, packet arrival time features and packet frequency features; a trust value model is established based on the extracted communication data features, and different types of communication operations are assigned corresponding trust value levels; A risk appraisal agent running step: after completing protocol identification and trust value modeling, the safety isolation device switches to an agent running mode, taking over the communication link between the operation host and the final end controller; for the received data packets, the trust value level is matched according to the trust value model, the high trust value level packets are directly forwarded, and the low trust value level packets are subjected to application layer risk appraisal based on the loaded protocol analysis method, risk operations are identified and alarm information is generated.

7. The method of claim 6, wherein, The port sniffing and protocol identification step specifically comprises: Statistically counting the destination port frequency of data packets flowing through the safety isolation device within a preset time period, and marking the destination port with the highest occurrence frequency as a suspected business port; Matching the suspected business port with the pre-stored industrial control business port library, if the matching is successful, the suspected business port is determined as a business port and associated with the corresponding protocol library; If the port matching fails, the field at a specific offset position in the data packet is extracted and compared with the pre-stored protocol feature value, and the protocol type and business port are determined according to the comparison result; If automatic identification is unsuccessful, the protocol type and business port information configured manually are received.

8. The method of claim 6, wherein, In the communication learning and trust value modeling step, when establishing the trust value model, the basis for dividing the trust value levels includes whether the operation occurs within a specific safe time period, whether the length of the data packet corresponding to the operation is within the range of the overall average length of the data packets, and the execution frequency of the operation; wherein the operation occurring within a specific safe time period, the data packet length being within the range of the overall average length of the data packets, and the highest execution frequency are assigned the highest trust value level.

9. The method of claim 6, wherein, In the risk appraisal agent running step, when performing risk appraisal on the low trust value level packets, the application layer data of the packets is analyzed, the specific function code of the industrial control protocol is extracted, and the operation risk is comprehensively evaluated by combining the characteristics of the function code with the trust value level of the packet.

10. The method of claim 6, wherein, In the risk appraisal agent running step, the security isolation device runs as an agent node in the network with the independent IP address of its upstream and downstream port configuration, and authenticates the operation host attempting to communicate through its upstream port, and after authentication, a communication agent link with the final end controller can be established.

Images