CN108170105A - Industrial control network protection system and method - Google Patents

Abstract

An industrial control network protection method, comprising: the data acquisition monitoring module carries an inspection identifier to inspect the industrial equipment group, wherein the inspection identifier comprises an address code and a core identifier; if the core identifier in the routing inspection identifier is not consistent with the core identifier in the industrial equipment, inquiring original data of the corresponding equipment in a backup database according to the address code in the routing inspection identifier; and exporting the original data inquired in the backup database and covering the data in the corresponding industrial equipment. Because the data acquisition monitoring module patrols and examines industrial equipment, through comparing the core sign, can detect whether industrial equipment receives the attack to in time through the data in the backup database recovery industrial equipment, avoid taking place the great loss. The invention also discloses an industrial control network protection system.

Description

An industrial control network protection system and method

technical field

This application relates to the technical field of network information security, in particular to an industrial control network protection system and method.

Background technique

With the development of computer and network technology, informatization security has been given a high degree of attention in the process of informatization construction. Industrial control system products are increasingly using general-purpose protocols, general-purpose hardware and general-purpose software, and some systems are based on various There are various ways to connect to public networks such as the Internet. Threats such as viruses, Trojan horses, and worms are spreading to industrial control systems, and the threats and problems to information security of industrial control systems are increasing day by day.

At present, industrial control network protection is mainly through setting up a firewall between the industrial control internal network and the external network, through the firewall to detect whether there is any abnormality in the data transmitted between the internal network and the external network, and if there is an abnormality, the transmission is blocked. When the amount of transmitted data is large, the firewall will detect data redundancy, resulting in crashes, and when the virus data is disguised, the firewall will fail to detect, resulting in threats to industrial control intranet data.

Contents of the invention

The application provides an industrial control network protection system and method to improve the security performance of the industrial control network.

According to the first aspect, an embodiment provides a method for protecting an industrial control network, including: the data collection and monitoring module carries an inspection identification to inspect the industrial equipment group, and the inspection identification includes an address code and a core identification; if the inspection If the core identification in the inspection identification does not match the core identification in the industrial equipment, query the original data of the corresponding equipment from the backup database according to the address code in the inspection identification; export the original data queried in the backup database and overwrite the corresponding industrial equipment The data.

Preferably, if the core identifier in the inspection identifier does not match the core identifier in the industrial equipment, the data collection and monitoring module triggers an alarm.

According to the second aspect, an embodiment provides an industrial control network protection system, including: a data collection and monitoring module, used for patrolling the industrial equipment according to the inspection identification, and also used for when the core identification in the inspection identification and the When the core identification in the industrial equipment does not match, query the original data of the corresponding equipment in the backup database according to the inspection identification, where the inspection identification includes address code and core identification; the industrial equipment group contains multiple industrial equipment, each industrial It has the address code of the equipment; the backup database stores the original data of each industrial equipment according to the address code.

Preferably, the data collection and monitoring module is also used to trigger an alarm when the core identifier in the inspection identifier does not match the core identifier in the industrial equipment.

According to the industrial control network protection method and system of the above-mentioned embodiments, since the data acquisition and monitoring module patrols the industrial equipment, by comparing the core identification, it can detect whether the industrial equipment is attacked, and restore the data in the industrial equipment through the backup database in time, Avoid major losses. Further, when the core identification in the inspection identification does not match the core identification in the industrial equipment, an alarm is triggered, and the manual is promptly prompted to do corresponding inspection and processing.

Description of drawings

Fig. 1 is a system block diagram of the present invention;

Fig. 2 is a flowchart of the present invention.

Detailed ways

The present invention will be further described in detail below through specific embodiments in conjunction with the accompanying drawings. Wherein, similar elements in different implementations adopt associated similar element numbers. In the following implementation manners, many details are described for better understanding of the present application. However, those skilled in the art can readily recognize that some of the features can be omitted in different situations, or can be replaced by other elements, materials, and methods. In some cases, some operations related to the application are not shown or described in the description, this is to avoid the core part of the application being overwhelmed by too many descriptions, and for those skilled in the art, it is necessary to describe these operations in detail Relevant operations are not necessary, and they can fully understand the relevant operations according to the description in the specification and general technical knowledge in the field.

The serial numbers assigned to components in this document, such as "first", "second", etc., are only used to distinguish the described objects, and do not have any sequence or technical meaning. The "connection" and "connection" mentioned in this application include direct and indirect connection (connection) unless otherwise specified.

Please refer to Fig. 1, the industrial control network protection system of the present invention comprises: data acquisition and monitoring module 1, industrial equipment group 2, backup database 3; When the core identification in the inspection identification does not match the core identification in the industrial equipment, query the original data of the corresponding equipment in the backup database 3 according to the address code in the inspection identification, wherein the inspection identification includes the address code and the core identification; The equipment group 2 includes a plurality of industrial equipment, and each industrial equipment has the address code of the equipment; the backup database 3 stores the original data of each industrial equipment according to the address code.

Wherein, the data acquisition monitoring module is also used to trigger an alarm when the core identification in the inspection identification does not match the core identification in the industrial equipment.

Please refer to Fig. 2, the industrial control network protection method of the present invention comprises:

Step 101, the data collection and monitoring module carries the inspection identification to the industrial equipment group for inspection, and the inspection identification includes address code and core identification;

Step 102, judging whether the core identification in the inspection identification matches the core identification in the industrial equipment, if not, proceed to step 103;

Step 103, querying the backup database for the original data of the corresponding device according to the address code in the inspection identification;

Step 104, exporting the original data queried in the backup database and overwriting the data in the corresponding industrial equipment.

As a preferred embodiment of the present invention, it further includes that the core identification in the inspection identification does not match the core identification in the industrial equipment, and the data collection and monitoring module triggers an alarm.

The above uses specific examples to illustrate the present invention, which is only used to help understand the present invention, and is not intended to limit the present invention. For those skilled in the technical field to which the present invention belongs, some simple deduction, deformation or replacement can also be made according to the idea of the present invention.

Claims (4)

1. a kind of industrial control network means of defence, it is characterised in that including：

Data acquisition monitoring module carries inspection and identifies to industrial equipment group inspection, and the inspection mark includes address coding and core The heart identifies；

If the core mark in inspection mark is not inconsistent with the core mark in industrial equipment, the address coding in being identified according to inspection The initial data of corresponding equipment is inquired into backup database；

The initial data inquired in backup database is exported and covers the data in corresponding industrial equipment.

2. industrial control network means of defence as described in claim 1, which is characterized in that if the core mark in inspection mark Know and be not inconsistent with the core mark in industrial equipment, data acquisition monitoring module triggering alarm.

3. a kind of industrial control network guard system, it is characterised in that including：

Data acquire monitoring module, for identifying the core to industrial equipment inspection, being additionally operable to when in inspection mark according to inspection When mark is not inconsistent with the core mark in industrial equipment, is identified according to inspection and the original of corresponding equipment is inquired into backup database Data；Wherein, inspection mark includes address coding and core mark；

Industrial equipment group, comprising multiple industrial equipments, each industrial equipment carries the address coding of the equipment；

Backup database is stored with the initial data of each industrial equipment by address coding.

4. industrial control network guard system as claimed in claim 3, which is characterized in that data acquisition monitoring module is additionally operable to Triggering is alarmed when core mark in inspection mark is not inconsistent with the core mark in industrial equipment.