Train network security protection method and system and storage medium

Abstract

The invention provides a train network security protection method, a train network security protection system and a computer readable storage medium. The train network security protection method comprises the following steps: carrying out identity authentication on an external system, and identifying an equipment category and a corresponding port of the external system; in response to the fact that the equipment category of the external system is maintenance equipment, starting a bastion host function; and in response to the fact that the equipment category of the external system is communication equipment, based on the configuration of the corresponding port, starting a security audit and intrusion detection function or a firewall function, the starting of the security audit and intrusion detection function or the firewall function comprising analysis of a message of a train-specific protocol and control data thereof. According to the train network safety protection method, multiple safety protection functions can be achieved at the same time, the number of safety devices and the size of a train communication network are reduced, analysis of a train special protocol is achieved, and therefore more efficient protection is achieved in a rail transit vehicle-mounted network.

Description

Technical Field

[0001] This invention relates to the field of train network information security, and in particular to a train network security protection method, a train network security protection system, and a computer-readable storage medium. Background Technology

[0002] Existing train communication networks or industrial control networks are equipped with a variety of proprietary information security protection devices, including firewalls, intrusion detection, security auditing, log analysis, antivirus firewalls, situational awareness, etc. These security protection functions are carried by multiple information security devices, each of which has a portion of the functions.

[0003] Please refer to Figure 1 , Figure 1 A schematic diagram of the existing train communication network architecture is shown.

[0004] The various safety protection functions of the existing train communication network are carried by safety devices on different boards or modules. Each safety device can only fulfill a part of the function, and the implementation of each part of the function requires access to a port of the train communication network. Different safety devices are accessed through different ports to access different systems. For example... Figure 1 As shown, port 101 of the train communication network 100 is used to access a security device 111 that functions as a firewall. The security device 111 then communicates with an external communication device 121 to filter and process the data from the communication device 121. Port 102 of the train communication network 100 is used to access a security device 112 that functions as a security audit and intrusion detection device. Port 104 is used to access an external communication device 122, allowing data from the communication device 122 that needs to be audited to be bypassed through the train communication network 100 to the security device 112 for auditing. Port 103 of the train communication network 100 is used to access a security device 113 that functions as a bastion host device. The security device 113 then communicates with an external maintenance device 123, which performs maintenance on the train communication network through the security device 113.

[0005] Therefore, existing train communication networks require the installation of various security devices to maintain network security while communicating with different external systems. However, the specific installation structure, size, and space limitations of train communication networks cannot accommodate the simultaneous installation of a wide variety of information security devices.

[0006] Furthermore, the information security equipment connected to the existing train communication network is defined by the corresponding national recommended standards or public safety industry standards. However, the information security equipment and the corresponding national and industry standards only implement or specify the detection of industrial control protocols commonly used in the industrial control field. They do not address message parsing and anomaly detection for the proprietary communication protocols in the train communication network, and therefore cannot meet the specific application scenario requirements of the train onboard network.

[0007] In order to overcome the above-mentioned defects of the existing technology, there is an urgent need in the field for a train network security protection method and a train network security protection system that can simultaneously realize multiple security protection functions, reduce the number of security devices and the size of the train communication network, and realize the parsing of train proprietary protocols, thereby achieving more efficient protection in rail transit on-board networks. Summary of the Invention

[0008] The following provides a brief overview of one or more aspects to offer a basic understanding of them. This overview is not an exhaustive summary of all conceived aspects, nor is it intended to identify key or decisive elements of all aspects, nor to define the scope of any or all aspects. Its sole purpose is to present some concepts of one or more aspects in a simplified form to prepare for the more detailed descriptions that follow.

[0009] To overcome the aforementioned deficiencies in the existing technology, the present invention provides a train network security protection method, a train network security protection system, and a computer-readable storage medium, which can simultaneously realize multiple security protection functions, reduce the number of security devices and the size of the train communication network, and realize the parsing of train proprietary protocols, thereby achieving more efficient protection in rail transit on-board networks.

[0010] Specifically, the train network security protection method provided by the first aspect of the present invention includes the steps of: authenticating the external system and identifying the device category and corresponding port of the external system; enabling the bastion host function in response to the device category of the external system being a maintenance device; and enabling the security audit and intrusion detection function or firewall function based on the configuration of the corresponding port in response to the device category of the external system being a communication device, wherein enabling the security audit and intrusion detection function or firewall function includes parsing the messages and control data of the train proprietary protocol.

