Method, system and terminal for industrial control system authentication and data interaction

Abstract

The present invention belongs to the field of industrial Internet technology and discloses a method, system and terminal for industrial control system authentication and data interaction. The method includes: during initialization, the equipment in the enterprise zone of the industrial control system creates a public-private key pair; the industrial security authentication system creates a device fingerprint for the equipment, and the industrial security authentication system respectively establishes its own enterprise zone device trust list and industrial zone device trust list; a three-level key system, dynamic keys, dedicated keys, domestic encryption algorithms, digital signature technology and device trust lists are combined to achieve device authentication and data interaction of the industrial control system. The present invention ensures that both communicating parties are authenticated and trusted devices, realizes secure information sharing between IT and OT, and avoids direct network access between the enterprise zone and the industrial equipment zone; the industrial zone equipment will only establish communication with the outside world through this system, providing a high level of protection for vulnerable industrial zones.

Description

Technical Field

[0001] The present invention belongs to the field of industrial Internet technology, and in particular relates to a method, system and terminal for industrial control system authentication and data interaction. Background Art

[0002] The continuous development of the Industrial Internet is driving closer connections between industrial control systems and the internet, and the gradual convergence of IT and OT networks. Today, industrial control systems are exposed to the threat of cyberattacks, with frequent attacks occurring both domestically and internationally. In existing industrial control systems, Internet devices in the enterprise zone and industrial devices exchange data through the Demilitarized Zone (DMZ). Malicious attacks can easily compromise the security mechanisms of the DMZ, potentially exposing industrial devices to attacks. Therefore, a new authentication and data exchange method for industrial control systems is urgently needed.

[0003] Through the above analysis, the problems and defects of the existing technology are as follows: industrial networks and enterprise networks are easily attacked by attackers when communicating; the existing industrial control systems lack complete and complex identity authentication for the access applicants, the data security exchange algorithm is not complex enough, and the key update is not timely, which makes it easy for attackers to take advantage of it. Summary of the Invention

[0004] In response to the problems existing in the prior art, the present invention provides a method, system, device and terminal for industrial control system authentication and data interaction.

[0005] The present invention is implemented as follows: a method for industrial control system authentication and data interaction, the method for industrial control system authentication and data interaction comprising: establishing an access control mechanism when the enterprise network and the industrial control network communicate, and at the same time establishing a list of trusted devices for the enterprise and industrial ends, using the trusted device list as a fine-grained access strategy and a dual identity authentication strategy, and realizing device authentication and secure data interaction of the industrial control system by combining a three-level key system, dynamic keys, dedicated keys, domestic encryption algorithms and digital signature technology.

[0006] Furthermore, the method for industrial control system authentication and data interaction also includes: during the first authentication of the enterprise area device, the industrial security authentication system ensures that the device requesting access is trustworthy, and issues a key K1 to the enterprise area device; during the second authentication, the enterprise area device generates a session key K2, and the industrial security authentication system verifies the digital signature to ensure whether the issued key K1 is valid, and at the same time verifies whether the enterprise area device is trustworthy; after verification, the industrial security authentication system forwards the instruction to the corresponding industrial area device, encrypts the returned data using the session key K2, calculates a summary of the original data to generate a digital signature, and then sends it to the enterprise area device; the enterprise area device decrypts the data after receiving it, and makes a summary after obtaining the original data; verifies the digital signature, if they are the same, the data is valid, if they are different, the data is invalid.

[0007] Furthermore, the method for industrial control system authentication and data interaction specifically includes the following steps:

[0008] Step 1: When the industrial security authentication system is initialized, a client trust list and a device trust list are established. The enterprise zone devices are pre-set with the industrial zone device fingerprint and device information.

[0009] Step 2: The enterprise client encrypts the original data using the public key of the industrial security authentication system, generates a digital signature based on the original data, and then sends it to the industrial security authentication system.

[0010] Step 3: After receiving the data packet, the industrial security authentication system uses the private key to decrypt the data and verify the digital signature. If it is valid and the device information is legitimate, access is authorized and the key K1 is returned and temporarily stored locally.

[0011] Step 4: The enterprise device generates a session key K2 and uses it to encrypt the original data to obtain ciphertext data P1. The original data is summarized and encrypted using the private key to generate a digital signature. The session key K2 is encrypted using key K1 and then encrypted using the public key of the industrial security authentication system to obtain ciphertext data P2, which is then sent to the industrial security authentication system.

[0012] Step 5: The industrial security authentication system uses the private key to decrypt the ciphertext data P2 to obtain the intermediate ciphertext, and then uses the key K1 to decrypt it to obtain the session key K2. The ciphertext data P1 is decrypted using K2. The digital signature is verified and the target device is determined to be legitimate. Finally, the key K1 is discarded.

