Industrial control system-based host peripheral protection method and device

Abstract

The invention belongs to the technical field of nuclear power, and particularly relates to a host peripheral protection method and device based on an industrial control system. According to the host peripheral protection method based on the industrial control system provided by the invention, the construction of an integrated external interface security protection system is taken as a core, a data transfer platform is deployed outside the industrial control equipment, and the industrial control equipment is connected through interface lines such as a USB (Universal Serial Bus), a serial port and the like. The industrial control equipment can be protected without any modification, so that the industrial control equipment operates independently, system resources are not occupied, the reliability of the industrial control equipment is not influenced, and meanwhile, the virus protection engine is arranged, so that virus detection and killing of data flowing into the industrial control equipment are realized.

Description

Technical Field

[0001] This invention belongs to the field of nuclear power technology, specifically relating to a method and device for protecting host peripherals based on an industrial control system. Background Technology

[0002] Due to the unique hardware, software, and network architecture of nuclear power plant control systems (DCS), which are physically isolated from external networks, cybersecurity attacks against DCS systems are often caused by improper peripheral device management and human error leading to internal malware infection. Mainstream host protection software cannot effectively address the key protection points and pain points of industrial control systems. Therefore, it is urgent to minimize the impact on industrial control systems and maximize their protection against cyberattacks. This invention, based on the unique network architecture and defense challenges of industrial control systems, designs a host peripheral protection method for industrial control systems, achieving security protection at the DCS system host data transfer level. Summary of the Invention

[0003] To overcome the problems existing in related technologies, a method and device for protecting host peripherals based on industrial control systems are provided.

[0004] According to one aspect of the present disclosure, a host peripheral protection method based on an industrial control system is provided, the method comprising:

[0005] Step 1: Through the business data security module, the core data of the industrial control system is encrypted, isolated, transmitted with encryption, and destroyed throughout its entire lifecycle.

[0006] Step 2: Through the mobile media fine-grained management and control module, USB devices connected to the industrial control system are centrally registered, authorized, channel isolated, and their behavior monitored.

[0007] Step 3: Through the trusted data exchange module, in a physically isolated environment, the data exchanged between the industrial control equipment and the user terminal is approved, deeply analyzed, and trusted for transmission.

[0008] Step 4: Perform a deep virus scan and malware detection on removable media and exchange files using the virus detection module;

[0009] Step 5: Record the entire operation interface of the industrial control host in real time through the host operation screen recording audit module.

[0010] Step 6: Monitor and record the remote network operation and maintenance behavior of the industrial control host through the network operation and maintenance behavior audit module;

[0011] Step 7: Monitor abnormal events in the industrial control network in real time and issue alarms through the equipment anomaly alarm module.

[0012] In one possible implementation, step 1 includes:

[0013] Step 11: Use an asymmetric encryption mechanism with a user-unique key to encrypt and store static data;

[0014] Step 12: Store the data of different users in separate encrypted storage spaces;

[0015] Step 13: Encrypt the transmission of business data based on HTTPS protocol and SSL / TLS encryption;

[0016] Step 14: At the end of the business process, clear and destroy the temporary data.

[0017] In one possible implementation, step 2 includes:

[0018] Step 21: Physically isolate the transmission channels of USB storage devices from those of non-storage devices;

[0019] Step 22: Centralize the registration and authentication management of USB flash drives used in the business site, and only registered mobile storage media can be used.

[0020] Step 23: Perform centralized registration and authentication of USB removable storage media and non-storage USB removable media, and only allow registered media to be used;

[0021] Step 24: Redirect the connected non-storage peripheral to a read-only USB storage device and automatically record and audit the operation.

[0022] Step 25: Perform in-depth analysis of the behavior of the USB media to monitor and prevent BAD USB attacks and USB Killer attacks;

[0023] Step 26: Perform one-to-one binding authorization based on the attributes of the host and the USB media.

[0024] In one possible implementation, step 3 includes:

[0025] Step 31: Through the transfer method, an approval process is executed for all imported and exported data, and a deep detection of viruses and Trojans is performed. At the same time, auditing is carried out based on the blacklist and whitelist mechanism and full screen recording.

