CN110933054B - Data network security protection method and device, computer equipment and storage medium - Google Patents

Data network security protection method and device, computer equipment and storage medium Download PDF

Info

Publication number
CN110933054B
CN110933054B CN201911134208.1A CN201911134208A CN110933054B CN 110933054 B CN110933054 B CN 110933054B CN 201911134208 A CN201911134208 A CN 201911134208A CN 110933054 B CN110933054 B CN 110933054B
Authority
CN
China
Prior art keywords
data network
check
result
data
inspection
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN201911134208.1A
Other languages
Chinese (zh)
Other versions
CN110933054A (en
Inventor
史增树
杨滨茂
张启鹤
马研
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Beijing Swjtu Richsun Tech Co ltd
Original Assignee
Beijing Swjtu Richsun Tech Co ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Beijing Swjtu Richsun Tech Co ltd filed Critical Beijing Swjtu Richsun Tech Co ltd
Priority to CN201911134208.1A priority Critical patent/CN110933054B/en
Publication of CN110933054A publication Critical patent/CN110933054A/en
Application granted granted Critical
Publication of CN110933054B publication Critical patent/CN110933054B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/145—Countermeasures against malicious traffic the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Virology (AREA)
  • Storage Device Security (AREA)
  • Telephonic Communication Services (AREA)

Abstract

The application relates to a data network safety protection method, a device, computer equipment and a storage medium, wherein the method comprises the steps of carrying out control check on a data network to obtain a control check result; the control check comprises the check of the control operation of the logged user account on the data network; carrying out program inspection on the data network to obtain a program inspection result; the program check comprises checking the application installed on the data network; carrying out data inspection on the data network to obtain a data inspection result; the data check comprises checking data information entering and leaving the data network; performing connection inspection on the data network to obtain a connection inspection result; the connection check comprises checking the internal and external connection relation of the data network; and carrying out safety control on the data network according to the inspection result. The railway signal safety data network has the advantages that the inside and outside full protection of the railway signal safety data network is realized, the sealing performance and the independence of the railway signal safety data network are ensured, and the railway signal safety data network has high-level safety protection capability.