[0013] Step 6: The industrial safety authentication system forwards the instruction data to the corresponding industrial zone equipment, and the industrial zone equipment returns the data calculated according to the instruction to the industrial safety authentication system;

[0014] Step 7: The industrial security authentication system uses the session key K2 to encrypt the original data returned by the device, generates a digital signature based on the summary of the original data, and finally discards K2;

[0015] Step 8: The enterprise zone device uses the key K2 to decrypt the ciphertext data to get the original data, and makes a summary of the original data; it verifies the digital signature. If they are the same, the data is valid; if they are different, it is discarded.

[0016] Furthermore, the client trust list in step 1 is for the enterprise zone, and the device trust list is for the industrial zone;

[0017] Furthermore, the initialization of the industrial safety authentication system in step 1 includes:

[0018] (1) Each device in the ICS enterprise zone that interacts with the industrial zone creates a public-private key pair;

[0019] (2) The industrial security authentication system creates its own public and private key pair, generates device fingerprints for devices in the enterprise area, and stores them in the corresponding devices;

[0020] (3) The industrial security authentication system establishes its own enterprise zone device trust list. The trust list stores key-value pairs, where the key is the device fingerprint of the enterprise zone device and the value corresponds to the device's public key and access count.

[0021] (4) The industrial security authentication system establishes its own trust list of industrial zone equipment. The trust list stores key-value pairs, where the key is the device fingerprint of the industrial zone equipment and the value corresponds to the device information;

[0022] (5) Enterprise zone devices are pre-configured with accessible industrial zone device fingerprints and device information.

[0023] Furthermore, the raw data in step 2 includes the access device fingerprint and the number of accesses.

[0024] Furthermore, the device information in step three includes the device fingerprint and the number of accesses.

[0025] Furthermore, the original data in step 4 includes the target device fingerprint and instruction data.

[0026] Furthermore, industrial control system authentication methods include:

[0027] (1) The enterprise zone device uses the public key of the industrial security authentication system to encrypt the device information using the SM2 encryption algorithm to obtain encrypted data, and uses the SM3 encryption algorithm to obtain the summary information M1 of the original data; uses the private key to sign and send it to the industrial security authentication system;

[0028] (2) After receiving the encrypted data, the industrial security authentication system uses its own private key to decrypt the data to obtain the original data, and uses the SM3 algorithm to generate the summary information M2 of the original data; compare the summary information M1 and M2, if they are different, the request is discarded; if they are the same, the system searches the device trust list of its own enterprise zone for the device information and access times, and obtains the public key of the device; if it exists and is legal, the key K1 is generated based on the fingerprint of the device at end A, the access times, the timestamp and the random number; if it does not exist, the request is discarded; the key K1 is encrypted with the public key of the enterprise zone device by SM4 and returned to the enterprise zone, and the key K1 is temporarily stored locally in the industrial security authentication system;

[0029] (3) After receiving the returned key ciphertext data, the enterprise zone device proves that the connection has been established, and uses the private key to decrypt the ciphertext data to obtain the key K1. It generates the session key K2 based on its own device fingerprint, the C-end target device fingerprint, the number of accesses, the timestamp, and the random number. It uses the key K2 to perform SM4 encryption on the original data to obtain the ciphertext data P1, and SM3 encryption on the original data to obtain the summary information, and then signs it only with the private key. It uses the key K1 to perform SM4 encryption on the session key, and then uses the public key of the industrial security authentication system to perform SM2 encryption to obtain the ciphertext data P2. Finally, the ciphertext data P1 and P2 are sent to the industrial security authentication system.

[0030] (4) After receiving the encrypted data, the industrial security authentication system uses its own private key to decrypt the ciphertext data P2 to obtain the intermediate data, and then uses the key K1 to decrypt the intermediate data to obtain the session key K2; the ciphertext data P1 is decrypted using the session key to obtain the target device fingerprint and instruction data; the digital signature is verified to verify whether the target device is legitimate, and finally the key K1 is discarded;

[0031] (5) After the industrial security authentication system successfully authenticates, the system forwards the request instruction to the industrial zone device that the enterprise zone device is requesting to access. After receiving the instruction, the industrial zone device returns the original data to the industrial security authentication system. The industrial security authentication system uses the agreed session key K2 to perform SM4 encryption on the original data to obtain the ciphertext data P3. The original data is calculated using the SM3 encryption algorithm to obtain the message digest M6, and the message digest is signed with the private key. The message digest is returned to the enterprise zone device and the session key K2 is discarded.

[0032] (6) After receiving the ciphertext data, the enterprise zone device uses the session key K2 to decrypt the ciphertext data P3 to obtain the original data PP2, and performs the SM3 encryption algorithm on the original data to obtain the summary information M7; the digital signature is verified. If the signature is illegal, it is discarded. If it is legal, the original data PP2 is usable.

[0033] Furthermore, the public key pair device information in step (1) includes the device fingerprint and access times.

[0034] Furthermore, the raw data in step (2) includes device fingerprints and access times.

[0035] Furthermore, the original data in step (3) includes the C-end target device fingerprint and instruction data.

[0036] Furthermore, the step (4) of verifying whether the target device is legitimate is as follows: matching the target device fingerprint in the industrial zone device trust list.

