CN105072025A - Safe protective gateway and system for modern industrial control system network communication - Google Patents

Abstract

The invention provides a security protection gateway and system aimed at network communication of a modern industrial control system, which can ensure communication security between users and field devices in a public network. The gateway includes: a communication control unit, which is used for basic communication control and to control the communication between the user and the field device according to the instructions sent by the linkage unit; Encryption and decryption and selective in-depth analysis; a linkage unit, used to send an instruction to the communication control unit whether to reject the user's future communication request according to the analysis result, and determine whether to send the analyzed communication data packet to the target field device. The invention is applicable to the technical field of communication.

Description

Security protection gateway and system for network communication of modern industrial control system

technical field

The invention relates to the field of communication technology, in particular to a security protection gateway and system for network communication of modern industrial control systems.

Background technique

In the past, the industrial production environment was relatively independent, and the industrial control system and communication protocols were independent to a certain extent, and there was no connection with other public networks. misuse, natural disasters, etc.

In recent years, with the progress of society and the development of computer technology, the industrial control system has gradually developed from a closed and isolated system to a more open system with multiple connections to the public network. The modern industrial production system not only has an industrial control system, but also combines a general operating system. In modern industrial production, we often need to remotely monitor the production situation and equipment operation status of the industrial site, and the industrial communication widely used in the modern industrial control system Protocols (such as network communication protocol (Modbus), distributed network protocol (DNP3), etc.) do not provide any security control. Therefore, this involves the security issue of industrial production data transmission in public networks. Due to the particularity of industrial production equipment, once it is attacked and malfunctions, it will bring incalculable losses to the enterprise.

At present, there are some security protection products for industrial control systems on the market, such as Tofino's industrial firewall and Winnut's trusted interval gateway. The main feature of these security protection products is that they can perform in-depth message analysis on various industrial communication protocols, and detect the instructions and data inside the protocols, so as to detect network attacks based on industrial communication protocols. However, the existing security protection products only perform matching detection on the message, and do not perform certain security protection on the message itself.

Contents of the invention

The technical problem to be solved by the present invention is to provide a security protection gateway and system for network communication of modern industrial control systems, so as to solve the problem that existing security protection products in the prior art cannot comprehensively protect It is difficult to meet the security requirements of modern industrial control systems for security protection of modern industrial control systems.

In order to solve the above technical problems, an embodiment of the present invention provides a security protection gateway for network communication of modern industrial control systems, including:

The communication control unit is used for basic communication control and to control the communication between the user and the field device according to the instructions sent by the linkage unit;

A data packet parsing unit is used for selectively encrypting and decrypting and selectively in-depth parsing the received communication data packets;

The linkage unit is used to send an instruction to the communication control unit whether to reject the user's subsequent communication request according to the analysis result, and determine whether to send the analyzed communication data packet to the target field device.

Preferably, the communication control unit includes: a whitelist detection module and a communication control module;

The white list detection module is used to determine whether the user information is included in the preset white list when the user sends a communication data packet to the field device, and if so, send the communication data packet to the data packet analysis unit, Otherwise, discard the communication data packet;

The communication control module is used to reject or accept the communication request sent by the user after this communication according to the instruction sent by the linkage unit, and is also used to send out the communication data packet sent by the field device;

Wherein, the user information includes: IP address, MAC address and port information of the user who sends the communication data.

Preferably, the packet parsing unit includes: an encryption and decryption module and a packet depth parsing module;

The encryption and decryption module: used to determine whether the communication data packet needs to be decrypted according to the encryption bit in the communication data packet sent by the communication control unit when the user sends the communication data packet to the field device, and is also used to When the field device sends a communication data packet to the user, it is judged whether the source field device information in the communication data packet is included in the preset device encryption list, and if so, the communication data packet is encrypted;

The data packet deep analysis module is used to judge whether it is necessary to perform deep analysis on the received communication data packet according to the user operation authority, and if necessary, perform deep analysis on the communication data packet, and combine the communication data packet and the analysis The result is passed to the linkage unit; otherwise, the analysis result is set as no attack, and the communication data packet and the analysis result are passed to the linkage unit;

Wherein, the source field device information includes: IP address, MAC address and port information of the field device sending the communication data packet.