Description

Data network security protection method and device, computer equipment and storage medium
Technical Field
The present application relates to the field of network and information security technologies, and in particular, to a method and an apparatus for data network security protection, a computer device, and a storage medium.
Background
The signal safety data network is a special communication network of each control system of a railway signal system, and each controlled subsystem, such as a train control center, a computer interlock, a temporary speed limiting server and a wireless automatic blocking system, is a train operation field control and execution system, and ensures the safe, orderly, stable and reliable operation of a train. After the signal safety data network is damaged by invasion, the train runs out of control, and the social order and public benefits, personal and property safety of people are seriously threatened.
In the traditional technology, the signal safety data network is isolated from an external system only through a firewall, and an ordinary firewall cannot effectively intercept invasion behaviors to the signal safety data network, so that the operation and maintenance safety of the railway signal safety data network cannot be guaranteed.
Disclosure of Invention
In view of the foregoing, it is desirable to provide a data network security protection method, apparatus, computer device and storage medium.
In one aspect, the present application provides a data network security protection method, where the method includes:
carrying out control inspection on the data network to obtain a control inspection result; the control check comprises check of control operation of the logged-in user account on the data network;
carrying out program inspection on the data network to obtain a program inspection result; wherein the program inspection comprises inspection of the data network installed application program;
carrying out data inspection on the data network to obtain a data inspection result; wherein the data inspection comprises inspection of data information entering and exiting the data network;
performing connection inspection on the data network to obtain a connection inspection result; wherein the connection check comprises checking internal and external connection relationships of the data network;
and carrying out safety control on the data network according to the control check result, the program check result, the data check result and the connection check result.
In another aspect, the present application provides a data network security device, comprising:
the control inspection module is used for carrying out control inspection on the data network to obtain a control inspection result; the control check comprises check of control operation of the logged-in user account on the data network;
the program checking module is used for checking the program of the data network to obtain a program checking result; wherein the program inspection comprises inspection of the data network installed application program;
the data inspection module is used for carrying out data inspection on the data network to obtain a data inspection result; wherein the data inspection comprises inspection of data information entering and exiting the data network;
the connection checking module is used for checking the connection of the data network to obtain a connection checking result; wherein the connection check comprises checking internal and external connection relationships of the data network;
and the safety control module is used for carrying out safety control on the data network according to the control check result, the program check result, the data check result and the connection check result.
In another aspect, the present application provides a computer device comprising a memory and a processor, the memory storing a computer program, the processor implementing the steps of any of the above methods when executing the computer program.
In another aspect, the present application provides a computer readable storage medium having stored thereon a computer program which, when executed by a processor, implements the steps of the method of any of the above.
According to the method, the control check of the control operation of the data network is performed through the logged user account, and the program check of the application program installed in the data network is performed, so that the environmental safety check of the railway signal safety data network is realized, and illegal invasion caused by access of any user account to any service area in the railway signal safety data network, installation of the program and operation of any installation program is avoided; by data inspection of data information entering and exiting the data network and connection inspection of the internal and external connection relation of the data network, boundary safety inspection of the data network is realized, the safety of data transmission is ensured, illegal invasion caused by data transmission is avoided, safety data in the railway signal safety data network are prevented from being damaged and stolen, the boundary integrity of the railway signal safety data network is ensured, and the railway signal safety data network can work safely and stably. The railway signal safety data network is protected in all aspects from the inside and the outside, the sealing performance and the independence of the railway signal safety data network are guaranteed, and the railway signal safety data network has high-level safety protection capability.
Drawings
FIG. 1 is a schematic flow chart illustrating a method for securing a data network according to an embodiment of the present disclosure;
FIG. 2 is a schematic flow chart of step 101 in one embodiment provided herein;
FIG. 3 is a schematic flow chart of step 203 in one embodiment provided herein;
FIG. 4 is a schematic flow chart of step 204 in one embodiment provided herein;
FIG. 5 is a schematic flow chart of step 102 in one embodiment provided herein;
FIG. 6 is a schematic flow chart of step 104 in one embodiment provided herein;
FIG. 7 is a block diagram of a data network security guard according to an embodiment of the present disclosure;
FIG. 8 is a diagram of an internal structure of a computer device in one embodiment provided herein.
Detailed Description
In order to make the objects, technical solutions and advantages of the present application more apparent, the present application is described in further detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the present application and are not intended to limit the present application.
The data network safety protection method can be applied to a railway signal safety data network, and is used for controlling and checking the control operation of the railway signal safety data network through logging in a user account, checking the installation application program of the railway signal safety data network through the user account, checking data information entering and exiting the railway signal safety data network, and checking the connection relation between the inside and the outside of the railway signal safety data network, so that the comprehensive safety check of the environment, the boundary and the communication network of the railway signal safety data network is realized. The method can also be applied to other data networks with high safety requirements, such as public security data networks, government data networks, enterprise internal data networks and the like, and the method can be used for carrying out safety control processing on the data networks with high safety requirements.
In one embodiment, as shown in fig. 1, a data network security protection method is provided, which is described by taking the method as an example of being applied to a railway signal security data network, and includes the following steps:
and step 101, performing control inspection on the data network to obtain a control inspection result.
The control check comprises check of control operation of the logged-in user account on the data network.
Specifically, the computer equipment logs in a railway signal security data network through a user account, and control check is carried out on control operation carried out through the user account. The control check comprises the control operation performed by the user account, whether the service area corresponding to the railway signal security data network has the access right is checked, and a control check result is obtained according to whether the user account has the access right in the corresponding service area. If the access authority exists, the control check result is safe; and if the access right does not exist, the control check result is unsafe.
And 102, carrying out program inspection on the data network to obtain a program inspection result.
Wherein the program inspection comprises an inspection of the data network installed application.
Specifically, the computer device checks whether the user account number has an installation authority for installing the application program in a service area corresponding to the railway signal safety data network, and checks whether the installed application program has a normal operation authority in the railway signal safety data network, so as to obtain a program check result according to whether the user account number has the installation authority and whether the application program has the operation authority. If the user account has an installation authority and the installed application program has an operation authority, the program check result is safe; and if the user account has no installation authority or the installed application program has no operation authority, the program check result is unsafe.
And 103, carrying out data inspection on the data network to obtain a data inspection result.
Wherein the data inspection comprises inspection of data information entering and exiting the data network.
Specifically, the computer device checks whether the information attribute of the external data information entering and exiting the boundary between the external system and the railway signal safety data network and the information attribute of the internal data information entering and exiting the boundary between different service areas in the railway signal safety data network are normal or not, and obtains a data checking result. If the information attributes of the external data information and the internal data information are normal, the data inspection result is safe; and if the information attribute of the external data information or the internal data information is abnormal, the data checking result is unsafe.
And step 104, performing connection check on the data network to obtain a connection check result.
Wherein the connection check comprises checking the connection relation between the inside and the outside of the data network.
Specifically, the computer device checks whether the connection relationship of the external device between the external system and the railway signal security data network is allowed or not, checks whether the connection relationship of the internal device between different service areas in the railway signal security data network is allowed or not, further checks whether the network address connected with the railway signal security data network is allowed or not, and obtains a connection check result according to the check whether the connection relationship of the external device is allowed or not, the check whether the connection relationship of the internal device is allowed or not and the check whether the connected network address is allowed or not. If the connection relation of the external equipment is allowed, the internal connection relation is allowed, and the connected network address is allowed, the connection checking result is safe; and if the connection relation of the external equipment is forbidden, the internal connection relation is forbidden, or the connected network address is forbidden, the connection checking result is unsafe.
And 105, performing safety control on the data network according to the control check result, the program check result, the data check result and the connection check result.