[0026] Step 32: Perform deep analysis on the exchanged data files to identify and block disguised viruses, Trojans, and sensitive files;

[0027] Step 33: Encapsulate the imported and exported data and build a trusted transmission system based on legitimate users, trusted media, and controlled files.

[0028] In one possible implementation, step 4 includes:

[0029] Step 41: Use the integrated third-party antivirus software engine to scan and remove viruses from the data copied into the industrial control system via USB storage medium;

[0030] Step 42: Use at least one of the following methods—multi-engine, sandbox, and Yara rules—to perform reputation detection and analysis on the file in order to obtain information about the type of malicious file.

[0031] In one possible implementation, step 5 includes:

[0032] Step 51: Record the user's operation behavior on the industrial control host in real time in the form of video. The operation behavior includes mouse clicks, importing and exporting USB storage devices, and serial communication.

[0033] Step 52: Store the entire screen recording data for post-incident tracing after a security incident.

[0034] In one possible implementation, step 6 includes:

[0035] Step 61: Perform deep analysis on the traffic data packets transmitted by the industrial control host to identify abnormal behavior traffic and abnormal access traffic;

[0036] Step 62: Perform full screen recording audit of the network remote operation and maintenance behavior of the industrial control system server.

[0037] In one possible implementation, step 7 includes:

[0038] Step 71: When the external computer interface security protection platform is illegally disconnected, alarms are generated simultaneously on both the platform side and the server side.

[0039] Step 72: Issue alarms and block any unauthorized access to the industrial control system via USB media or serial devices;

[0040] Step 73: The equipment performs self-checks regularly and issues an alarm when it detects a fault.

[0041] According to another aspect of the present disclosure, a host peripheral protection device based on an industrial control system is provided, the device comprising:

[0042] The business data security module is used to implement encrypted storage, isolated storage, encrypted transmission, and data destruction of the core data of the industrial control system throughout its entire lifecycle.

[0043] The mobile media fine-grained management and control module is used for centralized registration, authorization, channel isolation and behavior monitoring of USB devices connected to the industrial control system;

[0044] The trusted data exchange module is used to approve, deeply analyze, and reliably transmit data exchanged between industrial control equipment and user terminals in a physically isolated environment.

[0045] The virus detection module is used for deep virus scanning and malicious code detection on removable media and exchange files;

[0046] The host operation screen recording and auditing module is used to record the entire operation interface of the industrial control host in real time.

[0047] The network operation and maintenance behavior audit module is used to monitor and record the remote network operation and maintenance behavior of industrial control hosts;

[0048] The equipment anomaly alarm module is used to monitor abnormal events in the industrial control network in real time and issue alarms.

[0049] According to another aspect of the present disclosure, a host peripheral protection device based on an industrial control system is provided, the device comprising:

[0050] processor;

[0051] Memory used to store processor-executable instructions;

[0052] The processor is configured to execute the above-described method.

[0053] According to another aspect of the present disclosure, a non-volatile computer-readable storage medium is provided, on which computer program instructions are stored, which, when executed by a processor, implement the above-described method.

[0054] The beneficial effects of this disclosure are as follows: The host peripheral protection method based on industrial control systems provided in this disclosure takes the construction of an integrated external interface security protection system as its core. A data transfer platform is deployed outside the industrial control equipment and connected to the equipment via USB, serial ports, or other interface cables. Protection can be achieved without any modification to the industrial control equipment, allowing it to operate independently without consuming system resources or affecting its reliability. It also includes a built-in virus protection engine (and can integrate third-party antivirus software) to detect and remove viruses from data flowing into the industrial control equipment. Thus, this disclosure achieves unified secure takeover and control of industrial control peripherals through an external computer interface security protection system via direct connection, effectively blocking the spread of viruses through media such as USB flash drives, preventing the leakage of core data, and meeting the compliance requirements of independent controllability. Attached Figure Description

[0055] Figure 1 This is a flowchart illustrating a host peripheral protection method based on an industrial control system, as shown in an embodiment of this disclosure.