[0011] Preferably, in one embodiment of the present invention, the step of responding to the device category of the external system as a communication device and enabling the security audit and intrusion detection function or the firewall function based on the configuration of the corresponding port includes: when the corresponding port is configured as bypass, enabling the security audit and intrusion detection function to audit the data flow of the communication device; and when the corresponding port is configured as routing, enabling the firewall function to detect the packets of the communication device.

[0012] Preferably, in one embodiment of the present invention, the step of enabling the firewall function and detecting the packets of the communication device when the corresponding port is configured as a route includes: forwarding normal data to the train communication network in response to the data of the packet being normal; and recording abnormal data locally and issuing an alarm in response to the data of the packet being abnormal.

[0013] Preferably, in one embodiment of the present invention, the step of recording abnormal data to the local machine and issuing an alarm in response to the abnormal data in the message further includes: in response to the abnormal data being abnormal, transmitting safety control data through the TRDP protocol to achieve linkage protection with the main control equipment and switching equipment of the train communication network.

[0014] Preferably, in one embodiment of the present invention, the bastion host function includes auditing and recording the operation and maintenance process of the maintenance equipment, wherein the operation and maintenance process of the maintenance equipment includes parsing file transfer protocols, remote access protocols and private protocols.

[0015] Preferably, in one embodiment of the present invention, the train proprietary protocol includes the TRDP protocol, and the step of parsing the messages and control data of the train proprietary protocol includes detecting the TRDP messages transmitted by the TRDP protocol.

[0016] Preferably, in one embodiment of the present invention, detecting the TRDP message transmitted by the TRDP protocol includes detecting the port, data length, and CRC check value of the TRDP message.

[0017] Preferably, in one embodiment of the present invention, the TRDP message includes the control data transmitted by the TRDP protocol, and the detection of the TRDP message transmitted by the TRDP protocol includes detecting the numerical range, data type, and data length of key fields of the control data.

[0018] Preferably, in one embodiment of the present invention, the train proprietary protocol includes the TTDP protocol, and the step of parsing the messages and control data of the train proprietary protocol includes detecting the data frames of the TTDP messages transmitted by the TTDP protocol.

[0019] Preferably, in one embodiment of the present invention, the data frame for detecting the TTDP message transmitted by the TTDP protocol includes detecting the MAC address, initial running state, and grouping number of the data frame.

[0020] Furthermore, the train network security protection system provided according to the second aspect of the present invention includes a memory and a processor. The memory stores computer instructions. The processor is connected to the memory and configured to execute the computer instructions stored in the memory to implement the train network security protection method provided in any of the above embodiments.

[0021] Furthermore, the computer-readable storage medium provided according to the third aspect of the present invention stores computer instructions. When the computer instructions are executed by a processor, the train network security protection method provided in any of the above embodiments is implemented. Attached Figure Description

[0022] The above-described features and advantages of the present invention will be better understood after reading the following detailed description of embodiments of the present disclosure in conjunction with the accompanying drawings. In the drawings, components are not necessarily drawn to scale, and components having similar related characteristics or features may have the same or similar reference numerals.

[0023] Figure 1 A schematic diagram of the existing train communication network architecture is shown;

[0024] Figure 2 A schematic diagram of a train network security protection system architecture provided according to some embodiments of the present invention is shown;

[0025] Figure 3 A schematic diagram of a train network security protection system architecture provided according to some embodiments of the present invention is shown; and

[0026] Figure 4 A flowchart of a train network security protection method provided according to some embodiments of the present invention is shown.

[0027] Figure label:

[0028] 100: Train communication network;

[0029] 101, 102, 103, 104: Ports;

[0030] 111, 112, 113: Safety equipment;

[0031] 121, 122: Communication equipment;

[0032] 123: Equipment maintenance;

[0033] 200, 300: Train network security protection system;

[0034] 210, 310: Memory;

[0035] 211: Computer-readable storage medium;

[0036] 220: Processor;

[0037] 311: Identity authentication module;

[0038] 312: Operation and Maintenance Management Module;

[0039] 313: Detection and processing module;

[0040] 314: Normal data processing module;

[0041] 315: Abnormal Data Processing Module;

[0042] 320: External system;

[0043] 330: Train communication network;

[0044] 400: Train network security protection methods; and

[0045] S410~S430: Steps. Detailed Implementation

[0046] The present invention will now be described in detail with reference to the accompanying drawings and specific embodiments. It should be noted that the aspects described below with reference to the accompanying drawings and specific embodiments are merely exemplary and should not be construed as limiting the scope of protection of the present invention in any way.