Specifically, when the control check result is safe, the computer device allows the user account to perform control operation on the service area; and when the control check result is unsafe, the computer equipment prohibits the control operation of the user account on the service area. When the program check result is safe, allowing the user account to install an application program in a service area corresponding to the railway signal safety data network by the computer equipment; and when the program check result is unsafe, the computer equipment prohibits the user account from installing the application program in the service area corresponding to the railway signal safety data network, or prohibits the application program from running in the service area. When the data checking result is safe, allowing the external data information to enter and exit the boundary between the external system and the railway signal safety data network and allowing the internal data information to enter and exit the boundary between different service areas in the railway signal safety data network by the computer equipment; and when the data checking result is unsafe, the computer equipment prohibits the external data information from entering and exiting the boundary between the external system and the railway signal safety data network or prohibits the internal data information from entering and exiting the boundary between different service areas in the railway signal safety data network. When the connection check result is safe, allowing the external connection relation, allowing the internal connection relation and allowing the network address of the railway signal safety data network connection by the computer equipment; and when the connection check result is unsafe, the computer equipment forbids the external connection relation, and/or forbids the internal connection relation, and/or forbids the network address of the railway signal safety data network connection.
In the embodiment, the control check and the program check realize the environmental security check of the railway signal security data network, and avoid illegal invasion caused by access of any user account to any service area in the railway signal security data network, program installation and operation of any installation program; the data inspection and the connection inspection are used for realizing the boundary safety inspection of the data network, ensuring the safety of data transmission, avoiding illegal invasion caused by data transmission, damaging and stealing the safety data in the railway signal safety data network, and ensuring the boundary integrity of the railway signal safety data network, so that the railway signal safety data network can work safely and stably. The railway signal safety data network is protected in all aspects from the inside and the outside, the sealing performance and the independence of the railway signal safety data network are guaranteed, and the railway signal safety data network has high-level safety protection capability.
In another embodiment, in step 101, performing a control check on the data network, and before obtaining a control check result, the method further includes: and carrying out user identity authentication on the user to obtain an identity authentication result.
And the user identity authentication is identity validity check whether the user identity executing the operation of logging in the railway signal safety data network is legal or not.
Specifically, the computer device performs identity validity check on the user identity in a two-factor authentication form. When each user logs in the railway signal security data network, the identity is indicated by inputting a user account, each user account is provided with a hardware device USB-KEY, the user account corresponds to an account password, and the USB-KEY corresponds to a PIN code. When a user logs in the railway signal security data network, the USB-KEY is required to be correspondingly accessed to a service area in the railway signal security data network to be accessed, the user account is input, the account password corresponding to the user account and the PIN code corresponding to the USB-KEY are correspondingly input, if and only if the computer equipment detects that the USB-KEY is accessed and the account password and the PIN code are input correctly, the user identity using the user account is determined to be legal identity, the identity authentication result is safe, the computer equipment allows the user using the user account to log in the railway signal security data network, and the step 101 is executed; if only one of the account information (the user account and the account password) and the hardware information (the hardware USB-KEY and the PIN code corresponding to the user account) is login information, or only one group of the account information and the hardware information is correctly matched with the password, the identity authentication result is unsafe. The secure data storage space in the USB-KEY stores data such as digital certificates, KEYs and the like, and cannot be derived, and hardware of the USB-KEY cannot be copied.
In this embodiment, before performing environmental security check and boundary security check on the railway signal security data network, a two-factor authentication form is adopted to perform identity validity check on the identity of a user who logs in the railway signal security data network. The legality check of the user identity is realized by double verification of account information and hardware information, the account information and the hardware information form a double factor of whether the user identity is legal, and only if the account information and the hardware information are correctly matched, the user identity using the user account is determined to be legal, and the computer equipment allows the user using the user account to log in the railway signal safety data network. The identity of the user is identified through the dual verification mode, the legality of the identity of the user who performs login operation is guaranteed, and therefore the problems that the user account number is stolen due to single information leakage, and potential safety hazards are caused due to the fact that illegal users invade a railway signal safety data network are avoided.
In another embodiment, as shown in fig. 2, the step 101 of performing control check on the data network to obtain a control check result includes:
step 201, obtaining a control security domain corresponding to the user account according to the authority level of the user account.
The permission level is used for representing the control permission of the user account on different service areas in the data network, and the control security domain is a service area of the user account with the control permission in the data network.
Furthermore, an authority level table is stored in the computer device, the authority level table includes authority levels corresponding to different user accounts, different service areas in the controllable railway signal security data network corresponding to different authority levels are different, and the higher the authority level corresponding to a user account is, the more the service areas controllable by the user account are. The user permission level may be determined according to a job level of a user using the user account. For example, the authority level of the user account used by a department manager is higher, and can control most of the service areas in the railway signal safety data network, and the authority level of the user account used by a common staff is lower, and can control a few of the service areas in the railway signal safety data network.
Specifically, after obtaining a user account input by a user, the computer device compares the user account with the permission level table, and obtains the controllable service area corresponding to the user account as the access security domain according to the permission level table.
Step 202, determining whether the access security domain comprises a target security domain.
And the target security domain is a service area in the data network corresponding to the current control operation of the user account.
Specifically, the computer device takes a service area in the railway signal security data network corresponding to the current control operation of the acquired user account as the target security domain, compares the target security domain with the control security domain, determines whether the control security domain includes the target security domain, and obtains a control check result. And if the control security domain does not comprise the target security domain, the control check result is considered to be unsafe.
Step 203, if the access security domain includes the target security domain, performing security check and integrity check on the control operation to obtain a security check result and an integrity check result.
The confidentiality check is used for checking whether confidentiality grade requirements are met between the user account and the target security domain, and the integrity check is used for checking whether integrity grade requirements are met between the user account and the target security domain.
Specifically, a confidentiality level table and an integrity level table are stored in the computer device. The security level table comprises account security levels corresponding to the user accounts and region security levels corresponding to the target security regions, and the computer equipment obtains the security check result by comparing the account security levels with the region security levels. If the account number confidentiality level and the region confidentiality level meet the confidentiality level, the confidentiality check result is safe; and if the account number confidentiality grade and the area confidentiality grade do not meet the confidentiality grade, the confidentiality check result is unsafe. The integrity level table comprises an account integrity level corresponding to the user account and a region integrity level corresponding to the target security region, and the computer equipment obtains the integrity check result by comparing the account integrity level with the region integrity level. If the account number integrity level and the region integrity level meet the integrity level, the integrity check result is safe; and if the account number integrity level and the area integrity level do not meet the integrity level, the integrity check result is unsafe.
And step 204, obtaining a control check result according to the confidentiality check result and the integrity check result.
Specifically, when there is insecurity in the confidentiality check result and the integrity check result, the control check result is insecurity; and when the confidentiality check result and the integrity check result are both safe, the control check result is safe.
In this embodiment, a Domain and Type Enhancement (DTE) model may be adopted to perform a partitioning operation on the railway signal security data network, and the partitioning operation may be performed according to the service types executed in different service areas in the railway signal security data network. Role-Based Access Control (RBAC) models can be adopted to assign roles to the user account, the roles correspond to different permissions, the Control check of the data network is realized through a DTE model and the RBAC models, and the Control check result is obtained.
In the embodiment, whether the user account has the control authority on the target security domain is checked, if so, the confidentiality grade relation and the integrity grade relation between the user account and the target security domain are further checked, whether the user account has the authority or not is determined to perform the control operation on the whole, and whether the control operation is reasonable is checked, so that the safety protection of the railway signal safety data network from the outside to the inside is realized. The method comprises the following steps that business areas in a railway signal safety data network are divided, so that all the business areas are isolated, and mutual interference and damage are prevented; different control authorities are granted to different user accounts, authority refinement is carried out, the authorities between the user accounts and service areas correspond, unauthorized access is prevented, the protection capability of the railway signal safety data network on each service area is improved, and therefore the whole anti-attack capability of the railway signal safety data network is improved.
In another embodiment, as shown in fig. 3, if the security domain includes the target security domain, the step 203 performs security check and integrity check on the control operation to obtain a security check result and an integrity check result, including:
step 301, determining whether the confidentiality principle is satisfied between the user account and the target security domain according to the confidentiality level relationship between the account confidentiality level of the user account and the region confidentiality level of the target security domain, and obtaining the confidentiality check result.
