Bidirectional identity authentication and encryption communication method based on HART-IP protocol

Abstract

The invention provides a bidirectional identity authentication and encryption communication method based on an HART-IP protocol, and the method comprises the following steps: S1, respectively deploying the IP addresses of a control device and a field device and corresponding public and private key data to the control device and the field device through a configuration tool; s2, the control equipment sends an authentication request command to the field equipment, the field equipment analyzes and verifies the authentication request command and returns an authentication request response to the control equipment, and the control equipment analyzes and verifies the authentication request response and sends an authentication feedback command to the field equipment again; s3, after encrypting the session key, the control equipment sends a session key distribution command to the field equipment, and the field equipment analyzes, verifies and decrypts the session key distribution command to obtain the session key; and S4, the control equipment and the field equipment perform encryption and decryption operation on the sent and received message data based on the session key to realize encrypted communication between the control equipment and the field equipment.

Description

Technical Field

[0001] The invention belongs to the technical field of device communication, and in particular relates to a two-way identity authentication and encryption communication method based on the HART-IP protocol. Background Art

[0002] HART-IP (Highway Addressable Remote Transducer over Internet Protocol) is a communication protocol that combines the traditional HART protocol with modern IP network technology. HART-IP allows HART devices to communicate through Ethernet networks, providing higher data transmission rates and more flexible network integration capabilities. Therefore, it is used to achieve high-speed and reliable communication tasks between process automation equipment and control systems. As a standard Ethernet communication protocol, HART-IP protocol has been widely used in the process automation industry. It can meet the requirements of industrial data transmission with rapid growth in volume, and is increasingly sought after for its low cost, high reliability and strong compatibility.

[0003] However, with the rapid development of industrial automation, intelligence, Internet of Things and edge computing technologies under existing technologies, the field of industrial control systems has entered a new stage of development. Industrial control systems are increasingly interconnected with a large number of external network devices, and HART-IP, as a plaintext transmission protocol, has brought with it increasingly serious information security issues. At this stage, the HART-IP protocol is only used to meet the communication, diagnosis and control functions of industrial control systems. It does not pay enough attention to the security of the protocol and lacks the necessary protection measures to ensure information security, allowing attackers to use these information security loopholes to damage industrial control systems, causing immeasurable losses.

[0004] Although there have been relevant studies and experiments on information security of communication protocols in the field of industrial control, the following problems still exist under the existing technology:

[0005] (1) Most mainstream industrial control systems perform checks based on protocol compliance, that is, the communicating parties make compliance judgments on specific content of the HART-IP protocol. However, this does not solve the pain point that data is transmitted in plain text, and data still faces the risk of being stolen and tampered with.

[0006] (2) Some industrial control systems use private security protocols. For example, both parties configure a session key in advance to encrypt communication data. Although this method ensures the confidentiality of the communication data between the two parties, it cannot perform identity authentication or authorization, and cannot determine whether the identities of the two parties in communication are legal.

[0007] (3) Although the existing TLS or DTLS protocols can theoretically be used for the HART-IP protocol, in industrial control scenarios, the resources of control devices are very limited and the industrial control system has extremely high requirements for real-time performance, so it is impossible to maintain the high communication overhead of TLS or DTLS. Summary of the invention

[0008] The present invention aims to provide a two-way identity authentication and encryption communication method based on the HART-IP protocol to solve the technical problems that conventional industrial control communication methods in the prior art have poor confidentiality, lack of two-way identity authentication function and high requirements for system resources.

[0009] To solve the above problems, the technical solution of the present invention is: a two-way identity authentication and encryption communication method based on the HART-IP protocol, comprising the following steps:

[0010] S1: Deploy the IP addresses of the control device and the field device and the corresponding public and private key data to the control device and the field device respectively through a configuration tool;

[0011] S2: The control device sends an authentication request command to the field device based on the HART-IP protocol, the field device parses and verifies the authentication request command, and sends an authentication request response back to the control device, the control device parses and verifies the authentication request response, and sends an authentication feedback command to the field device again, thereby realizing two-way identity authentication between the control device and the field device;

[0012] S3: After the control device encrypts the session key, it sends a session key distribution command to the field device based on the HART-IP protocol, and the field device parses and verifies the session key distribution command and decrypts it to obtain the session key;

[0013] S4: The control device and the field device respectively perform encryption and decryption operations on sent and received message data based on the session key to achieve encrypted communication between the control device and the field device.

[0014] Preferably, in S1, deploying IP addresses and public and private key data for the control device and the field device specifically includes the following steps:

[0015] S11: deploying the IP address of the control device and the corresponding public and private key data to the control device through a configuration tool, wherein the private key data is deployed in the HSM hardware security module of the control device;

[0016] S12: deploying the IP address and corresponding public key data of the field device to the control device through a configuration tool;

[0017] S13: configuring the legal IP address of the field device to the control device through a configuration tool;

[0018] S14: deploying the IP address of the field device and the corresponding public and private key data to the field device through a configuration tool, wherein the private key data is deployed in the HSM hardware security module of the field device;

[0019] S15: Deploy the IP address and corresponding public key data of the control device to the field device through a configuration tool.

[0020] Preferably, the IP addresses of the control device and the field device and the corresponding public and private key data are stored and entered in PEM text format.

[0021] Preferably, in S2, the control device sends an authentication request command to the field device, which specifically includes the following steps:

[0022] S21: The control device uses its own private key to perform encryption signature calculation on the hexadecimal number of the last two bytes of its IP address, and the constructed data part will carry the authentication request command of the signature data of the control device.

[0023] Preferably, in S2, the field device parses and verifies the authentication request command, and returns an authentication request response to the control device, which specifically includes the following steps:

[0024] S22: The field device verifies the signature data of the control device using the public key corresponding to the IP address of the control device to obtain the field device signature verification data;

[0025] S23: Compare the value of the on-site device signature verification data with the last two bytes of the control device IP address to see if they are the same. If they are the same, the on-site device successfully authenticates the control device, and the on-site device uses its own private key to perform encrypted signature calculation on the hexadecimal number of the last two bytes of its own IP address, and constructs the data part that will carry the authentication request response of the on-site device signature data; if they are different, the on-site device fails to authenticate the control device.

[0026] Preferably, in S2, the control device parses and verifies the authentication request response, and sends an authentication feedback command to the field device again, which specifically includes the following steps:

[0027] S24: The control device uses the public key corresponding to the IP address of the field device to verify the signature data of the field device to obtain control device signature verification data;

[0028] S25: Compare the value of the control device's signature verification data with the last two bytes of the field device's IP address to see if they are the same. If they are the same, the control device successfully authenticates the field device and sends an authentication feedback command to the field device again; if they are different, the control device fails to authenticate the field device.

[0029] Preferably, in S3, the control device encrypts the session key and sends a session key distribution command to the field device, which specifically includes the following steps:

[0030] S31: The control device uses the HSM module to generate a 16-byte session key required by the symmetric encryption algorithm;

[0031] S32: the control device uses the public key of the field device communicating with the control device to encrypt the session key, and performs hash calculation on the encrypted session key data to obtain a hash value of the encrypted session key;

[0032] S33: The control device uses its own private key to sign the encrypted session key hash value, and constructs the session key distribution command whose data part carries the encrypted session key and the encrypted session key hash value signature data.

[0033] Preferably, in S3, the on-site device parses and verifies the session key distribution command, and decrypts to obtain the session key, which specifically includes the following steps:

[0034] S34: The field device uses the public key of the control device communicating with it to verify the encrypted session key hash value signature data. If the verification is successful, the field device further uses its own private key to decrypt the encrypted session key to obtain the session key; if the verification fails, the control device fails to distribute the interactive session key task to the field device.

[0035] Preferably, the session key update period is 24 hours. When the session key update period expires, the control device updates the session key and performs the session key encryption distribution task again.

[0036] Preferably, in S4, the control device and the field device respectively perform encryption and decryption operations on the sent and received message data based on the session key, which specifically includes the following steps:

[0037] S41: the control device performs a hash calculation on the request data in the message data to be sent to obtain a first request data hash value;

[0038] S42: the control device uses a symmetric encryption algorithm to encrypt the message data to be sent, the encryption key is the session key, and the control device sends the encrypted message data to the field device;

[0039] S43: The field device receives the encrypted message data, and uses the session key to decrypt the encrypted message data, performs hash calculation on the request data in the decrypted message to obtain a second request data hash value, and compares the first request data hash value with the second request data hash value. If the two are the same, the message data is available and the field device responds to the control device. If the two are different, the message data is unavailable and the field device does not respond to the control device.

[0040] S44: the field device performs hash calculation on the request data in the message data to be sent to obtain a third request data hash value;

[0041] S45: the field device uses a symmetric encryption algorithm to encrypt the message data to be sent, the encryption key is the session key, and the field device sends the encrypted message data to the control device;

[0042] S46: the control device receives the encrypted message data, and uses the session key to decrypt the encrypted message data, performs hash calculation on the request data in the decrypted message to obtain a fourth request data hash value, and compares the third request data hash value with the fourth request data hash value. If the two are the same, the message data is available and the control device responds to the field device. If the two are different, the message data is unavailable and the control device does not respond to the field device.

[0043] S47: Repeat steps S41-S46 until the communication task between the control device and the field device is completed.

[0044] Due to the adoption of the above technical solution, the present invention has the following advantages and positive effects compared with the prior art:

[0045] The present invention provides a bidirectional identity authentication and encryption communication method based on the HART-IP protocol. On the basis of the HART-IP protocol, bidirectional identity authentication and data encryption communication between a control device and a field device are realized by customizing the HART-IP command code, and a hash algorithm is used to ensure the integrity of the communication, thereby solving the vulnerability that the plain text transmission data of the HART-IP protocol is easily stolen, tampered with, and attacked by a middleman, and enhancing the security and reliability of the data during the communication process. At the same time, the present invention designs a safer and lighter encryption method based on the existing HART-IP protocol, which ensures the confidentiality and integrity of the communication without occupying too many industrial control equipment resources and without affecting the real-time performance of the industrial control system, and greatly reduces the occupation and demand of system resources by the control device and the field device during the communication process. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 A schematic flow chart of a two-way identity authentication and encryption communication method based on the HART-IP protocol provided by the present invention;

[0047] Figure 2 A schematic diagram of the flow chart of the control device and field device data configuration provided by the present invention;

[0048] Figure 3 The bidirectional identity authentication communication message flow model diagram based on the HART-IP protocol provided by the present invention;

[0049] Figure 4 The key security distribution communication message flow model diagram based on the HART-IP protocol provided by the present invention;

[0050] Figure 5 The present invention provides a HART-IP protocol-based encrypted communication and communication integrity message flow model diagram. DETAILED DESCRIPTION

[0051] The following is a further detailed description of a bidirectional identity authentication and encryption communication method based on the HART-IP protocol proposed by the present invention in conjunction with the accompanying drawings and specific embodiments. The advantages and features of the present invention will become more apparent from the following description and claims.

[0052] See also Figures 1 to 5 , this embodiment provides a bidirectional identity authentication and encryption communication method based on the HART-IP protocol, which is used to improve the security and reliability of bidirectional communication between control equipment and field equipment in the industrial control field.

[0053] First of all, it should be noted that the control device described in this embodiment refers to an electronic or electrical device used to manage, adjust and command field equipment in an industrial control system. The control device is connected to the field equipment, and can issue instructions to the field equipment and read the reply data of the field equipment, and further transmit the data to the control system for processing, so as to realize the automatic control of the overall tooling, that is, in this embodiment, the control device is the initiator of the communication process, that is, the master of the master-slave communication. The field device refers to the back-end device in the industrial control system, which is used to convert the instructions of the control system into physical actions, which directly affects the physical movement process and achieves the control target by adjusting or moving mechanical parts, such as instruments, valves, etc., that is, in this embodiment, the field device is the responder of the communication process, that is, the slave of the master-slave communication.

[0054] This embodiment provides a two-way identity authentication and encryption communication method based on the HART-IP protocol, comprising the following steps:

[0055] S1: Before establishing a HART-IP secure communication connection, deploy the IP addresses and corresponding public and private key data of the control device and the field device to the control device and the field device respectively through the configuration tool to implement data configuration of the control device and the field device;

[0056] S2: The control device sends an authentication request command to the field device based on the HART-IP protocol. The field device parses and verifies the authentication request command and sends an authentication request response back to the control device. The control device parses and verifies the authentication request response and sends an authentication feedback command to the field device again, thereby achieving two-way identity authentication between the control device and the field device.

[0057] S3: After the two-way identity authentication is passed, the control device sets up a session key, encrypts the session key, and sends a session key distribution command to the field device based on the HART-IP protocol. The field device parses and verifies the session key distribution command, decrypts it to obtain the session key, and thus establishes a secure communication connection based on the session key between the control device and the field device;

[0058] S4: The control device and the field device respectively perform encryption and decryption operations on the sent and received message data based on the session key to achieve encrypted communication between the control device and the field device.

[0059] See also Figure 2 Preferably, in one embodiment, deploying IP addresses and public and private key data for control devices and field devices in S1 specifically includes the following steps:

[0060] S11: Deploy the IP address of the control device and the corresponding public and private key data to the control device through the configuration tool.

[0061] The configuration tool described in this embodiment is a software tool that can configure information such as IP addresses and asymmetric keys into the configured device and store them permanently. At the same time, due to the use of the configuration tool, when the key data is leaked, a new key can be written through the configuration tool to ensure the availability of the device and the confidentiality of the communication.

[0062] The encryption algorithm used in this embodiment includes the RSA algorithm (hereinafter, the RSA algorithm is used as an example for the embodiment), the elliptic curve encryption algorithm or other asymmetric encryption algorithms. The RSA algorithm is an asymmetric encryption algorithm, and its security depends on the prime factorization problem of large integers. It is widely used in data encryption and digital signatures. The RSA algorithm uses a pair of keys, respectively called public key and private key. The public key is used to encrypt data, and the private key is used to decrypt data, or the private key is used to sign data, and the public key is used to verify the signature data. The public key can be publicly distributed, and the private key must be kept confidential. The elliptic curve algorithm is a public key asymmetric encryption algorithm based on the mathematical structure of the elliptic curve. It can use the algebraic structure of the points on the elliptic curve to create an encryption algorithm. It can use a shorter key length while providing the same security level as the RSA algorithm, thereby improving efficiency and security. The asymmetric encryption algorithm will be further used in the S2 and S3 steps later.

[0063] In this embodiment, the IP address of the control device is: 192.168.1.1, and its public key is: Pub CD , the private key is: Pri CD .

[0064] S12: Deploy the IP address and corresponding public key data of the field device to the control device through the configuration tool.

[0065] In this embodiment, the IP address of the field device is: 192.168.1.6, and its public key is: Pub FD After deployment, the control device will establish a mapping relationship between the IP address and the public key of the field device. In this embodiment, it is: {192.168.1.6:Pub FD}.

[0066] S13: The IP address of the legal field device is configured to the control device through the configuration tool. At this point, the control device obtains the IP address of the field device that can be authenticated.

[0067] S14: Deploy the IP address of the field device and the corresponding public and private key data to the field device through the configuration tool.

[0068] In this embodiment, the IP address of the field device is 192.168.1.6, and its public key is: Pub FD , the private key is: PriFD .

[0069] S15: Deploy the IP address of the control device and the corresponding public key data to the field device through the configuration tool.

[0070] In this embodiment, the IP address of the control device is: 192.168.1.1, and its public key is: Pub CD After deployment, the on-site device will establish a mapping relationship between the control device IP address and the public key. In this embodiment, it is: {192.168.1.1:Pub CD}.

[0071] It is worth noting that, in the present embodiment, the private keys of the control device and the field device are respectively deployed in the HSM hardware security modules of the control device and the field device. The HSM hardware security module is a hardware device specially designed to perform encryption operations and protect encryption keys and other confidential data. It can ensure high data security by providing high-performance encryption calculation, key generation, storage and management functions. That is, in the present embodiment, the private keys of the control device and the field device are secretly stored in their own HSM modules.

[0072] Furthermore, the IP addresses of the control device and the field device and the corresponding public and private key data are stored and entered in PEM text format. PEM format is a text format used to store and transmit encrypted data, certificates and keys. It represents binary data in Base64 encoding and adds specific identification lines before and after the encoded data. That is, in this embodiment, the public key of the control device is Pub CD , private key Pri CD , the public key Pub of the field device FD , private key Pri FD All are standard PEM format data, and the lengths of public and private keys meet the requirements of the corresponding RSA algorithm.

[0073] It should be noted that HART-IP commands are required in the two-way authentication communication interaction process of S2 and the session key distribution interaction process of S3. HART-IP commands can be divided into universal commands, general commands and special commands. Among them, command codes 0-31, 38, and 48 are universal commands, command codes 32-121 (except commands 38 and 48) are general commands, and command codes 128-253 are special commands, also known as device custom commands.

[0074] See also Figure 3 Preferably, in one embodiment, in S2, the control device sends an authentication request command to the field device, specifically comprising the following steps:

[0075] S21: Define HART-IP command code 129 as an authentication request command (other HART-IP command codes may also be used in other embodiments). The control device first sends a message of the HART-IP 129 authentication request command to the field device, wherein the control device uses its own RSA private key Pri CD The hexadecimal number of the last two bytes of the IP address is used for RSA encryption signature calculation, that is, the data obtained by signing 0x101 in this embodiment is recorded as: S CD , the data part of the construction will carry the control device signature data S CD Authentication request command.

[0076] Furthermore, in S2, the field device parses and verifies the authentication request command, and transmits an authentication request response back to the control device, which specifically includes the following steps:

[0077] S22: After receiving the HART-IP 129 authentication request command message, the field device parses the message and obtains the signature data S of the control device. CD , then the field device uses the public key Pub corresponding to the IP address of the control device CD Signature data S CD Perform signature verification and obtain the on-site device signature verification data: VS CD .

[0078] S23: Compare the on-site device verification data VS CD The value of is the same as the last two bytes of the IP address of the control device. If they are the same, it means that the field device has successfully authenticated the control device. If they are different, it means that the field device has failed to authenticate the control device.

[0079] If the authentication is successful, the first byte of the data part of the HART-IP 129 authentication request response message of the field device needs to be set to 0x00, otherwise it is 0x01, and the signature data of the field device needs to be further filled in the HART-IP 129 authentication request response message, that is, the field device uses its own RSA private key Pri FD The hexadecimal number of the last two bytes of the IP address is used to perform RSA encryption signature calculation, that is, the data obtained by signing 0x106 in this embodiment is recorded as: S FD , the data part of the construction will carry the signature data S of the field device FD Response to the authentication request.

[0080] Further, in S2, the control device parses and verifies the authentication request response, and sends an authentication feedback command to the field device again, which specifically includes the following steps:

[0081] S24: After the control device receives the HART-IP 129 authentication request response message sent by the field device, it parses the message and first obtains the authentication result of the field device to the control device. If it is 0x01, that is, failure, then record the failure and issue an alarm, and then repeat steps S21-S23. If it is 0x00, that is, success, then continue to obtain the field device signature data S FD , and then the control device uses the public key Pub corresponding to the IP address of the field device FD Signature data S FD Verify the signature and obtain the control device verification data: VS FD .

[0082] S25: Compare the control device verification data VS FD The value of is the same as the last two bytes of the IP address of the field device. If they are the same, it means that the control device has successfully authenticated the field device. If they are different, it means that the control device has failed to authenticate the field device.

[0083] Define HART-IP command code No. 130 as an authentication feedback command (other HART-IP command codes may also be used in other embodiments). If the authentication is successful, it means that the corresponding control device and the field device have successfully completed the two-way authentication. The control device will send a message of HART-IP No. 130 authentication feedback command to the field device. The first byte of the data part in the HART-IP No. 130 authentication feedback command message of the control device needs to be set to 0x00, otherwise it is 0x01. After receiving the authentication feedback command message, the field device only needs to determine whether the two-way authentication is successful, and there is no need to reply to the HART-IP No. 130 command. At this point, the two-way authentication process ends. If the two-way authentication is successful, the session key distribution interaction process continues. Otherwise, the failure is recorded and an alarm is issued, and steps S21-S24 are repeated.

[0084] In summary, step S2 uses an asymmetric encryption algorithm to implement identity authentication and authorization functions for both communicating parties in the industrial control system.

[0085] It should be noted that in the session key distribution interaction process of S3 and the two-way encrypted communication process of S4, the encryption algorithms used include the AES128-CCM algorithm or other symmetric encryption algorithms. The AES128-CCM algorithm is a symmetric encryption algorithm that combines the Advanced Encryption Standard and the Counter Mode with the Cipher Block Chaining Message Authentication Code Mode to simultaneously provide confidentiality (confidentiality), integrity and authentication of data. The AES128 mode is an AES algorithm that uses a 128-bit key, and the CCM mode is an authenticated encryption mode, thereby ensuring the confidentiality and integrity of the data.

[0086] See also Figure 4Preferably, in one embodiment, in S3, the control device encrypts the session key and sends a session key distribution command to the field device, which specifically includes the following steps:

[0087] S31: The control device uses the HSM module to generate a 16-byte session key SKey required by the AES128-CCM algorithm.

[0088] S32: Define HART-IP command No. 131 as a session key distribution command (other HART-IP command codes may also be used in other embodiments), and then the control device uses the RSA public key Pub of the field device communicating with it FD The session key SKey is encrypted to obtain encrypted session key data: En(SKey), and then the encrypted session key data En(SKey) is hashed to obtain an encrypted session key hash value.

[0089] In this embodiment, the adopted hash algorithm is SHA256, so a 32-byte encrypted session key hash value is obtained: SHA256(En(SKey)).

[0090] S33: The control device uses its own private key to sign the encrypted session key hash value SHA256(En(SKey)) to obtain the encrypted session key hash value signature data Sign(SHA256(En(SKey))), and constructs a session key distribution command whose data part will carry the encrypted session key En(SKey) and the encrypted session key hash value signature data Sign(SHA256(En(SKey))), and the control device sends the HART-IP 131 session key distribution command to the field device.

[0091] Furthermore, in S3, the on-site device parses and verifies the session key distribution command and decrypts it to obtain the session key, which specifically includes the following steps:

[0092] S34: After receiving the message of HART-IP 131 session key distribution command, the field device parses the message to obtain the encrypted session key En(SKey) and the encrypted session key hash value signature data Sign(SHA256(En(SKey))) of the control device, and then uses the public key Pub of the control device to communicate with it. CDThe encrypted session key hash value signature data Sign (SHA256 (En (SKey))) is verified. If the verification fails, the control device fails to distribute the interactive session key task to the field device, and the data part of the HART-IP 131 response message of the field device is filled with 0x01, otherwise it is filled with 0x00. If the verification succeeds, the field device uses its own RSA private key Pri FD The encrypted session key En(SKey) is decrypted to obtain the decrypted data: De(En(SKey)). Based on the symmetric encryption and decryption characteristics of the AES128-CCM algorithm, it can be seen that De(En(SKey)) is equal to SKey, that is, the field device obtains the session key SKey set by the control device.

[0093] After the session key SKey is successfully distributed, a secure connection is established between the control device and the field device, and all subsequent HART-IP communication data will be encrypted and decrypted using the above session key SKey.

[0094] Preferably, the session key SKey update period is set to 24 hours. When the session key update period expires, the control device will autonomously update the session key and re-perform the session key encryption distribution task, thereby fully ensuring the confidentiality of the communication and the security of the session key.

[0095] In summary, in step S3, asymmetric encryption algorithm and hash algorithm are used to achieve a more secure key distribution function for the industrial control system.

[0096] See also Figure 5 Preferably, in one embodiment, in S4, the control device and the field device perform encryption and decryption operations on the sent and received message data based on the session key, specifically including the following steps:

[0097] S41: The message data sent by the control device to the field device includes the request data Data. The control device performs a hash calculation on the request data Data in the message data to be sent. In this embodiment, the hash algorithm selected is SHA1, that is, the hash calculation result of the request data Data is SHA1(Data). Therefore, the message data sent by the control device to the field device actually carries its own request data Data and the first request data hash value SHA1(Data). 1 .

[0098] S42: The control device uses the AES128-CCM symmetric encryption algorithm to encrypt the entire HART-IP message data to be sent, and the encryption key is the above-mentioned session key SKey. Then the control device sends the encrypted message data to the field device.

[0099] S43: The field device receives the encrypted HART-IP message data, first uses the session key SKey and uses the AES128-CCM algorithm to decrypt the encrypted message data, and then performs a hash calculation on the request data Data in the decrypted message to obtain a second request data hash value SHA1(Data) 2 , hash the first request data to SHA1(Data) 1 Hash value SHA1(Data) with the second request data 2 Compare them. If the two are the same, the message data is available and the field device responds to the control device. If the two are different, the message data may be tampered with, the message data is unavailable and the field device does not respond to the control device.

[0100] S44: Similarly, the message data sent back by the field device to the control device also includes the request data Data. The field device performs a hash calculation on the request data Data in the message data to be sent to obtain a third request data hash value SHA1(Data). 3 , that is, the message data sent by the field device to the control device actually carries its own request data Data and the third request data hash value SHA1(Data) 3 .

[0101] S45: The field device uses the AES128-CCM symmetric encryption algorithm to encrypt the entire HART-IP message data to be sent. The encryption key is also the above-mentioned session key SKey. Then the field device sends the encrypted message data to the control device.

[0102] S46: The control device receives the encrypted HART-IP message data, first uses the session key SKey and uses the AES128-CCM algorithm to decrypt the encrypted message data, and then performs a hash calculation on the request data Data in the decrypted message to obtain a fourth request data hash value SHA1(Data) 4 , hash the third request data to SHA1(Data) 3 And the fourth request data hash value SHA1(Data) 4 Compare them. If the two are the same, the message data is available and the control device responds to the field device. If the two are different, the message data may be tampered with, the message data is unavailable and the control device does not respond to the field device.

[0103] S47: Repeat steps S41-S46 until the communication task between the control device and the field device is completed. In this two-way communication process, the message data sent and received by the control device and the field device must be encrypted and decrypted by the session key, and the request data is compared and verified using a hash algorithm to prevent the two-way message data from being maliciously tampered with during transmission.

[0104] In summary, this embodiment provides a two-way authentication and encryption communication method based on the HART-IP protocol. On the basis of the HART-IP protocol, the two-way authentication and data encryption communication between the control device and the field device are realized by customizing the HART-IP command code, and the integrity of the communication is ensured by using a hash algorithm, which solves the vulnerability of the HART-IP protocol in which plain text transmission data is easily stolen, tampered with, and attacked by a middleman, effectively enhances the security and reliability of data during the communication process, and solves the problem that the traditional industrial control system can only encrypt but cannot perform identity authentication. At the same time, this embodiment uses the native HART-IP protocol to complete the establishment of a secure communication connection without using other complex security protocol stacks. Under the premise of not occupying too many industrial control equipment resources and not affecting the real-time performance of the industrial control system, the confidentiality and integrity of the communication are guaranteed, which greatly reduces the occupation and demand for system resources by the control device and the field device during the communication process. In addition, this embodiment only uses a two-way identity authentication and key distribution scheme based on an asymmetric encryption algorithm before the control device and the field device establish a secure communication connection. After the secure communication is established, the communicating parties use the symmetric encryption algorithm AES128-CCM. The overhead of the symmetric encryption algorithm is much smaller than that of the asymmetric encryption algorithm. Therefore, the encrypted communication after establishing a secure connection will not occupy too many device resources, and will not affect the real-time requirements of the industrial control system.

[0105] The embodiments of the present invention are described in detail above in conjunction with the accompanying drawings, but the present invention is not limited to the above embodiments. Even if various changes are made to the present invention, if these changes fall within the scope of the claims of the present invention and their equivalents, they still fall within the protection scope of the present invention.

Claims

1. A two-way identity authentication and encryption communication method based on HART-IP protocol, characterized in that: The steps include: S1: Deploy the IP addresses of the control device and the field device and the corresponding public and private key data to the control device and the field device respectively through a configuration tool; S2: The control device sends an authentication request command to the field device based on the HART-IP protocol, the field device parses and verifies the authentication request command, and sends an authentication request response back to the control device, the control device parses and verifies the authentication request response, and sends an authentication feedback command to the field device again, thereby realizing two-way identity authentication between the control device and the field device; S3: After encrypting the session key, the control device sends a session key distribution command to the field device based on the HART-IP protocol, and the field device parses and verifies the session key distribution command and decrypts it to obtain the session key; S4: The control device and the field device respectively perform encryption and decryption operations on sent and received message data based on the session key to achieve encrypted communication between the control device and the field device.

2. The two-way identity authentication and encryption communication method based on the HART-IP protocol as claimed in claim 1, characterized in that: In S1, the IP address and public and private key data are deployed to the control device and the field device, specifically including the following steps: S11: deploying the IP address of the control device and the corresponding public and private key data to the control device through a configuration tool, wherein the private key data is deployed in the HSM hardware security module of the control device; S12: deploying the IP address and corresponding public key data of the field device to the control device through a configuration tool; S13: configuring the legal IP address of the field device to the control device through a configuration tool; S14: deploying the IP address of the field device and the corresponding public and private key data to the field device through a configuration tool, wherein the private key data is deployed in the HSM hardware security module of the field device; S15: Deploy the IP address and corresponding public key data of the control device to the field device through a configuration tool.

3. The two-way identity authentication and encryption communication method based on the HART-IP protocol as claimed in claim 2, characterized in that: The IP addresses of the control device and the field device and the corresponding public and private key data are stored and entered in PEM text format.

4. The two-way identity authentication and encryption communication method based on the HART-IP protocol as claimed in claim 1, characterized in that: In S2, the control device sends an authentication request command to the field device, which specifically includes the following steps: S21: The control device uses its own private key to perform encryption signature calculation on the hexadecimal number of the last two bytes of its IP address, and the constructed data part will carry the authentication request command of the signature data of the control device.

5. The two-way identity authentication and encryption communication method based on the HART-IP protocol as claimed in claim 4, characterized in that: In S2, the field device parses and verifies the authentication request command, and returns an authentication request response to the control device, which specifically includes the following steps: S22: The field device verifies the signature data of the control device using the public key corresponding to the IP address of the control device to obtain the field device signature verification data; S23: Compare the value of the on-site device signature verification data with the last two bytes of the control device IP address to see if they are the same. If they are the same, the on-site device successfully authenticates the control device, and the on-site device uses its own private key to perform encrypted signature calculation on the hexadecimal number of the last two bytes of its own IP address, and constructs the data part that will carry the authentication request response of the on-site device signature data; if they are different, the on-site device fails to authenticate the control device.

6. The two-way identity authentication and encryption communication method based on the HART-IP protocol as claimed in claim 5, characterized in that: In S2, the control device parses and verifies the authentication request response, and sends an authentication feedback command to the field device again, which specifically includes the following steps: S24: The control device uses the public key corresponding to the IP address of the field device to verify the signature data of the field device to obtain control device signature verification data; S25: comparing the value of the control device's signature verification data with the last two bytes of the IP address of the field device to see if they are the same; if they are the same, the control device successfully authenticates the field device and sends an authentication feedback command to the field device again; If they are different, the control device fails to authenticate the field device.

7. The two-way identity authentication and encryption communication method based on the HART-IP protocol as claimed in claim 1, characterized in that: In S3, the control device encrypts the session key and sends a session key distribution command to the field device, which specifically includes the following steps: S31: The control device uses the HSM module to generate a 16-byte session key required by the symmetric encryption algorithm; S32: the control device uses the public key of the field device communicating with the control device to encrypt the session key, and performs hash calculation on the encrypted session key data to obtain a hash value of the encrypted session key; S33: The control device uses its own private key to sign the encrypted session key hash value, and constructs the session key distribution command whose data part carries the encrypted session key and the encrypted session key hash value signature data.

8. The two-way identity authentication and encryption communication method based on the HART-IP protocol as claimed in claim 7, characterized in that: In S3, the on-site device parses and verifies the session key distribution command, and decrypts to obtain the session key, which specifically includes the following steps: S34: The field device uses the public key of the control device communicating with it to verify the encrypted session key hash value signature data. If the verification is successful, the field device further uses its own private key to decrypt the encrypted session key to obtain the session key; if the verification fails, the control device fails to distribute the interactive session key task to the field device.

9. The two-way identity authentication and encryption communication method based on the HART-IP protocol as claimed in claim 8, characterized in that: The session key update period is 24 hours. When the session key update period expires, the control device updates the session key and performs the session key encryption distribution task again.

10. The two-way identity authentication and encryption communication method based on the HART-IP protocol as claimed in claim 1, characterized in that: In S4, the control device and the field device respectively perform encryption and decryption operations on the sent and received message data based on the session key, which specifically includes the following steps: S41: the control device performs a hash calculation on the request data in the message data to be sent to obtain a first request data hash value; S42: the control device uses a symmetric encryption algorithm to encrypt the message data to be sent, the encryption key is the session key, and the control device sends the encrypted message data to the field device; S43: The field device receives the encrypted message data, and uses the session key to decrypt the encrypted message data, performs hash calculation on the request data in the decrypted message to obtain a second request data hash value, and compares the first request data hash value with the second request data hash value. If the two are the same, the message data is available and the field device responds to the control device. If the two are different, the message data is unavailable and the field device does not respond to the control device. S44: the field device performs hash calculation on the request data in the message data to be sent to obtain a third request data hash value; S45: the field device uses a symmetric encryption algorithm to encrypt the message data to be sent, the encryption key is the session key, and the field device sends the encrypted message data to the control device; S46: the control device receives the encrypted message data, and uses the session key to decrypt the encrypted message data, performs hash calculation on the request data in the decrypted message to obtain a fourth request data hash value, and compares the third request data hash value with the fourth request data hash value. If the two are the same, the message data is available and the control device responds to the field device. If the two are different, the message data is unavailable and the control device does not respond to the field device. S47: Repeat steps S41-S46 until the communication task between the control device and the field device is completed.

Images