Method and device for safely accessing industrial control equipment to public test platform

Abstract

The invention discloses a method and device for safely accessing industrial control equipment to a public test platform, and the method comprises the steps: carrying out the initialization of the public test platform, including the generation of a public and private key pair, the configuration of a digital certificate, the configuration of a Bloom filter, the selection of a hash function set matched with the Bloom filter, and the construction of a controlled resource identifier set; the public test platform receives registration information of the industrial control equipment, grants a corresponding authority to the industrial control equipment according to the registration information, generates a minimum authorized resource set corresponding to the authority, writes the minimum authorized resource set into the Bloom filter, and stores identity information of the industrial control equipment; the public testing platform performs bidirectional authentication of the public testing platform and the industrial control equipment based on an authentication request initiated by the industrial control equipment, and dynamically updates authentication information held by the public testing platform and the industrial control equipment respectively; and after the bidirectional authentication is completed, the public test platform performs access admission judgment on a resource access request initiated by the industrial control equipment by using a bloom filter based on the controlled resource identifier set and corresponding authority granted to the industrial control equipment. The invention aims to solve the problems that the current industrial control equipment in a large-scale access scene is weak in authentication anti-attack capability, a secret key is easy to leak and counterfeit, physical attack protection is insufficient, communication lacks forward and backward security, and a resource authorization mechanism does not have a fine granularity and minimum authorization principle.

Description

Technical Field

[0001] The present invention belongs to the technical field of industrial control system network security, and specifically relates to a method and device for securely accessing industrial control equipment to a crowd-testing platform. Background Art

[0002] With the deep integration of industrial control systems and internet technologies, more and more industrial control equipment is required to securely and efficiently connect to various industrial internet platforms and third-party security crowd-testing platforms. These crowd-testing platforms enable unified management, security testing, and vulnerability discovery for connected industrial control equipment, helping users and operators promptly identify potential security risks and effectively improving the system's overall protection capabilities. Typical application scenarios include distributed industrial control equipment in critical infrastructure such as power, energy, and manufacturing. By connecting to crowd-testing platforms, dynamic identification of equipment assets, real-time status monitoring, and remote security assessment and compliance verification can be achieved, driving the evolution of industrial control systems towards intelligence, networking, security, and controllability.

[0003] However, with the growing demand for secure access to industrial control equipment, existing solutions still face multiple challenges. On the one hand, a large number of terminal devices still use traditional industrial protocols such as Modbus and IEC60870-5-104, which lack a comprehensive security design. After the devices are connected to the platform, they are vulnerable to attacks such as data eavesdropping, command injection, and forgery [1]. On the other hand, although some solutions have introduced cryptographic mechanisms such as digital signatures and threshold secret sharing to enhance authentication strength [2], they generally rely on long-term storage of keys on the device side, resulting in the device identity being easily forged once the key is leaked. In addition, in terms of physical attack protection, dynamic authentication, and refined permission management (such as device identity anonymity and least privilege authorization), existing methods are still insufficient and cannot support the actual demand for high security in large-scale industrial control scenarios.

[0004] [1] Yang T, Zhang J, Huang Z, et al. A review of industrial control system security[J].JisuanjiYanjiu yu Fazhan / Computer Research and Development,2022,59(5):1035-1053.

[0005] [2]Yang LY,Tong WM,Li ZW,et al.Authentication scheme for distributed industrial control system terminals[C] / / Proceedings of the 20215th International Conference on Electronic Information Technology andComputer Engineering.2021:1005-1012. Summary of the Invention

[0006] In response to the problems existing in the prior art, the present invention provides a method and device for securely accessing industrial control equipment to a crowd-testing platform. The purpose is to solve the problems currently faced by industrial control equipment in large-scale access scenarios, such as weak authentication anti-attack capabilities, easy leakage and forgery of keys, insufficient protection against physical attacks, lack of forward and backward security in communications, and a resource authorization mechanism that lacks fine-grainedness and the principle of minimum authorization.

[0007] In order to solve the above technical problems, the present invention is implemented through the following technical solutions:

[0008] According to a first aspect of the present invention, a method for securely accessing an industrial control device to a crowd testing platform is provided, comprising:

[0009] Initializing the crowd testing platform, including generating a public-private key pair and configuring a digital certificate, configuring a Bloom filter, selecting a set of hash functions that match the Bloom filter, and constructing a set of controlled resource identifiers;

[0010] The crowd-testing platform receives the registration information of industrial control devices, grants corresponding permissions to the industrial control devices based on the registration information, generates a minimum authorized resource set corresponding to the permissions, writes the minimum authorized resource set into the Bloom filter, and saves the identity information of the industrial control devices;

[0011] Based on the authentication request initiated by the industrial control device, the public testing platform performs two-way authentication between the public testing platform and the industrial control device, and dynamically updates the authentication information held by the public testing platform and the industrial control device respectively;

[0012] After the two-way authentication is completed, the crowd-testing platform uses Bloom filters and, based on the set of controlled resource identifiers and the corresponding permissions granted to the industrial control equipment, makes access permission decisions on resource access requests initiated by the industrial control equipment.