The account confidentiality grade is used for representing the credibility of the user account, and the higher the credibility of the user account is, the higher the account confidentiality grade is; the zone confidentiality grade is used for representing the importance degree of the business executed by the target safety zone, and the higher the importance degree of the business executed by the target safety zone is, the higher the zone confidentiality grade is; the confidentiality principle is to prohibit data information from being transmitted from a high security level to a low security level.
Specifically, in this embodiment, the account confidentiality level is represented by the trustworthiness level of the user account, and the region confidentiality level is represented by the importance level of the service executed by the target security region. If the security level of the account number obtained by the computer equipment according to the stored security level table is greater than or equal to the region security level, and the security check result is security, the computer equipment allows the user account number to perform control operation on the target security region; and if the security level of the account number obtained by the computer equipment according to the stored security level table is less than the region security level and the security check result is unsafe, the computer equipment prohibits the control operation of the user account number on the target security region.
Step 302, determining whether the integrity principle is satisfied between the user account and the target security domain according to an integrity level relationship between the account integrity level of the user account and the region integrity level of the target security domain, and obtaining the integrity check result.
The account integrity level is used for representing the read-write permission of the user account, and the higher the read-write permission of the user account is, the higher the account integrity level is; the zone integrity level is used for representing the readable and writable degree of the service data in the service zone, and the higher the readable and writable degree of the service data is, the lower the zone integrity level is; the integrity principle is that the user account with the high account integrity level is prohibited from accessing the target security domain with the low region integrity level, and the user account with the low account integrity level is prohibited from modifying the service data in the target security domain with the high region integrity level.
Specifically, in this embodiment, the read-write permission of the user account is used to represent the integrity level of the account, and the readable-write degree of the service data in the target security region is used to represent the integrity level of the region. When the user account browses the target safety area, the computer equipment obtains the account integrity level which is larger than the area integrity level according to a stored integrity level table, the integrity check result is unsafe, the computer equipment prohibits the user account from browsing the target safety area, and if the account integrity level obtained by the computer equipment according to the stored integrity level table is smaller than or equal to the area integrity level, the integrity check result is safe, the computer equipment permits the user account to browse the target safety area; when the user account modifies the service data in the target safety area, the computer device obtains the account integrity level smaller than the area integrity level according to the stored integrity level table, the integrity check result is unsafe, the computer device prohibits the user account from modifying the service data in the target safety area, and if the computer device obtains the account integrity level larger than or equal to the area integrity level according to the stored integrity level table, the integrity check result is safe, the computer device allows the user account to modify the service data in the target safety area.
In this embodiment, the confidentiality check and the integrity check may be implemented by using a BLP (Bell-LaPadual) model and a BIBA (BIBA) model, so as to obtain a confidentiality check result and an integrity check result.
In this embodiment, the computer device obtains the access control check result according to the security check result and the integrity check result, specifically, the trustworthiness degree of the user account is used to represent the security level of the account, the importance degree of the service executed by the target security region is used to represent the security level of the region, the security check result is obtained according to whether the relationship between the security level of the account and the security level of the region meets the security level principle, the read-write permission of the user account is used to represent the integrity level of the account, the readable-write degree of the service data in the target security region is used to represent the integrity level of the region, and the integrity check result is obtained according to whether the relationship between the integrity level of the account and the integrity level of the region meets the integrity level principle. By the method, the requirements on information confidentiality and integrity in network information security are comprehensively considered, the control operation of a subject (a user account) on an object (a target security area) is planned, illegal operation is forbidden, and the network security protection capability of a railway signal security data network is improved.
In another embodiment, as shown in fig. 4, the step 204 of obtaining a control check result according to the confidentiality check result and the integrity check result includes:
step 401, if the security check result is security and the integrity check result is security, the access control check is security.
Specifically, the computer device obtains that the confidentiality principle is satisfied between the user account and the target security domain according to the confidentiality principle, and the confidentiality check result is safe; and according to the integrity principle, if the user account and the target security domain meet the integrity principle, the integrity check result is safe. And if the confidentiality check result and the integrity check result are both safe, the control check result is safe.
Step 402, if the security check result is safe and the integrity check result is unsafe, and when the region security level is greater than the region integrity level, the account integrity level is adjusted to be safe, and the control check result is safe.
Specifically, the computer device obtains that the confidentiality principle is satisfied between the user account and the target security domain according to the confidentiality principle, and the confidentiality check result is safe; and obtaining that the integrity principle is not satisfied between the target security domains of the user account according to the integrity principle, and determining that the integrity check result is unsafe. When the confidentiality requirement on the target safety area is higher than the integrity requirement, namely when the area confidentiality level is higher than the area integrity level, the account number integrity level is adjusted to ensure that the integrity check result is safe. For example, when the user account browses the target security area and the security check result is secure, the computer device may decrease the account integrity level until the account integrity level is less than or equal to the area integrity level, so that the access control check is secure.
Further, if the security check result is secure, the integrity check result is not secure, and when the area integrity level is higher than the area security level, the account integrity level is not allowed to be adjusted, and since the integrity check result is not secure, the control check is not secure.
And 403, if the security check result is unsafe, the integrity check result is safe, and when the area integrity level is greater than the area security level, the account security level is adjusted to be safe, and the control check is safe.
Specifically, the computer device obtains that the confidentiality principle is not satisfied between the user account and the target security domain according to the confidentiality principle, and the confidentiality check result is unsafe; and according to the integrity principle, if the target security domains of the user account satisfy the integrity principle, the integrity check result is safe. When the integrity requirement of the target safety area is higher than the confidentiality requirement, namely when the area integrity level is higher than the area confidentiality level, the account confidentiality level is adjusted to ensure that the confidentiality check result is safe. For example, since the security check result is unsafe because the security level of the account number is less than the region security level, the computer device may increase the security level of the account number until the security level of the account number is greater than or equal to the region security level, so that the security check result is safe, and the control check is safe.
Further, if the security check result is not secure, the integrity check result is secure, and when the region security level is higher than the region integrity level, the account security level is not allowed to be adjusted, and since the security check result is not secure, the control check is not secure.
And step 404, if the security check result is not secure and the integrity check result is not secure, the control check is not secure.
Specifically, the computer device obtains that the confidentiality principle is not satisfied between the user account and the target security domain according to the confidentiality principle, and the confidentiality check result is unsafe; and according to the integrity principle, if the integrity principle is not satisfied between the user account and the target security domain, the integrity check result is unsafe. And if the confidentiality check result and the integrity check result are both unsafe, the control check result is unsafe.
In this embodiment, the control check result depends on the confidentiality check result and the integrity check result, and the control check result is safe only when both the confidentiality check result and the integrity check result are safe. When the confidentiality levels of different areas and the integrity levels of different service areas in the railway signal safety data network are faced, the confidentiality level of the account number and the integrity level of the account number can be adaptively adjusted, so that the control check result is safe, the initiative and the flexibility of safety protection of the railway signal safety data network are realized, and the problem that the safety control operation cannot be performed due to the fact that a safety protection system is not flexible enough is avoided.
In another embodiment, as shown in fig. 5, the step 102 of performing a program check on the data network to obtain a program check result includes:
step 501, performing installation account number inspection on the user account number performing application program installation operation in the data network according to the trusted installation account number, and obtaining an account number inspection result.
The trusted installation account number comprises a trusted account number capable of carrying out installation application program operation on the data network.
Specifically, the computer device prestores the trusted installation account in a white list mode, and compares the user account for performing program installation application program operation on the railway signal data network with the trusted installation account to obtain the account checking result. If the trusted installation account includes the user account and the installation check result is safe, allowing the user account to install the application program on the data network by the computer equipment; if the trusted installation account does not include the user account and the account check result is unsafe, the computer equipment prohibits the user account from installing the application program on the data network. For example, a user uses a user account XXXX to install a certain application program in a certain service area of the railway signal safety data network, and if the computer device obtains that the user account XXXX is an untrusted account according to a trusted installation account, the user is prohibited from using the user account XXXX to install the application program in the certain service area of the railway signal safety data network.
Step 502, performing program behavior check on the installed application program according to the trusted application program to obtain a behavior check result.
