State analysis-based industrial 5g security analysis method and apparatus, and medium

Abstract

The present invention provides a state analysis-based industrial 5G security analysis method and apparatus, and a medium. The method comprises: security state analysis: performing security state analysis on the basis of a 5G traffic feature and a security state database, and when the security state analysis fails, giving an alarm; white list check: checking whether a source of 5G traffic exists in a white list, and when not, giving an alarm; asset analysis: checking whether an asset conforms to a definition of an asset database, and when not, giving an alarm; trust analysis: checking whether the 5G traffic meets a definition of a traffic state database, and when not, giving an alarm; and behavior analysis: checking whether the 5G traffic meets a definition of a behavior database, and when not, giving an alarm. According to the technical solutions in the embodiments of the present invention, abnormal access from industrial 5G or other malicious terminals can be found, so that the accuracy of industrial 5G access security analysis is increased, a client is prevented from being controlled to perform a remote malicious operation on a target system in a system, and possible attacks by a remote client on the system can be detected.

Description

Industrial 5G security analysis method, device and medium based on state analysis Technical Field

[0001] The present invention relates to the field of network security, and in particular to an industrial 5G security analysis method, device, and medium based on state analysis. Background Art

[0002] With the launch of industrial 5G, more and more industrial 5G applications are emerging, such as industrial 5G remote control and maintenance, which can improve the efficiency and speed of control and troubleshooting of industrial production and control.

[0003] This type of remote control and maintenance poses a security threat because it directly introduces remote connections into industrial control systems. In real-world scenarios, if a terminal with a low security status is connected to an industrial control system via industrial 5G, it could pose a significant threat to the system and production line.

[0004] Summary of the Invention

[0005] To achieve the above objectives, the present invention proposes an industrial 5G security analysis method, device and medium based on state analysis, which can be used to detect abnormal access from industrial 5G or other malicious terminals, improve the accuracy of industrial 5G access security analysis, prevent the client from being controlled in the system to perform remote malicious operations on the target system, and detect possible attacks on the system by remote clients.

[0006] An industrial 5G security analysis method based on state analysis proposed in an embodiment of the present invention includes: (security state analysis, performing security state analysis based on 5G traffic characteristics and a security state database; if the security state analysis fails, an alarm is generated; whitelist verification, verifying whether the source of the 5G traffic exists in the whitelist; if not, an alarm is generated; asset analysis, verifying whether the asset complies with the asset database definition; if not, an alarm is generated; trust analysis, verifying whether the 5G traffic complies with the traffic state database definition; if not, an alarm is generated; behavior analysis, verifying whether the 5G traffic complies with the behavior database definition: if not, an alarm is generated. Through traffic characteristics and trust analysis, abnormal access from industrial 5G or other malicious terminals can be discovered, the accuracy of industrial 5G access security analysis can be improved, the client can be prevented from being controlled in the system to perform remote malicious operations on the target system, and possible attacks on the system by remote clients can be detected.

[0007] An industrial 5G security analysis device based on state analysis proposed in an embodiment of the present invention includes: a security state analysis module, configured to: perform security state analysis based on 5G traffic characteristics and a security state database; if the security state analysis fails, an alarm is generated; a whitelist verification module, configured to: verify whether the source of the 5G traffic exists in the whitelist; if not, an alarm is generated; an asset analysis module, configured to: verify whether the asset complies with the definition in the asset database; if not, an alarm is generated; a trust analysis module, configured to: verify whether the 5G traffic complies with the definition in the traffic state database; if not, an alarm is generated; a behavior analysis module, configured to: verify whether the 5G traffic complies with the definition in the behavior database; if not, an alarm is generated. Through traffic characteristics and trust analysis, abnormal access from industrial 5G or other malicious terminals can be discovered, the accuracy of industrial 5G access security analysis can be improved, the client can be prevented from being controlled in the system to perform remote malicious operations on the target system, and possible attacks on the system by remote clients can be detected.

[0008] An electronic device proposed in an embodiment of the present invention includes: at least one processor; and a memory coupled to the at least one processor, wherein the memory is used to store instructions, and when the instructions are executed by the at least one processor, the processor executes the method described above.