[0056] Figure 2 This is a block diagram of a host peripheral protection device based on an industrial control system, as shown in an embodiment of this disclosure. Detailed Implementation

[0057] The present disclosure will now be described in further detail with reference to the accompanying drawings and specific embodiments.

[0058] Unless otherwise defined, the technical and scientific terms used in this disclosure have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure pertains; the terminology used in this disclosure is for the purpose of describing particular embodiments only and is not intended to be limiting of this disclosure; the term "comprising" and any variations thereof in this disclosure are intended to cover non-exclusive inclusion. Clearly, the embodiments described in this disclosure are only a part of the embodiments of this disclosure, and not all of them. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of this disclosure without inventive effort are within the scope of protection of this disclosure.

[0059] In this disclosure, the reference to "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this disclosure. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0060] Figure 1 This is a flowchart illustrating a host peripheral protection method based on an industrial control system, as shown in an embodiment of this disclosure. The method can be executed by a terminal device, which can be a server, desktop computer, laptop computer, tablet computer, etc. The terminal device can also be, for example, a user device, in-vehicle device, or wearable device, etc. This disclosure does not limit the type of terminal device. Figure 1 As shown, the method includes:

[0061] Step 1: Through the business data security module, the core data of the industrial control system is encrypted, isolated, transmitted with encryption, and destroyed throughout its entire lifecycle.

[0062] As an example of this embodiment, in step 1, through static data encryption, isolated data storage, transmission encryption, and data destruction by the business data security module, in-depth protection is implemented throughout the entire lifecycle of the core data of the industrial control system, from creation and storage to transfer and destruction, thereby reducing the risk of data leakage. Step 1 may include:

[0063] Step 11, Static Data Protection: An asymmetric encryption mechanism using a user-unique key is used to encrypt and store static data in the industrial control system.

[0064] Step 12, User Data Isolation: User data from different industrial control systems is stored in different storage spaces and encrypted.

[0065] Step 13, Data Transmission Encryption: All business data communication of the industrial control system is protected by HTTPS security protocol encryption. Industry-standard SSL / TLS encryption is used for internal communication between the user and server, and between the protection terminal and the server.

[0066] Step 14, Data Destruction: When the business process ends, temporary data will be promptly cleared and destroyed in accordance with industry standard practices.

[0067] Step 2 involves centralized registration, authorization control, and security testing via mobile media to achieve refined management of data interfaces and strictly prevent data leakage in industrial control environments. Step 2 may include:

[0068] Step 21, USB transmission channel isolation: Physically isolate the pathways of USB storage devices and non-storage devices;

[0069] Step 22, USB removable storage media registration: Centralized registration and authentication management of USB flash drives used in the business site, and only registered removable storage media can be used;

[0070] Step 23, Registration of non-storage USB removable media: Centralized registration and authentication management of USB keyboards, mice, external optical drives, etc. used in the business site;

[0071] Step 24, USB peripheral protocol conversion: Redirect the connected external device to the USB storage device and ensure that it can only be in read-only mode. At the same time, all operations are automatically recorded and audited.

[0072] Step 25, USB attack detection and protection: Perform in-depth analysis and monitoring of the behavior of USB media to prevent APT attacks such as BADUSB attacks and USB Killer attacks;

[0073] Step 21, USB removable storage media authorization: Authorize and manage USB registered media, and bind and authorize the host and USB media one-to-one according to different attributes (importance, device security level, user department);

[0074] Step 3, Trusted Data Exchange: Through the platform's device-side and user-side data exchange system environment, all direct data connection and exchange channels between users and host devices are blocked. This achieves physical isolation while performing deep analysis of the exchanged data to prevent the presence of Trojan virus files, ensuring that critical manufacturing data is shared without leaking original sensitive information. Step 3 includes:

[0075] Step 31, data exchange in a transfer manner: all imported and exported data undergoes approval and strict deep detection of viruses and Trojans, and is audited based on a blacklist / whitelist mechanism and full screen recording.