[0013] In a possible implementation of the first aspect, the public-private key pair generation and digital certificate configuration are specifically implemented as follows:

[0014] The public testing platform executes the national secret SM2 key generation algorithm to generate a public and private key pair (pk P ,sk P ), as follows:

[0015] SM2.KeyGen(1 λ )→(sk P , pk P )

[0016] The public-private key pair (pk P ,sk P ) satisfies the following relationship:

[0017] pk P =[sk P ]G

[0018] Where λ represents the security parameter, SM2.KeyGen(·) is the key generation algorithm in the SM2 elliptic curve cryptosystem, and sk P It is the private key of the public testing platform, pk P It is the public key of the crowd testing platform. G is the base point defined by the SM2 elliptic curve, [sk P ]G represents scalar multiplication on the SM2 elliptic curve;

[0019] The public testing platform will pk the public testing platform public key P Submit to an authoritative digital certificate authority for signature and obtain a digital certificate Cert P ;

[0020] The Bloom filter configuration and the selection of a set of hash functions that match the Bloom filter are specifically implemented as follows:

[0021] The Bloom filter adopts a counting Bloom filter;

[0022] The crowd testing platform initializes the counting Bloom filter, initializes all counting units to 0, and predefines the hash function set H required by the counting Bloom filter = {h1, h2, ..., h γ}, each hash function satisfies the following mapping form:

[0023] h i :{0,1} * →[0,η-1],i=1,2,...,γ

[0024] Where η is the bitmap length of the counting Bloom filter, and γ is the number of hash functions;

[0025] The specific implementation process of constructing the controlled resource identifier set is as follows:

[0026] The crowd testing platform predefines a set of controlled resource identifiers that can be accessed by industrial control equipment , as follows:

[0027]

[0028] Where RID i Indicates the identifier corresponding to a controlled resource, and n indicates the number of controlled resources.

[0029] In a possible implementation of the first aspect, the crowd-testing platform receives registration information of an industrial control device, grants corresponding permissions to the industrial control device based on the registration information, generates a minimum authorized resource set corresponding to the permissions, and writes the minimum authorized resource set into a Bloom filter. The specific implementation process is as follows:

[0030] Step S2-1: The industrial control device and the crowd-testing platform negotiate to generate a temporary session key based on the SM2-ECDH protocol. Specifically:

[0031] Industrial control equipment receives digital certificate Cert from the public testing platform P , and complete signature verification to confirm the identity of the crowd testing platform;

[0032] The industrial control device calls the PUF module to derive the temporary private key of the industrial control device and generate the temporary private key of the industrial control device , and calculate the corresponding temporary public key of the industrial control equipment based on the elliptic curve point multiplication rule , as follows:

[0033]

[0034] The crowd testing platform runs the SM2.KeyGen(·) algorithm to generate a temporary key pair for the crowd testing platform. , the crowd testing platform and the industrial control equipment exchange their respective temporary public keys, and the industrial control equipment uses and , crowd testing platform use and , respectively execute the SM2-ECDH protocol to generate the temporary session key K, as follows:

[0035]

[0036] Wherein, ECDH is a key agreement protocol based on elliptic curve;

[0037] Step S2-2: The crowd testing platform receives the registration request message sent by the industrial control device, specifically:

[0038] D→P:|{Manu,Func,Usage,HMAC}|

[0039] Where, Manu represents the manufacturer identifier of the industrial control device; Func represents the functional type of the industrial control device; Usage represents the intended use or deployment scenario of the industrial control device; HMAC represents the industrial control device identifier, HMAC = SM3(MAC), MAC represents the MAC address of the industrial control device; |·| represents the message encrypted using a temporary session key by SM4; D represents the industrial control device; and P represents the crowd testing platform.