Wherein the trusted application comprises a program that performs trusted operational behavior in the data network.
Specifically, the computer device prestores the trusted application program in a white list mode, and performs program behavior check on the application program installed in the railway signal security data network by using the user account to obtain a behavior check result. If the trusted application program comprises the installed application program and the behavior check result is safe, the computer device executes step 503; and if the trusted application program does not comprise the installed application program, and the behavior check result is unsafe, the computer equipment prohibits the installed application program from running in the railway signal safety data network. For example, a user uses a user account to install an application program Y into a certain service area of the railway signal safety data network, and the computer device obtains that the installed application program Y is an untrusted application program according to the trusted application program, and then prohibits the application program Y from running in the railway signal safety data network.
And 503, carrying out system program inspection on the data network system program called by the application program according to the trusted system program to obtain a system inspection result.
Wherein the trusted system program is a system program which allows the application program to call in the data network by the application program;
specifically, the computer device prestores the trusted system program in a white list mode, and performs system program inspection on the application program installed in the railway signal safety data network by using the user account to obtain a system inspection result. If the trusted system program comprises a system program used when the installed application program runs and the program check result is safe, the computer equipment allows the installed application program to run in the railway signal safety data network; and if the trusted system program does not comprise the system program used when the installed application program runs, and the system check result is unsafe, the computer equipment prohibits the installed application program from running in the railway signal safety data network. For example, a user uses a user account to install a certain application program Y into a certain service area of the railway signal safety data network, the application program Y will use a system program W in the railway signal safety data network when running, and the computer device prohibits the application program Y from running in the railway signal safety data network if the called system program W is an untrusted system program according to the trusted system program.
And step 504, obtaining an installer checking result according to the account checking result, the behavior checking result and the system checking result.
Specifically, if the account number checking result, the behavior checking result and the system checking result are unsafe, the installer checking result is unsafe; and if the account number checking result, the behavior checking result and the system checking result are all safe, the installing program checking result is safe.
In this embodiment, when an application is installed in the railway signal security data network, it is first checked whether a user account for installing the application is trusted, if the user account is trusted, it is further checked whether the installed application is a trusted application, and if the application is trusted, it is further checked whether a system program called when the application is running is a system program that allows the application to be called, so that installation of the application is progressively checked layer by layer from a source to the application itself and then to the running of the application. The method has the advantages that program installation operation is carried out on unauthorized user accounts, operation of application programs which are not in line with expectation is prevented in time, active defense on known/unknown malicious codes is achieved, all links with potential safety hazards existing in the installation of the application programs are protected, and the risk that the integrity and the usability of a railway signal safety data network are damaged is reduced.
In another embodiment, the step 103 of performing data inspection on the data network to obtain the data inspection result includes:
and carrying out data inspection on the data information transmitted to the data network according to the packet filtering strategy to obtain a data inspection result.
The packet filtering policy is a policy for managing and controlling the data information according to a data packet comparison result, and the data packet comparison result is a comparison result of data packet attribute information of the data information and preset attribute information. The data information comprises external data information entering and exiting a boundary between an external system and the railway signal safety data network and internal data information entering and exiting a boundary between different service areas in the railway signal safety data network.
Specifically, the computer device collects external data information entering and exiting a boundary between an external system and a railway signal safety data network through a mirror image port of a switch in the railway signal safety data network, collects internal data information entering and exiting the boundary between different areas of the railway signal safety data network, and performs data inspection on data packets in the external data information and the internal data information one by one according to the packet filtering strategy. And the data inspection is to compare the attribute information of the data packet with preset attribute information according to a packet filtering strategy aiming at the packet head of each data packet. If the data packet data information is the same as the preset attribute information and the data inspection result is safe, allowing the external data information to enter and exit the boundary between the external system and the railway signal safety data network and allowing the internal data information to enter and exit the boundary between different service areas in the railway signal safety data network by the computer equipment; and if the data packet data information is different from the preset attribute information and the data inspection result is unsafe, the computer equipment prohibits the external data information from entering and exiting the boundary between the external system and the railway signal safety data network or prohibits the internal data information from entering and exiting the boundary between different service areas in the railway signal safety data network. The packet filtering policy is implemented at an IP layer, and the packet attribute information includes header information of the packet, such as a source IP address, a destination IP address, a protocol type (a TCP packet, a UDP packet, and an ICMP packet), a source port (a TCP or a UDP), and a destination port (a TCP or a UDP), and data information related to a data transmission process, such as a transmission direction of the packet.
In the embodiment, a packet filtering strategy is adopted to carry out data inspection on external data information entering and exiting a boundary between an external system and the railway signal safety data network and internal data information entering and exiting the boundary between different areas between the railway signal safety data network, the data information entering and exiting the boundary is filtered and intercepted, illegal data is prevented from passing through the boundary, attack and diffusion of network viruses are avoided, an operating-system-free and network-protocol-free design is adopted for a mirror image port, and attack behaviors generated from a network level and by utilizing operating system loopholes are avoided, so that the safety protection capability of the railway signal safety data network is improved.
In another embodiment, as shown in fig. 6, the step 104 of performing connection check on the data network to obtain a connection check result further includes:
step 601, performing device connection check on the connection relation of the external device and the connection relation of the internal device according to the connection relation of the trusted device to obtain a device check result.
The trusted connection relationship is a connection relationship between allowed connection devices, the external device connection relationship is a connection relationship between an external device outside the data network and an internal device inside the data network, and the internal connection relationship is a connection relationship between internal devices inside the data network.
Further, the computer device prohibits illegal inlining. The illegal inline connection described in this embodiment refers to an internal network connection that is not allowed. The illegal inline connection comprises a connection relation between the external equipment which does not accord with the trusted connection relation and internal equipment in the railway signal safety data network, and a connection relation between the internal equipment in the railway signal safety data network which does not accord with the trusted connection relation.
Furthermore, the computer can also adopt 802.1X authentication to the external equipment accessed to the railway signal safety data network, and limits unauthorized equipment to access the LAN/WLAN through the access port, and after the authentication is passed, normal data information can smoothly pass through the Ethernet port and enter the railway signal safety data network.
Specifically, the computer device binds the IP/MAC addresses of the internal device and the external device with the IP/MAC addresses or port addresses of other internal devices that are correspondingly accessible in the railway signal security data network, as the trusted connection relationship. The computer equipment acquires the connection relation among the internal equipment, the external equipment and other internal equipment in the railway signal safety data network, compares the connection relation with the credible connection relation, and if the connection relation accords with the credible connection relation, the equipment inspection result is safe; and if the connection relation does not conform to the trusted connection relation, the equipment checking result is unsafe.
Step 602, performing network connection check on the network address connected to the data network according to the forbidden internet address to obtain a network check result.
Further, the computer device prohibits illegal external connections. The illegal external connection in this embodiment refers to an internet connection that is not allowed, and the illegal external connection includes all internet connections.
Specifically, the computer device obtains a network address logged in through the railway signal security data network, compares the prohibited internet address with the network address, and if the prohibited internet address does not include the network address, the network check result is safe; and if the forbidden internet address comprises the network address, the network inspection result is unsafe.
Step 603, obtaining a connection checking result according to the equipment checking result and the network checking result.
Specifically, if the device check result is security and the network check result is security, the connection check result is security; and if the equipment checking result is unsafe and/or the network checking result is unsafe, the connection checking result is unsafe.
In this embodiment, an IP/MAC address binding manner is adopted to check an external connection relationship between an external device accessed to the railway signal security data network and an internal device in the railway signal security data network and an internal connection relationship between internal devices in the railway signal security data network, so as to obtain whether the external connection relationship and the internal connection relationship correspond to a preset IP/MAC address binding relationship, thereby realizing the check of the connection relationship between the internal device and the internal device in an internal network connection state; and checking the network address connected with the railway signal safety data network by adopting a mode of forbidding internet connection so as to forbid internet connection. The network protection of intranet connection and extranet connection is realized on the whole, and potential safety hazards caused by equipment connection relation errors and the invasion of internet viruses are avoided.