[0076] Step 32, Deep File Analysis: Perform deep analysis on the data exchanged between host devices to identify and block disguised viruses, Trojans, and sensitive files;

[0077] Step 33, Data Encapsulation: Encapsulate and reliably transmit the data imported and exported by the host device, and build a reliable data exchange system using multiple mechanisms such as legitimate users, trusted media, and controlled files.

[0078] Step 4, Virus Detection: Deep virus scanning and malware detection are performed on removable media and files to effectively identify and remove viruses, Trojans, and other threats, ensuring the security of industrial control host data. Step 4 includes:

[0079] Step 41, Dedicated Virus Engine: By integrating certified third-party antivirus software, this step enables virus scanning and removal of data copied to the industrial control system from USB storage media.

[0080] Step 42, File Reputation Detection: Through multi-engine, sandbox, Yara rules and other detection and analysis methods, more comprehensive and accurate information such as the type of malicious files can be obtained.

[0081] Step 5, Host Operation Screen Recording and Auditing Module: This module records the entire operation interface of the industrial control host in real time, enabling traceability and auditability of operational behavior. Step 5 includes:

[0082] Step 51, Real-time monitoring: The entire process of the user's important operations on the host (such as mouse clicks, importing and exporting USB storage devices, serial communication, etc.) is recorded by video.

[0083] Step 52, Post-incident tracing: All important operations of the industrial control host are recorded in their entirety, allowing for rapid post-incident tracing after a security incident.

[0084] Step 6, Network Operation and Maintenance Behavior Audit Function Module: This module monitors and records the entire process of operation and maintenance personnel's actions on the industrial control host (such as commands, logins, file transfers, etc.). Step 6 includes:

[0085] Step 61, Network Protocol Identification: By performing deep analysis of the traffic data packets transmitted by the industrial control host, abnormal behavior traffic and abnormal access traffic are identified.

[0086] Step 62, Behavior Audit: Perform full screen recording audit of the network remote operation and maintenance behavior of host devices such as industrial control system servers.

[0087] Step 7, Device Anomaly Alarm: Real-time monitoring of abnormal traffic, unauthorized device access, illegal commands, and virus behavior within the industrial control network, and immediate alarm and log recording. Step 7 includes:

[0088] Step 71, Protection Terminal Connection Disconnection Alarm: When the external computer interface security protection platform is illegally disconnected from the host, both the platform side and the server side will issue an alarm.

[0089] Step 72, Unauthorized Device Access Alarm: Alarms and blocks all unauthorized access to the industrial control system by unauthorized USB media, serial devices, etc.

[0090] Step 73, Fault Alarm: The equipment performs regular self-checks and promptly issues an alarm if it detects a fault.

[0091] In one possible implementation, a host peripheral protection device based on an industrial control system is provided, the device comprising:

[0092] The business data security module is used to implement encrypted storage, isolated storage, encrypted transmission, and data destruction of the core data of the industrial control system throughout its entire lifecycle.

[0093] The mobile media fine-grained management and control module is used for centralized registration, authorization, channel isolation and behavior monitoring of USB devices connected to the industrial control system;

[0094] The trusted data exchange module is used to approve, deeply analyze, and reliably transmit data exchanged between industrial control equipment and user terminals in a physically isolated environment.

[0095] The virus detection module is used for deep virus scanning and malicious code detection on removable media and exchange files;

[0096] The host operation screen recording and auditing module is used to record the entire operation interface of the industrial control host in real time.

[0097] The network operation and maintenance behavior audit module is used to monitor and record the remote network operation and maintenance behavior of industrial control hosts;

[0098] The equipment anomaly alarm module is used to monitor abnormal events in the industrial control network in real time and issue alarms.

[0099] The description of the above-mentioned apparatus has been elaborated in detail in the description of the above-mentioned method, and will not be repeated here.