[0040] Step S2-3: The crowd testing platform determines whether the industrial control device is allowed to be registered based on the access rules and the registration request message. If allowed, a registration response message is constructed and sent to the industrial control device. Specifically:

[0041] P→D:|{TID i ,C i}|

[0042] In the formula, TID i Temporary identification for industrial control equipment; C i It is a one-time challenge value; TID i with C i All are generated by calling the pseudo-random number generator on the crowd-testing platform;

[0043] Step S2-4: The crowd-testing platform receives the first response message sent by the industrial control device, specifically:

[0044] D→P:|R i |

[0045] The first response message sent by the industrial control device is generated by the industrial control device based on the registration response message, specifically:

[0046] R i =PUF(C i )

[0047] Where R i Challenge response sent by industrial control equipment;

[0048] Step S2-5: The crowd-testing platform grants the industrial control device corresponding permissions based on the registration request message and the preset authorization policy and generates the minimum authorized resource set corresponding to the permissions, specifically:

[0049]

[0050] Where RE is the minimum authorized resource set; ARID j The unique identifier of the jth controlled resource;

[0051] Step S2-6: The crowd testing platform generates a unique identifier ARID for each controlled resource in the minimum authorized resource set RE. jConnect with the HMAC of the industrial control equipment and perform hashing, calling the hash function set H={h1,h2,...h γ}, calculate the index position of the unique identifier of the controlled resource in the counting Bloom filter as follows:

[0052]

[0053] In the formula, || represents the connection operation;

[0054] The crowd-testing platform writes the minimum authorized resource set of the industrial control device into the counting Bloom filter according to the index position, as follows:

[0055] CBF[idx i，j ]←CBF[idx i，j ]+1.

[0056] In a possible implementation of the first aspect, the industrial control device calls the PUF module to derive the temporary private key of the industrial control device and generate the temporary private key of the industrial control device. , specifically:

[0057] The industrial control device uses a pseudo-random number generator to generate a random number r1, inputs the random number r1 into the PUF module, and obtains a unique response σ = PUF(r1). The unique response is then processed using a key derivation function to generate a temporary private key for the industrial control device, as follows:

[0058]

[0059] Where KDF(·) is the key derivation function.

[0060] In a possible implementation of the first aspect, the elliptic curve-based key agreement protocol is specifically:

[0061] The crowd-testing platform and the industrial control equipment each use their own temporary private key and the other party's temporary public key to perform a point multiplication operation to calculate the shared point P = sk·pk, extract the horizontal coordinate from the shared point P, and pass the horizontal coordinate as input to the key derivation function to generate a temporary session key K of a fixed length.

[0062] In a possible implementation of the first aspect, the saving of the identity information of the industrial control device is specifically implemented as follows:

[0063] The public testing platform saves the identity information of the industrial control device based on the first response message and registration request message sent by the industrial control device. Specifically:

[0064]

[0065] Where, It is a collection of local registration data for the crowd testing platform.

[0066] In one possible implementation of the first aspect, the crowd-testing platform performs bidirectional authentication between the crowd-testing platform and the industrial control device based on an authentication request initiated by the industrial control device, and dynamically updates the authentication information held by each of the crowd-testing platform and the industrial control device. The specific implementation process is as follows:

[0067] Step S3-1: The industrial control device and the crowd-testing platform negotiate to generate a new round of temporary session key K′ based on the SM2-ECDH protocol;

[0068] Step S3-2: The public testing platform receives the authentication request message sent by the industrial control equipment, specifically:

[0069] D→P:|{TID i ,X}|

[0070]

[0071] Where X is the authentication binding value; r2 is the random number generated by the industrial control device using a pseudo-random number generator; Represents a bitwise exclusive OR operation;

[0072] Step S3-3: The crowd testing platform checks the temporary identity identifier (TID) of the industrial control equipment i If it does not exist, the industrial control equipment authentication request is rejected; if it exists, the temporary identity TID of the industrial control equipment is read from the local registration data set. i Bound Registration Record {TID i , C i , R i , HMAC}, and based on this, restore the random number r2 generated by the industrial control equipment, as follows:

[0073]

[0074] The public testing platform constructs an authentication response message based on the random number r2 and sends it to the industrial control device. Specifically:

[0075] P→D:|{C i ,F,Auth,TID i+1 ,C i+1 , T P}|

[0076]

[0077] Auth=SM3(r2||r3||F)

[0078] Where F is the authentication factor; Auth is the first authentication summary; TID i+1A new temporary identity assigned by the crowd-testing platform to industrial control equipment; C i+1 is the new one-time challenge value; TID i+1 with C i+1 All are generated by the platform calling the pseudo-random number generator; T P is the current timestamp; r3 is the random number generated by the crowd testing platform;

[0079] Step S3-4: The crowd-testing platform receives the second response message sent by the industrial control device, specifically:

[0080] D→P:||{R i+1 ,Auth′,T D}|

[0081] The second response message sent by the industrial control device is generated by the industrial control device based on the authentication response message, specifically:

[0082] The industrial control equipment verifies the timestamp T according to the authentication response message P The freshness is as follows:

[0083] T Cur -T P <Δt

[0084] Where, T cur is the current time; Δt is the maximum response delay between the industrial control equipment and the crowd testing platform;

[0085] After verification, the industrial control device extracts the one-time challenge value C from the authentication response message i As input, call the PUF module to restore the challenge response R sent by the industrial control equipment i ;

[0086] The industrial control equipment restores the random number r3 as follows:

[0087]

[0088] The industrial control device combines the locally stored random number r2 and random number r3 to calculate the second authentication digest, as follows:

[0089] Auth * =SM3(r2||r3||F)

[0090] Industrial control equipment will use Auth and Auth * A comparison is performed. If the two are not equal, the industrial control equipment fails to authenticate the crowd testing platform and the authentication process is terminated.

[0091] If the two are equal, the industrial control device constructs a second response message, the structure of which is as follows:

[0092] {R i+1,Auth′,T D}

[0093] Auth′=SM3(r2||r3||C i ||R i )

[0094] Where R i+1 The new one-time challenge value C i+1 A new challenge response is generated by the local PUF, where Auth′ is the third authentication digest; T D is the current timestamp;

[0095] Step S3-5: The crowd-testing platform verifies the identity of the industrial control device according to the second response message. If the verification is successful, the authentication information held by the crowd-testing platform and the industrial control device is updated.

[0096] In a possible implementation of the first aspect, the crowd-testing platform verifies the identity of the industrial control device according to the second response message. If the verification succeeds, the crowd-testing platform and the industrial control device respectively update their authentication information, specifically:

[0097] The crowd testing platform verifies the timestamp T according to the second response message D The freshness is as follows:

[0098] T′ cur -T D <Δt

[0099] Where, T cur is the current time;

[0100] Crowd-testing platform reconstructs the fourth authentication summary Auth′ * , as follows:

[0101] Auth′ * =SM3(r2||r3||C i ||R i )

[0102] The public testing platform combines Auth′ and Auth′ * Perform consistency comparison. If the two are not equal, the crowd-testing platform fails to authenticate the industrial control equipment.

[0103] If the two are equal, the crowd-testing platform successfully authenticates the industrial control device, and then records the new temporary identity and new challenge response {TID i+1 , R i+1}, after this round of conversation, the crowd testing platform will Delete the old {TID i , C i , HMAC}, save the new

[0104] In a possible implementation of the first aspect, the crowd-testing platform utilizes a Bloom filter and, based on a set of controlled resource identifiers and corresponding permissions granted to the industrial control device, performs an access permission determination on a resource access request initiated by the industrial control device. The specific implementation process is as follows:

[0105] Step S4-1: The crowd-testing platform receives a resource access request from the industrial control device, specifically:

[0106] D→P:|{HAMC,AR}|

[0107]

[0108] Where, AR represents the set of resource identifiers that the industrial control device expects to access; RRI represents a resource identifier that the industrial control device expects to access;

[0109] Step S4-2: The crowd-testing platform uses a Bloom filter to determine access permission for resource access requests initiated by industrial control equipment based on the resource access request. Specifically,

[0110] The crowd testing platform uses the resource access request and the hash function set that matches the Bloom filter to generate each resource identifier RRID in the resource identifier set AR that the industrial control device expects to access. j Construct the corresponding Bloom filter hash index set as follows:

[0111] idx i，j =h i (HMAC||RRID j ), i=1,...,γ

[0112] The crowd testing platform has a resource identifier RRID for each j The corresponding Bloom filter hash index set is queried. If the corresponding set of indexes idx in the Bloom filter hash index set is i，j , all satisfy:

[0113]

[0114] It is determined that the industrial control device has the resource identifier RRID j Access permissions for the corresponding resources.

[0115] According to a second aspect of the present invention, there is provided an apparatus for securely accessing an industrial control device to a crowd-testing platform, comprising:

[0116] An initialization module, used for initializing the crowd-testing platform, including generating public and private key pairs and configuring digital certificates, configuring Bloom filters, selecting a set of hash functions that match the Bloom filters, and constructing a set of controlled resource identifiers;

[0117] A registration processing module is used to receive the registration information of the industrial control device, grant corresponding permissions to the industrial control device based on the registration information and generate a minimum authorized resource set corresponding to the permissions, write the minimum authorized resource set into the Bloom filter and save the identity information of the industrial control device;

[0118] The two-way authentication module is used to perform two-way authentication between the public testing platform and the industrial control device based on the authentication request initiated by the industrial control device, and dynamically update the authentication information held by the public testing platform and the industrial control device respectively;

[0119] The access admission determination module is used to perform access admission determination on resource access requests initiated by industrial control devices using Bloom filters based on a set of controlled resource identifiers and corresponding permissions granted to the industrial control devices after two-way authentication is completed.