[0047] In the description of this invention, it should be noted that, unless otherwise explicitly specified and limited, the terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection of two components. Those skilled in the art can understand the specific meaning of the above terms in this invention based on the specific circumstances.

[0048] Furthermore, the terms "upper," "lower," "left," "right," "top," "bottom," "horizontal," and "vertical" used in the following description should be understood as the orientations shown in the relevant paragraphs and accompanying drawings. These relative terms are for illustrative purposes only and do not imply that the described apparatus must be manufactured or operated in a specific orientation, and therefore should not be construed as limiting the invention.

[0049] It is understood that although terms such as "first," "second," and "third" may be used herein to describe various components, regions, layers, and / or parts, these components, regions, layers, and / or parts should not be limited by these terms, and these terms are only used to distinguish different components, regions, layers, and / or parts. Therefore, the first components, regions, layers, and / or parts discussed below may be referred to as second components, regions, layers, and / or parts without departing from some embodiments of the present invention.

[0050] As mentioned above, existing train communication networks require the installation of various security devices to maintain network security while communicating with different external systems. However, the specific installation structure, size, and space limitations of train communication networks cannot accommodate the simultaneous installation of a wide variety of information security devices.

[0051] Furthermore, the information security equipment connected to the existing train communication network is defined by the corresponding national recommended standards or public safety industry standards. However, the information security equipment and the corresponding national and industry standards only implement or specify the detection of industrial control protocols commonly used in the industrial control field. They do not address message parsing and anomaly detection for the proprietary communication protocols in the train communication network, and therefore cannot meet the specific application scenario requirements of the train onboard network.

[0052] To overcome the aforementioned deficiencies in the existing technology, the present invention provides a train network security protection method, a train network security protection system, and a computer-readable storage medium, which can simultaneously realize multiple security protection functions, reduce the number of security devices and the size of the train communication network, and realize the parsing of train proprietary protocols, thereby achieving more efficient protection in rail transit on-board networks.

[0053] Please refer to Figure 2 , Figure 2 A schematic diagram of a train network security protection system architecture provided according to some embodiments of the present invention is shown.

[0054] In some non-limiting embodiments, the train network security protection method provided in the first aspect of the present invention can be implemented via the train network security protection system provided in the second aspect of the present invention. For example... Figure 2 As shown, the train network security protection system 200 may be configured with a memory 210 and a processor 220. The memory 210 includes, but is not limited to, the computer-readable storage medium 211 described in the third aspect of the present invention, which stores computer instructions thereon. The processor 220 is connected to the memory 210 and is configured to execute the computer instructions stored in the memory 210 to implement the train network security protection method provided in the first aspect of the present invention.

[0055] In a preferred embodiment, the train network security protection system provided in the second aspect of the present invention may include multiple program modules. These program modules may be stored in memory. The program modules include, but are not limited to, an operating system, one or more application programs, other program modules, and program data; each or some combination of these examples may include an implementation of a network environment. The program modules typically perform the functions and / or methods described in the embodiments of the present invention.

[0056] Please refer to Figure 3 , Figure 3 A schematic diagram of a train network security protection system architecture provided according to some embodiments of the present invention is shown.

[0057] like Figure 3 As shown, the train network security protection system 300 may include an identity authentication module 311, an operation and maintenance management module 312, a detection and processing module 313, a normal data processing module 314, and an abnormal data processing module 315. This train network security protection system 300 can communicate with external systems 320 and the train communication network 330. Furthermore, those skilled in the art will understand that the train network security protection system 300 can be part of the train communication network 330, or it can be one of the security devices externally connected to the train communication network 330.

