A security protection system and method for a DNC network

Abstract

The application relates to the technical field of industrial automation control, in particular to a DNC network security protection system and method, which solves the security problems such as fuzzy DNC network boundary and lack of permission management and control. The system comprises a hardware protection layer, a software protection module and a database system, the hardware protection layer is provided with four-layer architecture such as a security isolation layer and a core control layer, the software protection module is integrated with five modules such as permission management and encrypted transmission, and the database system realizes data classified storage and automatic backup. The application realizes full-dimension protection of the DNC network through physical and logical double isolation, hierarchical permission management and control, AES-256 encrypted transmission and second-level abnormality monitoring. The application realizes double isolation of the DNC industrial control network and the office network by adopting an industrial firewall and a physical isolation device, realizes accurate binding of man-machine and operation by establishing a three-level permission system of administrators, operators and maintenance personnel, and is suitable for DNC network security guarantee.

Description

Technical Field

[0001] This invention relates to the field of industrial automation control technology, and in particular to a security protection system and method for DNC networks. Background Technology

[0002] In the development of industrial automation and intelligent manufacturing, Direct Numerical Control (DNC) networks have become a core infrastructure for machining workshops to achieve centralized management and control of CNC machine tools, efficient transmission of machining programs, and real-time acquisition of equipment operation data. Their stable and secure operation is directly related to workshop production efficiency, machining accuracy, and the security of core process data assets. Currently, most domestic machining enterprises focus on the functional implementation of DNC networks, neglecting the construction and improvement of network security protection systems. Existing protection methods are mostly simple applications of general industrial control network protection solutions, without customized design considering the unique characteristics of DNC networks, such as a large number of machine tools, frequent machining data interaction, diverse equipment interface types, and cross-access with office networks. This results in a serious mismatch between DNC network security protection capabilities and actual production safety needs.

[0003] The existing DNC network security system has several prominent and urgent shortcomings: First, the network boundary is blurred, failing to achieve both physical and logical isolation between the DNC industrial control network and the office network. Office equipment can be freely connected to the DNC network switch, easily introducing external viruses and malicious programs into the machine tool control system, causing production failures such as lost machining programs and abnormal machine tool shutdowns. Second, access control is lacking; a hierarchical access control system for equipment and operators has not been established. Unauthorized personnel can freely log in to the server to modify machining programs, tamper with process parameters, or upload illegal data through the machine tool touch screen, posing serious data security risks. Third... First, data transmission lacks protection. Processing programs and equipment operation data are not encrypted during transmission, making them vulnerable to network interception and tampering. Furthermore, there is a lack of complete transmission log records, making it impossible to trace the source when data anomalies occur. Second, anomaly monitoring is lagging behind. There is no real-time security monitoring mechanism, and the identification of behaviors such as virus intrusion, unauthorized device access, and illegal data transmission relies solely on manual inspections. This usually results in reactive handling only after a fault occurs, leading to increased security losses. Third, the ability to trace the source is weak. A standardized log management system has not been established, making it difficult to quickly locate the cause of the problem and the responsible party after a security incident occurs, and it is also difficult to formulate targeted protection and optimization solutions.

[0004] With the deep integration of Industrial Internet technology, DNC networks face increasingly diverse and complex security risks such as cyberattacks and data breaches. Numerous vulnerabilities in existing protection systems not only cause direct economic losses such as increased scrap rates, production delays, and higher equipment maintenance costs, but may also lead to the leakage of core process data, weakening market competitiveness. Currently, there is no integrated security protection solution in the industry that is specifically tailored to the characteristics of DNC networks and can simultaneously achieve network boundary isolation, hierarchical access control, encrypted data transmission, real-time anomaly monitoring, and full-process log traceability. Therefore, developing a targeted, comprehensive, stable, and easy-to-maintain DNC network security protection system and method has become an urgent technical problem to be solved in this field. Summary of the Invention

[0005] The purpose of this invention is to provide a security protection system and method for DNC networks, which solves the security problems of existing DNC networks such as ambiguous boundaries and lack of access control. It achieves physical and logical dual isolation of DNC networks, precise access control among humans, machines and operators, encryption and integrity verification of data transmission, real-time monitoring and rapid handling of security risks, and full-process tracing and responsibility positioning of security incidents, ultimately achieving full-dimensional and intelligent security protection for DNC networks.