[0120] Compared with the prior art, the present invention has at least the following beneficial effects:

[0121] (1) This invention can effectively defend against high-risk attacks such as physical contact and memory reading faced by the device in actual deployment. Relying on the PUF's instant key derivation mechanism, it only saves the PUF input random number and does not store any key data. It dynamically generates a temporary private key for each authentication and automatically destroys it after the authentication is completed. Even if the industrial control device is compromised, the attacker cannot restore the temporary private key or reproduce the authentication process, fundamentally eliminating the risk of identity forgery and cloning, and improving the industrial control device's ability to resist physical attacks.

[0122] (2) This invention utilizes the PUF derivation mechanism and the SM2-ECDH protocol to dynamically generate temporary session keys in each round of authentication interaction, without relying on any long-term storage state, thereby effectively ensuring the forward and backward security of the system. Even if an attacker obtains the temporary session key for a certain round, they cannot deduce the historical communication content or affect the generation of future temporary session keys, ensuring that the device authentication process still has good privacy isolation and anti-correlation in attack scenarios such as key leakage and communication backtracking.

[0123] (3) This invention enables Bloom filter-based resource authorization verification, enabling fine-grained and dynamic determination of access rights for industrial control equipment. The crowd-testing platform independently verifies the authorization status of each resource, strictly adhering to the principle of least authorization to ensure that devices only access authorized resources. The use of a hash index determination method prevents exposure of plaintext resources or permission tables, achieving constant authorization overhead and making it suitable for large-scale concurrent access.

[0124] (4) This invention supports bidirectional device-platform authentication based on dynamic challenge response and PUF output, ensuring complete identity verification and process security. This mechanism can effectively resist attacks such as replay, forgery, and impersonation. After authentication is completed, the device identity and parameters are automatically updated, achieving anonymity and behavioral privacy protection for industrial control devices.

[0125] (5) The present invention adopts the national cryptographic algorithm system throughout the entire process, including SM2 key negotiation, SM3 hash calculation, and SM4 symmetric encryption. While ensuring authentication security and encryption strength, it also meets the compliance requirements of domestic cryptography and has good adaptability to key areas such as government affairs, industrial control, and information technology innovation. Compared with authentication mechanisms that rely on internationally accepted encryption algorithms, the present invention is easier to implement and deploy under the national standard system, and has greater promotion value and independent control advantages.

[0126] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, preferred embodiments are given below and described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0127] In order to more clearly illustrate the technical solutions in the specific embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the specific embodiments. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0128] Figure 1 This is a flow chart of a method for securely connecting industrial control equipment to a crowd-testing platform according to an embodiment of the present invention;

[0129] Figure 2 This is a flow chart of the boot registration phase of industrial control equipment according to an embodiment of the present invention;

[0130] Figure 3 This is a flow chart of the dynamic session authentication phase of an embodiment of the present invention;

[0131] Figure 4 This is a flow chart of the resource authorization and verification phase in an embodiment of the present invention. DETAILED DESCRIPTION

[0132] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of them. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0133] like Figure 1As shown, an embodiment of the present invention provides a method for securely accessing an industrial control device to a crowd testing platform, specifically comprising the following steps:

[0134] Step 1: The crowd-testing platform is initialized, which includes generating a public-private key pair and configuring a digital certificate, configuring a Bloom filter, selecting a set of hash functions that match the Bloom filter, and constructing a set of controlled resource identifiers.

[0135] In other words, this step is the initialization phase, which completes the generation of public and private key pairs and the configuration of digital certificates. It also initializes the Bloom filter and sets its parameters and hash function set. It also builds the set of controlled resource identifiers managed by the crowd-testing platform to support industrial control device registration, permission verification, and secure communication mechanisms. This initialization phase is completed once before the crowd-testing platform is deployed to ensure that the platform has the key foundation, permission management foundation, and authentication support capabilities.