[0058] The working principle of the above-mentioned train network security protection system will be described below with reference to some embodiments of train network security protection methods. Those skilled in the art will understand that these embodiments of train network security protection methods are merely non-limiting implementations provided by the present invention, intended to clearly demonstrate the main concepts of the invention and provide specific solutions convenient for public implementation, rather than limiting all functions or all working methods of the train network security protection system. Similarly, the train network security protection system is also only one non-limiting implementation provided by the present invention, and does not constitute a limitation on the executing entity and execution order of the steps in these train network security protection methods.

[0059] Please refer to Figure 4 , Figure 4 A flowchart of a train network security protection method provided according to some embodiments of the present invention is shown.

[0060] like Figure 4 As shown, the train network security protection method 400 may include step S410: authenticating the external system and identifying the device type and corresponding port of the external system.

[0061] Please combine Figure 3The train network security protection system 300 can authenticate with the external system 320 through the identity authentication module 311 to identify the device category and corresponding port of the external system 320 that poses a risk. The device categories of the external system 320 may include, but are not limited to, maintenance equipment and communication equipment. Maintenance equipment may include maintenance computers, and communication equipment may include ground systems and infotainment systems.

[0062] Train network security protection method 400 may also include:

[0063] Step S420: In response to the external system's device category being a maintenance device, enable the bastion host function; and

[0064] Execution step S430: In response to the fact that the device category of the external system is a communication device, based on the configuration of the corresponding port, enable the security audit and intrusion detection function or firewall function. Enabling the security audit and intrusion detection function or firewall function includes parsing the messages and control data of the train proprietary protocol.

[0065] When the device category of the external system 320 is identified as maintenance equipment, the train network security protection system 300 can enable the bastion host function of the operation and maintenance management module 312. The bastion host function can monitor and record the operational behavior of the maintenance equipment on various devices (e.g., servers, network devices, security devices, databases) in the train communication network 330, thereby enabling auditing and recording of the operation and maintenance process. Figure 3 In the illustrated embodiment, the audit and recording data of the operation and maintenance process can be further processed by the normal data processing module 314 and then sent to the train communication network 330.

[0066] When the device category identification result of external system 320 is a communication device, train network security protection system 300 can select to enable the security audit and intrusion detection function or the firewall function of detection processing module 313 based on the configuration of the corresponding port. The security audit and intrusion detection function can be used to bypass auditable data streams from communication devices for auditing purposes. The firewall function can filter and process data by detecting messages from communication devices, such as processing data at the vehicle-to-ground boundary or PIS (Passenger Information System) boundary.

[0067] The aforementioned bastion host functions, security audit and intrusion detection functions, and firewall functions can realize different network security functions at different levels. For more specific functions, please refer to standards such as GB / T 37933, GB / T 37941, and GA / T 1394.

[0068] When the corresponding port is configured as a bypass, the security audit and intrusion detection functions of the detection and processing module 313 are enabled to audit the data flow of the communication device. When the corresponding port is configured as a route, the firewall function of the detection and processing module 313 is enabled to detect the packets of the communication device.

[0069] Those skilled in the art will understand that the train network security protection system 300 provided by the present invention can not only achieve security protection for data from external system 320 entering the train communication network 330, but also achieve security protection when data from the train communication network 330 is sent to external system 320 in the same way.

[0070] In this way, the train network security protection system 300 can simultaneously realize the functions of multiple traditional information security protection devices, while reducing the number of security devices and the size and cost of the train communication network.

[0071] Existing security devices with firewall functionality and those with security auditing and intrusion detection capabilities primarily parse messages for general industrial control protocols (such as Modbus / TCP and IEC104), but cannot parse messages for train-specific protocols. Existing security devices with bastion host functionality primarily parse messages for common remote access or file transfer protocols such as FTP (File Transfer Protocol), SFTP (Secret File Transfer Protocol), TELNET (Remote Login Protocol), and SSH (Secure Shell), but cannot parse messages for proprietary protocols (such as proprietary UDP / TCP protocols).

[0072] The operation and maintenance management module 312 of the train network security protection system 300 provided by the present invention can install maintenance software for private protocols to parse the command line fields of private protocols, so as to realize the parsing of file transfer protocols, remote access protocols and private protocols.

[0073] In addition, the detection and processing module 313 of the train network security protection system 300 can parse the messages of the train proprietary protocol when the security audit and intrusion detection function or the firewall function is enabled.