[0006] To achieve the above objectives, the present invention provides the following technical solution: According to one aspect of the present invention, a security protection method for a DNC network is provided, comprising the following steps: S1, based on the DNC network site survey and security requirements, deploy hardware protection layers and software protection modules; S2 achieves logical isolation by configuring an IP whitelist through an industrial firewall, and achieves physical isolation by combining the port locking function of a physical isolation device, clearly defining the network boundary between the DNC industrial control network and the office network, and blocking unauthorized device access. S3 establishes a hierarchical permission system for equipment and operators, completes the entry and binding of user roles and equipment authorization information, and realizes hierarchical permission control configuration and verification; S4 uses an encryption algorithm to encrypt the transmission of machining data and program data within the DNC network, and combines hash verification to verify data integrity, while recording the entire process data transmission log. S5 uses a security monitoring and data acquisition device to collect network device status and data transmission behavior in real time, identify abnormal behavior in real time and trigger multi-level early warnings, and execute corresponding emergency response operations to achieve proactive prevention and control of security risks.

[0007] According to one embodiment of the present invention, the method further includes: S6 performs daily maintenance on the DNC security protection system, regularly backs up data and updates the virus database, and enables full-process tracing and analysis of security events and data transmission behavior based on the log database.

[0008] According to an embodiment of the present invention, in step S1, the hardware protection layer includes a security isolation layer, a core control layer, a terminal protection layer, and a data acquisition and monitoring layer; the software protection module is DNC security protection management software, which integrates access control, network isolation configuration, encrypted data transmission, security monitoring and early warning, and log and traceability functions.

[0009] According to an embodiment of the present invention, in step S2, the IP whitelist configured by the industrial firewall records the IP and MAC addresses of authorized devices in the DNC network. The DNC industrial control network and the office network belong to different IP segments. When an office network device needs to access the DNC network, it is temporarily added to the whitelist after approval by the administrator, and is automatically removed after the approval expires. When the physical isolation device detects illegal device access, it immediately cuts off the power supply to the corresponding switch port.

[0010] According to an embodiment of the present invention, in step S3, the hierarchical permission system includes three user roles: administrator, operator, and maintenance personnel. Administrators have access to parameter modification and permission configuration functions, operators only have access to program reception and device startup functions, and maintenance personnel have access to device detection and virus scanning functions. During device access verification, the security monitoring collector reads the device's MAC address and IP address and transmits them to the DNC security protection server. Devices not entered into the authorized device database will have their network connection blocked by the industrial firewall and trigger an early warning.

[0011] According to an embodiment of the present invention, in step S4, the encryption algorithm adopts the AES-256 symmetric encryption algorithm, and the data transmission is based on the FTP protocol; after the machine tool terminal security module decrypts the encrypted data, it performs hash value comparison. If the verification fails, it refuses to receive the data and reports the abnormality to the DNC security protection server; the data transmission log records at least the transmission initiator IP, the receiving machine tool number, the transmission time, the data type, and the encryption status information.

[0012] According to one embodiment of the present invention, in step S5, the security monitoring and acquisition device supports the Modbus / TCP protocol; the abnormal behavior includes virus intrusion, unauthorized IP access, illegal data transmission, and abnormal device access.

[0013] According to one embodiment of the present invention, in step S5, the multi-level early warning includes OA pop-up window and SMS early warning, and the emergency response operation includes virus file isolation and removal, illegal IP blocking, and network disconnection of risky devices.

[0014] According to an embodiment of the present invention, in step S6, the log tracing supports multi-dimensional queries by time, device number, event type, and operator account, thereby achieving 100% accountability for security incidents.

[0015] On the other hand, the present invention also provides a security protection system for a DNC network, the system comprising a hardware protection layer, a software protection module, and a database system, wherein the hardware protection layer is communicatively connected to the software protection module, and the software protection module is mounted on the database system; wherein: The hardware protection layer includes a security isolation layer, a core control layer, a terminal protection layer, and a data acquisition and monitoring layer, with each layer communicating with each other at each level. The security isolation layer includes an industrial-grade firewall and physical isolation devices, the core control layer includes a DNC security protection server, the terminal protection layer includes a machine tool terminal security module and a touch screen identity authentication component, and the data acquisition and monitoring layer includes a security monitoring collector. The software protection module is DNC security protection management software, which integrates a permission management module, a network isolation configuration module, a data encryption transmission module, a security monitoring and early warning module, and a log and tracing module; The database system includes a permission database, a log database, and a device database, which are used to store user and device permission information, security event and data transmission log information, and basic information of authorized devices, respectively, and support daily automatic backup.