[0100] Figure 2 This is a block diagram illustrating a host peripheral protection device based on an industrial control system, as shown in an embodiment of this disclosure. For example, device 1900 can be provided as a server. See also... Figure 2The apparatus 1900 includes a processing component 1922, which further includes one or more processors, and memory resources represented by memory 1932 for storing instructions, such as application programs, that can be executed by the processing component 1922. The application programs stored in memory 1932 may include one or more modules, each corresponding to a set of instructions. Furthermore, the processing component 1922 is configured to execute instructions to perform the methods described above.

[0101] Device 1900 may also include a power supply component 1926 configured to perform power management of device 1900, a wired or wireless network interface 1950 configured to connect device 1900 to a network, and an input / output (I / O) interface 1958. Device 1900 can operate on an operating system stored in memory 1932, such as Windows Server™, MacOS X™, Unix™, Linux™, FreeBSD™, or similar.

[0102] In an exemplary embodiment, a non-volatile computer-readable storage medium is also provided, such as a memory 1932 including computer program instructions that can be executed by a processing component 1922 of the device 1900 to perform the above-described method.

[0103] This disclosure can be a system, method, and / or computer program product. A computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for causing a processor to implement various aspects of this disclosure.

[0104] Computer-readable storage media can be tangible devices capable of holding and storing instructions for use by an instruction execution device. Computer-readable storage media can be, for example—but not limited to—electrical storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any suitable combination thereof. More specific examples (a non-exhaustive list) of computer-readable storage media include: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disc read-only memory (CD-ROM), digital multifunction disc (DVD), memory sticks, floppy disks, mechanical encoding devices, such as punch cards or recessed protrusions storing instructions thereon, and any suitable combination thereof. The computer-readable storage media used herein are not to be construed as transient signals themselves, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (e.g., light pulses through fiber optic cables), or electrical signals transmitted through wires.

[0105] The computer-readable program instructions described herein can be downloaded from computer-readable storage media to various computing / processing devices, or downloaded via a network, such as the Internet, local area network, wide area network, and / or wireless network, to an external computer or external storage device. The network may include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards them to the computer-readable storage media in the respective computing / processing device.

[0106] Computer program instructions used to perform the operations of this disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, status setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk, C++, etc., and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The computer-readable program instructions may execute entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, electronic circuitry, such as programmable logic circuitry, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), is personalized by utilizing the status information of the computer-readable program instructions to implement various aspects of this disclosure.

[0107] Various aspects of this disclosure are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0108] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that, when executed by the processor of the computer or other programmable data processing apparatus, they create means for implementing the functions / actions specified in one or more blocks of the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium that causes a computer, programmable data processing apparatus, and / or other device to operate in a particular manner; thus, the computer-readable medium storing the instructions comprises an article of manufacture that includes instructions for implementing aspects of the functions / actions specified in one or more blocks of the flowchart and / or block diagram.

[0109] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to perform the functions / actions specified in one or more boxes of a flowchart and / or block diagram.

[0110] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of an instruction containing one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions marked in the blocks may occur in a different order than those shown in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0111] The various embodiments of this disclosure have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen to best explain the principles, practical application, or improvement of the technology in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A method for protecting host peripherals based on an industrial control system, characterized in that, The method includes: Step 1: Through the business data security module, the core data of the industrial control system is encrypted, isolated, transmitted with encryption, and destroyed throughout its entire lifecycle. Step 2: Through the mobile media fine-grained management and control module, USB devices connected to the industrial control system are centrally registered, authorized, channel isolated, and their behavior monitored. Step 3: Through the trusted data exchange module, in a physically isolated environment, the data exchanged between the industrial control equipment and the user terminal is approved, deeply analyzed, and trusted for transmission. Step 4: Perform a deep virus scan and malware detection on removable media and exchange files using the virus detection module; Step 5: Record the entire operation interface of the industrial control host in real time through the host operation screen recording audit module. Step 6: Monitor and record the remote network operation and maintenance behavior of the industrial control host through the network operation and maintenance behavior audit module; Step 7: Monitor abnormal events in the industrial control network in real time and issue alarms through the equipment anomaly alarm module.