[0074] Here, train-specific protocols can include TRDP (Train Real-time Data Protocol) and TTDP (Train Topology Discovery Protocol). TRDP is a train-specific protocol based on UDP, defined by the GB / T 28029.4 standard, primarily used for the exchange of control data between various systems within the train communication network. Control data between train main control equipment, traction system, braking system, displays, and other devices are transmitted using the TRDP protocol, with each type of control data encapsulated in a specific TRDP port. Additionally, the TTDP protocol, defined by the GB / T 28029.6 standard, can be used to achieve automatic discovery and re-networking of multiple trains in coupled operations (e.g., connecting multiple short trains to form a long train).

[0075] Specifically, when processing packets, the detection and processing module 313 can perform checks on TRDP packets based on the UDP port (port number can be 17224) defined in GB / T28029.4, in addition to the usual checks on source IP address, destination IP address, source port, destination port, protocol type, traffic size, and virus detection. More preferably, the detection and processing module 313 can also check on TTDP data frames defined in GB / T 28029.6.

[0076] The detection of TRDP messages transmitted via the TRDP protocol can include detecting the port ComId, data length datasetLength, and CRC (Cyclic Redundancy Check) headerCRC value of the TRDP message. When the detection processing module 313 detects an unplanned port, an abnormal data length, or an incorrect CRC check value, it indicates that the detected data is abnormal. The abnormal data processing module 315 can record the abnormal data locally and issue an alarm, and will no longer forward the abnormal data to the train communication network 330.

[0077] The detection of data frames in TTDP messages transmitted via the TTDP protocol can include detecting the values ​​of fields such as the MAC (Medium Access Control) address, initial operating status, and number of trains. When the detection processing module 313 detects abnormal data, it can transfer the abnormal data to the abnormal data processing module 315 for processing, and will not forward the abnormal data to the train communication network 330.

[0078] In addition, the information security equipment connected to the existing train communication network can usually only parse general application layer protocols, and cannot parse private protocols for train control data, nor can it link with other train equipment.

[0079] The TRDP message transmitted via the TRDP protocol may include control data transmitted by the TRDP protocol. The detection and processing module 313 of the train network security protection system 300 provided by this invention can also detect the control data, specifically including detecting the numerical range, data type, and data length of key fields of the control data. When the parsed control data is normal data, it is transferred to the normal data processing module 314 for processing; when the parsed control data is abnormal data, it is transferred to the abnormal data processing module 315 for processing.

[0080] Specifically, the detection processing module 313 can be configured with numerical ranges for specific TRDP port application fields. When the value of the corresponding field in a received TRDP message is outside the configured range, the parsed control data is identified as abnormal data. Furthermore, the detection processing module 313 can be further configured to define the normal standards for control data. For example, a secondary development program module or instruction can be embedded as a detection engine in the detection processing module 313 to limit the data range, data type, and data length. When the value of the corresponding field in a received TRDP message does not meet the defined requirements, the parsed control data is determined to be abnormal data.

[0081] Thus, the train network security protection system 300 can perform in-depth analysis of TRDP and TTDP protocol messages, meeting the requirements for train communication data protection and reconnection data protection. The train network security protection system 300 provided by this invention can detect and analyze train-specific protocols and control data, overcoming the shortcomings of traditional information security equipment in the rail transit field. It is more suitable for rail transit onboard networks and can achieve more efficient protection.

[0082] Furthermore, when the detection and processing module 313 is configured to use the firewall function, if the detection result of the data in response to the message is normal, the normal data processing module 314 processes the normal data and then forwards it to the train communication network for normal communication; if the detection result of the data in response to the message is abnormal, the abnormal data processing module 315 identifies the risk of the abnormal data, records it locally, and issues an alarm.

[0083] Furthermore, the train network security protection system provided by the present invention can transmit control data through train proprietary protocols. For example, the abnormal data processing module 315 of the train network security protection system 300 can analyze abnormal data including control data transmitted by the TRDP protocol. In addition, the train network security protection system 300 can transmit control data to the train communication network 330 through the TRDP protocol to achieve guidance safety.