[0016] The present invention provides a security protection system and method for DNC networks. Compared with the prior art, the beneficial effects of the present invention are as follows: 1. High network isolation security: Through dual protection measures of industrial-grade firewall and physical isolation device, strict isolation is achieved between DNC industrial control network and office network, with an unauthorized device access interception rate of 100%, effectively cutting off the propagation path of external viruses and malicious programs, greatly reducing the risk of infection of machine tool control system and reducing the number of abnormal equipment downtimes.

[0017] 2. Highly precise access control: A three-tiered access control system is established for administrators, operators, and maintenance personnel, achieving precise binding between people, machines, and operations. The rate of intercepting unauthorized operations reaches 100%, preventing unauthorized personnel from modifying processing programs and process parameters, which could lead to an increase in the scrap rate and ensure the stability of processing production.

[0018] 3. Excellent data transmission integrity: The system employs a combination of AES-256 symmetric encryption algorithm and hash verification to achieve encryption protection and integrity verification during the data transmission process. The data transmission tampering rate is 0, ensuring the confidentiality and integrity of the processing program and equipment operation data. At the same time, it records an immutable full-process transmission log, providing a basis for data anomaly investigation.

[0019] 4. Fast response to anomalies: The security monitoring and data acquisition device that supports Modbus / TCP protocol enables real-time collection of device status and data transmission behavior. The total response time for anomaly identification and early warning triggering is ≤3 seconds. It can quickly perform emergency response operations such as virus isolation and removal and illegal IP blocking. The response efficiency is improved by more than 90% compared with traditional manual inspection, which greatly shortens the time for handling security failures and reduces production losses.

[0020] 5. Enhanced Log Tracing Capabilities: A database system consisting of a permission database, a log database, and a device database is established. The log database enables full-dimensional and tamper-proof recording of security events and data transmission behaviors, and supports multi-dimensional queries by time, device number, event type, and operator account, achieving 100% accountability for security events and providing data support for the optimization of the protection system.

[0021] 6. Excellent system compatibility and scalability: The hardware protection layer adopts a modular architecture, and the software protection module adopts an open interface design, supporting flexible access for new machine tools. Only the terminal security module needs to be installed on the new machine tool and entered into the equipment library, adapting to the needs of workshop capacity expansion; at the same time, it is compatible with mainstream machine tool brands such as Siemens and FANUC, as well as industrial communication protocols such as Modbus and FTP, without the need for large-scale modification of existing DNC network equipment, reducing system implementation costs. Attached Figure Description

[0022] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this invention, illustrate exemplary embodiments of the invention and are used to explain the invention, but do not constitute an undue limitation of the invention. In the drawings: Figure 1 This is a flowchart of a security protection method for a DNC network according to an embodiment of the present invention; Figure 2 This is a schematic diagram of a DNC network security protection system according to an embodiment of the present invention; Figure 3 This is a schematic diagram of the system hardware network layout according to an embodiment of the present invention; Figure 4 This is a schematic diagram of the system traffic monitoring and management interface according to an embodiment of the present invention; Figure 5 This is a schematic diagram of the system threat monitoring and management interface according to an embodiment of the present invention; Figure 6 This is a schematic diagram of the IP access management interface according to an embodiment of the present invention. Detailed Implementation

[0023] To facilitate a clear description of the technical solutions in the embodiments of the present invention, the terms "first" and "second" are used to distinguish identical or similar items with essentially the same function and effect. For example, the first threshold and the second threshold are merely used to distinguish different thresholds and do not limit their order. Those skilled in the art will understand that the terms "first" and "second" do not limit the quantity or execution order, and that the terms "first" and "second" are not necessarily different.

[0024] It should be noted that in this invention, the terms "exemplary" or "for example" are used to indicate examples, illustrations, or descriptions. Any embodiment or design described as "exemplary" or "for example" in this invention should not be construed as being more preferred or advantageous than other embodiments or designs. Specifically, the use of terms such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner.

[0025] In this invention, "at least one" refers to one or more, and "more than one" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one" or similar expressions refer to any combination of these items, including any combination of singular or plural items. For example, "at least one of a, b, or c" can represent: a, b, c, a combination of a and b, a combination of a and c, a combination of b and c, or a, b, and c, where a, b, and c can be single or multiple.