Preferably, the encryption and decryption module includes: an encryption and decryption judgment submodule and an encryption and decryption operation submodule;

The encryption and decryption judging submodule is used to judge the received communication data packet, determine whether the communication data packet needs to be encrypted or decrypted, and directly send out the communication data packet that does not need to be encrypted or decrypted;

The encryption and decryption operation sub-module is used to perform encryption or decryption operations on communication data packets that need to be encrypted or decrypted, and send out the encryption or decryption results.

Preferably, the encryption and decryption judging submodule includes: an encryption judging submodule and a decryption judging submodule;

Encryption judging sub-module: used to determine whether the source field device information in the communication data packet is included in the preset device encryption list when the field device sends the communication data packet to the user, and if it is included, the information in the communication data packet will be Encrypting the position and encrypting the label, and sending the communication data packet to the encryption and decryption operation sub-module, otherwise, sending the communication data packet to the communication control unit;

Decryption judgment sub-module: used to judge the encryption bit in the communication data packet when the user sends the communication data packet to the field device, and when the encryption bit is an encryption label, then send the communication data packet to the encryption and decryption operation sub-module, otherwise, the communication data packet is sent to the data packet deep analysis module.

Preferably, the encryption and decryption operation sub-module is used to perform encryption or decryption operations on the communication data packets that need to be encrypted or decrypted through the key dynamic generation module based on the time synchronization mechanism;

The encryption and decryption operation submodule includes: an encryption operation submodule and a decryption operation submodule;

Encryption operation sub-module: used to generate a series of unpredictable random number combinations as keys through the dynamic key generation module using the random number generation algorithm when the communication data packet needs to be encrypted, and the key pair needs to be encrypted Encrypt the communication data packet, and then send the encrypted communication data packet;

Decryption operation sub-module: used to use the historical key schedule established by the key dynamic generation module when the communication data packet needs to be decrypted, according to the encryption time stamp in the communication data packet, in the historical key schedule Find the corresponding key, and use the key to decrypt the encrypted communication data packet, and then send the decrypted communication data packet to the data packet deep analysis module.

Preferably, the data packet depth analysis module is also used to separate the industrial communication protocol header and data of the application data part of the communication data packet sent by the encryption and decryption module when the user sends the communication data packet to the field device, and separate the The obtained industrial communication protocol header is combined with the TCP/IP protocol header to determine whether there is an offside operation, and conduct attack detection on the separated data to determine whether there is an attack in the communication data packet.

Preferably, the linkage unit includes:

Attack control module: used to send to the communication control unit a communication request instruction after rejecting the user who initiated the communication when the analysis result shows that there is an attack, and discard the communication data packet;

The authority offside control module is used to send the communication request instruction of rejecting the user within a preset time to the communication control unit when the analysis result is that the operation authority is offside, and discard the communication data packet;

The security control module is used to send the communication data packet to the target field device when the analysis result is no attack.

The embodiment of the present invention also provides a security protection gateway system for network communications of modern industrial control systems, including: the public network where the user is located, the Internet, and the network for modern industrial control systems described in any one of claims 1-8 The industrial control system network where the communication security protection gateway is located;

The public network where the user is located includes: users and encryption and decryption devices;

The encryption and decryption device is used for selectively encrypting and decrypting the communication data packets between the user and the field device.

Preferably, the encryption and decryption device is used to determine whether the communication data packet needs to be decrypted according to the encryption bit in the communication data packet sent by the field device, and is also used to determine whether the communication data packet needs to be decrypted when the user sends the communication data packet to the field device. Whether the target field device information in the communication data packet is included in the preset device encryption list, if included, the communication data packet is encrypted;

Wherein, the target field device information includes: IP address, MAC address and port information of the field device receiving the communication data packet.

The beneficial effects of above-mentioned technical scheme of the present invention are as follows:

In the above scheme, the communication data packet between the user (the user is a user in the public network) and the field device is selectively encrypted and decrypted by the data packet analysis unit, so as to ensure the safe transmission of the communication data packet, and pass the data The packet analysis unit conducts selective in-depth analysis of the communication data packets between the user and the field equipment, and selectively detects attacks, which improves the automatic defense capability against attacks. The unit determines whether to send the analyzed communication data packet to the target field device, and sends a control command to the communication control unit, and the communication control unit controls the communication between the user and the field device according to the received control command, which is different from the traditional Compared with intrusion detection, the encryption gateway not only improves the communication security between users and field devices, but also improves the performance of the industrial control system network, and the security protection gateway has high versatility in industrial control systems.