2. The method according to claim 1, characterized in that, Step 1 includes: Step 11: Use an asymmetric encryption mechanism with a user-unique key to encrypt and store static data; Step 12: Store the data of different users in separate encrypted storage spaces; Step 13: Encrypt the transmission of business data based on HTTPS protocol and SSL / TLS encryption; Step 14: At the end of the business process, clear and destroy the temporary data.

3. The method according to claim 1, characterized in that, Step 2 includes: Step 21: Physically isolate the transmission channels of USB storage devices from those of non-storage devices; Step 22: Centralize the registration and authentication management of USB flash drives used in the business site, and only registered mobile storage media can be used. Step 23: Perform centralized registration and authentication of USB removable storage media and non-storage USB removable media, and only allow registered media to be used; Step 24: Redirect the connected non-storage peripheral to a read-only USB storage device and automatically record and audit the operation. Step 25: Perform in-depth analysis of the behavior of the USB media to monitor and prevent BAD USB attacks and USB Killer attacks; Step 26: Perform one-to-one binding authorization based on the attributes of the host and the USB media.

4. The method according to claim 1, characterized in that, Step 3 includes: Step 31: Through the transfer method, an approval process is executed for all imported and exported data, and a deep detection of viruses and Trojans is performed. At the same time, auditing is carried out based on the blacklist and whitelist mechanism and full screen recording. Step 32: Perform deep analysis on the exchanged data files to identify and block disguised viruses, Trojans, and sensitive files; Step 33: Encapsulate the imported and exported data and build a trusted transmission system based on legitimate users, trusted media, and controlled files.

5. The method according to claim 1, characterized in that, Step 4 includes: Step 41: Use the integrated third-party antivirus software engine to scan and remove viruses from the data copied into the industrial control system via USB storage medium; Step 42: Use at least one of the following methods—multi-engine, sandbox, and Yara rules—to perform reputation detection and analysis on the file in order to obtain information about the type of malicious file.

6. The method according to claim 1, characterized in that, Step 5 includes: Step 51: Record the user's operation behavior on the industrial control host in real time in the form of video. The operation behavior includes mouse clicks, importing and exporting USB storage devices, and serial communication. Step 52: Store the entire screen recording data for post-incident tracing after a security incident.

7. The method according to claim 1, characterized in that, Step 6 includes: Step 61: Perform deep analysis on the traffic data packets transmitted by the industrial control host to identify abnormal behavior traffic and abnormal access traffic; Step 62: Perform full screen recording audit of the network remote operation and maintenance behavior of the industrial control system server.

8. The method according to claim 1, characterized in that, Step 7 includes: Step 71: When the external computer interface security protection platform is illegally disconnected, alarms are generated simultaneously on both the platform side and the server side. Step 72: Issue alarms and block any unauthorized access to the industrial control system via USB media or serial devices; Step 73: The equipment performs self-checks regularly and issues an alarm when it detects a fault.

9. A host peripheral protection device based on an industrial control system, characterized in that, The device includes: The business data security module is used to implement encrypted storage, isolated storage, encrypted transmission, and data destruction of the core data of the industrial control system throughout its entire lifecycle. The mobile media fine-grained management and control module is used for centralized registration, authorization, channel isolation and behavior monitoring of USB devices connected to the industrial control system; The trusted data exchange module is used to approve, deeply analyze, and reliably transmit data exchanged between industrial control equipment and user terminals in a physically isolated environment. The virus detection module is used to perform deep virus scanning and malicious code detection on removable media and exchange files; The host operation screen recording and auditing module is used to record the entire operation interface of the industrial control host in real time. The network operation and maintenance behavior audit module is used to monitor and record the remote network operation and maintenance behavior of industrial control hosts; The equipment anomaly alarm module is used to monitor abnormal events in the industrial control network in real time and issue alarms.

10. A host peripheral protection device based on an industrial control system, characterized in that, The device includes: processor; Memory used to store processor-executable instructions; The processor is configured to perform the method according to any one of claims 1 to 8.

11. A non-volatile computer-readable storage medium storing computer program instructions thereon, characterized in that, When the computer program instructions are executed by the processor, they implement the method described in any one of claims 1 to 8.

Images