[0026] like Figure 1 The diagram shows a flowchart of a security protection method for DNC networks, which includes the following steps: S101, Deployment of hardware protection layer and software protection module; First, a site survey of the DNC network was conducted to collect information such as the quantity, model, IP address allocation, and interface type of CNC machine tools, servers, switches, and other equipment within the network. The workshop's security requirements regarding access control, data encryption, anomaly alert methods, and log tracing were then identified. Next, based on the survey results and security requirements, hardware was selected, including an industrial-grade firewall, physical isolation devices, a DNC security protection server, machine tool terminal security modules, touchscreen authentication components, and security monitoring and data acquisition devices supporting Modbus / TCP protocols. Subsequently, the hardware protection layer was deployed. The industrial-grade firewall and physical isolation devices were deployed at the connection point between the DNC industrial control network and the office network. The DNC security protection server was deployed in the workshop server room and connected to a UPS power supply. Machine tool terminal security modules and authentication components were installed on each machine tool. Security monitoring and data acquisition devices were evenly deployed according to the workshop layout. Finally, the DNC security protection management software was deployed, and communication debugging between the software and hardware was completed to ensure the normal operation of each module.

[0027] S102: Dual isolation configuration at the network boundary; Configure a dedicated IP segment (e.g., 192.168.1.0 / 24) for the DNC industrial control network and an independent IP segment (e.g., 192.168.2.0 / 24) for the office network, ensuring no overlap between the two segments; enter the IP and MAC addresses of authorized devices such as the DNC security protection server, CNC machine tools, and security monitoring and acquisition devices into the industrial-grade firewall, create an access whitelist, and only allow devices on the whitelist to access the DNC industrial control network; configure physical isolation devices to lock unused ports of the DNC network switches and enable the "automatic power-off for unauthorized access" function, immediately cutting off the power supply to the corresponding port when an unfamiliar MAC address device is detected accessing the network; at the same time, configure access approval rules for office network devices in the firewall. When an office network device needs to access the DNC industrial control network, the administrator must approve it in the software. After approval, the device's IP address is temporarily added to the whitelist, and an approval validity period is set. After the expiration, the device is automatically removed from the whitelist.

[0028] S103: Hierarchical access control configuration and verification; In the permission management module of the DNC security protection management software, three user roles are created: administrator, operator, and maintenance personnel. Each role is configured with corresponding operating permissions: administrators have full system operation permissions, including parameter modification, permission configuration, and system maintenance; operators have basic operation permissions, including receiving machining programs, starting the machine tool, and viewing equipment operating status; maintenance personnel have specialized operation permissions, including equipment testing, virus scanning, and troubleshooting. The operator's account and password information are then entered, binding the operator's account to the corresponding machine tool equipment number to achieve human-machine binding. The operator's account and password are then entered into the machine tool touchscreen's authentication component to complete the authentication configuration. Finally, permission verification is performed by logging into the machine tool touchscreen using different role accounts to verify if the operating permissions match. Simulating an unfamiliar device connecting to the DNC network verifies whether the server can quickly verify and trigger the firewall to block the connection, while simultaneously triggering an anomaly warning.

[0029] S104: Configuration and operation of encrypted data transmission; In the data encryption transmission module of the software protection module, the AES-256 symmetric encryption algorithm is configured as the default data encryption algorithm, and data transmission is determined to be based on the FTP protocol. When the administrator uploads machining programs, equipment operating parameters, and other data to the DNC security protection server, the software automatically encrypts the data. The encrypted data is then transmitted to the target machine tool via the DNC network. After receiving the encrypted data, the machine tool terminal security module first decrypts it, and then compares the hash value of the decrypted data with the hash value of the original data on the server to verify data integrity. If the hash values ​​match, the machine tool receives the data normally; if they do not match, the machine tool refuses to receive the data and immediately reports the data transmission anomaly to the DNC security protection server. Simultaneously, during data transmission, the server records information such as the initiating IP address, the receiving machine tool number, the transmission time, the data type, the encryption status, and the transmission result in real time, forming a data transmission log and storing it in the database system's log library.

[0030] S105: Real-time safety monitoring and emergency response; Configure the data collection frequency of the security monitoring collector (default 1 time / second). The collector collects information such as communication status, port connection status, virus detection results, and data transmission behavior of each device in the DNC network in real time, and transmits the collected data to the DNC security protection server in real time via Modbus / TCP protocol. The server's security monitoring and early warning module analyzes the collected data in real time to identify abnormal behaviors such as virus intrusion, unauthorized IP access, illegal data transmission, and abnormal device access. When abnormal behavior is detected, the module immediately triggers multi-level early warnings: pushes an OA pop-up warning to the workshop administrator's office terminal, and sends SMS warnings to the mobile phones of administrators and maintenance personnel. The warning information includes the type of abnormal event, the time of occurrence, and the equipment involved. At the same time, the module automatically executes corresponding emergency response operations according to the type of abnormal event: when a virus intrusion is detected, the machine tool terminal security module is instructed to immediately isolate the virus file and automatically remove it; when unauthorized IP access is detected, the industrial-grade firewall is instructed to immediately block the IP address and record the access information; when abnormal device access is detected, the physical isolation device is instructed to cut off the power supply to the corresponding port, and the firewall is instructed to block the network connection of the device.