Description of drawings

Fig. 1 is a system deployment diagram of a security protection gateway and an encryption and decryption device provided by an embodiment of the present invention;

FIG. 2 is a schematic diagram of the workflow of the security protection gateway when the user sends a communication data packet to the field device provided by the embodiment of the present invention;

3 is a schematic diagram of the workflow of the whitelist detection module provided by the embodiment of the present invention;

FIG. 4 is a schematic diagram of the workflow of the data packet parsing unit provided by the embodiment of the present invention;

Fig. 5 is a working flowchart of the encryption and decryption module provided by the embodiment of the present invention.

detailed description

In order to make the technical problems, technical solutions and advantages to be solved by the present invention clearer, the following will describe in detail with reference to the drawings and specific embodiments.

The present invention aims at the problem that the existing safety protection products cannot comprehensively protect the modern industrial control system due to their own deficiencies, and it is difficult to meet the safety requirements of the modern industrial control system. security gateway and system.

Embodiment one

A security protection gateway for network communication of modern industrial control systems provided by an embodiment of the present invention includes:

The communication control unit is used for basic communication control and to control the communication between the user and the field device according to the instructions sent by the linkage unit;

A data packet parsing unit is used for selectively encrypting and decrypting and selectively in-depth parsing the received communication data packets;

The linkage unit is used to send an instruction to the communication control unit whether to reject the user's subsequent communication request according to the analysis result, and determine whether to send the analyzed communication data packet to the target field device.

The security protection gateway for the network communication of the modern industrial control system described in the embodiment of the present invention selectively encrypts the communication data packets between the user (the user is a user in the public network) and the field device through the data packet analysis unit. Decryption ensures the safe transmission of communication data packets, and selectively in-depth analysis of communication data packets between users and field devices through the data packet analysis unit, selectively detects attacks, and improves the automatic detection of attack behaviors. Defensive capability, according to the detection result of the data packet analysis unit, through the linkage unit to determine whether to send the analyzed communication data packet to the target field device, and send a control command to the communication control unit, and the communication control unit according to the received control command Controlling the communication between the user and the field device, compared with the traditional encryption gateway and intrusion detection, not only improves the communication security between the user and the field device, but also improves the performance of the industrial control system network, and the Security protection gateways are highly versatile in industrial control systems.

In the embodiment of the present invention, as shown in Figure 1, the public network includes: users and encryption and decryption devices located in the public network; the industrial control system network includes: a security protection gateway and an industrial control system, and the security protection gateway is located in the industrial control system Between the industrial control system and the Internet, it is responsible for the security defense of the industrial control system. The security protection gateway between the industrial control system and the Internet will be described in detail below.

In the embodiment of the present invention, as shown in FIG. 2, the communication data packet for communication between the user and the field device may include: header information, application data and tail information, wherein the header information includes: Ethernet header, network Interconnected protocol (Internet Protocol, IP) header, transmission control protocol (Transmission Control Protocol, TCP) header, the application data includes: industrial communication protocol header and data, tail information includes: Ethernet tail.

In the aforementioned specific implementation of the security protection gateway for network communication of modern industrial control systems, optionally, the communication control unit includes: a whitelist detection module and a communication control module;

The white list detection module is used to determine whether the user information is included in the preset white list when the user sends a communication data packet to the field device, and if so, send the communication data packet to the data packet analysis unit, Otherwise, discard the communication data packet;

The communication control module is used for basic communication control and rejecting or accepting the communication request sent by the user after this communication according to the instruction sent by the linkage unit, and is also used for sending the communication data packet sent by the field device;

Wherein, the user information includes: IP address, Media Access Control (MAC, MediaAccessControl) address and port information of the user who sends the communication data.