[0084] Specifically, when the abnormal data identified by the abnormal data processing module 315 is high-risk abnormal control data, the abnormal data processing module 315 records the high-risk abnormal control data locally and issues an alarm. Furthermore, the train network security protection system 300 can transmit safety control data to the train communication network 330 via the TRDP protocol to achieve linkage with onboard equipment, operate the main control equipment and switching equipment, and thus perform guided safety operations. The linkage protection of the train network security protection system 300 may include, but is not limited to, audible and visual alarms on displays or main control equipment, abnormal switch port closure, abnormal data recording, and traction or braking system risk warnings. Thus, the train network security protection system 300 achieves linkage protection with the main control equipment and switching equipment connected to the train communication network 330.

[0085] For example, in a non-limiting embodiment, the train network security protection system 300 receives control data transmitted via the TRDP protocol, which instructs the train to increase its speed to 450 km / h. The detection and processing module 313 of the train network security protection system 300 identifies this control data as high-risk abnormal control data. Subsequently, the train network security protection system 300 can send safety control data to the train communication network 330, which can instruct the train to maintain its speed below 300 km / h.

[0086] Therefore, the train network security protection system 300 can judge and identify risks in the key fields of the traffic and control data of critical equipment, and can carry out linkage protection with other equipment of the train when the control data is abnormal.

[0087] Those skilled in the art will understand that the train network security protection system proposed in this invention is not limited to a specific physical structure; it can be a module, a plug-in single board, or multiple plug-ins within a chassis. If the train network security protection system proposed in this invention is composed of multiple plug-ins within a chassis, the received packets can flow between the plug-ins, but there is only one external interface. The train network security protection system proposed in this invention embodies a high degree of functional integration, thereby reducing the number of ports and the difficulty of installation and deployment. Furthermore, Figure 3The implementation of the multiple program modules shown can also take many forms. They can be implemented by a single software or by a plugin plus corresponding software.

[0088] Although the methods described above are illustrated and depicted as a series of actions for the sake of simplicity, it should be understood and appreciated that these methods are not limited by the order of the actions, as some actions may occur in a different order and / or concurrently with other actions from the illustrations and descriptions herein or not illustrated and described herein but which may be understood by those skilled in the art, according to one or more embodiments.

[0089] Those skilled in the art will understand that information, signals, and data can be represented using any of a variety of different techniques and arts. For example, the data, instructions, commands, information, signals, bits, symbols, and chips described throughout the above description can be represented by voltage, current, electromagnetic waves, magnetic fields or magnetic particles, light fields or optical particles, or any combination thereof.

[0090] Those skilled in the art will further appreciate that the various illustrative logic blocks, modules, circuits, and algorithm steps described in conjunction with the embodiments disclosed herein can be implemented as electronic hardware, computer software, or a combination of both. To clearly illustrate this interchangeability between hardware and software, the various illustrative components, blocks, modules, circuits, and steps are described above in a generalized manner in terms of their functionality. Whether such functionality is implemented as hardware or software depends on the specific application and the design constraints imposed on the overall system. Those skilled in the art may implement the described functionality in different ways for each specific application, but such implementation decisions should not be construed as departing from the scope of the invention.

[0091] The various illustrative logic modules and circuits described in conjunction with the embodiments disclosed herein may be implemented or performed using a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. The general-purpose processor may be a microprocessor, but in alternatives, it may be any conventional processor, controller, microcontroller, or state machine. The processor may also be implemented as a combination of computing devices, such as a combination of a DSP and a microprocessor, multiple microprocessors, one or more microprocessors cooperating with a DSP core, or any other such configuration.

[0092] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein may be embodied directly in hardware, in a software module executed by a processor, or in a combination of both. The software module may reside in RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art. An exemplary storage medium is coupled to a processor such that the processor can read and write information to / from the storage medium. In an alternative, the storage medium may be integrated into the processor. The processor and storage medium may reside in an ASIC. The ASIC may reside in a user terminal. In an alternative, the processor and storage medium may reside as discrete components in the user terminal.