[0031] S106: System daily operation and maintenance and log traceability analysis; Establish daily system operation and maintenance procedures, regularly update and optimize access rules for the industrial-grade firewall, remotely upgrade the virus database of the machine tool terminal security module, and perform redundant backups of the DNC security protection server to ensure no single point of failure. The database system automatically performs off-site data backups daily at 23:00, backing up all information from the permission database, log database, and device database to prevent data loss or corruption. When a security incident occurs on the DNC network, administrators can use the log and tracing modules of the software protection module to set query conditions such as time range, device number, event type, and operator account in the log tracing query interface, performing single or multiple conditional queries. The system retrieves the corresponding security event logs and data transmission logs from the log database, displaying the complete process of the event, including the cause of the event, involved equipment, operators, and handling procedures, achieving full-process tracing and 100% accountability for security incidents. Simultaneously, administrators can optimize system protection strategies based on log analysis results to improve the system's security capabilities.

[0032] like Figure 2 The diagram shows a security protection system for a DNC network. This system is used to implement the above method and consists of three parts: a hardware protection layer, a software protection module, and a database system.

[0033] The hardware protection layer specifically includes a security isolation layer, a core control layer, a terminal protection layer, and a data acquisition and monitoring layer.

[0034] The security isolation layer consists of an industrial-grade firewall and a physical isolation device. The industrial-grade firewall achieves logical isolation between the DNC industrial control network and the office network and controls network access through a whitelist mechanism. The physical isolation device achieves physical isolation by blocking unauthorized devices from physically accessing the DNC network through port locking and power-off functions for unauthorized access. The two work together to form a dual isolation system of "logical + physical".

[0035] The core device of the core control layer is the DNC security protection server, equipped with a high-performance CPU, large-capacity memory and hard drive, and supports redundant backup. As the core management and control node of the system, it realizes data interaction between the hardware protection layer and the software protection module, analysis and processing of security monitoring data, issuance of emergency response instructions, and storage of log data. It is the "brain" of the system. The DNC security protection server is configured with an 8-core CPU, 32GB of memory and a 2TB HDD to meet the data processing requirements of the DNC network. It supports redundant backup, is deployed in the workshop computer room and connected to a UPS power supply, and is configured with a dedicated fixed IP address for the DNC network: 192.168.1.100.

[0036] The terminal protection layer consists of a machine tool terminal security module and a touch screen authentication component. The machine tool terminal security module is installed in the machine tool's electrical control cabinet and enables functions such as local virus scanning, illegal data interception, encrypted data decryption, and data integrity verification. The touch screen authentication component is integrated into the machine tool's touch screen and enables functions such as operator identity verification and operation permission recognition, serving as the machine tool's "security door."

[0037] The core equipment of the data acquisition and monitoring layer is the safety monitoring and acquisition device, which supports the Modbus / TCP industrial communication protocol. It can flexibly configure the acquisition frequency according to the needs of the workshop, collect information such as the status of each device in the DNC network and data transmission behavior in real time, and transmit the collected data to the DNC safety protection server in real time. It is the "sensory nerve" of the system.

[0038] The software protection module is DNC security protection management software, developed based on an industrial-grade operating system. It integrates five core modules: permission management module, network isolation configuration module, data encryption transmission module, security monitoring and early warning module, and log and traceability module. The functions of each module work together to achieve intelligent security management and control of the DNC network.

[0039] The access control module is used to implement functions such as user role creation, operation permission configuration, operator account management, human-machine binding, and device authorization information entry. It is the core module for access control.

[0040] The network isolation configuration module is used to remotely configure, modify, and delete whitelists for industrial-grade firewalls, remotely manage port rules for physical isolation devices, and approve access to office network devices. It is the core module for network boundary isolation.

[0041] The data encryption transmission module is used to implement functions such as encryption algorithm configuration, automatic data encryption and decryption, hash value calculation and comparison, and data transmission protocol configuration. It is the core module for data transmission security.

[0042] The security monitoring and early warning module is used to realize functions such as real-time analysis of monitoring data, intelligent identification of abnormal behavior, multi-level early warning via OA pop-ups and SMS, and automatic issuance of emergency response instructions. It is the core module of real-time security monitoring.