In another embodiment, the data network security protection method further includes:
carrying out equipment inspection on external equipment accessed to the data network to obtain an equipment inspection result;
and carrying out safety control on the external equipment according to the equipment inspection result.
The external equipment comprises a USB flash disk, WIFI, Bluetooth, a wireless network card and other movable media.
Specifically, the computing device obtains a device ID of an external device accessing the data network, where the device ID is used to represent a specific external device, a legal device ID is preset in a white list form, and the device check result is obtained according to the legal device ID and the device ID. When the legal ID comprises the equipment ID, the equipment checking result is safe, and the computer equipment allows the external equipment to access the data network; and when the legal ID does not comprise the equipment ID, the equipment detection result is unsafe, and the computer equipment prohibits the external equipment from accessing the data network.
In another embodiment, the computer device may preset an illegal device ID in the form of a blacklist, and obtain the device check result according to the illegal ID and the device ID. And if the device ID representing the wireless network card is set as the illegal ID, the access of the wireless network card to the data network is forbidden.
In the embodiment, the external equipment accessed to the railway signal safety data network is further subjected to equipment management and control, the external equipment with legal equipment ID is allowed to enter according to the equipment ID, the external equipment with illegal equipment ID is forbidden to access, the access authentication of the external equipment is realized, the external equipment accessed to the railway signal safety data network is guaranteed to be real and credible, and a first safety protection barrier of the railway signal safety data network is constructed.
In another embodiment, the data network security protection method further includes network management data ferrying, performing generic protocol stripping and proprietary protocol encapsulation transmission on data received from an Element Management System (EMS), and then performing the proprietary protocol stripping and generic protocol encapsulation transmission on the data to other service areas in the railway signal security data network, realize safety isolation between networks on the basis of ensuring data transmission, the application data stripped of the universal protocol is upper layer application data without the format of the universal protocol, through the encapsulation transmission of the private protocol, the safety ferry of data is realized, and the safety problems that illegal access and malicious attack cannot be intercepted by using the universal protocol transmission, illegal commands or instructions cannot be blocked, and the safety problems of artificial misoperation, malicious damage and the like in operation and maintenance work cannot be managed are avoided, so that the safety of data transmission is improved.
In another embodiment, the data network security protection method further includes:
and recording any one of the control operation, the inspection result and the safety control.
Specifically, the computer device records control operation of a user on the railway signal safety data network through logging in a user account, program inspection of an application program installed in the railway signal safety data network, data inspection of data information entering and exiting the railway signal safety data network, connection inspection of internal and external connection relations of the railway signal safety data network, and records corresponding inspection results and safety control operation performed on the inspection results. If the user logs in a certain area in the railway signal safety data network through the user account XXXX, and the control check result is determined to be unsafe because the access of the USB-KEY is not detected, the login of the user account XXXX is forbidden, and the computer records the whole process and the result caused by the login.
In the embodiment, the whole protection process is recorded so as to definitely record the operation behavior of the user and the decision result made by the corresponding safety mechanism, and an audit log is formed and stored in the audit information base, so that the user can know the running state of each terminal in time and can search for the alleys after a safety accident occurs, the state of the railway signal safety data network can be known, and the running can be controlled, and the protection process of the whole railway signal safety data network can be managed conveniently and quickly.
It should be understood that although the various steps in the flow charts of fig. 1-6 are shown in order as indicated by the arrows, the steps are not necessarily performed in order as indicated by the arrows. The steps are not performed in the exact order shown and described, and may be performed in other orders, unless explicitly stated otherwise. Moreover, at least some of the steps in fig. 1-6 may include multiple sub-steps or multiple stages that are not necessarily performed at the same time, but may be performed at different times, and the order of performance of the sub-steps or stages is not necessarily sequential, but may be performed in turn or alternating with other steps or at least some of the sub-steps or stages of other steps.
In one embodiment, as shown in fig. 7, there is provided a data network security device comprising:
a control checking module 710, configured to perform control checking on the data network to obtain a control checking result; the control check comprises check of control operation of the logged-in user account on the data network;
a program checking module 720, configured to perform program checking on the data network to obtain a program checking result; wherein the program inspection comprises inspection of the data network installed application program;
the data inspection module 730 is used for performing data inspection on the data network to obtain a data inspection result; wherein the data inspection comprises inspection of data information entering and exiting the data network;
a connection checking module 740, configured to perform connection checking on the data network to obtain a connection checking result; wherein the connection check comprises checking internal and external connection relationships of the data network;
and a security management and control module 750, configured to perform security management and control on the data network according to the control check result, the program check result, the data check result, and the connection check result.
For specific limitations of the data network security protection device, reference may be made to the above limitations of the data network security protection method, which are not described herein again. All or part of each module in the data network safety protection device can be realized by software, hardware and a combination thereof. The modules can be embedded in a hardware form or independent from a processor in the computer device, and can also be stored in a memory in the computer device in a software form, so that the processor can call and execute operations corresponding to the modules.
In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as shown in fig. 8. The computer device includes a processor, a memory, a network interface, and a database connected by a system bus. Wherein the processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device comprises a nonvolatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operation of an operating system and computer programs in the non-volatile storage medium. The database of the computer device is used for storing the data of the data network safety protection method. The network interface of the computer device is used for communicating with an external terminal through a network connection. The computer program is executed by a processor to implement a data network security method.
Those skilled in the art will appreciate that the architecture shown in fig. 8 is merely a block diagram of some of the structures associated with the disclosed aspects and is not intended to limit the computing devices to which the disclosed aspects apply, as particular computing devices may include more or less components than those shown, or may combine certain components, or have a different arrangement of components.
In one embodiment, a computer device is provided, comprising a memory and a processor, the memory having a computer program stored therein, the processor implementing the following steps when executing the computer program:
carrying out control inspection on the data network to obtain a control inspection result; the control check comprises check of control operation of a user account which logs in the data network on the data network;
carrying out program inspection on the data network to obtain a program inspection result; wherein the program inspection comprises inspection of the data network installed application program;
carrying out data inspection on the data network to obtain a data inspection result; wherein the data inspection comprises inspection of data information entering and exiting the data network;
performing connection inspection on the data network to obtain a connection inspection result; wherein the connection check comprises checking internal and external connection relationships of the data network;
and carrying out safety control on the data network according to the control check result, the program check result, the data check result and the connection check result.
In one embodiment, a computer-readable storage medium is provided, having a computer program stored thereon, which when executed by a processor, performs the steps of:
carrying out control inspection on the data network to obtain a control inspection result; the control check comprises check of control operation of the logged-in user account on the data network;
carrying out program inspection on the data network to obtain a program inspection result; wherein the program inspection comprises inspection of the data network installed application program;
carrying out data inspection on the data network to obtain a data inspection result; wherein the data inspection comprises inspection of data information entering and exiting the data network;
performing connection inspection on the data network to obtain a connection inspection result; wherein the connection check comprises checking internal and external connection relationships of the data network;
and carrying out safety control on the data network according to the control check result, the program check result, the data check result and the connection check result.
It will be understood by those skilled in the art that all or part of the processes of the methods of the embodiments described above can be implemented by hardware instructions of a computer program, which can be stored in a non-volatile computer-readable storage medium, and when executed, can include the processes of the embodiments of the methods described above. Any reference to memory, storage, database, or other medium used in the embodiments provided herein may include non-volatile and/or volatile memory, among others. Non-volatile memory can include read-only memory (ROM), Programmable ROM (PROM), Electrically Programmable ROM (EPROM), Electrically Erasable Programmable ROM (EEPROM), or flash memory. Volatile memory can include Random Access Memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms such as Static RAM (SRAM), Dynamic RAM (DRAM), Synchronous DRAM (SDRAM), Double Data Rate SDRAM (DDRSDRAM), Enhanced SDRAM (ESDRAM), Synchronous Link DRAM (SLDRAM), Rambus Direct RAM (RDRAM), direct bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).
The technical features of the above embodiments can be arbitrarily combined, and for the sake of brevity, all possible combinations of the technical features in the above embodiments are not described, but should be considered as the scope of the present specification as long as there is no contradiction between the combinations of the technical features.
The above-mentioned embodiments only express several embodiments of the present application, and the description thereof is more specific and detailed, but not construed as limiting the scope of the invention. It should be noted that, for a person skilled in the art, several variations and modifications can be made without departing from the concept of the present application, which falls within the scope of protection of the present application. Therefore, the protection scope of the present patent shall be subject to the appended claims.