[0136] In one possible implementation, regarding the generation of public and private key pairs and the configuration of digital certificates, the specific implementation process is as follows:

[0137] The public testing platform executes the national secret SM2 key generation algorithm to generate a public and private key pair (pk P ,sk P ), as follows:

[0138] SM2.KeyGen(1 λ )→(sk P ,pk P )

[0139] It should be understood that the public-private key pair (pk P ,sk P ) is a pair of long-term public and private key pairs, the public and private key pair (pk P ,sk P ) satisfies the following relationship:

[0140] pk P =[sk P ]G

[0141] Where λ represents the security parameter, SM2.KeyGen(·) is the key generation algorithm in the SM2 elliptic curve cryptosystem, and sk P It is the private key of the public testing platform, pk P is the public key of the crowd testing platform, pk P Used for identity signature verification and session key negotiation on the crowd testing platform. G is the base point defined by the SM2 elliptic curve, [sk P ]G represents scalar multiplication on the SM2 elliptic curve;

[0142] Subsequently, the public testing platform will send the public testing platform public key pk PSubmit it to an authoritative digital certificate authority (CA) for signature and obtain a digital certificate Cert P This digital certificate will serve as a trusted credential for the crowd-testing platform's identity in the industrial control equipment registration and certification process, allowing the industrial control equipment side to perform legitimacy verification.

[0143] In one possible implementation, regarding the configuration of the Bloom filter and the selection of a set of hash functions that match the Bloom filter, the specific implementation process is as follows:

[0144] The Bloom filter (CBF) adopts a counting Bloom filter;

[0145] The crowd testing platform initializes the counting Bloom filter, initializes all counting units to 0, and predefines the hash function set H required by the counting Bloom filter = {h1, h2, ..., h γ}, each hash function satisfies the following mapping form:

[0146] h i : {0,1} * →[0,η-1],i=1,2,...,γ

[0147] Where η is the bitmap length of the counting Bloom filter, and γ is the number of hash functions. The crowd-testing platform fixes these parameters during the system deployment phase and ensures that each hash function is independent and reproducible, facilitating consistent insertion and query of permission data.

[0148] In one possible implementation, the construction of the controlled resource identifier set is specifically implemented as follows:

[0149] The crowd testing platform predefines a set of controlled resource identifiers that can be accessed by industrial control equipment The details are as follows:

[0150]

[0151] Where RID

[0152] i represents the identifier corresponding to a controlled resource, and n represents the number of controlled resources.

[0153] More specifically, the crowd testing platform will preset a set of "controlled resources" during the initialization phase. Each resource (for example: control interface, database module, sensor service, etc.) corresponds to a unique identifier RID i . A set of controlled resource identifiers This is the "resource index directory" of all resources that are allowed to be accessed on the public testing platform. In the future, industrial control equipment will reference these identifiers to declare permissions and request access when registering, authenticating, and authorizing. This step is essentially the definition and numbering of resource space, with the goal of forming a unified resource management framework. Subsequent Bloom filters also rely on these numbers to perform authorization hashing. Finally, the public testing platform publicly releases the digital certificate Cert P , hash function set H and controlled resource identifier set

[0154] Step 2: The crowd-testing platform receives the registration information of the industrial control device, grants the corresponding permissions to the industrial control device based on the registration information, generates a minimum authorized resource set corresponding to the permissions, writes the minimum authorized resource set into the Bloom filter, and saves the identity information of the industrial control device.

[0155] In other words, this step is the industrial control device onboarding and registration phase, which establishes the initial identity binding between the industrial control device and the access crowd-testing platform and completes the initial configuration of permissions. It is a key step in ensuring the trustworthiness of industrial control devices within the entire secure access mechanism. This phase is typically performed when industrial control devices are first put into use or during the initial stages of system deployment.

[0156] In one possible implementation, Figure 2 As shown in the figure, the crowd testing platform receives the registration information of industrial control equipment, grants corresponding permissions to the industrial control equipment based on the registration information, generates the minimum authorized resource set corresponding to the permissions, and writes the minimum authorized resource set into the Bloom filter. The specific implementation process is as follows:

[0157] Step S2-1: The industrial control device and the crowd-testing platform negotiate to generate a temporary session key based on the SM2-ECDH protocol. Specifically:

[0158] First, the industrial control equipment receives the digital certificate Cert from the public testing platform P , and complete the signature verification to confirm that the identity of the crowd testing platform is authentic and reliable;

[0159] Subsequently, the industrial control device calls the PUF module to derive the temporary private key of the industrial control device and generate the temporary private key of the industrial control device. , and calculate the corresponding temporary public key of the industrial control equipment based on the elliptic curve point multiplication rule , as follows:

[0160]

[0161] Finally, the crowd testing platform runs the SM2.KeyGen(·) algorithm to generate a temporary key pair for the crowd testing platform. , the crowd testing platform and the industrial control equipment exchange their respective temporary public keys, and the industrial control equipment uses and , crowd testing platform use and Execute the SM2-ECDH protocol to generate the temporary session key K, as follows:

[0162]

[0163] Wherein, ECDH is a key agreement protocol based on elliptic curves.

