WO2020037478A1 - 一种基于状态关系图的工控防火墙实现方法 - Google Patents

一种基于状态关系图的工控防火墙实现方法 Download PDF

Info

Publication number
WO2020037478A1
WO2020037478A1 PCT/CN2018/101405 CN2018101405W WO2020037478A1 WO 2020037478 A1 WO2020037478 A1 WO 2020037478A1 CN 2018101405 W CN2018101405 W CN 2018101405W WO 2020037478 A1 WO2020037478 A1 WO 2020037478A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
module
industrial control
state
state relationship
Prior art date
Application number
PCT/CN2018/101405
Other languages
English (en)
French (fr)
Inventor
王勇
刘蔚
Original Assignee
上海云剑信息技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 上海云剑信息技术有限公司 filed Critical 上海云剑信息技术有限公司
Priority to PCT/CN2018/101405 priority Critical patent/WO2020037478A1/zh
Publication of WO2020037478A1 publication Critical patent/WO2020037478A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols

Definitions

  • the invention relates to the field of industrial control firewalls, and in particular, to a method for implementing an industrial control firewall based on a state relationship diagram.
  • a firewall is a protection barrier constructed by a combination of software and hardware devices on the interface between an internal network and an external network, and between a private network and a public network. It is an image saying that it is a method of obtaining security.
  • a combination of computer hardware and software enables a secure gateway to be established between the Internet and the intranet, thereby protecting the internal network from the intrusion of illegal users.
  • Traditional firewalls can be divided into various types according to different prevention methods and focuses, mainly divided into packet filtering firewalls, application gateway firewalls, stateful inspection firewalls, and composite firewalls.
  • Packet filtering firewall This firewall is generally implemented on routers to filter user-defined content, such as IP addresses. But because it inspects data packets at the network layer, the system has no awareness of the application layer information, so its security has certain defects.
  • Application gateway firewall This firewall inspects all application layer packets and puts the content of the inspection into the decision-making process, thereby improving the security of the network. But because each client / server communication requires two connections, and each proxy needs to add a service program for this new application for each new application. Therefore, the scalability of the application gateway firewall is poor.
  • This firewall basically maintains the advantages of a simple packet filtering firewall, has better performance, and is transparent to applications.
  • the principle is to establish a state connection table in the core part of the firewall, maintain the connection, and treat the data that enters and exits the network as individual events, which has greatly improved the security.
  • This firewall is a new generation of firewall that integrates state detection and transparent proxy. It integrates anti-virus and content filtering into the firewall, including virtual private network and intrusion detection functions.
  • the industrial control firewall can be applied to the industrial control environment, to protect the boundaries of the industrial control system and between different control domains within the industrial control system, and to meet specific industrial environment and functional requirements.
  • the current industrial control firewalls are mainly used to filter ModbusTCP and IEC104 packets, and identify industrial control protocols and instructions. , Extracting the content of the transmitted industrial control instruction operation, making judgments and identifying and processing the traffic accordingly.
  • the status firewall status detection system based on the Industrial Internet of Things mainly identifies and monitors the status of the network layer.
  • the firewalls use the packet filtering firewall method. They only check the rules of each passing data packet, lack of monitoring of behavior and traffic, and there are some firewalls based on state detection, but they are just In monitoring the status of the network layer, no state relationship has been established for the data itself.
  • the firewall we invented uses state-relation diagrams to formulate detection rules for industrial control behaviors based on the state-relation diagrams to implement the security functions of protocol analysis, behavior monitoring, and traffic monitoring of industrial control systems.
  • the implementation method of the industrial control system firewall can not only analyze the protocol type and communication data of the industrial control system, but also determine abnormal data relationships and abnormal operation commands.
  • an object of the present invention is to provide an industrial control firewall based on a state relationship diagram. It includes: industrial data acquisition module, state relationship diagram module, protocol analysis module and behavior monitoring module.
  • the firewall of the industrial control system based on the state relation diagram includes the industrial data acquisition module, the state relation diagram module, the protocol analysis module and the behavior monitoring module.
  • the industrial data acquisition module collects real-time operating data of the industrial system, and the state relation diagram
  • the state relationship diagram of the data module is generated in the module, and this feature is used as the judgment condition for judging whether the system is operating normally.
  • the protocol analysis module proposes the data packet content of the industrial communication protocol, dynamically generates the state relationship diagram at the time of operation, and the behavior monitoring module Compared with the state relationship diagram at normal operating time, if an abnormality is found, it is judged that an attack event has occurred, and the data abnormal behavior caused by the attack event is further analyzed.
  • Industrial data acquisition module collects various industrial control protocols TCP / IP, ModBus TCP, OPC, DNP3.0, ProfiNet, IEC60870-5-104 protocol, IEC61850, Step7 protocol data, and collects input and output data and industrial control instructions. The collected data is transferred to the state diagram module for further processing.
  • State relationship diagram module The state relationship diagram first runs in the rule generation mode. Under normal conditions, the industrial data acquisition module collects real-time operating data of the industrial system, and generates the state relationship diagram of the data module in the state relationship diagram module. Use this feature as The conditions under which the firewall determines whether the system is operating normally. After the firewall determines that the state relationship diagram is generated, the state relationship diagram is switched to the working mode, and then the industrial data acquisition module is used to collect real-time operating data of the industrial system, generate the state relationship diagram, and then turn to the protocol analysis module.
  • Protocol analysis module identify the protocol types of different industrial control systems, filter and detect communication data according to protocols and other rules, and analyze the data of protocol types, source addresses, source ports, destination addresses, and destination ports. If the state relationship diagram and the state production diagram of the production process are the same, the data is released. If there is a difference, the data is blocked and the behavior monitoring module is turned to further operation.
  • Behavior monitoring module the data blocked by the protocol analysis module, detecting that the state relationship diagram under the working model does not match the state relationship diagram in the rule generation mode, recording the configuration of the industrial control system, the data of the operating station and the changes in the operating instructions, It mainly monitors changes in the configuration of the engineer station, changes in the operating station data and operating instructions, as well as changes in the mainstream fieldbus access, communication behavior, and load changes, and updates the firewall rule base.
  • FIG. 1 is a system structure of an industrial control firewall based on a state relationship diagram
  • Figure 2 is a schematic diagram of an industrial data acquisition module
  • FIG. 3 is a schematic diagram of a state relationship diagram module
  • Figure 4 is a schematic diagram of a protocol analysis module
  • Figure 5 is a schematic diagram of a behavior monitoring module
  • the system structure of the industrial control firewall based on the state relationship diagram includes: industrial data collection module, state relationship diagram module, protocol analysis module and behavior monitoring module, industrial data collection of multiple industrial control types of protocols and data, according to The data generates a state relationship diagram and generates firewall judgment rules for protocol analysis and behavior monitoring.
  • the system of the present invention collects protocol data, which includes a protocol type, a source address, a source port, a destination address, a destination port, and communication data.
  • Protocol types can be TCP / IP, ModBus TCP, OPC, DNP3.0, ProfiNet, IEC60870-5-104, IEC61850, Step7, etc.
  • the collected communication data is prepared for generating state relationship diagrams and behavior monitoring.
  • the communication data includes temperature, pressure, moderation, speed, valve status and control commands.
  • the state diagram is drawn using the communication data collected at each moment, and the state relationship diagram is generated according to the change of the state node, and simplified.
  • the firewall Corresponding detection rules for industrial control behavior are automatically generated according to this relationship diagram.
  • the firewall detection rules generated by the state relationship diagram are composed of combination conditions and operations, and form operation command rules according to the combination conditions.
  • the combination conditions include several conditions. , Formed by the logical relationship of conditional AND, OR, NOT, XOR; the condition is that there is a number of data and the logical relationship and the specific value through greater than, less than and equal to.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Computer And Data Communications (AREA)

Abstract

本发明公开了一种基于状态关系图的工控防火墙实现方法，它属于工业控制系统安全领域，基于状态关系图的工业控制系统防火墙，包括工业数据采集模块，状态关系图模块，协议分析模块和行为监控模块，在正常状态下，工业数据采集模块采集工业系统的实时运行数据，在状态关系图模块中生成数据模块的状态关系图，把这个特征作为判断系统是否正常运行的判断条件，此后，协议分析模块提出工业通信协议的数据包内容，动态生成运行时刻的状态关系图，在行为监控模块中，对比正常运行时刻的状态关系图，若发现异常，判断攻击事件发生。

Description

一种基于状态关系图的工控防火墙实现方法 技术领域
本发明涉及工控防火墙领域，尤其涉及一种基于状态关系图的工控防火墙实现方法。
背景技术
防火墙是指一个由软件和硬件设备组合而成，在内部网和外部网之间、专用网与公共网之间的界面上构造的保护屏障，是一种获取安全性方法的形象说法，它是一种计算机硬件和软件的结合，使Internet与Intranet之间建立起一个安全网关，从而保护内部网免受非法用户的侵入。传统防火墙可根据防范的方式和侧重点的不同而分为多种类型，主要分为包过滤防火墙、应用网关防火墙、状态检测防火墙和复合型防火墙。
包过滤防火墙：该防火墙一般在路由器上实现，用以过滤用户定义的内容，如IP地址。但因其是在网络层检查数据包，系统对应用层信息无感知，所以其安全性有一定缺陷。
应用网关防火墙：该防火墙是检查所有应用层的信息包，并将检查的内容信息放入决策过程，从而提高网络的安全性。但因为每个客户机/服务器通信需要两个连接，而且每个代理需要对每个新的应用添加针对此应用的服务程序。所以，应用网关防火墙的可伸缩性较差。
状态检测防火墙：该防火墙基本保持了简单包过滤防火墙的优点，性能较好，同时对应用是透明的。其原理是在防火墙的核心部分建立状态连接表，维护了连接，将进出网络的数据当成一个个的事件来处理，在安全性上有了大幅提升。
复合型防火墙：该防火墙综合了状态检测与透明代理的新一代的防火墙，把防病毒、内容过滤整合到防火墙里，其中还包括虚拟专用网络、入侵检测功能，多功能融为一体。
随着科技的不断创新，工业自动化发展快速，工控系统的安全是发展的重中之重，而防火墙则是工控系统安全的重要组成部分之一。工控防火墙可应用于工业控制环境，对工业控制系统边界以及工业控制系统内部不同控制域之间进行边界保护，并满足特定的工业环境和功能要求。
现如今在工控防火墙的研究上已有较大突破。在专利方面，有如支持过滤ModbusTCP协议的工控防火墙，支持过滤IEC104协议的工控防火墙，基于多核处理器的工控防火墙，当前工控防火墙主要是对ModbusTCP、IEC104进行数据包的过滤、工控协议和指令的识别，提取传输的工控指令操作内容，进行判定识别并对流量进行相应处理。基于工业物联网的状态防火墙状态检测系统，主要是对网络层状态进行识别监测。
综上说述，当前工业防火墙大部分采用基于包过滤防火墙的方法，单单对每个经过的 数据包进行规则检查，缺乏对行为和流量的监测，也有一些事基于状态检测的防火墙，但仅仅是在监测网络层的状态，还没有对数据本身建立状态关系。而我们所发明的防火墙是采用状态关系图，根据状态关系图去制定对工控行为的检测规则，实现工控系统的协议分析、行为监测和流量监测的安全功能。该工业控制系统防火墙的实现方法与当前基于包过滤技术和网络状态技术的相比，不仅可以对工业控制系统的协议类型，通信数据，而且还能判定异常的数据关系，操作命令的异常。
发明内容
针对现有技术存在的不足，本发明的目的是提供一种基于状态关系图的工控防火墙。其包括：工业数据采集模块，状态关系图模块，协议分析模块和行为监控模块。基于状态关系图的工业控制系统防火墙，包括工业数据采集模块，状态关系图模块，协议分析模块和行为监控模块，在正常状态下，工业数据采集模块采集工业系统的实时运行数据，在状态关系图模块中生成数据模块的状态关系图，把这个特征作为判断系统是否正常运行的判断条件，此后，协议分析模块提出工业通信协议的数据包内容，动态生成运行时刻的状态关系图，在行为监控模块中，对比正常运行时刻的状态关系图，若发现异常，就判断有攻击事件发生，进一步分析攻击事件导致的数据异常行为。
工业数据采集模块：采集多种工控协议TCP/IP、ModBus TCP、OPC、DNP3.0、ProfiNet、IEC60870-5-104协议、IEC61850、Step7协议数据，采集输入输出数据和工控指令。采集后的数据传入状态关系图模块做进一步处理。
状态关系图模块：状态关系图首先在规则生成模式运行，在正常状态下，工业数据采集模块采集工业系统的实时运行数据，在状态关系图模块中生成数据模块的状态关系图，把这个特征作为防火墙判断系统是否正常运行的判断条件。当防火墙判定状态关系图生成完毕后，状态关系图切换到工作模式，接续接收工业数据采集模块采集工业系统的实时运行数据，生成状态关系图，然后转向协议分析模块。
协议分析模块：识别不同工业控制系统的协议类型根据协议等规则，对通信数据进行过滤和检测，对协议的类型、源地址、源端口、目的地址、目的端口的数据，把工作模式下生产的状态关系图与规程生产生产的状态关系图，如果相同，则放行数据，若有差异，拦阻数据，转向行为监控模块进一步操作。
行为监测模块：协议分析模块拦阻的数据，检测分析工作模型下的状态关系图与规则生成模式下的状态关系图不匹配，记录工业控制系统组态、操作站的数据与操作指令变更的情况，主要监控如工程师站组态变更、操作站数据与操作指令变更，以及各主流现场总线访问、通信行为、负载变更情况，更新防火墙规则库。
附图说明
图1为基于状态关系图的工控防火墙的系统结构；
图2为工业数据采集模块示意图；
图3为状态关系图模块示意图；
图4为协议分析模块示意图；
图5为行为监控模块示意图；
具体实施方式
下面结合附图对本发明做进一步说明。
如图1所示，基于状态关系图的工控防火墙的系统结构，其包括：工业数据采集模块，状态关系图模块，协议分析模块和行为监控模块，工业数据采集多种工控类型协议和数据，根据数据生成状态关系图，产生防火墙判断规则，用于协议分析与行为监控。
如图2所示，为图1中11工业数据采集模块的详解。本发明系统采集协议数据，其中包括协议类型、源地址、源端口、目的地址、目的端口和通信数据。协议类型可以为TCP/IP、ModBus TCP、OPC、DNP3.0、ProfiNet、IEC60870-5-104、IEC61850、Step7等。所采集的通信数据是为生成状态关系图以及行为监控做准备。其中通信数据包括温度、压力、适度、转速以及阀门状态和控制命令等。
如图3所示，为图1中12状态关系图模块的详解，运用所采集到的每一时刻的通信数据绘制状态图，根据状态结点的变化情况生成状态关系图，并作简化，防火墙根据此关系图自动生成相应的对工控行为的检测规则。
如图4所示，为图1中13协议分析模块的详解，根据数据关系图生产的规则，通过对协议的类型、源地址、源端口、目的地址、目的端口的分析，判断所经过的数据包是否通过或者丢弃。
如图5所示，为图1中14行为监控模块的详解，通过状态关系图所生成的防火墙检测规则，规则是有组合条件和操作组成，根据组合条件形成操作命令规则；组合条件包括若干条件，通过条件的与、或、非、异或的逻辑关系形成；条件是有若干数据与通过大于、小于和等于的逻辑关系和特定数值组成。

Claims (5)

  1. 一种基于状态关系图的工控防火墙实现方法，其特征在于基于状态关系图的工业控制系统防火墙，包括工业数据采集模块，状态关系图模块，协议分析模块和行为监控模块，在正常状态下，工业数据采集模块采集工业系统的实时运行数据，在状态关系图模块中生成数据模块的状态关系图，把这个特征作为判断系统是否正常运行的判断条件，此后，协议分析模块根据此判断条件，通过对协议的类型、源地址、源端口、目的地址、目的端口的分析，判断所经过的数据包是否通过或者丢弃，若发现异常，就判断有攻击事件发生，进一步分析攻击事件导致的数据异常。
  2. 根据权利要求1所述的工业数据采集模块，可以采集多种工控协议TCP/IP、ModBus TCP、OPC、DNP3.0、Profinet、IEC60870-5-104协议、IEC61850、Step7协议数据，采集输入输出数据和工控指令。采集后的数据传入状态关系图模块做进一步处理。
  3. 根据权利要求书1所述的状态关系图模块，其特征在于，根据工业控制数据采集模块采集的数据，绘制该数据变量的时序图，根据工业控制系统某个时刻所有被监控数据的时序图，绘制工业控制系统的状态图，然后根据状态结点变化情况，生成状态关系图。在工业控制系统正常运行情况下生成状态关系图，把这个特征作为判断系统是否正常运行的判断条件，然后转向协议分析模块。
  4. 根据权利要求书1所述的协议分析模块，其特征在于根据数据关系图的特征作为判断系统是否正常运行的条件，通过对协议的类型、源地址、源端口、目的地址、目的端口的分析，判断所经过的数据包是否通过或者丢弃，如果相同，则放行数据，若有差异，拦阻数据，转向行为监控模块进一步操作。
  5. 根据权利要求书1所述的行为监控模块，其特征在于根据状态关系图生成防火墙所需的检测规则，该规则的判断条件包含采集的数据之间的逻辑关系，由这些判断条件之间的逻辑组合形成组合条件，若满足该组合条件，就执行相应的操作。
PCT/CN2018/101405 2018-08-21 2018-08-21 一种基于状态关系图的工控防火墙实现方法 WO2020037478A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
PCT/CN2018/101405 WO2020037478A1 (zh) 2018-08-21 2018-08-21 一种基于状态关系图的工控防火墙实现方法

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2018/101405 WO2020037478A1 (zh) 2018-08-21 2018-08-21 一种基于状态关系图的工控防火墙实现方法

Publications (1)

Publication Number Publication Date
WO2020037478A1 true WO2020037478A1 (zh) 2020-02-27

Family

ID=69592338

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/101405 WO2020037478A1 (zh) 2018-08-21 2018-08-21 一种基于状态关系图的工控防火墙实现方法

Country Status (1)

Country Link
WO (1) WO2020037478A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112822211A (zh) * 2021-02-06 2021-05-18 西安热工研究院有限公司 电力工控便携式自学习工业防火墙系统、装置及使用方法
CN114817641A (zh) * 2022-02-19 2022-07-29 英赛克科技（北京）有限公司 一种工业数据采集方法、装置及电子设备

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105204487A (zh) * 2014-12-26 2015-12-30 北京邮电大学 基于通信模型的工业控制系统的入侵检测方法及系统
EP2991305A1 (en) * 2014-08-29 2016-03-02 Electronics and Telecommunications Research Institute Apparatus and method for identifying web page for industrial control system
CN105721498A (zh) * 2016-04-07 2016-06-29 周文奇 一种工控网络安全预警系统
CN106790235A (zh) * 2017-01-20 2017-05-31 上海云剑信息技术有限公司 一种基于状态关系图的工控防火墙实现方法

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP2991305A1 (en) * 2014-08-29 2016-03-02 Electronics and Telecommunications Research Institute Apparatus and method for identifying web page for industrial control system
CN105204487A (zh) * 2014-12-26 2015-12-30 北京邮电大学 基于通信模型的工业控制系统的入侵检测方法及系统
CN105721498A (zh) * 2016-04-07 2016-06-29 周文奇 一种工控网络安全预警系统
CN106790235A (zh) * 2017-01-20 2017-05-31 上海云剑信息技术有限公司 一种基于状态关系图的工控防火墙实现方法

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112822211A (zh) * 2021-02-06 2021-05-18 西安热工研究院有限公司 电力工控便携式自学习工业防火墙系统、装置及使用方法
CN114817641A (zh) * 2022-02-19 2022-07-29 英赛克科技（北京）有限公司 一种工业数据采集方法、装置及电子设备
CN114817641B (zh) * 2022-02-19 2023-06-20 英赛克科技（北京）有限公司 一种工业数据采集方法、装置及电子设备

Similar Documents

Publication Publication Date Title
CN110378103B (zh) 一种基于OpenFlow协议的微隔离防护方法及系统
Deri et al. Combining System Visibility and Security Using eBPF.
CN110213198A (zh) 网络流量的监控方法及系统
Nife et al. Application-aware firewall mechanism for software defined networks
CN113240116B (zh) 基于类脑平台的智慧防火云系统
CN114553537A (zh) 一种面向工业互联网的异常流量监测方法和系统
WO2020037478A1 (zh) 一种基于状态关系图的工控防火墙实现方法
Atighetchi et al. Adaptive cyberdefense for survival and intrusion tolerance
CN103997439A (zh) 一种流量监测方法、装置和系统
Qiu et al. Global Flow Table: A convincing mechanism for security operations in SDN
Gad et al. Employing the CEP paradigm for network analysis and surveillance
Wang et al. Novel architectures and security solutions of programmable software-defined networking: a comprehensive survey
Cheminod et al. Performance impact of commercial industrial firewalls on networked control systems
Sainz et al. Software defined networking opportunities for intelligent security enhancement of industrial control systems
Ahmad Solution Model for Intrusion Detection in Software Defined Networking (SDN) using Machine Learning
CN106790235A (zh) 一种基于状态关系图的工控防火墙实现方法
Levin et al. Network Monitoring in Federated Cloud Environment
Li et al. A defense model study based on IDS and firewall linkage
Li et al. Research on dos attack detection method of modbus tcp in openplc
Cisco Working with Sensor Signatures
CN112437070A (zh) 一种基于操作生成树状态机完整性验证计算方法及系统
Du et al. A Dynamic Security Mechanism for Web Services Based on NDIS Intermediate Drivers.
CN106657087B (zh) 一种实现Ethernet/Ip协议动态跟踪的工业防火墙的方法
CN116827698B (zh) 一种网络关口流量安全态势感知系统及方法
Shang et al. Security defense model of Modbus tcp communication based on zone/border rules

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18931152

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 18931152

Country of ref document: EP

Kind code of ref document: A1