[0037] Another object of the present invention is to provide a system for industrial control system authentication and data interaction using the method for industrial control system authentication and data interaction. The system for industrial control system authentication and data interaction includes:

[0038] Initialization module, used to create public and private key pairs for devices in the enterprise zone of the industrial control system;

[0039] A device fingerprint creation module, used to create a device fingerprint for a device using an industrial security authentication system;

[0040] A device trust list creation module is used to use the industrial security authentication system to establish its own enterprise zone device trust list and industrial zone device trust list;

[0041] The device authentication and data interaction module is used to implement device authentication and data interaction of industrial control systems by combining a three-level key system, dynamic keys, dedicated keys, domestic encryption algorithms, digital signature technology and device trust lists.

[0042] Another object of the present invention is to provide a computer device, which includes a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the method for industrial control system authentication and data interaction.

[0043] Another object of the present invention is to provide an information data processing terminal, which is used to implement the system for industrial control system authentication and data interaction.

[0044] In combination with the above technical solutions and the technical problems solved, the advantages and positive effects of the technical solutions to be protected by the present invention are as follows:

[0045] First, in view of the technical problems existing in the above-mentioned prior art and the difficulty of solving these problems, we closely combine the technical solutions to be protected by the present invention and the results and data during the research and development process, and conduct a detailed and in-depth analysis of how the technical solutions of the present invention solve the technical problems and some creative technical effects brought about by solving the problems. The specific description is as follows:

[0046] The present invention provides a system and method for industrial control system authentication and data interaction, which uses an authentication-first-then-connection approach to ensure that both communicating parties are authenticated and trusted devices, thereby enabling information sharing between IT and OT. Direct network access between the enterprise area and the industrial equipment area is avoided, and the industrial area equipment will only establish communication with the outside world through this system, providing a high level of protection for vulnerable industrial areas and completing the secure transmission of data. The present invention adopts a combination of symmetric encryption and asymmetric encryption in the authentication stage, which improves the performance of device data encryption and decryption and ensures the confidentiality of transmitted data; it adopts the one-way irreversibility of digital summaries to ensure the integrity and availability of data.

[0047] This method for industrial control system authentication and data exchange utilizes an authentication-first-then-connection approach, ensuring both communicating parties are authenticated and trusted devices, enabling secure information sharing between IT and OT. This method avoids direct network access between the enterprise and industrial equipment zones, and industrial zone devices communicate only with the outside world through this system. This provides a high level of protection for vulnerable industrial zones, while ensuring data availability, security, and integrity, enabling secure data transmission.

[0048] The present invention integrates a three-level key system, dynamic keys, dedicated keys, domestic encryption algorithms, digital signature technology, and dual authentication to provide a reliable communication environment for both devices, ensuring that both communicating parties are trustworthy and providing availability and integrity verification for the interactive data. Specifically, it is embodied in the following aspects:

[0049] (1) Data confidentiality: Device data is encrypted using a domestic encryption algorithm and a three-level key system to ensure the confidentiality of device data during transmission. Even if an attacker obtains the key, the key is dynamically changed. The key issued by the industrial security certification system can only be used once and is discarded after the encrypted device data is returned to the enterprise area. An attacker cannot deduce the new key based on the old key.

[0050] (2) Double authentication: The first authentication ensures whether the requesting device is legitimate, and the second authentication determines whether the target device is legitimate.

[0051] (3) Identity authentication: Use digital signature technology to process the industrial security authentication system’s built-in enterprise zone device trust list to ensure that the requesting party is a trusted device.

[0052] (4) Avoid external access devices from directly communicating with industrial zone equipment: Industrial zone equipment must pass the industrial security certification system before communicating with the outside world.

[0053] (5) Data availability and integrity: The SM3 encryption algorithm is used to ensure data integrity and availability. Even if an attacker tampers with the transmitted data, the enterprise area equipment and industrial security authentication system can determine whether the data has been tampered with by verifying the message digest.

[0054] Second, considering the technical solution as a whole or from the perspective of the product, the technical effects and advantages of the technical solution to be protected by the present invention are described in detail as follows:

[0055] The method for industrial control system authentication and data interaction provided by the present invention mainly includes an authentication method for the ICS (Industrial Control System) enterprise zone before communicating with the industrial zone. Based on multiple security technologies, it realizes secure access and data interaction between the ICS enterprise zone and the industrial zone, and can be applied in the field of industrial control systems.

[0056] The method for industrial control system authentication and data interaction provided by the present invention mainly includes an authentication method for the ICS (industrial control system) enterprise zone before communicating with the industrial zone, based on a fine-grained access strategy with a device trust list as the core and a dual identity authentication strategy, and in a combination of a three-level key system, dynamic keys, dedicated keys, domestic encryption algorithms, and digital signature technology, thereby realizing secure access and data interaction between the ICS enterprise zone and the industrial zone, which can be applied in the field of industrial control systems. The industrial security authentication system not only hides the industrial zone equipment from the external network, but also uses a dual authentication mechanism and a three-level key system for data encryption to protect the safe operation of the industrial zone equipment and data security to a great extent. Advantages: The dynamic key and the three-layer key system prevent the keys of both parties from being stolen or stolen during communication.