Claims (9)

1. A method for securing a data network, the method comprising:
carrying out control inspection on the data network to obtain a control inspection result; the control check comprises check of control operation of the logged-in user account on the data network;
carrying out program inspection on the data network to obtain a program inspection result; wherein the program inspection comprises inspection of the data network installed application program;
carrying out data inspection on the data network to obtain a data inspection result; wherein the data inspection comprises inspection of data information entering and exiting the data network;
performing connection inspection on the data network to obtain a connection inspection result; wherein the connection check comprises checking internal and external connection relationships of the data network;
according to the control check result, the program check result, the data check result and the connection check result, performing safety control on the data network;
the control inspection of the data network to obtain a control inspection result comprises the following steps:
acquiring a control security domain corresponding to the user account according to the authority level of the user account; the authority level is used for representing the control authority of the user account on different service areas in the data network, and the control security domain is a service area of the user account with control authority in the data network;
determining whether a target security domain is included in the control security domain; the target security domain is a service area in the data network corresponding to the current control operation of the user account;
if the control security domain comprises the target security domain, performing confidentiality check and integrity check on the control operation to obtain a confidentiality check result and an integrity check result; the confidentiality check is used for checking whether confidentiality grade requirements are met between the user account and the target security domain, and the integrity check is used for checking whether integrity grade requirements are met between the user account and the target security domain;
and obtaining a control check result according to the confidentiality check result and the integrity check result.
2. The method of claim 1, wherein said performing a security check and an integrity check on said control to obtain a security check result and an integrity check result comprises:
determining whether the confidentiality principle is met between the user account and the target security domain according to the confidentiality grade relation between the account confidentiality grade of the user account and the region confidentiality grade of the target security domain, and obtaining a confidentiality check result; the account confidentiality grade is used for representing the credibility degree of the user account; the zone confidentiality grade is used for representing the importance degree of the business executed by the target safety zone; the confidentiality principle is that the data information is forbidden to be transmitted from a high security level to a low security level;
determining whether the integrity principle is met between the user account and the target security domain according to the integrity level relation between the account integrity level of the user account and the region integrity level of the target security domain, and obtaining an integrity check result; the account integrity level is used for representing the read-write permission of the user account; the region integrity level is used for representing the readable and writable degree of the service data in the service region; the integrity principle is that the user account with the high account integrity level is prohibited from accessing the target security domain with the low region integrity level, and the user account with the low account integrity level is prohibited from modifying the service data in the target security domain with the high region integrity level.
3. The method of claim 1, wherein obtaining an access control check result of the access control check based on the security check result and the integrity check result comprises:
if the security check result is safe and the integrity check result is safe, the access control check is safe;
if the security check result is safe, the integrity check result is unsafe, and when the region security level is greater than the region integrity level, the account integrity level is adjusted to be safe, and the access control check is safe;
if the security check result is unsafe, the integrity check result is safe, and when the area integrity level is greater than the area security level, the account security level is adjusted to be safe, and the access control check is safe;
and if the confidentiality check result is unsafe and the integrity check result is unsafe, the access control check is unsafe.
4. The method of claim 1, wherein said performing a program check on said data network to obtain a program check result comprises:
according to the trusted installation account, carrying out installation account inspection on the user account which carries out application program installation operation in the data network to obtain an account inspection result; the trusted installation account number comprises a trusted account number capable of carrying out installation application program operation on the data network;
performing program behavior check on the installed application program according to the trusted application program to obtain a behavior check result; wherein the trusted application comprises a program that performs trusted operational behavior in the data network;
carrying out system program inspection on the data network system program called by the application program according to the trusted system program to obtain a system inspection result; wherein the trusted system program is a system program which allows the application program to call in the data network by the application program;
and obtaining an installation program checking result according to the account checking result, the behavior checking result and the system checking result.
5. The method of claim 1, wherein the performing data inspection on the data network to obtain a data inspection result comprises:
performing the data inspection on the data information transmitted to the data network according to a packet filtering strategy to obtain a data inspection result; the packet filtering policy is a policy for managing and controlling the data information according to a data packet comparison result, and the data packet comparison result is a comparison result of data packet attribute information of the data information and preset attribute information.
6. The method of claim 1, wherein performing connectivity check on the data network to obtain a connectivity check result comprises:
performing equipment connection check on the connection relation of the external equipment and the connection relation of the internal equipment according to the connection relation of the trusted equipment to obtain an equipment check result; the trusted connection relation is a connection relation between allowed connection devices, the external device connection relation is a connection relation between an external device outside the data network and an internal device inside the data network, and the internal connection relation is a connection relation between internal devices inside the data network;
performing network connection check on the network address connected with the data network according to the forbidden internet address to obtain a network check result;
and obtaining a connection checking result according to the equipment checking result and the network checking result.
7. A data network security device, the device comprising:
the control inspection module is used for carrying out control inspection on the data network to obtain a control inspection result; the control check comprises check of control operation of the logged-in user account on the data network;
the program checking module is used for checking the program of the data network to obtain a program checking result; wherein the program inspection comprises inspection of the data network installed application program;
the data inspection module is used for carrying out data inspection on the data network to obtain a data inspection result; wherein the data inspection comprises inspection of data information entering and exiting the data network;
the connection checking module is used for checking the connection of the data network to obtain a connection checking result; wherein the connection check comprises checking internal and external connection relationships of the data network;
the safety control module is used for carrying out safety control on the data network according to the control check result, the program check result, the data check result and the connection check result;
the control checking module is specifically configured to:
acquiring a control security domain corresponding to the user account according to the authority level of the user account; the authority level is used for representing the control authority of the user account on different service areas in the data network, and the control security domain is a service area of the user account with control authority in the data network;
determining whether a target security domain is included in the control security domain; the target security domain is a service area in the data network corresponding to the current control operation of the user account;
if the control security domain comprises the target security domain, performing confidentiality check and integrity check on the control operation to obtain a confidentiality check result and an integrity check result; the confidentiality check is used for checking whether confidentiality grade requirements are met between the user account and the target security domain, and the integrity check is used for checking whether integrity grade requirements are met between the user account and the target security domain;
and obtaining a control check result according to the confidentiality check result and the integrity check result.
8. A computer device comprising a memory and a processor, the memory storing a computer program, wherein the processor implements the steps of the method of any one of claims 1 to 6 when executing the computer program.
9. A computer-readable storage medium, on which a computer program is stored, which, when being executed by a processor, carries out the steps of the method of any one of claims 1 to 6.
CN201911134208.1A 2019-11-19 2019-11-19 Data network security protection method and device, computer equipment and storage medium Active CN110933054B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201911134208.1A CN110933054B (en) 2019-11-19 2019-11-19 Data network security protection method and device, computer equipment and storage medium