In the embodiment of the present invention, the communication control unit includes: a whitelist detection module and a communication control module. Due to the particularity of the industrial control system, within a certain period of time, users in the public network who can communicate with the industrial control system network are very limited. Stable, therefore, users who access the industrial control system can be filtered through the whitelist detection module, and at the same time, the communication default policy is set to deny communication. The specific detection process of the whitelist detection module includes: using whitelist technology to record the user information (the user information includes: IP address, MAC address, port information, etc.) that is allowed to communicate with the field device, see Figure 2 and Figure 3 shows that when the communication data packet sent by the user enters the security protection gateway, the whitelist detection module firstly uses the header information of the communication data packet (the header information includes: Ethernet header, IP header, TCP header, etc., from the header information can obtain user information) and the user information recorded in the whitelist to query and compare, if the corresponding header information is found in the whitelist, then initially decide to receive the communication data packet, and pass the communication data packet to the data packet analysis unit; If the user information is not found in the white list, the communication data packet is discarded.

In the embodiment of the present invention, as shown in Figure 2, according to the instruction sent by the linkage unit, the communication request sent by the user after this communication is rejected or accepted by the communication control module, and the field device is also sent by the communication control module Incoming communication packets are sent out.

In the aforementioned specific implementation of the security protection gateway for network communication of modern industrial control systems, optionally, the data packet parsing unit includes: an encryption and decryption module and a data packet deep parsing module;

The encryption and decryption module: used to determine whether the communication data packet needs to be decrypted according to the encryption bit in the communication data packet sent by the communication control unit when the user sends the communication data packet to the field device, and is also used to When the field device sends a communication data packet to the user, it is judged whether the source field device information in the communication data packet is included in the preset device encryption list, and if so, the communication data packet is encrypted;

The data packet deep analysis module is used to judge whether it is necessary to perform deep analysis on the received communication data packet according to the user operation authority, and if necessary, perform deep analysis on the communication data packet, and combine the communication data packet and the analysis The result is passed to the linkage unit; otherwise, the analysis result is set as no attack, and the communication data packet and the analysis result are passed to the linkage unit;

Wherein, the source field device information includes: IP address, MAC address and port information of the field device sending the communication data packet.

In the embodiment of the present invention, as shown in FIG. 2, the data packet analysis unit includes: an encryption and decryption module and a data packet depth analysis module. There are various field devices located in the industrial control system, and the association with the safe operation of the industrial control system The characteristics are also different. For the communication data packets from the industrial control system network to the public network (also known as the field device to the user), the communication data is determined according to the importance of the field device in the industrial control system (communication level). Whether the package needs to be encrypted.

In the embodiment of the present invention, for example, the encryption needs of field devices can be classified to form a device encryption list of whether the field devices need to be encrypted. Whether the source field device information is included in the preset device encryption list, if so, the communication data packet will be encrypted, and when the user sends the communication data packet to the field device, it will be sent by the encryption module according to the communication control unit The encryption bit in the communication data packet judges whether the communication data packet needs to be decrypted. In this way, the selective encryption and decryption module can not only ensure the communication security of important communication data packets sent by important field devices, but also effectively improve network performance, thereby achieving a balance between security and performance.

In the embodiment of the present invention, the encryption and decryption module includes: an encryption and decryption judgment submodule and an encryption and decryption operation submodule; the encryption and decryption judgment submodule is used to judge the received communication data packet and determine the communication data packet Whether encryption or decryption operations are required, and the communication data packets that do not need to be encrypted or decrypted are sent directly; the encryption and decryption operation submodule is used to encrypt or decrypt the communication data packets that need to be encrypted or decrypted, and send The encrypted or decrypted result is sent out.

In the embodiment of the present invention, the data packet deep analysis module can determine whether to perform deep analysis on the communication data packet sent by the user according to the user's operation authority, so as to selectively perform attack detection, thereby improving the automatic defense of the industrial control system ability.

In the aforementioned specific implementation of the security protection gateway for network communication of modern industrial control systems, optionally, the encryption and decryption judging submodule includes: an encryption judging submodule and a decryption judging submodule;

Encryption judging sub-module: used to determine whether the source field device information in the communication data packet is included in the preset device encryption list when the field device sends the communication data packet to the user, and if it is included, the information in the communication data packet will be Encrypting the position and encrypting the label, and sending the communication data packet to the encryption and decryption operation sub-module, otherwise, sending the communication data packet to the communication control unit;

Decryption judgment sub-module: used to judge the encryption bit in the communication data packet when the user sends the communication data packet to the field device, and when the encryption bit is an encryption label, then send the communication data packet to the encryption and decryption operation sub-module, otherwise, the communication data packet is sent to the data packet deep analysis module.