[0009] An embodiment of the present invention provides a computer-readable storage medium on which computer instructions are stored. When the computer instructions are executed, the method described in any of the above embodiments is executed.

[0010] A computer program product provided in an embodiment of the present invention includes a computer program. When the computer program is executed by a processor, the method described in any one of the above embodiments is implemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] The following drawings are only intended to illustrate and explain the present invention, and do not limit the scope of the present invention.

[0012] FIG1 is a flow chart of an industrial 5G security analysis method 100 based on state analysis according to an embodiment of the present invention.

[0013] FIG2 is a structural diagram of an industrial 5G security analysis device 200 based on state analysis according to an embodiment of the present invention.

[0014] Figure 3 is a schematic diagram of an electronic device 300 according to an embodiment of the present invention.

[0015] The following are the descriptions of the reference numerals: DETAILED DESCRIPTION

[0016] In order to have a clearer understanding of the technical features, purposes and effects of the present invention, specific embodiments of the present invention are now described with reference to the accompanying drawings.

[0017] In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention may also be implemented in other ways different from those described herein. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0018] As used in this application and the claims, unless the context clearly indicates otherwise, the words "a," "an," "an," and / or "the" are not intended to refer to the singular but may include the plural. Generally speaking, the terms "comprises" and "include" only indicate the inclusion of the steps and elements specifically identified, and these steps and elements do not constitute an exclusive list. A method or apparatus may also include other steps or elements.

[0019] In the embodiments of the present invention, the impact of industrial 5G security on OT (Operation Technology) systems and equipment is taken into consideration.

[0020] Therefore, in order to provide an industrial 5G security analysis method, device and medium based on state analysis, in an embodiment of the present invention, the method includes: security state analysis, performing security state analysis based on 5G traffic characteristics and a security state database; if the security state analysis fails, an alarm is generated; whitelist verification, verifying whether the source of the 5G traffic exists in the whitelist; if not, an alarm is generated; asset analysis, verifying whether the asset complies with the definition in the asset database; if not, an alarm is generated; trust analysis, verifying whether the 5G traffic complies with the definition in the traffic state database; if not, an alarm is generated; behavior analysis, verifying whether the 5G traffic complies with the definition in the behavior database; if not, an alarm is generated. The technical solution in the embodiment of the present invention can detect abnormal access from industrial 5G or other malicious terminals, improve the accuracy of industrial 5G access security analysis, prevent the client from being controlled in the system to perform remote malicious operations on the target system, and detect possible attacks on the system by remote clients.

[0021] FIG1 is a flow chart of an industrial 5G security analysis method 100 based on state analysis according to an embodiment of the present invention. As shown in FIG1 , the method 100 may include:

[0022] Step S101: security status analysis: security status analysis is performed based on 5G traffic characteristics and a security status database.

[0023] Specifically, OT traffic is collected by the data collector and 5G connection identification is performed. The 5G connection identification module will detect 5G traffic based on the 5G fingerprint features in the 5G feature database.

[0024] In one embodiment, the 5G traffic characteristics further include: the fingerprint of the 5G router in the traffic, the IP address range of the local port of the 5G router and the conventional protocol characteristics of the 5G traffic.

[0025] In one embodiment, the security status analysis further includes: connection statistics and abnormal connection number detection, 5G traffic protocol number, abnormal protocol traffic and abnormal file or message content in the traffic.

[0026] Step S102: whitelist verification, verifying whether the source of 5G traffic exists in the whitelist.

[0027] Specifically, the source IP address and user of the client are both in a predefined whitelist.

[0028] Step S103: asset analysis to verify whether the assets comply with the asset database definition.

[0029] Specifically, the asset database defines the assets that the client can access remotely via Industrial 5G. If the target asset is not defined in the asset database, it means that the client's access behavior via Industrial 5G is illegal, and an alert will be generated to the administrator.

[0030] Step S104: Trust analysis to verify whether the 5G traffic complies with the traffic status database definition.

[0031] In one embodiment, the traffic status database definition further includes: allowed protocols, allowed ports, client types, and protocol tags of certain fields in the traffic.

[0032] Specifically, the traffic status database defines the protocols and ports allowed for industrial 5G remote access. In remote system status monitoring services, only OPC-UA can be used with target assets. If another port or protocol is used during a 5G access, the traffic is untrustworthy and an alert is generated for the administrator.