[0093] In one or more exemplary embodiments, the described functionality may be implemented in hardware, software, firmware, or any combination thereof. If implemented in software as a computer program product, the functionality may be stored or transmitted as one or more instructions or code on or through a computer-readable medium. A computer-readable medium includes both computer storage media and communication media, encompassing any medium that facilitates the transfer of a computer program from one location to another. A storage medium may be any available medium accessible to a computer. By way of example and not limitation, such a computer-readable medium may include RAM, ROM, EEPROM, CD-ROM or other optical disc storage, disk storage or other magnetic storage devices, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and is accessible to a computer. Any connection is also legitimately referred to as a computer-readable medium. For example, if the software is transmitted from a website, server, or other remote source using coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), or wireless technologies such as infrared, radio, and microwave, then the coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technologies such as infrared, radio, and microwave are included in the definition of a medium. As used in this article, disk and disc include compact discs (CDs), laser discs, optical discs, digital multi-purpose discs (DVDs), floppy disks, and Blu-ray discs. Disks typically reproduce data magnetically, while discs reproduce data optically using lasers. Combinations of these should also be included within the scope of computer-readable media.

[0094] The prior description of this disclosure is provided to enable any person skilled in the art to make or use this disclosure. Various modifications to this disclosure will be apparent to those skilled in the art, and the general principles defined herein may be applied to other variations without departing from the spirit or scope of this disclosure. Therefore, this disclosure is not intended to be limited to the examples and designs described herein, but should be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for securing a train network, the method comprising: The method comprises the steps of: carrying out identity authentication on an external system, identifying a device category and a corresponding port of the external system; enabling a bastion function in response to the device category of the external system being a maintenance device; and enabling a security audit and intrusion detection function or a firewall function based on a configuration of the corresponding port in response to the device category of the external system being a communication device, the enabling of the security audit and intrusion detection function or the firewall function comprising analysis of messages of a train-specific protocol and control data thereof.

2. The train network security protection method of claim 1, wherein, The step of enabling the security audit and intrusion detection function or the firewall function based on the configuration of the corresponding port in response to the device category of the external system being a communication device comprises: when the configuration of the corresponding port is bypass, enabling the security audit and intrusion detection function to audit data flow of the communication device; and when the configuration of the corresponding port is routing, enabling the firewall function to detect messages of the communication device.

3. The train network security protection method of claim 2, wherein, The step of enabling the firewall function to detect messages of the communication device when the configuration of the corresponding port is routing comprises: in response to data of the messages being normal, forwarding normal data to a train communication network; and in response to data of the messages being abnormal, recording abnormal data locally and alarming.

4. The train network security protection method of claim 3, wherein, The step of recording abnormal data locally and alarming in response to data of the messages being abnormal further comprises: in response to the abnormal data being abnormal control data, transmitting secure control data through a TRDP protocol to achieve linkage protection with a host device and a switching device of the train communication network.

5. The method of claim 1, wherein, The bastion function comprises auditing and recording an operation and maintenance process of the maintenance device, the operation and maintenance process of the maintenance device comprising analysis of a file transfer protocol, a remote access protocol and a private protocol.

6. The train network security protection method of claim 1, wherein, The train-specific protocol comprises a TRDP protocol, and the step of analyzing messages of a train-specific protocol and control data thereof comprises detecting TRDP messages transmitted by the TRDP protocol.

7. The train network security protection method of claim 6, wherein, The detection of the TRDP messages transmitted by the TRDP protocol comprises detection of a port, data length and CRC check value of the TRDP messages.

8. The method of claim 6, wherein, The TRDP messages comprise the control data transmitted by the TRDP protocol, and the detection of the TRDP messages transmitted by the TRDP protocol comprises detection of a value range, data type and data length of a key field of the control data.

9. The train network security protection method of claim 1 or 6, wherein, The train-specific protocol comprises a TTDP protocol, and the step of analyzing messages of a train-specific protocol and control data thereof comprises detection of a data frame of TTDP messages transmitted by the TTDP protocol.

10. The method of claim 9, wherein, The detection of the data frame of the TTDP messages transmitted by the TTDP protocol comprises detection of a MAC address, initial operation state and grouping quantity of the data frame.

11. A train network security protection system, characterized by, The method comprises: a memory having computer instructions stored thereon; and a processor connected to the memory and configured to execute the computer instructions stored on the memory to implement the train network security protection method according to any one of claims 1 to 10.

12. A computer readable storage medium having stored thereon computer instructions, wherein, The computer instructions, when executed by a processor, implement the train network security protection method according to any one of claims 1-10.

Images