[0043] The logging and tracing module is used to realize functions such as automatic logging, classified storage, multi-dimensional query, result export and printing, and is the core module for security incident tracing.

[0044] The database system uses a high-performance relational database and consists of three sub-databases: a permission database, a log database, and a device database. Each sub-database is stored independently but is interconnected. It supports daily automatic off-site backups to ensure data security.

[0045] The permission database stores information such as operator accounts, passwords, user roles, operation permissions, and bound device numbers, providing data support for the permission management module.

[0046] The log library is used to store tamper-proof security event logs and data transmission logs. The security event logs record information such as the type of abnormal event, the time of occurrence, the equipment involved, and the handling process. The data transmission logs record information such as the IP address of the transmission initiator, the machine tool number of the receiving end, and the transmission time, providing data support for the log and traceability modules.

[0047] The device library stores basic information about authorized devices within the DNC network, including device number, IP address, MAC address, device model, interface type, and installation location, providing data support for device access verification and access control.

[0048] like Figure 3 As shown, a detailed schematic diagram of the system hardware network layout is presented, clearly demonstrating the actual network topology of each device in the hardware protection layer of the DNC network. It clarifies that the industrial-grade firewall and physical isolation devices are deployed at the network boundary between the DNC industrial control network and the office network. The DNC security protection server, as the core management node, establishes communication connections with the firewall and security monitoring and acquisition devices. The security monitoring and acquisition devices are deployed according to the machine tool cluster distribution and connected to each CNC machine tool terminal. The machine tool terminals have built-in terminal security modules and identity authentication components. This intuitively presents the hardware network architecture of "office network - security isolation layer - core control layer - data acquisition and monitoring layer - terminal protection layer," reflecting the customization and rationality of the hardware deployment in this invention.

[0049] like Figure 4The diagram shows a schematic of the system traffic monitoring and management interface. This interface is one of the core monitoring interfaces of the DNC security protection management software. It can display the real-time data of the transmitted traffic, received traffic, total traffic, average traffic, and peak traffic of each physical interface in the DNC network. It can also statistically analyze the real-time changing trends of the number of concurrent connections and new connections. It supports filtering and querying by time dimensions such as the last hour, 1 day, 7 days, and 30 days, and can also export monitoring reports in PDF format. Through this interface, administrators can have a comprehensive understanding of the DNC network traffic operation status, promptly detect potential security risks such as abnormal traffic fluctuations, and provide data support for network security analysis.

[0050] like Figure 5 The diagram shows the system's threat monitoring and management interface, enabling visualized monitoring of DNC network security threats. It can display the changing trends of the number of threats at different levels (severe, high, medium, and low) within the network by time dimension. At the same time, the threat type ranking module counts the frequency of various threats such as security vulnerabilities, suspicious behaviors, and CGI access, intuitively presenting the threat distribution characteristics of the DNC network. Administrators can use this interface to quickly locate the types and time periods of high network threat incidence, and carry out targeted optimization of protection strategies to improve the system's proactive prevention and control capabilities.

[0051] like Figure 6 The diagram shows a schematic of the IP access management interface. This interface is the core configuration and monitoring interface of the industrial firewall. It supports configuring access policies for the DNC industrial control network, allowing customization of policy parameters such as ingress / egress interface security domain, source address, destination address, service, application, and access time. It also allows setting access actions such as PERMIT / DENY, and can statistically analyze traffic data and session timeout for each access policy, and record policy execution log information. This enables fine-grained and configurable control over IP address access, and is the core operation interface for this invention to achieve network logical isolation and block unauthorized IP access.

[0052] Example 1: Application of DNC Network Security Protection System in Machining Workshop A machining workshop has 30 Siemens 840D and FANUC series CNC machine tools. The original DNC network lacked a security protection system, resulting in problems such as unauthorized access to office network devices, repeated tampering of machining programs, and frequent machine tool downtime due to virus intrusion. The scrap rate reached 8%, and the average monthly equipment downtime exceeded 10 hours. The DNC network security protection system and method of this invention were used to upgrade the workshop's DNC network. The implementation process is as follows: Deployment Phase: Completed on-site survey of the workshop DNC network, collected equipment information for 30 machine tools, 2 servers, and 3 switches, identified the permission hierarchy requirements for "3 administrators, 20 operators, and 5 maintenance personnel," and determined the early warning method of "OA pop-up + SMS." Selected industrial-grade firewalls, physical isolation devices, an 8-core / 32GB / 2TB DNC security protection server, 30 machine tool terminal security modules, 30 touch screen authentication components, and 3 security monitoring and data acquisition devices. Completed the deployment of the hardware protection layer and the installation of the DNC security protection management software. After debugging, the communication between the hardware and software was normal.