[0033] Step S105: Behavior analysis to verify whether the 5G traffic complies with the behavior database definition.

[0034] In one embodiment, the behavior database definition includes: command types, valid command parameters, and valid command parameter ranges in a specific protocol.

[0035] Specifically, industrial behaviors in traffic will be collected and compared with those defined in the behavior database.

[0036] Specifically, if the traffic is credible, the status of the traffic passing through Industrial 5G will be recorded.

[0037] FIG2 is a schematic diagram of the structure of a device 200 according to an embodiment of the present invention. As shown in FIG2 , the device 200 may include:

[0038] The security status analysis module 201 is configured to perform security status analysis based on 5G traffic characteristics and a security status database.

[0039] Specifically, OT traffic is collected by the data collector and 5G connection identification is performed. The 5G connection identification module will detect 5G traffic based on the 5G fingerprint features in the 5G feature database.

[0040] In one embodiment, the 5G traffic characteristics further include: the fingerprint of the 5G router in the traffic, the IP address range of the local port of the 5G router and the conventional protocol characteristics of the 5G traffic.

[0041] In one embodiment, the security status analysis further includes: connection statistics and abnormal connection number detection, 5G traffic protocol number, abnormal protocol traffic and abnormal file or message content in the traffic.

[0042] The whitelist verification module 202 is configured to verify whether the source of the 5G traffic exists in the whitelist.

[0043] Specifically, the source IP address and user of the client are both in a predefined whitelist.

[0044] The asset analysis module 203 is configured to verify whether the asset complies with the asset database definition.

[0045] Specifically, the asset database defines the assets that the client can access remotely via Industrial 5G. If the target asset is not defined in the asset database, it means that the client's access behavior via Industrial 5G is illegal, and an alert will be generated to the administrator.

[0046] The trust analysis module 204 is configured to verify whether the 5G traffic complies with the traffic status database definition.

[0047] In one embodiment, the traffic status database definition further includes: allowed protocols, allowed ports, client types, and protocol tags of certain fields in the traffic.

[0048] Specifically, the traffic status database defines the protocols and ports allowed for industrial 5G remote access. In remote system status monitoring services, only OPC-UA can be used with target assets. If another port or protocol is used during a 5G access, the traffic is untrustworthy and an alert is generated for the administrator.

[0049] The behavior analysis module 205 is configured to verify whether the 5G traffic complies with the behavior database definition.

[0050] In one embodiment, the behavior database definition includes: command types, valid command parameters, and valid command parameter ranges in a specific protocol.

[0051] Specifically, industrial behaviors in traffic will be collected and compared with those defined in the behavior database.

[0052] Specifically, if the traffic is credible, the status of the traffic passing through Industrial 5G will be recorded.

[0053] The present invention also provides an electronic device 300. FIG3 is a schematic diagram of an electronic device 300 according to an embodiment of the present invention. As shown in FIG3 , the electronic device 300 includes a processor 310 and a memory 320. The memory 320 stores instructions, wherein the instructions, when executed by the processor 310, implement the method 100 described above.

[0054] The present invention further provides a computer-readable storage medium having computer instructions stored thereon. When the computer instructions are executed, the method described above is executed.

[0055] The present invention also provides a computer program product, comprising a computer program, which implements the above-mentioned method when executed by a processor.

[0056] Some aspects of the methods and apparatus of the present invention may be performed entirely by hardware, entirely by software (including firmware, resident software, microcode, etc.), or by a combination of hardware and software. The above hardware or software may be referred to as "data blocks," "modules," "engines," "units," "components," or "systems." The processor may be one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DAPDs), programmable logic devices (PLCs), field-programmable gate arrays (FPGAs), processors, controllers, microcontrollers, microprocessors, or combinations thereof. In addition, various aspects of the present invention may be embodied as computer products in one or more computer-readable media, the product including computer-readable program code. For example, computer-readable media may include, but are not limited to, magnetic storage devices (e.g., hard disks, floppy disks, tapes, etc.), optical disks (e.g., compact disks (CDs), digital versatile disks (DVDs), etc.), smart cards, and flash memory devices (e.g., cards, sticks, key drives, etc.).

