CN115081498A - Industrial data processing method and device and industrial gateway - Google Patents

Abstract

The disclosure discloses an industrial data processing method, an industrial data processing device and an industrial gateway, and relates to the technical field of network security. The method comprises the following steps: determining a classification result and a classification result corresponding to the industrial data according to the classification characteristic of the industrial data and a set classification rule; determining a disposal strategy corresponding to the industrial data according to the classification result and the grading result corresponding to the industrial data; and processing the industrial data according to the disposal strategy corresponding to the industrial data. The method and the system meet the national supervision requirement of classified management of industrial data under the condition of not building a virtual private network or other gateways.

Description

Industrial data processing method, device and industrial gateway

technical field

The present disclosure relates to the technical field of network security, and in particular, to an industrial data processing method, device and industrial gateway.

Background technique

The Industrial Internet has opened the protection boundaries of industrial enterprises. Production and operation data flows in enterprise parks, private data centers, public clouds, and industry regulatory agencies, and there is a lack of effective regulatory mechanisms.

In related technologies, 5GUPF (User Plane Function, User Plane Function) divides data based on quintuple, and has few classification methods, which does not meet security requirements; it requires operators to configure or build a virtual private network, and the management is complicated; moreover, this solution Only traffic can be shunted. If other operations are required, other network elements need to be connected in series, which will reduce the security and reliability of data. The SDN service chain is mainly used in the cloud and wide area network, distributed deployment, and is not suitable for enterprise export protection.

SUMMARY OF THE INVENTION

A technical problem to be solved by the present disclosure is to provide an industrial data processing method, device and industrial gateway, which can meet the national regulatory requirements for hierarchical and classified management of industrial data without building a virtual private network or other gateways.

According to an aspect of the present disclosure, an industrial data processing method is proposed, which includes: determining a classification result and a classification result corresponding to the industrial data according to the classification and classification features of the industrial data and a set classification and classification rule; According to the classification result, the disposal strategy corresponding to the industrial data is determined; and the industrial data is processed according to the disposal strategy corresponding to the industrial data.

In some embodiments, the industrial data is analyzed based on the deep packet inspection DPI technology to obtain at least one item of quintuple information and business behavior of the industrial data; and according to the quintuple information, time information, external environment of the industrial data One or more of characteristics and business behaviors that determine the classification and classification characteristics of industrial data.

In some embodiments, classification and grading rules and handling policies of industrial data corresponding to services are preconfigured.

In some embodiments, the disposition policy includes: encrypting industrial data, decrypting industrial data, discarding industrial data, logging industrial data, forwarding industrial data with high priority, signing industrial data, redirecting industrial data, tunneling in encapsulating industrial data one or more of.

In some embodiments, the classification rules include two or three of production, business, and management categories; and the classification rules include two or three of general, corporate secret, and state secret.

According to another aspect of the present disclosure, a business data processing device is also proposed, comprising: a data classification and grading module configured to determine a classification result corresponding to the industrial data according to the classification and classification features of the industrial data and the set classification and classification rules and grading results; a strategy implementation module, configured to determine a disposal strategy corresponding to the industrial data according to the classification results and grading results corresponding to the industrial data; and a data processing module, configured to perform processing on the industrial data according to the disposal strategy corresponding to the industrial data deal with.

In some embodiments, the industrial data processing apparatus further includes: a data acquisition unit configured to acquire industrial data based on the deep packet inspection DPI technology, according to the quintuple information, time information, external environment characteristics and business behavior of the industrial data. One or more items to determine the classification and classification characteristics of industrial data.

In some embodiments, the industrial data processing apparatus further includes: a policy configuration storage module configured to pre-configure the classification and grading rules and disposal policies of the industrial data corresponding to the business.

According to another aspect of the present disclosure, an industrial data processing apparatus is also proposed, comprising: a memory; and a processor coupled to the memory, the processor is configured to execute the industrial data processing method as described above based on instructions stored in the memory .

According to another aspect of the present disclosure, an industrial gateway is also provided, comprising: the above-mentioned industrial data processing device.

According to another aspect of the present disclosure, a non-transitory computer-readable storage medium is also provided, having computer program instructions stored thereon, the instructions implementing the above-mentioned industrial data processing method when executed by a processor.

In the embodiment of the present disclosure, according to the classification and classification rules, after determining the classification results and classification results corresponding to the classification and classification features of the industrial data, a corresponding processing strategy is determined and processed. Without the need to build a virtual private network or other gateways, it can meet the national regulatory requirements for hierarchical and classified management of industrial data.

Other features of the present disclosure and advantages thereof will become apparent from the following detailed description of exemplary embodiments of the present disclosure with reference to the accompanying drawings.

Description of drawings

The accompanying drawings, which form a part of the specification, illustrate embodiments of the present disclosure and together with the description serve to explain the principles of the present disclosure.

The present disclosure may be more clearly understood from the following detailed description with reference to the accompanying drawings, wherein:

FIG. 1 is a schematic flowchart of some embodiments of the disclosed industrial data processing method.

FIG. 2 is a schematic flowchart of other embodiments of the disclosed industrial data processing method.

FIG. 3 is a schematic flowchart of other embodiments of the disclosed industrial data processing method.

FIG. 4 is a schematic structural diagram of some embodiments of the service data processing apparatus of the present disclosure.

FIG. 5 is a schematic structural diagram of other embodiments of the service data processing apparatus of the present disclosure.

FIG. 6 is a schematic structural diagram of other embodiments of the service data processing apparatus of the present disclosure.

Detailed ways

Various exemplary embodiments of the present disclosure will now be described in detail with reference to the accompanying drawings. It should be noted that the relative arrangement of the components and steps, the numerical expressions and numerical values set forth in these embodiments do not limit the scope of the present disclosure unless specifically stated otherwise.

Meanwhile, it should be understood that, for the convenience of description, the dimensions of various parts shown in the accompanying drawings are not drawn in an actual proportional relationship.

The following description of at least one exemplary embodiment is merely illustrative in nature and is in no way intended to limit the disclosure, its application or uses in any way.

Techniques, methods, and apparatus known to those of ordinary skill in the relevant art may not be discussed in detail, but where appropriate, techniques, methods, and apparatus should be considered part of the authorized description.

In all examples shown and discussed herein, any specific value should be construed as illustrative only and not as limiting. Accordingly, other examples of exemplary embodiments may have different values.

It should be noted that like numerals and letters refer to like items in the following figures, so once an item is defined in one figure, it does not require further discussion in subsequent figures.

In order to make the objectives, technical solutions and advantages of the present disclosure clearer, the present disclosure will be further described in detail below with reference to the specific embodiments and the accompanying drawings.

FIG. 1 is a schematic flowchart of some embodiments of the disclosed industrial data processing method. This embodiment is performed by an industrial gateway, or by an industrial data processing device located at the industrial gateway.

In step 110, a classification result and a classification result corresponding to the industrial data are determined according to the classification and classification features of the industrial data and the set classification and classification rules.

In some embodiments, classification and grading rules and handling policies of industrial data corresponding to services are preconfigured. After obtaining the classification and grading features of the industrial data, by searching for the classification and grading rules, the classification results and grading results corresponding to the industrial data can be determined.

In step 120, a disposal strategy corresponding to the industrial data is determined according to the classification result and the classification result corresponding to the industrial data.

In some embodiments, different treatment strategies are implemented for industrial data belonging to different classification results and ranking results. For example, encrypt the industrial data, decrypt the industrial data, discard the industrial data, log the industrial data, forward the industrial data with high priority, sign the industrial data, redirect the industrial data, tunnel the industrial data, etc. .

In step 130, the industrial data is processed according to the disposal strategy corresponding to the industrial data.

In the above embodiment, according to the classification and classification rules, after determining the classification results and classification results corresponding to the classification and classification features of the industrial data, a corresponding processing strategy is determined and processed. Without the need to build a virtual private network or other gateways, it can meet the national regulatory requirements for hierarchical and classified management of industrial data.

FIG. 2 is a schematic flowchart of other embodiments of the disclosed industrial data processing method. This embodiment is implemented by an industrial gateway.

In step 210, the classification and grading rules and treatment strategies of the industrial data corresponding to the business are pre-configured.

In some embodiments, through the WEB management interface of the industrial gateway or the TR069 remote management capability, the classification and grading rules and treatment strategies of the industrial data corresponding to the service are configured.

In some embodiments, the classification rules include production categories, business categories, management categories, and the like, and the classification rules include common levels, corporate secret levels, and state secret levels, among others.

At step 220, industrial data is acquired through the industrial gateway.

In step 230, the industrial data is analyzed based on the DPI (Deep packet inspection, deep packet inspection) technology to obtain at least one item of quintuple information and business behavior of the industrial data. According to the quintuple information and time information of the industrial data , one or more of external environment characteristics and business behaviors to determine the classification and classification characteristics of industrial data.

In some embodiments, the external environment characteristic includes a security situation level.

In some embodiments, the business behavior includes determination of user misoperation, illegal user operation, illegal device access, network attack, and the like.

In step 240, according to the classification and classification features of the industrial data, by searching for classification and classification rules, the classification results and classification results corresponding to the industrial data are determined.

In some embodiments, all data traffic within the local area network is analyzed.

In some embodiments, corresponding reverse processing is also performed on the returned traffic.

In step 250, a disposal strategy corresponding to the industrial data is determined according to the classification results and classification results corresponding to the industrial data.

In step 260, the industrial data is processed according to the disposal strategy corresponding to the industrial data.

In the above embodiment, after classifying and grading the industrial data according to the pre-configured classification and grading rules and treatment strategies, the industrial data can be processed differently in real time according to the classification and grading results, which can improve data security and reliability. At the same time, it can realize the classification and hierarchical protection of data and data processing.

FIG. 3 is a schematic flowchart of other embodiments of the disclosed industrial data processing method.

In step 310, the industrial gateway receives an internal data forwarding request.

In step 320, it is judged whether the classification and grading rule is triggered, if so, step 330 is executed, otherwise, step 360 is executed.

In step 330, the classification and classification results of the data are determined according to the classification and classification features of the data.

In some embodiments, as shown in Table 1, the network grouping is set according to the quintuple information in the data, the time stamp is matched, and the traffic limit is increased to realize the classification and grading of the steady state data within the enterprise.

Table 1

In step 340, the treatment strategy corresponding to the data is searched.

At step 350, processing actions are performed according to the processing policy.

For example, when the production data is transmitted to the data center, if the security situation level is level 1 at a fixed time point, the traffic limit is less than 10K, and it needs to be encrypted for forwarding and transmission.

At step 360, data forwarding is completed.

In the above-mentioned embodiment, the management and control of the data flowing out of the industrial enterprise can be implemented in compliance with the national regulatory requirements.

FIG. 4 is a schematic structural diagram of some embodiments of the service data processing apparatus of the present disclosure. The apparatus includes: a data classification and grading module 410 , a policy implementation module 420 and a data processing module 430 .

The data classification and classification module 410 is configured to determine classification results and classification results corresponding to the industrial data according to the classification and classification features of the industrial data and the set classification and classification rules.

In some embodiments, the data is divided into production categories, business categories, management categories, and the like.

In some embodiments, according to the security level, the data is classified into a general level, an enterprise secret level, a state secret level, and the like.

The policy implementation module 420 is configured to determine a disposal policy corresponding to the industrial data according to the classification results and classification results corresponding to the industrial data.

In some embodiments, the disposal policy includes: encrypting industrial data, decrypting industrial data, discarding industrial data, logging industrial data, forwarding industrial data with high priority, signing industrial data, redirecting industrial data, tunneling encapsulating industrial data, etc. .

The data processing module 430 is configured to process the industrial data according to the disposal strategy corresponding to the industrial data.

In the above embodiment, according to the classification and classification rules, after determining the classification results and classification results corresponding to the classification and classification features of the industrial data, a corresponding processing strategy is determined and processed. Without the need to build a virtual private network or other gateways, it can meet the national regulatory requirements for hierarchical and classified management of industrial data.

In other embodiments of the present disclosure, as shown in FIG. 5 , the apparatus further includes a data acquisition unit 510, which is configured to analyze the industrial data based on the DPI technology, and obtain the quintuple information of the industrial data and the data in the business behavior. At least one item, according to one or more of the quintuple information, time information, external environment characteristics and business behavior of the industrial data, to determine the classification and grading characteristics of the industrial data.

In this embodiment, the DPI technology can be used to dynamically obtain industrial data, set network groupings according to quintuple, and match timestamps to increase the traffic limit and realize the classification and grading of internal stable data of the enterprise.

In other embodiments of the present disclosure, as shown in FIG. 5 , the apparatus further includes a policy configuration storage module 520, which is configured to pre-configure classification and grading rules and processing policies of industrial data corresponding to services.

In some embodiments, through the WEB management interface of the industrial gateway or the TR069 remote management capability, data classification and grading rules and treatment strategies corresponding to services are configured.

In some embodiments, the apparatus can also receive treatment policies issued by other control platforms.

FIG. 6 is a schematic structural diagram of other embodiments of the service data processing apparatus of the present disclosure. The apparatus includes 600 including a memory 610 and a processor 620 . Wherein: the memory 610 may be a magnetic disk, flash memory or any other non-volatile storage medium. The memory is used to store the instructions in the embodiments corresponding to Figures 1-3. The processor 620 is coupled to the memory 610 and may be implemented as one or more integrated circuits, such as a microprocessor or microcontroller. The processor 620 is used to execute instructions stored in the memory.

In some embodiments, processor 620 is coupled to memory 610 through BUS bus 630 . The apparatus 600 can also be connected to an external storage system 650 through a storage interface 640 for recalling external data, and can also be connected to a network or another computer system (not shown) through a network interface 660 . It will not be described in detail here.

In this embodiment, the data instructions are stored by the memory, and the above-mentioned instructions are processed by the processor, so as to meet the national regulatory requirements for hierarchical and classified management of industrial data without building a virtual private network or other gateways.

In other embodiments of the present disclosure, an industrial gateway is protected. The industrial gateway is a network-connectable device used in an industrial control application scenario, and can implement functions such as data collection, protocol conversion, and data forwarding. An industrial data processing device is added to the industrial gateway. Based on the classification and grading characteristics of the data and the pre-configured classification and grading rules and disposal strategies of industrial data corresponding to the business, the management and control of the data flowing out of industrial enterprises that meet the national regulatory requirements are implemented. . The disclosed collection is centralized and deployed, the classification and grading strategy is flexible, and the processing and classification are in the same node, which is more secure and efficient.

In other embodiments, a computer-readable storage medium has computer program instructions stored thereon, the instructions, when executed by a processor, implement the steps of the methods in the embodiments corresponding to FIGS. 1-3 . As will be appreciated by one skilled in the art, embodiments of the present disclosure may be provided as a method, apparatus, or computer program product. Accordingly, the present disclosure may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present disclosure may take the form of a computer program product embodied on one or more computer-usable non-transitory storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein .

The present disclosure is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the disclosure. It will be understood that each flow and/or block in the flowchart illustrations and/or block diagrams, and combinations of flows and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to the processor of a general purpose computer, special purpose computer, embedded processor or other programmable data processing device to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing device produce Means for implementing the functions specified in a flow or flow of a flowchart and/or a block or blocks of a block diagram.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory result in an article of manufacture comprising instruction means, the instructions The apparatus implements the functions specified in the flow or flow of the flowcharts and/or the block or blocks of the block diagrams.

These computer program instructions can also be loaded on a computer or other programmable data processing device to cause a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process such that The instructions provide steps for implementing the functions specified in the flow or blocks of the flowcharts and/or the block or blocks of the block diagrams.

So far, the present disclosure has been described in detail. Some details that are well known in the art are not described in order to avoid obscuring the concept of the present disclosure. Those skilled in the art can fully understand how to implement the technical solutions disclosed herein based on the above description.

While some specific embodiments of the present disclosure have been described in detail by way of examples, those skilled in the art will appreciate that the above examples are provided for illustration only, and are not intended to limit the scope of the present disclosure. Those skilled in the art will appreciate that modifications may be made to the above embodiments without departing from the scope and spirit of the present disclosure. The scope of the present disclosure is defined by the appended claims.

Claims (11)

1. An industrial data processing method, comprising:

determining a classification result and a classification result corresponding to the industrial data according to the classification characteristics of the industrial data and a set classification rule;

determining a disposal strategy corresponding to the industrial data according to a classification result and a grading result corresponding to the industrial data; and

and processing the industrial data according to a disposal strategy corresponding to the industrial data.

2. The industrial data processing method of claim 1, further comprising:

analyzing the industrial data based on a Deep Packet Inspection (DPI) technology to obtain at least one of quintuple information and business behavior of the industrial data; and

and determining classification and grading characteristics of the industrial data according to one or more of quintuple information, time information, external environment characteristics and business behaviors of the industrial data.

3. The industrial data processing method of claim 1, further comprising:

classification rules and disposal policies corresponding to industrial data of the business are pre-configured.

4. The industrial data processing method of any one of claims 1 to 3, wherein the disposition policy comprises: one or more of encrypting the industrial data, decrypting the industrial data, discarding the industrial data, recording the industrial data, high priority forwarding the industrial data, signing the industrial data, redirecting the industrial data, tunneling the industrial data.

5. The industrial data processing method according to any one of claims 1 to 3,

the classification rules comprise two or three of a production category, an operation category and a management category; and

the classification rules include two or three of a general level, an enterprise confidentiality level, and a national confidentiality level.

6. A service data processing apparatus, comprising:

the data classification and classification module is configured to determine a classification result and a classification result corresponding to the industrial data according to classification and classification characteristics of the industrial data and a set classification and classification rule;

the policy implementation module is configured to determine a disposal policy corresponding to the industrial data according to a classification result and a grading result corresponding to the industrial data; and

the data processing module is configured to process the industrial data according to a disposal strategy corresponding to the industrial data.

7. The industrial data processing apparatus of claim 6, further comprising:

the data acquisition unit is configured to analyze the industrial data based on a Deep Packet Inspection (DPI) technology to obtain at least one of quintuple information and business behavior of the industrial data, and determine classification and classification characteristics of the industrial data according to one or more of the quintuple information, time information, external environment characteristics and the business behavior of the industrial data.

8. The industrial data processing device of claim 6 or 7, further comprising:

a policy configuration storage module configured to pre-configure classification rules and handling policies corresponding to the industrial data of the business.

9. An industrial data processing apparatus comprising:

a memory; and

a processor coupled to the memory, the processor configured to perform the industrial data processing method of any of claims 1 to 5 based on instructions stored in the memory.

10. An industrial gateway, comprising:

an industrial data processing device according to any one of claims 6 to 9.

11. A non-transitory computer readable storage medium having stored thereon computer program instructions which, when executed by a processor, implement the industrial data processing method of any one of claims 1 to 5.

Images