In the embodiment of the present invention, the encryption and decryption judging submodule includes: an encryption judging submodule and a decryption judging submodule, as shown in FIG. When communicating data packets, or in other words, when the communication data packets flow from eth0 to eth1, the source field device information in the data communication packet is searched in the preset device encryption list by the encryption judgment submodule, if in the device encryption list Find the field device information that sent the data communication packet of this communication in , you can set the encryption position of the communication data packet to 1 (1 is the encryption label), and send the communication data packet to the encryption and decryption operation sub-module, otherwise, the The encryption position of the communication data packet is 0 (0 is a non-encrypted label), and the communication data packet is sent to the communication control unit, wherein the source field device information includes: the IP address, the MAC address of the field device sending the communication data packet Address and port information, etc.

In the embodiment of the present invention, as shown in Fig. 1 and Fig. 4, when the public network sends a communication data packet to the industrial control system network (also referred to as the user to the field device), or when the communication data packet flows from eth1 to eth0 , judging the encryption bit in the communication data packet through the decryption judging submodule, when the encryption bit is 1, it indicates that the data part of the communication data packet is encrypted, and it is determined that the communication data packet needs to be decrypted Operation, and send the communication data packet to the encryption and decryption operation sub-module, when the encryption bit is 0, it indicates that the communication data packet is not encrypted, then the communication data packet is directly sent to the data packet deep analysis module.

In the aforementioned specific implementation of the security protection gateway for network communication of modern industrial control systems, optionally, the encryption and decryption operation sub-module is used to use the key dynamic generation module based on the time synchronization mechanism to encrypt or decrypt the The communication data packets are encrypted or decrypted respectively;

The encryption and decryption operation submodule includes: an encryption operation submodule and a decryption operation submodule;

Encryption operation sub-module: used to generate a series of unpredictable random number combinations as keys through the dynamic key generation module using the random number generation algorithm when the communication data packet needs to be encrypted, and the key pair needs to be encrypted Encrypt the communication data packet, and then send the encrypted communication data packet;

Decryption operation sub-module: used to use the historical key schedule established by the key dynamic generation module when the communication data packet needs to be decrypted, according to the encryption time stamp in the communication data packet, in the historical key schedule Find the corresponding key, and use the key to decrypt the encrypted communication data packet, and then send the decrypted communication data packet to the data packet deep analysis module.

In the embodiment of the present invention, as shown in Figure 5, the key generation in the encryption and decryption operation sub-module adopts the key dynamic generation module based on the time synchronization mechanism, and the encryption and decryption equipment and industrial control in the public network where the user is located The algorithm and structure adopted by the key dynamic generation module in the security protection gateway in the system network are the same.

In the embodiment of the present invention, the key generation process is as follows: the key dynamic generation module is based on a time synchronization mechanism, and uses a random number generation algorithm to generate a series of unpredictable random number combinations as keys, and each key can only be used Once, it becomes invalid immediately after use, and the key is periodically updated by the key dynamic generation module. Therefore, in order to find the correct and corresponding key during the decryption operation without transmitting the key in the network, a historical key schedule is established and maintained in the key dynamic generation module. The schedule records and maintains the dynamically generated keys and time within a certain period of time.

In the embodiment of the present invention, when the communication data packet needs to be decrypted, according to the encryption time stamp in the communication data packet, the corresponding key is found in the historical key time table, and then the encrypted key is used to decrypt the encrypted data. Communication packets are decrypted. In this way, through the key dynamic generation module based on the time synchronization mechanism, the communication data packets that need to be encrypted or decrypted are encrypted or decrypted respectively, which can effectively ensure the uniqueness of the key and greatly improve the industrial control system network and public security. Security of network communications.

In the aforementioned specific implementation of the security protection gateway for network communication of modern industrial control systems, optionally, the data packet deep analysis module is also used to send the encryption and decryption module to the The industrial communication protocol header of the application data part of the incoming communication data packet is separated from the data, and the separated industrial communication protocol header is combined with the TCP/IP protocol header to determine whether there is an offside operation, and to perform attack detection on the separated data. It is judged whether there is an attack on the communication data packet.