[0057] Flowcharts are used herein to illustrate the operations performed by the methods according to the embodiments of the present application. It should be understood that the preceding operations are not necessarily performed in exact order. Instead, the various steps may be performed in reverse order or simultaneously. Furthermore, other operations may be added to these processes, or one or more operations may be removed from these processes.

[0058] It should be understood that although this specification is described according to various embodiments, not every embodiment contains only one independent technical solution. This narrative method of the specification is only for the sake of clarity. Those skilled in the art should regard the specification as a whole. The technical solutions in each embodiment can also be appropriately combined to form other implementation methods that can be understood by those skilled in the art.

[0059] The above description is only an illustrative embodiment of the present invention and is not intended to limit the scope of the present invention. Any equivalent changes, modifications and combinations made by those skilled in the art without departing from the concept and principle of the present invention shall fall within the scope of protection of the present invention.

Claims

1. An industrial 5G security analysis method (100) based on state analysis, characterized in that: The method comprises: Security status analysis (S101), performing security status analysis based on 5G traffic characteristics and a security status database; If the safety status analysis fails, an alarm is issued; Whitelist verification (S102), verifying whether the source of 5G traffic exists in the whitelist; If not, call the police; Asset analysis (S103), verifying whether the assets conform to the definition in the asset database; If not, call the police; Trust analysis (S104), verifying whether the 5G traffic complies with the traffic status database definition; If not, call the police; Behavior analysis (S105) verifies whether the 5G traffic complies with the behavior database definition: If not, call the police.

2. The method according to claim 1, characterized in that The 5G traffic characteristics further include: The fingerprint of 5G routing in traffic, the IP address range of the local port of 5G routing, and the general protocol characteristics of 5G traffic.

3. The method according to claim 1, characterized in that The security status analysis further includes: Connection statistics and abnormal connection number detection, 5G traffic protocol number, abnormal protocol traffic, and abnormal file or message content in the traffic.

4. The method according to claim 1, characterized in that: The traffic status database definition further includes: Allowed protocols, allowed ports, client types, and protocol tags for certain fields in the traffic.

5. The method according to claim 1, characterized in that The behavior database definition includes: The command type, valid command parameters, and valid command parameter ranges in a specific protocol.

6. An industrial 5G security analysis device based on state analysis, characterized in that: The device comprises: A security status analysis module (201) is configured to: perform security status analysis based on 5G traffic characteristics and a security status database; If the safety status analysis fails, an alarm is issued; A whitelist verification module (202) is configured to: verify whether the source of the 5G traffic exists in the whitelist; If not, call the police; The asset analysis module (203) is configured to: verify whether the asset complies with the definition of the asset database; If not, call the police; The trust analysis module (204) is configured to: verify whether the 5G traffic complies with the traffic status database definition; If not, call the police; The behavior analysis module (205) is configured to: check whether the 5G traffic complies with the behavior database definition: If not, call the police.

7. The device according to claim 6, characterized in that The 5G traffic characteristics further include: The fingerprint of 5G routing in traffic, the IP address range of the local port of 5G routing, and the general protocol characteristics of 5G traffic.

8. The device according to claim 6, characterized in that The security status analysis further includes: Connection statistics and abnormal connection number detection, 5G traffic protocol number, abnormal protocol traffic, and abnormal file or message content in the traffic.

9. The device according to claim 6, characterized in that The traffic status database definition further includes: Allowed protocols, allowed ports, client types, and protocol tags for certain fields in the traffic.

10. The device according to claim 6, characterized in that The behavior database definition includes: The command type, valid command parameters, and valid command parameter ranges in a specific protocol.

11. An electronic device (300), comprising: at least one processor (310); as well as A memory (320) coupled to the at least one processor (310), the memory (320) being used to store instructions, which, when executed by the at least one processor (310), causes the processor (310) to perform the method according to any one of claims 1 to 5.

12. A computer-readable storage medium having computer instructions stored thereon, wherein the computer instructions, when executed, execute the method according to any one of claims 1 to 5.

13. A computer program product, characterized in that The invention comprises a computer program, which, when executed by a processor, implements the method according to any one of claims 1 to 5.

Images