[0164] It should be noted that industrial control devices must verify the public testing platform's digital certificate before registration. After confirming the public testing platform's identity, they call the local PUF module to generate a temporary private key and complete key negotiation. The core goal of this design is to establish session keys for subsequent interactions without directly storing any key material. This protects against physical attacks such as key leakage and device cloning, thereby improving the security and robustness of the overall system.

[0165] PUF is a lightweight hardware security unit based on chip manufacturing differences. It can achieve unique key derivation each time without storing the private key and generate a temporary private key. .

[0166] In one implementation, the industrial control device calls the PUF module to derive the temporary private key of the industrial control device and generate the temporary private key of the industrial control device. Specifically:

[0167] The industrial control device uses a pseudo-random number generator (PRNG) to generate a random number r1, inputs the random number r1 into the PUF module, and obtains a unique response σ = PUF(r1). The unique response is then processed using a key derivation function (KDF) to generate a temporary private key for the industrial control device, as follows:

[0168]

[0169] Where KDF(·) is the key derivation function.

[0170] More specifically, the core advantage of this temporary private key derivation method for industrial control devices is that the industrial control device only needs to save the random input r1 used during generation throughout its life cycle, without the need to store any form of plaintext key. Since the PUF module's response σ = PUF(r1) is a unique mapping generated by the device's physical structure, even if an attacker obtains the random number r1, without the target device hardware, they cannot calculate σ, let alone restore the derived temporary private key. Furthermore, the derivation process involves only one random number generation, one PUF response call, and one hash-like KDF function calculation. This computational complexity is extremely low, requiring no encryption module or security chip support, making it suitable for resource-constrained industrial control terminal devices. This "light computing, zero storage, and high security" key generation mechanism effectively improves the resistance of industrial control equipment to physical and side-channel attacks.

[0171] In one possible implementation, regarding the elliptic curve-based key agreement protocol, specifically:

[0172] The crowd-testing platform and the industrial control device each use their own temporary private key and the other's temporary public key to perform a point multiplication operation to calculate the shared point P = sk·pk. They then extract the horizontal coordinate from the shared point P and pass it as input to the key derivation function to generate a temporary session key K of fixed length. All subsequent exchange messages are encrypted using the symmetric encryption algorithm SM4 based on this temporary session key, unless otherwise specified.

[0173] Preferably, in order to further enhance the anti-attack capability of the key negotiation process, the crowd testing platform sends its own temporary public key When using the signature method, it can be protected. And the current timestamp or session identifier and other information use their own long-term private key sk P Perform SM2 signature and then send it to the industrial control equipment. After receiving it, the industrial control equipment can use the long-term public key pk of the public testing platform P Verifying the legitimacy of the signature effectively prevents the risk of the public key of the crowd-testing platform being forged or tampered with by a middleman during transmission. This mechanism can enhance the credibility of the source of the negotiated key, provided that the public key of the industrial control device is sent in plain text, and is an important means of improving the system's overall resistance to man-in-the-middle attacks.

[0174] Step S2-2: The crowd-testing platform receives the registration request message sent by the industrial control device. In other words, the industrial control device constructs a registration request message and sends it to the crowd-testing platform to submit its own identity information and intended access purpose, so that the crowd-testing platform can subsequently complete the registration determination and permission configuration.

[0175] D→P:||{Manu,Func,Usage,HMAC}|

[0176] In the formula, Manu represents the manufacturer identifier of the industrial control equipment, which can be used by the crowd-testing platform to identify the source and brand of the industrial control equipment; Func represents the functional type of the industrial control equipment, such as sensor, actuator, edge node, etc.; Usage represents the intended use or deployment scenario of the industrial control equipment; HMAC is the industrial control equipment identifier, HMAC = SM3(MAC), where MAC is the MAC address of the industrial control equipment, which is used to determine uniqueness and prevent security risks caused by the leakage of plaintext MAC addresses; |·| indicates that the message is encrypted using a temporary session key via SM4; D is the industrial control equipment; and P is the crowd-testing platform.

[0177] It should be noted that the above structure is merely an example, and the specific fields can be adjusted or expanded based on actual system deployment requirements. Its core purpose is to ensure that industrial control devices provide a set of information reflecting their identity and usage requirements during the registration phase, allowing the crowd-testing platform to determine access and configure permissions based on system policies.

[0178] Step S2-3: The crowd testing platform determines whether the industrial control device is allowed to be registered based on the access rules and the registration request message. If allowed, a registration response message is constructed and sent to the industrial control device. Specifically:

[0179] P→D:|{TID i , C i}|

[0180] In the formula, TID i It is a temporary identification for industrial control equipment, used for anonymous representation of the equipment identity in the subsequent authentication phase, avoiding direct exposure of sensitive identification such as manufacturer or serial number; C i A one-time challenge value used to start the PUF module to generate an authentication response, ensuring that subsequent device registration is indeed initiated by the current physical entity; TID i with C i All of them are generated by the crowd-testing platform using a pseudo-random number generator and are unpredictable and unique.