In the embodiment of the present invention, in the industrial control system, users with different security levels have different operation rights to different field devices. Some users can only read the data of the device and cannot control the device, while some users have Has read and write operation permissions. Therefore, for example, the communication between the user who only has read data authority and the field device does not need to perform deep analysis of data packets, but the communication between the user with read and write operation authority and the field device needs to perform deep analysis operation.

In the embodiment of the present invention, when the user sends a communication data packet to the field device, the communication data packet received by the data packet deep analysis module has been decrypted by the decryption operation sub-module, and the application data part already belongs to plaintext data. Described packet deep analysis module decides whether to carry out this communication packet according to user information (comprising: information such as user's IP address, MAC address, port), i.e. the source end related information of communication packet, and industrial communication protocol header In-depth analysis. If in-depth analysis is required, the communication data packet is subjected to in-depth analysis, and then the communication data packet and the analysis result are passed to the linkage unit; if no in-depth analysis is required, the analysis result is set as non-attack (or safe), and then Pass the communication data packet and analysis result to the linkage unit.

In the embodiment of the present invention, the in-depth analysis process is as follows: the data packet in-depth analysis module mainly separates the industrial communication protocol header and data from the application data part of the communication data packet according to the known industrial communication protocol format, and then separates the The obtained industrial communication protocol header is combined with the TCP/IP protocol header to determine whether there is an offside operation, etc.; finally, attack detection is performed on the separated data to determine whether the communication data packet contains malicious code and other attack operations. In this way, data unpacking and analysis of various industrial communication protocols can be performed through in-depth analysis operations, and attacks can be detected at a deeper level, so as to realize comprehensive protection of the network communication security of modern industrial control systems. At the same time, in-depth analysis operations can also provide future traffic statistics Analytics lays the groundwork and is very scalable.

In the aforementioned specific implementation of the security protection gateway for network communication of modern industrial control systems, optionally, the linkage unit includes:

Attack control module: used to send to the communication control unit a communication request instruction after rejecting the user who initiated the communication when the analysis result shows that there is an attack, and discard the communication data packet;

The authority offside control module is used to send the communication request instruction of rejecting the user within a preset time to the communication control unit when the analysis result is that the operation authority is offside, and discard the communication data packet;

The security control module is used to send the communication data packet to the target field device when the analysis result is no attack.

In the embodiment of the present invention, the main job of the linkage unit is to judge the related operation of this communication according to the analysis result of the communication data packet. When the analysis result is that there is an attack, the linkage unit sends an instruction to the communication control unit, rejects the subsequent communication request and connection of the user who initiates this communication, and discards this communication data packet; when the analysis result is no attack (safety), The linkage unit sends out the communication data packet; when the analysis result is that the operation authority is offside, the linkage unit sends an instruction to the communication control unit to reject the user’s communication request within a preset period of time and discard the communication data packet .

In the embodiment of the present invention,

The safety protection gateway described in the present invention has high versatility in industrial control systems, and the use of encryption and decryption equipment can effectively ensure the communication security between users and field devices, and because the communication data packets are selectively Encryption and decryption and deep packet analysis, compared with traditional encryption gateway and intrusion detection, not only improve the security of the system, but also improve the performance of the network.

In this way, the linkage unit sends a control instruction to the communication control unit according to the analysis result, and the communication control unit controls the communication between the user and the field device according to the received control instruction, thereby improving the network automatic defense of the industrial control system. ability.

Embodiment two

The present invention also provides a specific embodiment of a security protection gateway system for network communication of modern industrial control systems, because the security protection gateway system for network communication of modern industrial control systems provided by the present invention is the same as the aforementioned system for network communication of modern industrial control systems Corresponding to the specific implementation of the security protection gateway, the security protection gateway system for modern industrial control system network communication can achieve the purpose of the present invention by executing the process steps in the specific implementation of the above method, so the above-mentioned network for modern industrial control system The explanations in the specific implementation of the communication security protection gateway are also applicable to the specific implementation of the security protection gateway system for modern industrial control system network communication provided by the present invention, and will not be repeated in the following specific implementation modes of the present invention .

Referring to Fig. 1, an embodiment of the present invention also provides a security protection gateway system for network communication of modern industrial control systems, including: the public network where the user is located, the Internet and any one of claims 1-8 The industrial control system network where the security protection gateway for modern industrial control system network communication is located;

The public network where the user is located includes: users and encryption and decryption devices;

The encryption and decryption device is used for selectively encrypting and decrypting the communication data packets between the user and the field device.

The security protection gateway system for modern industrial control system network communication described in the embodiment of the present invention is responsible for the security defense work of the industrial control system through the security protection for modern industrial control system network communication described in any one of claims 1-8 , and through the encryption and decryption equipment used in conjunction with the security protection gateway in the public network, it is responsible for the encryption and decryption of the communication between the user and the industrial field equipment, so as to ensure the communication security between the user and the field equipment.

In the real-time example of the present invention, the working principle of the encryption and decryption device is consistent with that of the encryption and decryption module in the security protection gateway, and can run on an embedded linux platform, and implements a policy of full permission for communication, which greatly improves the encryption and decryption of the encryption and decryption device. versatility.

In the aforementioned specific implementation of the security protection gateway system for network communication of modern industrial control systems, optionally, the encryption and decryption device is used to judge whether the encryption bit in the communication data packet sent by the field device needs to The communication data packet is decrypted, and it is also used to determine whether the target field device information in the communication data packet is included in the preset device encryption list when the user sends the communication data packet to the field device. encrypt;

Wherein, the target field device information includes: IP address, MAC address and port information of the field device receiving the communication data packet.

In the embodiment of the present invention, referring to Fig. 1 and Fig. 2, in the public network, when the public network sends a communication data packet to the industrial control system network (also referred to as the user to the field device), or when the communication data packet When flowing from eth0 to eth1, use the encryption and decryption device to search for the target field device information in the data communication packet in the preset device encryption list, if the target receiving the data communication packet of this communication is found in the device encryption list For field device information, the encryption position of the communication data packet can be set to 1 and encrypted, otherwise, the encryption position of the communication data packet can be set to 0, and the communication data packet can be sent to the security protection gateway, wherein the target site The device information includes: the IP address, MAC address and port information of the field device receiving the communication data packet.

In the embodiment of the present invention, as shown in FIG. 1, in the public network, when the industrial control system network sends communication data packets to the public network (also referred to as the field device to the user), or when the communication data packets flow from eth1 to When eth0, the encryption bit in the communication data packet is judged by the encryption and decryption device, when the encryption bit is 1, the encrypted communication data packet is decrypted, and when the encryption bit is 0, then It indicates that the communication data packet is not encrypted, and the communication data packet is directly sent to the security protection gateway.

The above description is a preferred embodiment of the present invention, it should be pointed out that for those of ordinary skill in the art, without departing from the principle of the present invention, some improvements and modifications can also be made, and these improvements and modifications can also be made. It should be regarded as the protection scope of the present invention.

Claims (10)

1., for a security protection gateway for modern industrial control system network service, it is characterized in that, comprising:

Communication control unit, controls the communication between user and field apparatus for the Control on Communication on basis and the instruction of sending according to linkage unit;

Packet resolution unit, for carrying out selectivity encryption and decryption and selectivity deep analysis to the communication data packet received;

Linkage unit, for sending whether refuse the later communication request instruction of this user according to analysis result to described communication control unit, and determines whether to send the communication data packet after resolving to target field devices.

2. security protection gateway according to claim 1, is characterized in that, described communication control unit comprises: white list detection module and communication control module;

Described white list detection module, for when user sends communication data packet to field apparatus, judges whether this user profile is included in default white list, if comprise, then this communication data packet is sent to packet resolution unit, otherwise, abandon this communication data packet;

Described communication control module, for send according to linkage unit instruction refusal or accept this this communication after user send communication request, the communication data packet also for being sent by field apparatus sends;

Wherein, described user profile comprises: send the IP address of the user of communication data, MAC Address and port information.

3. security protection gateway according to claim 2, is characterized in that, described packet resolution unit comprises: encryption/decryption module and packet deep analysis module;

Described encryption/decryption module: for when user sends communication data packet to field apparatus, judge whether to need to be decrypted this communication data packet according to the encrypted bits in the communication data packet that described communication control unit is sent, also for when field apparatus sends communication data packet to user, judge whether the source field device information in communication data packet is included in default devices encrypt list, if comprise, then this communication data packet is encrypted;

Described packet deep analysis module, need to carry out deep analysis to the communication data packet received for judging whether according to user operation authority, if desired, then deep analysis is carried out to this communication data packet, and described communication data packet and analysis result are passed to linkage unit; Otherwise, then analysis result is set to without attacking, and communication data packet and analysis result is passed to linkage unit;

Wherein, described source field device information comprises: send the IP address of the field apparatus of communication data packet, MAC Address and port information.

4. security protection gateway according to claim 3, is characterized in that, described encryption/decryption module comprises: encryption and decryption judges submodule and encryption and decryption operator module;

Described encryption and decryption judges submodule, for judging the communication data packet received, determines that this communication data packet is the need of encryption or decryption oprerations, and will the communication data packet of encrypting or deciphering not needed directly to send;

Described encryption and decryption operator module, for being encrypted respectively or decryption oprerations the communication data packet of needs encryption or deciphering, and sends encryption or decrypted result.

5. security protection gateway according to claim 4, is characterized in that, described encryption and decryption judges that submodule comprises: encryption judges that submodule and deciphering judge submodule;

Encryption judges submodule: for when field apparatus sends communication data packet to user, judge whether the source field device information in communication data packet is included in default devices encrypt list, if comprise, then by the encrypted location encryption label in this communication data packet, and this communication data packet is sent to encryption and decryption operator module, otherwise, then this communication data packet is sent to communication control unit;

Deciphering judges submodule: for when user sends communication data packet to field apparatus, encrypted bits in this communication data packet is judged, when this encrypted bits is for encryption label, then this communication data packet is sent to encryption and decryption operator module, otherwise, then this communication data packet is sent to packet deep analysis module.

6. security protection gateway according to claim 4, it is characterized in that, described encryption and decryption operator module, for by the key feed generation module based on Time Synchronization Mechanism, is encrypted or decryption oprerations respectively to needing the communication data packet of encryption or deciphering;

Described encryption and decryption operator module comprises: cryptographic operation submodule and deciphering operator module;

Cryptographic operation submodule: during for needing when communication data packet to encrypt, random number generating algorithm is utilized to generate a series of uncertain random digit combination as key by described key feed generation module, and need the communication data packet of encryption to be encrypted by described double secret key, then the communication data packet after encryption is sent;

Decryption oprerations submodule: during for needing when communication data packet to decipher, utilize the history key time table that described key feed generation module is set up, according to the encryption times label in communication data packet, corresponding key is found in described history key time table, and utilize the communication data packet after this key pair encryption to be decrypted, then the communication data packet after deciphering is sent to packet deep analysis module.

7. security protection gateway according to claim 3, it is characterized in that, described packet deep analysis module, also for when user sends communication data packet to field apparatus, the industrial communication protocol stem of communication data packet application data part encryption/decryption module sent is separated with data, the industrial communication protocol stem and the combination of ICP/IP protocol stem that obtain will be separated, judge whether to there is offside operation, and carry out attack detecting to being separated the data obtained, judge whether this communication data packet exists attack.

8. security protection gateway according to claim 1, is characterized in that, described linkage unit comprises:

Attack control module: for when analysis result is for existence attack, sends refusal to described communication control unit and initiate the later communication request instruction of this user communicated, and abandon this communication data packet;

The offside control module of authority, for when analysis result be operating right offside time, be sent in Preset Time the communication request instruction refusing this user to described communication control unit, and abandon this communication data packet;

Safety control module, for being without when attacking when analysis result, is sent to target field devices by this communication data packet.

9. the security protection gateway system for modern industrial control system network service, it is characterized in that, comprising: the industrial control system network at the public network at user place, internet and the security protection gateway place for modern industrial control system network service described in any one of claim 1-8;

The public network at user place comprises: user and encryption and decryption equipment;

Described encryption and decryption equipment, for carrying out the operation of selectivity encryption and decryption to the communication data packet between user and field apparatus.

10. security protection gateway system according to claim 9, it is characterized in that, described encryption and decryption equipment, judge whether to need to be decrypted this communication data packet for the encrypted bits in the communication data packet sent according to field apparatus, also for when user sends communication data packet to field apparatus, judge whether the target field devices information in communication data packet is included in default devices encrypt list, if comprise, is then encrypted this communication data packet;

Wherein, described target field devices information comprises: the IP address of the field apparatus of received communication packet, MAC Address and port information.