[0053] Configuration Phase: Configure the IP segment 192.168.1.0 / 24 for the DNC industrial control network and the IP segment 192.168.2.0 / 24 for the office network; enter the IP and MAC addresses of authorized devices in the firewall and configure the port locking function of the physical isolation device; create three types of user roles in the software, enter the information of 28 operators and complete human-machine binding; configure the AES-256 encryption algorithm and FTP transfer protocol, and set the collector's collection frequency to 1 time / second. Considering the significant impact of equipment downtime during DNC network processing, the security monitoring collector is configured with a high-frequency collection frequency of 1 time / second. Combined with the real-time transmission characteristics of the Modbus / TCP protocol, abnormal behavior can be identified within ≤1 second. Simultaneously, emergency response rules are preset to automate virus scanning, IP blocking, and port power-off, with warnings and command issuance within ≤3 seconds, significantly shortening fault handling time.

[0054] Operation and Maintenance Phase: After the system was put into operation, dedicated personnel were assigned to perform daily maintenance, with firewall rules updated weekly, virus definitions upgraded monthly, and the database automatically backed up off-site daily. During system operation, 12 unauthorized device accesses, 5 unauthorized IP accesses, and 3 virus intrusions were successfully intercepted, all triggering alerts and completing emergency responses within 3 seconds; no further tampering of processing programs occurred, the processing scrap rate dropped to below 0.5%, and the average monthly equipment downtime was reduced to less than 1 hour.

[0055] Traceability Application: During a machine tool's reception of a machining program, a verification failure occurred. By using the logs and traceability module, the administrator queried the data transmission logs by machine tool number and time range, quickly identifying the cause as network fluctuations leading to data transmission interruption. Subsequently, the data transmission retransmission mechanism was optimized to prevent similar problems from recurring.

[0056] This embodiment demonstrates that the security protection system and method for DNC networks of the present invention can effectively solve the security problems of existing DNC networks, achieve all-dimensional security protection, significantly improve the production stability and data security of machining workshops, and has significant practical application value. Compared with the existing technology's "passive protection, single dimension, and lack of standardized implementation process," the present invention achieves a technological breakthrough of proactive prevention and control, all-dimensional coverage, and standardized implementation, and can be directly applied to the DNC network transformation of machining workshops, possessing extremely strong practicality.

[0057] This invention proposes an integrated protection architecture through architectural innovation, which adapts to the multi-machine tool networking characteristics of DNC networks. This architecture features four layers of hardware protection, five major software modules, and three databases working together, achieving full-dimensional coverage from network boundary to terminal devices and from data transmission to security traceability, thus solving the problem of single protection dimensions in existing technologies.

[0058] This invention innovates through technical means: addressing the pain point of cross-access between the DNC network office network and the industrial control network, it designs a dual isolation mechanism of "industrial firewall whitelist + physical isolation device port locking" to achieve 100% interception of unauthorized access; and to meet the requirement of tamper-proof processing data, it integrates AES-256 encryption and hash verification before and after transmission to achieve a data transmission tampering rate of 0.

[0059] This invention innovates the implementation model, establishes a standardized deployment process for the distribution characteristics of DNC network devices (configuring collectors according to the number of machine tools and dividing IP segments according to the workshop layout), and designs scenario-based functional test cases to solve the problem that existing technologies are difficult to implement in DNC networks.

[0060] Although the invention has been described herein in conjunction with various embodiments, those skilled in the art will understand and implement other variations of the disclosed embodiments by reviewing the accompanying drawings, disclosure, and other materials. In this specification, the word "comprising" does not exclude other components or steps, and "a" or "an" does not exclude multiple components. A single processor or other unit can implement several functions listed in the specification. While certain measures are described in different embodiments, this does not mean that these measures cannot be combined to produce good results.

[0061] Although the invention has been described in conjunction with specific features and embodiments, it is obvious that various modifications and combinations can be made therein without departing from the spirit and scope of the invention. Accordingly, this specification and drawings are merely illustrative of the invention and are considered to cover any and all modifications, variations, combinations, or equivalents within the scope of the invention. Clearly, those skilled in the art can make various alterations and modifications to the invention without departing from its spirit and scope. Thus, if such modifications and modifications fall within the scope of the invention and its equivalents, the invention is also intended to include such modifications and modifications.

Claims

1. A security protection method for a DNC network, characterized in that, Includes the following steps: S1, based on the DNC network site survey and security requirements, deploy hardware protection layers and software protection modules; S2 achieves logical isolation by configuring an IP whitelist through an industrial firewall, and achieves physical isolation by combining the port locking function of a physical isolation device, clearly defining the network boundary between the DNC industrial control network and the office network, and blocking unauthorized device access. S3 establishes a hierarchical permission system for equipment and operators, completes the entry and binding of user roles and equipment authorization information, and realizes hierarchical permission control configuration and verification; S4 uses an encryption algorithm to encrypt the transmission of machining data and program data within the DNC network, and combines hash verification to verify data integrity, while recording the entire process data transmission log. S5 uses a security monitoring and data acquisition device to collect network device status and data transmission behavior in real time, identify abnormal behavior in real time and trigger multi-level early warnings, and execute corresponding emergency response operations to achieve proactive prevention and control of security risks.

2. The method according to claim 1, characterized in that, The method further includes: S6 performs daily maintenance on the DNC security protection system, regularly backs up data and updates the virus database, and enables full-process tracing and analysis of security events and data transmission behavior based on the log database.

3. The method according to claim 1, characterized in that, In step S1, the hardware protection layer includes a security isolation layer, a core control layer, a terminal protection layer, and a data acquisition and monitoring layer; the software protection module is DNC security protection management software, which integrates access control, network isolation configuration, encrypted data transmission, security monitoring and early warning, and log and traceability functions.

4. The method according to claim 1, characterized in that, In step S2, the IP whitelist configured by the industrial firewall records the IP and MAC addresses of authorized devices within the DNC network. The DNC industrial control network and the office network belong to different IP segments. When office network devices need to access the DNC network, they are temporarily added to the whitelist after administrator approval, and are automatically removed after the approval expires. When the physical isolation device detects unauthorized device access, it immediately cuts off the power supply to the corresponding switch port.

5. The method according to claim 1, characterized in that, In step S3, the hierarchical permission system includes three user roles: administrator, operator, and maintenance personnel. Administrators have access to parameter modification and permission configuration functions, operators only have access to program reception and device startup functions, and maintenance personnel have access to device detection and virus scanning functions. During device access verification, the security monitoring collector reads the device's MAC address and IP address and transmits them to the DNC security protection server. Devices not entered into the authorized device database will have their network connection blocked by the industrial firewall and trigger an early warning.

6. The method according to claim 1, characterized in that, In step S4, the encryption algorithm adopts the AES-256 symmetric encryption algorithm, and the data transmission is based on the FTP protocol. After decrypting the encrypted data, the machine tool terminal security module performs hash value comparison. If the verification fails, it refuses to receive the data and reports the abnormality to the DNC security protection server. The data transmission log records at least the transmission initiator IP, the receiving machine tool number, the transmission time, the data type, and the encryption status information.

7. The method according to claim 1, characterized in that, In step S5, the security monitoring and acquisition device supports the Modbus / TCP protocol; the abnormal behaviors include virus intrusion, unauthorized IP access, illegal data transmission, and abnormal device access.

8. The method according to claim 1, characterized in that, In step S5, the multi-level early warning includes OA pop-up windows and SMS alerts, and the emergency response operations include virus file isolation and removal, illegal IP blocking, and network disconnection of risky devices.

9. The method according to claim 2, characterized in that, In step S6, the log tracing supports multi-dimensional queries by time, device number, event type, and operator account, achieving 100% accountability for security incidents.

10. A security protection system for a DNC network, used to implement the method according to any one of claims 1 to 9, characterized in that, The system includes a hardware protection layer, a software protection module, and a database system. The hardware protection layer is communicatively connected to the software protection module, and the software protection module is mounted on the database system. The hardware protection layer includes a security isolation layer, a core control layer, a terminal protection layer, and a data acquisition and monitoring layer, with each layer communicating with each other at each level. The security isolation layer includes an industrial-grade firewall and physical isolation devices, the core control layer includes a DNC security protection server, the terminal protection layer includes a machine tool terminal security module and a touch screen identity authentication component, and the data acquisition and monitoring layer includes a security monitoring collector. The software protection module is DNC security protection management software, which integrates a permission management module, a network isolation configuration module, a data encryption transmission module, a security monitoring and early warning module, and a log and tracing module; The database system includes a permission database, a log database, and a device database, which are used to store user and device permission information, security event and data transmission log information, and basic information of authorized devices, respectively, and support daily automatic backup.

Images