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201911134208.1A CN110933054B (en) 2019-11-19 2019-11-19 Data network security protection method and device, computer equipment and storage medium

Publications (2)

Publication Number Publication Date
CN110933054A CN110933054A (en) 2020-03-27
CN110933054B true CN110933054B (en) 2022-04-15

Family

ID=69853581

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201911134208.1A Active CN110933054B (en) 2019-11-19 2019-11-19 Data network security protection method and device, computer equipment and storage medium

Country Status (1)

Country Link
CN (1) CN110933054B (en)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111460461B (en) * 2020-04-03 2023-06-06 全球能源互联网研究院有限公司 Trusted CPU system, read-write request and DMA data trusted checking method
CN115871754B (en) * 2023-03-08 2023-07-21 北京全路通信信号研究设计院集团有限公司 Rail transit control signal system, detection method, detection device, detection equipment and medium

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102238030A (en) * 2011-05-16 2011-11-09 北京全路通信信号研究设计院有限公司 Signal security data network system and network management system
CN105306471A (en) * 2015-11-03 2016-02-03 国家电网公司 System and method for management and control of access control policy of security domain boundary equipment of smart grid
CN106950948A (en) * 2017-05-25 2017-07-14 北京长安汽车工程技术研究有限责任公司 A kind of vehicle CAN Communication diagnostic logger and system
CN108256811A (en) * 2017-04-18 2018-07-06 平安科技（深圳）有限公司 Job information processing method, device, computer equipment and storage medium
CN108632114A (en) * 2018-05-08 2018-10-09 西南交通大学 Standardization for rds data web network equipment configures automatic checking method
CN110428216A (en) * 2019-07-03 2019-11-08 平安科技（深圳）有限公司 Operation flow management-control method, device, computer equipment and storage medium

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20050108518A1 (en) * 2003-06-10 2005-05-19 Pandya Ashish A. Runtime adaptable security processor

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102238030A (en) * 2011-05-16 2011-11-09 北京全路通信信号研究设计院有限公司 Signal security data network system and network management system
CN105306471A (en) * 2015-11-03 2016-02-03 国家电网公司 System and method for management and control of access control policy of security domain boundary equipment of smart grid
CN108256811A (en) * 2017-04-18 2018-07-06 平安科技（深圳）有限公司 Job information processing method, device, computer equipment and storage medium
CN106950948A (en) * 2017-05-25 2017-07-14 北京长安汽车工程技术研究有限责任公司 A kind of vehicle CAN Communication diagnostic logger and system
CN108632114A (en) * 2018-05-08 2018-10-09 西南交通大学 Standardization for rds data web network equipment configures automatic checking method
CN110428216A (en) * 2019-07-03 2019-11-08 平安科技（深圳）有限公司 Operation flow management-control method, device, computer equipment and storage medium

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
信息等级保护中一些安全防护措施;熊宇飞;《理论探讨》;20150331;第25-28页 *

Also Published As

Publication number Publication date
CN110933054A (en) 2020-03-27

Similar Documents

Publication Publication Date Title
US8407462B2 (en) Method, system and server for implementing security access control by enforcing security policies
US8407240B2 (en) Autonomic self-healing network
US9917863B2 (en) Method and system for implementing mandatory file access control in native discretionary access control environments
CN114598540B (en) Access control system, method, device and storage medium
US20070294759A1 (en) Wireless network control and protection system
CN115001870B (en) Information security protection system, method and storage medium
US20090247125A1 (en) Method and system for controlling access of computer resources of mobile client facilities
WO2023159994A1 (en) Operation and maintenance processing method, and terminal device
US20100095365A1 (en) Self-setting security system and method for guarding against unauthorized access to data and preventing malicious attacks
CN106899561B (en) TNC (network node controller) authority control method and system based on ACL (Access control List)
CN110933054B (en) Data network security protection method and device, computer equipment and storage medium
WO2007001046A1 (en) Method for protecting confidential file of security countermeasure application and confidential file protection device
US8713640B2 (en) System and method for logical separation of a server by using client virtualization
CN107358097A (en) A kind of method and system in open environment Computer protecting information safety
US11533312B2 (en) Dynamically enforcing context sensitive network access control policies
CN101764788B (en) Safe access method based on extended 802.1x authentication system
CN106685912B (en) Safety access method of application system
Muzzi et al. Using Botnets to provide security for safety critical embedded systems-a case study focused on UAVs
US11663325B1 (en) Mitigation of privilege escalation
CN113194088B (en) Access interception method, device, log server and computer readable storage medium
US20210306300A1 (en) Portable, hardware-based authentication client to enforce user-to-site network access control restrictions
US9239915B2 (en) Synchronizing between host and management co-processor for network access control
KR102623168B1 (en) Data protection system
US11736520B1 (en) Rapid incidence agentless lateral movement protection from ransomware for endpoints deployed under a default gateway with point to point links
US11711396B1 (en) Extended enterprise browser blocking spread of ransomware from alternate browsers in a system providing agentless lateral movement protection from ransomware for endpoints deployed under a default gateway with point to point links

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant