Industrial control system security data verification system and method

Abstract

The embodiment of the invention provides an industrial control system security data verification system and method. The method comprises the following steps of adjusting the time interval of adjacentdata packets by using a time hidden channel to represent check information so that a time hidden channel between the main terminal unit and the remote terminal unit is established; completing the processes of sending and receiving the authentication information of an Modbus-TCP data packet; wherein the verification information is generated through an unlimited type hash algorithm; therefore, the time delay of the Modbus-TCP data packet can be detected; when the communication time delay does not accord with the verification information of the time hidden channel, the communication between the main terminal unit and the remote terminal unit is blocked, and an alarm is generated, so that various network attacks can be resisted, and the invention is not easy to identify based on a content detection method and supports a domestic cryptographic algorithm.

Description

technical field [0001] The present application relates to the technical field of industrial control system security, in particular to an industrial control system security data verification system and method. Background technique [0002] Data acquisition and monitoring system (SCADA, Supervisory Control And Data Acquisition) is an important part of industrial control system. Traditional SCADA locks the interface in a specified range through physical means, which leads to only considering functionality and stability when designing and deploying. Safety considerations are lacking. In the actual operation of the industrial control system, the attacker penetrates into the SCADA internal network through system background loopholes or human negligence, and conducts network attacks such as data tampering on the normal operation of the industrial control system, thereby secretly causing continuous physical damage to industrial equipment. . [0003] For data tampering attacks on i...

AI Technical Summary

Problems solved by technology

Although the SCTP protocol itself has good defense capabilities against denial-of-service attacks and man-in-the-middle attacks, the authentication method is a symmetric encryption authentication structure with a single key, and its defense against unauthorized commands and replay attacks is weak; the Sec_Modbus protocol uses symmetric encryption and digital signature technology to achieve confidentiality requirements and authentication, use the SHA-256 hash algorithm to calculate the digest of the message, and use the synchronization principle and the one-way design of the hash function to realize the anti-replay attack method based on the hash chain, but This method needs to change the communication protocol used by the original system, has compatibility problems, and does not support domestic cryptographic algorithms; uses TCP storage-type covert channels to perform hash verification on Modbus data, and is targeted by content-based detection methods risk of detection

Images