[0057] Third, as auxiliary evidence for the inventiveness of the claims of the present invention, it is also reflected in the following important aspects:

[0058] The expected benefits and commercial value of the technical solution after transformation are as follows: The present invention requires strict authentication for all devices that require access. It uses complex encryption methods for data transmission. Even if an attacker steals the key, the key cannot be used, nor can a new key be calculated. This can greatly protect the safe operation of industrial equipment and data security. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments of the present invention. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0060] Figure 1 This is a flow chart of an industrial control system authentication and data interaction method provided by an embodiment of the present invention;

[0061] Figure 2 This is a schematic diagram of an industrial control system authentication and data interaction method provided by an embodiment of the present invention;

[0062] Figure 3 This is a flow chart of an industrial control system authentication method provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0063] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0064] In order to solve the problems existing in the prior art, the present invention provides a method, system and terminal for industrial control system authentication and data interaction. The present invention is described in detail below with reference to the accompanying drawings.

[0065] 1. Explanatory Examples In order to enable those skilled in the art to fully understand how to implement the present invention, this section provides an illustrative example that expands upon the technical solutions of the claims.

[0066] like Figure 1 As shown, the industrial control system authentication and data interaction method provided by the embodiment of the present invention includes the following steps:

[0067] S101, during initialization, the device in the enterprise zone of the industrial control system creates a public and private key pair;

[0068] S102: The industrial security authentication system creates a device fingerprint for the device and establishes its own enterprise zone device trust list and industrial zone device trust list.

[0069] S103 uses a three-level key system, dynamic keys, dedicated keys, domestic encryption algorithms, digital signature technology and device trust lists to achieve ICS device authentication and data interaction.

[0070] The system for industrial control system authentication and data interaction provided by an embodiment of the present invention includes:

[0071] Initialization module, used to create public and private key pairs for devices in the enterprise zone of the industrial control system;

[0072] A device fingerprint creation module, used to create a device fingerprint for a device using an industrial security authentication system;

[0073] A device trust list creation module is used to use the industrial security authentication system to establish its own enterprise zone device trust list and industrial zone device trust list;

[0074] The device authentication and data interaction module is used to implement device authentication and data interaction of industrial control systems by combining a three-level key system, dynamic keys, dedicated keys, domestic encryption algorithms, digital signature technology and device trust lists.

[0075] The present invention will be further described below with reference to the accompanying drawings.

[0076] like Figure 2 As shown, the industrial control system authentication and data interaction method provided by the embodiment of the present invention includes the following steps:

[0077] Step 1: When the industrial security authentication system is initialized, a client trust list (enterprise zone) and a device trust list (industrial zone) are established. The enterprise zone devices are pre-set with the industrial zone device fingerprint and device information.

[0078] Step 2: The enterprise client uses the public key of the industrial security authentication system to encrypt the original data (access device fingerprint + access count), generates a digital signature based on the summary of the original data, and then sends it to the industrial security authentication system;

[0079] Step 3: After receiving the data packet, the industrial security authentication system uses the private key to decrypt the data and verify the digital signature. If it is valid and the device information is legal (device fingerprint + access count), access is authorized and the key K1 is returned and temporarily stored locally.

[0080] Step 4: The enterprise device generates a session key K2 and uses the key K2 to encrypt the original data (target device fingerprint + command data) to obtain the ciphertext data P1. The original data is summarized and encrypted using the private key to generate a digital signature. Finally, the session key K2 is encrypted using the key K1 and then the public key of the industrial security authentication system to obtain the ciphertext data P2, which is then sent to the industrial security authentication system.

[0081] Step 5: The industrial security authentication system uses the private key to decrypt the ciphertext data P2 to obtain the intermediate ciphertext, and then uses the key K1 to decrypt it to obtain the session key K2. The ciphertext data P1 is decrypted using K2. The digital signature is verified and the target device is determined to be legitimate. Finally, the key K1 is discarded.

[0082] Step 6: The industrial safety authentication system forwards the instruction data to the corresponding industrial zone equipment, and the industrial zone equipment returns the data calculated according to the instruction to the industrial safety authentication system;

[0083] Step 7: The industrial security authentication system uses the session key K2 to encrypt the data returned by the device (original data), generates a digital signature based on the summary of the original data, and finally discards K2;

[0084] Step 8: The enterprise zone device uses the key K2 to decrypt the ciphertext data to obtain the original data, and makes a summary of the original data; it verifies the digital signature. If they are the same, the data is valid; if they are different, it is discarded.

[0085] In an industrial control system, the authentication process required before data exchange between the enterprise zone and the industrial zone includes initialization and authentication processes;

[0086] Initialization includes:

[0087] (1) Each device in the ICS enterprise zone that needs to interact with the industrial zone creates a public-private key pair;

[0088] (2) The industrial security authentication system creates its own public and private key pair, generates device fingerprints for the devices in the enterprise zone in the first step, and stores them in the corresponding devices;

[0089] (3) The industrial security authentication system establishes its own enterprise zone device trust list, which stores key-value pairs, where the key is the device fingerprint of the enterprise zone device and the value corresponds to the public key of the device and the number of times the device is accessed;

[0090] (4) The industrial security authentication system establishes its own industrial zone equipment trust list, which stores key-value pairs, where the key is the device fingerprint of the industrial zone device and the value corresponds to the device information;

[0091] (5) Enterprise zone devices are pre-configured with accessible industrial zone device fingerprints and device information.

[0092] The certification process includes:

[0093] (1) The enterprise zone device uses the public key of the industrial security authentication system to encrypt the device information (device fingerprint + access times) using the SM2 encryption algorithm to obtain encrypted data, and uses the SM3 encryption algorithm to obtain the summary information M1 of the original data; uses the private key to sign and send it to the industrial security authentication system;

[0094] (2) After receiving the encrypted data, the industrial security authentication system uses its own private key to decrypt the data to obtain the original data (device fingerprint + access count), and uses the SM3 algorithm to generate summary information M2 for the original data. Compare the summary information M1 and M2. If they are different, the request is discarded. If they are the same, the system goes to its own enterprise zone device trust list to search for the device information and access count, and obtains the public key of the device. If it exists and is legal, the key K1 is generated based on the fingerprint of the device on the A side + access count + timestamp + random number. If it does not exist, the request is discarded. The key K1 is encrypted with the enterprise zone device public key using SM4 and returned to the enterprise zone. Finally, the key K1 is temporarily stored locally in the industrial security authentication system.

[0095] (3) After the enterprise zone device receives the returned key ciphertext data, it proves that the connection has been established. It uses the private key to decrypt the ciphertext data to obtain the key K1, and generates the session key K2 based on its own device fingerprint + C-end target device fingerprint + access timestamp + random number splicing. Use the key K2 to perform SM4 encryption on the original data (C-end target device fingerprint and instruction data) to obtain the ciphertext data P1. And perform SM3 encryption on the original data to obtain the summary information, and then only use the private key to sign. Finally, use the key K1 to perform SM4 encryption on the session key, and then use the public key of the industrial security authentication system to perform SM2 encryption to obtain the ciphertext data P2. Finally, the ciphertext data P1 and P2 are sent to the industrial security authentication system;

[0096] (4) After receiving the encrypted data, the industrial security authentication system first uses its own private key to decrypt the ciphertext data P2 to obtain the intermediate data, and then uses the key K1 to decrypt the intermediate data to obtain the session key K2. The ciphertext data P1 is decrypted using the session key to obtain the target device fingerprint and instruction data, and then the digital signature is verified. The target device is verified to be legitimate (based on the target device fingerprint matching in the industrial zone device trust list), and finally the key K1 is discarded;

[0097] (5) After successful authentication, the industrial security authentication system forwards the request instruction to the industrial zone device that the enterprise zone device is requesting access to. After receiving the instruction, the industrial zone device returns the original data to the industrial security authentication system. The industrial security authentication system uses the agreed session key K2 to perform SM4 encryption on the original data to obtain the ciphertext data P3. The original data is encrypted using the SM3 encryption algorithm to obtain the message digest M6. The message digest is then signed with the private key and returned to the enterprise zone device, discarding the session key K2.

[0098] (6) After receiving the ciphertext data, the enterprise device uses the session key K2 to decrypt the ciphertext data P3 to obtain the original data PP2. It then performs the SM3 encryption algorithm on the original data to obtain the digest information M7. The digital signature is then verified. If the signature is invalid, it is discarded. If it is valid, the original data PP2 is valid.

[0099] like Figure 3 As shown, the industrial control system authentication and data interaction method provided by the embodiment of the present invention includes the following steps:

[0100] (1) During initialization, the ICS enterprise zone device creates a public-private key pair. Next, the industrial security authentication system creates a device fingerprint for the above device. The industrial security authentication system establishes its own enterprise zone device trust list and industrial zone device trust list. The former stores key-value pairs, where the key is the device fingerprint of the enterprise zone device and the value corresponds to the public key of the device. The latter stores the device information of all industrial zones.

[0101] (2) During device authentication and data interaction, all domestic encryption algorithms are used. This is achieved by combining a three-level key system, dynamic keys, dedicated keys, domestic encryption algorithms, digital signature technology, and a device trust list to ensure the security of communication between the two parties.

[0102] (3) During authentication, when the enterprise zone device authenticates for the first time, the industrial security authentication system will ensure that the device requesting access is trustworthy and issue the key K1 to the enterprise zone device. During the second authentication, the enterprise zone device will generate a session key K2, and the industrial security authentication system will verify the digital signature to ensure that the issued key K1 is valid and verify whether the enterprise zone device is trustworthy. After verification, the industrial security authentication system will forward the instruction to the corresponding industrial zone device, and after receiving the returned data, it will use the session key K2 to encrypt it and calculate the summary of the original data to generate a digital signature and send it to the enterprise zone device. After receiving the data, the enterprise zone device will decrypt it using the same algorithm, make a summary of the original data, and then verify the digital signature. If they are the same, the data is valid; if they are different, it is invalid.

[0103] In the attached Figure 3 In the initialization process, the following is the process:

[0104] (1) Device A creates a public-private key pair;

[0105] (2) Side B creates a public-private key pair and generates a device fingerprint for the device in zone A. The device in zone A stores its own device fingerprint;

[0106] (3) End B establishes its own trust list for End A devices. The trust list stores key-value pairs, where the key is the device fingerprint of End A device and the value corresponds to the public key of the device and the number of times the device has been accessed.

[0107] (4) The B-end establishes its own C-end device trust list, which stores key-value pairs, where the key is the C-end device fingerprint and the value corresponds to the device information of the device;

[0108] (5) The A-side presets the accessible C-side device fingerprint and device information.

[0109] In the attached Figure 3 The authentication process is as follows:

[0110] (1) Device A uses the public key of device B to encrypt the device information (device fingerprint) and access times of device A that needs to be accessed using the SM2 encryption algorithm to obtain encrypted data, and then uses the SM3 encryption algorithm to obtain the summary information of the original data, signs it with the private key, and then sends it to device B;

[0111] (2) After receiving the encrypted data, the B side uses the private key to decrypt the data to obtain the original data (the device fingerprint and access count of the A side device), and uses the SM3 algorithm to generate the summary information M2 of the original data. Then the digital signature is verified. If it is illegal, the request is discarded. If it is legal, the device trust list of the enterprise area is searched for the information of the device. If it exists and the access count is compared to see if it is the same, the connection is successfully established and the public key of the A side device is obtained. The key K1 is generated by splicing the A side device fingerprint + access count + timestamp + random number. The key K1 is encrypted with the A side public key by SM2 and returned to the A side and the key K1 is temporarily stored locally.

[0112] (3) After receiving the returned ciphertext, the A-side device proves that the connection has been established and uses the private key to decrypt it to obtain the key K1. The session key K2 is generated by splicing the fingerprint of the A-side device + the fingerprint of the C-side target device + the number of accesses + the timestamp + the random number. The original data (command data) is encrypted with SM4 using the key K2 to obtain the ciphertext data P1, and the original data is encrypted with SM3 to obtain the summary information, and then signed with the private key. After SM4 encryption of K2 using the key K1, the public key of the B-side is used to perform SM2 encryption to obtain the ciphertext data P2;

[0113] (4) After receiving the encrypted data, the B side first uses the private key to decrypt the ciphertext data P2 to obtain the intermediate ciphertext, and then uses the locally temporarily stored key K1 to decrypt the intermediate ciphertext to obtain the session key K2. The ciphertext P1 is decrypted using the session key K2 to obtain the original data PP1. The SM3 encryption algorithm is used on PP1 to obtain the summary information. The digital signature is then verified. If it is invalid, the authentication fails. If it is valid, the industrial zone device trust list is queried based on the target device fingerprint of the C side in the original data PP1. If it exists, the authentication is successful. If not, the request is discarded. Finally, the key K1 is discarded;

[0114] (5) After the B-end is successfully authenticated, the system forwards the request instruction to the C-end device that the A-end device is requesting access to. After receiving the instruction, the C-end device returns the original data to the B-end. The B-end uses the agreed session key K2 to perform SM4 encryption on the original data to obtain the ciphertext data P3. The SM3 encryption algorithm is then used to calculate the message digest M6 on the original data. The message digest M6 is then signed using the private key. Finally, the ciphertext data P3 and P4 are returned to the enterprise zone device and the session key K2 is discarded.

[0115] (6) After receiving the ciphertext data, the A-side device uses the session key K2 to decrypt the ciphertext data P3 to obtain the original data PP2, and then performs the SM3 encryption algorithm on the original data to obtain the summary information. Finally, the digital signature is verified. If the signature is valid, the data is valid. If not, the request is discarded.

[0116] The key structure of the present invention is as follows:

[0117] Table 1 Key K1 (generated by the industrial security authentication system)

[0118]

[0119]

[0120] Table 2 Session key K2 (generated by the enterprise zone device)

[0121]

[0122] 2. Application Examples: In order to demonstrate the creativity and technical value of the technical solution of the present invention, this section provides application examples of the claimed technical solution on specific products or related technologies.

[0123] The present invention can be applied to the PERA model, with the industrial zone as the intranet and the enterprise zone as the extranet. The industrial security authentication system is located in the DMZ area, completely isolating the industrial zone from the external network. All devices that want to access the industrial zone network must be authenticated by the industrial security authentication system, and data interaction must also be encrypted and verified by the industrial security authentication system.

[0124] The embodiments of the present invention have achieved some positive effects during the development or use process, and indeed have great advantages compared with the existing technology. The technical effects are described below.

[0125] In the simulated scenario, enterprise zone devices were not included in the industrial security authentication system's device trust list, preventing them from establishing a connection with industrial zone devices. All devices within the industrial control network must be registered in the device trust list to ensure that both communicating parties are trusted. During connectivity testing of data exchange between enterprise zone and industrial zone devices, both the verification and authorization processes worked as expected. Due to the use of dynamic keys and a one-time pad policy, even if an attacker steals the key, they cannot use or deduce the key for the next communication. Digital signatures prevent data tampering, ensuring data integrity and availability.

[0126] It should be noted that the embodiments of the present invention can be implemented by hardware, software, or a combination of software and hardware. The hardware portion can be implemented using dedicated logic; the software portion can be stored in a memory and executed by an appropriate instruction execution system, such as a microprocessor or dedicated design hardware. Those skilled in the art will appreciate that the above-mentioned devices and methods can be implemented using computer-executable instructions and / or contained in processor control code, for example, such as a carrier medium such as a disk, CD or DVD-ROM, a programmable memory such as a read-only memory (firmware), or a data carrier such as an optical or electronic signal carrier. The devices and modules of the present invention can be implemented by hardware circuits such as very large-scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, or programmable hardware devices such as field programmable gate arrays, programmable logic devices, etc., can also be implemented by software executed by various types of processors, or can be implemented by a combination of the above-mentioned hardware circuits and software, such as firmware.

[0127] The above description is only a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any modifications, equivalent substitutions and improvements made by any technician familiar with this technical field within the technical scope disclosed by the present invention and within the spirit and principles of the present invention should be covered by the scope of protection of the present invention.

Claims

1. A method for industrial control system authentication and data interaction, characterized in that: The method for industrial control system authentication and data interaction includes: establishing an access control mechanism when the enterprise network and the industrial control network communicate, establishing a list of trusted devices on the enterprise and industrial sides, and implementing a fine-grained access policy and a dual authentication policy centered on the trusted device list. Furthermore, the method utilizes a three-level key system, dynamic keys, dedicated keys, domestic encryption algorithms, and digital signature technology to achieve device authentication and secure data interaction in the industrial control system. The method for industrial control system authentication and data interaction also includes: during the initial authentication of an enterprise zone device, the industrial security authentication system ensures that the device requesting access is authentic and issues a key K1 to the enterprise zone device; during the secondary authentication, the enterprise zone device generates a session key K2, and the industrial security authentication system verifies the digital signature to ensure that the issued key K1 is valid and verifies whether the enterprise zone device is authentic; After verification, the industrial safety authentication system forwards the instruction to the corresponding industrial zone device. After receiving the returned data, it uses the session key K2 to encrypt it, calculates the summary of the original data to generate a digital signature, and then sends it to the enterprise zone device. After receiving the data, the enterprise zone device decrypts it, obtains the original data and creates a summary. The digital signature is then verified. If they are the same, the data is valid; if they are different, the data is invalid. The method for industrial control system authentication and data interaction specifically includes the following steps: Step 1: When the industrial security authentication system is initialized, a client trust list and a device trust list are established. The enterprise zone devices are pre-set with the industrial zone device fingerprint and device information. Step 2: The enterprise client encrypts the original data using the public key of the industrial security authentication system, generates a digital signature based on the original data, and then sends it to the industrial security authentication system. Step 3: After receiving the data packet, the industrial security authentication system uses the private key to decrypt the data and verify the digital signature. If it is valid and the device information is legitimate, access is authorized and the key K1 is returned and temporarily stored locally. Step 4: The enterprise device generates a session key K2 and uses it to encrypt the original data to obtain ciphertext data P1. The original data is summarized and encrypted using the private key to generate a digital signature. The session key K2 is encrypted using key K1 and then encrypted using the public key of the industrial security authentication system to obtain ciphertext data P2, which is then sent to the industrial security authentication system. Step 5: The industrial security authentication system uses the private key to decrypt the ciphertext data P2 to obtain the intermediate ciphertext, and then uses the key K1 to decrypt it to obtain the session key K2. The ciphertext data P1 is decrypted using K2. The digital signature is verified and the target device is determined to be legitimate. Finally, the key K1 is discarded. Step 6: The industrial safety authentication system forwards the instruction data to the corresponding industrial zone equipment, and the industrial zone equipment returns the data calculated according to the instruction to the industrial safety authentication system; Step 7: The industrial security authentication system uses the session key K2 to encrypt the original data returned by the device, generates a digital signature based on the summary of the original data, and finally discards K2; Step 8: The enterprise device uses the key K2 to decrypt the ciphertext data to get the original data and make a summary of the original data. The digital signature is verified. If they are the same, the data is valid. If they are different, the data is discarded. The client trust list in step 1 is for the enterprise zone, and the device trust list is for the industrial zone; The raw data in step 2 includes the access device fingerprint and access times; The device information in step 3 includes the device fingerprint and access count; The raw data in step 4 includes the target device fingerprint and command data; The initialization of the industrial safety certification system in step 1 includes: (1) Each device in the ICS enterprise zone that interacts with the industrial zone creates a public-private key pair; (2) The industrial security authentication system creates its own public and private key pair, generates device fingerprints for devices in the enterprise area, and stores them in the corresponding devices; (3) The industrial security authentication system establishes its own enterprise zone device trust list. The trust list stores key-value pairs, where the key is the device fingerprint of the enterprise zone device and the value corresponds to the device's public key and access count. (4) The industrial security authentication system establishes its own trust list of industrial zone equipment. The trust list stores key-value pairs, where the key is the device fingerprint of the industrial zone equipment and the value corresponds to the device information; (5) Pre-installed accessible industrial zone device fingerprints and device information for enterprise zone devices; Industrial control system authentication methods include: (1) The enterprise zone device uses the public key of the industrial security authentication system to encrypt the device information using the SM2 encryption algorithm to obtain encrypted data, and uses the SM3 encryption algorithm to obtain the summary information M1 of the original data; uses the private key to sign and send it to the industrial security authentication system; (2) After receiving the encrypted data, the industrial security authentication system uses its own private key to decrypt the data to obtain the original data, and uses the SM3 algorithm to generate the summary information M2 of the original data; compare the summary information M1 and M2, if they are different, the request is discarded; if they are the same, the system searches the device trust list of its own enterprise zone for the device information and access times, and obtains the public key of the device; if it exists and is legal, the key K1 is generated based on the fingerprint of the device at end A, the access times, the timestamp and the random number; if it does not exist, the request is discarded; the key K1 is encrypted with the public key of the enterprise zone device by SM4 and returned to the enterprise zone, and the key K1 is temporarily stored locally in the industrial security authentication system; (3) After receiving the returned key ciphertext data, the enterprise zone device proves that the connection has been established, and uses the private key to decrypt the ciphertext data to obtain the key K1. It generates the session key K2 based on its own device fingerprint, the C-end target device fingerprint, the number of accesses, the timestamp, and the random number. It uses the key K2 to perform SM4 encryption on the original data to obtain the ciphertext data P1, and SM3 encryption on the original data to obtain the summary information, and then signs it only with the private key. It uses the key K1 to perform SM4 encryption on the session key, and then uses the public key of the industrial security authentication system to perform SM2 encryption to obtain the ciphertext data P2. Finally, the ciphertext data P1 and P2 are sent to the industrial security authentication system. (4) After receiving the encrypted data, the industrial security authentication system uses its own private key to decrypt the ciphertext data P2 to obtain the intermediate data, and then uses the key K1 to decrypt the intermediate data to obtain the session key K2; the ciphertext data P1 is decrypted using the session key to obtain the target device fingerprint and instruction data; the digital signature is verified to verify whether the target device is legitimate, and finally the key K1 is discarded; (5) After the industrial security authentication system successfully authenticates, the system forwards the request instruction to the industrial zone device that the enterprise zone device is requesting to access. After receiving the instruction, the industrial zone device returns the original data to the industrial security authentication system. The industrial security authentication system uses the agreed session key K2 to perform SM4 encryption on the original data to obtain the ciphertext data P3. The original data is calculated using the SM3 encryption algorithm to obtain the message digest M6, and the message digest is signed with the private key. The message digest is returned to the enterprise zone device and the session key K2 is discarded. (6) After receiving the ciphertext data, the enterprise zone device uses the session key K2 to decrypt the ciphertext data P3 to obtain the original data PP2, and then performs the SM3 encryption algorithm on the original data to obtain the digest information M7; the digital signature is verified. If the signature is invalid, it is discarded. If it is valid, the original data PP2 is valid; The public key in step (1) includes the device fingerprint and access times. The raw data in step (2) includes device fingerprint and access count; The original data in step (3) includes the C-end target device fingerprint and instruction data; The verification of whether the target device is legitimate in step (4) is as follows: matching the target device fingerprint in the industrial zone device trust list.

2. A system for industrial control system authentication and data interaction using the method for industrial control system authentication and data interaction according to claim 1, characterized in that: Systems for industrial control system authentication and data interaction include: Initialization module, used to create public and private key pairs for devices in the enterprise zone of the industrial control system; A device fingerprint creation module, used to create a device fingerprint for a device using an industrial security authentication system; A device trust list creation module is used to use the industrial security authentication system to establish its own enterprise zone device trust list and industrial zone device trust list; The device authentication and data interaction module is used to implement device authentication and data interaction of industrial control systems by combining a three-level key system, dynamic keys, dedicated keys, domestic encryption algorithms, digital signature technology and device trust lists.

3. A computer device, characterized in that: The computer device includes a memory and a processor. The memory stores a computer program. When the computer program is executed by the processor, the processor performs the steps of the method for industrial control system authentication and data interaction as claimed in claim 1.

4. An information data processing terminal, characterized in that: The information data processing terminal is used to implement the system for industrial control system authentication and data interaction as described in claim 2.

Images