[0181] If the registration conditions are not met, the registration will be rejected and the exception log will be recorded.

[0182] Step S2-4: The crowd-testing platform receives the first response message sent by the industrial control device, specifically:

[0183] D→P:|R i |

[0184] In other words, the industrial control device receives the registered response message, generates a first response message and sends it to the crowd testing platform to complete the identity binding confirmation in the registration phase.

[0185] The first response message sent by the industrial control device is generated by the industrial control device based on the registration response message, specifically:

[0186] R i =PUF(C i )

[0187] Where R i Challenge response sent by industrial control equipment.

[0188] More specifically, the challenge response value R i The one-time challenge value C preset by the crowd testing platform i Correspondingly, it can be proved that the response is indeed generated by a physical device with a PUF module and cannot be forged by a middleman or simulation software, ensuring the physical entity binding and non-cloning verification of the registration process.

[0189] Step S2-5: The crowd-testing platform grants the industrial control device corresponding permissions based on the registration request message and the preset authorization policy and generates a minimum authorized resource set corresponding to the permissions.

[0190] In other words, the crowd testing platform receives the challenge response R i Then, based on the industrial control device registration information and the preset authorization policy (it should be understood that the preset authorization policy refers to a series of permission allocation rules pre-defined by the crowd testing platform based on the type, function or security level of the industrial control device, which is used to determine the minimum set of resources accessible to the industrial control device), the minimum set of authorized accessible resources RE required by the industrial control device is first mapped, specifically:

[0191]

[0192] Where RE is the minimum authorized resource set; ARID j The unique identifier of the jth controlled resource;

[0193] Step S2-6: To ensure that the results of the permissions written by different industrial control devices to the same resource do not conflict with each other in the Bloom filter, the crowd testing platform generates a unique identifier ARID for each controlled resource in the minimum authorized resource set RE. j Connect with the HMAC of the industrial control equipment and perform hashing, calling the hash function set H = {h1, h2, ..., h γ}, calculate the index position of the unique identifier of the controlled resource in the counting Bloom filter as follows:

[0194] idx i,j =hi(HMAC||ARID j ), i=1,...,γ

[0195] In the formula, || represents the connection operation;

[0196] The crowd-testing platform writes the minimum authorized resource set of the industrial control device into the counting Bloom filter according to the index position, as follows:

[0197] CBF[idx i，j ]←CBF[idx i，j ]+1.

[0198] More specifically, the above operation ensures efficient storage and rapid determination of device permissions. The verification process eliminates the need to explicitly record plaintext permission tables, offering the dual advantages of space efficiency and access privacy protection. Although CBF carries a certain false positive probability—in rare cases, it may mistakenly determine that an industrial control device possesses an unauthorized resource—this probability can be effectively reduced to an acceptable level by controlling Bloom filter parameters (such as bitmap length and the number of hash functions). Importantly, resource permission verification is only triggered after the industrial control device has passed pre-authentication, thus avoiding the risk of unregistered or counterfeit devices gaining illegal access due to false positives. Compared to traditional determination mechanisms based on plaintext permission mapping tables, the CBF architecture not only avoids direct exposure of permission information but also supports concurrent access determination with constant time complexity, significantly reducing the resource management burden of the crowd-testing platform in large-scale device access scenarios. Therefore, even with the introduction of a controllable false positive risk, the overall system benefits of this mechanism in terms of security, efficiency, and scalability far outweigh its potential drawbacks.

[0199] Finally, the public testing platform will register the key information of industrial control equipment {TID i ,C i , R i , HMAC} writes the local registration data set to complete the device registration status record, that is, saves the identity information of the industrial control device. The specific implementation process is:

[0200] The public testing platform saves the identity information of the industrial control device based on the first response message and registration request message sent by the industrial control device. Specifically:

[0201]

[0202] Where, It is a collection of local registration data for the crowd testing platform.

[0203] Step 3: Based on the authentication request initiated by the industrial control device, the crowd testing platform performs two-way authentication between the crowd testing platform and the industrial control device, and dynamically updates the authentication information held by the crowd testing platform and the industrial control device respectively.

[0204] In other words, this step is the dynamic session authentication stage, which is used to complete identity authentication of industrial control equipment before each access to the crowd-testing platform, ensuring the legitimacy of the current communication entity and the freshness of the authentication parameters. It is the core link to ensure system security and anti-attack capabilities.

[0205] In one possible implementation, combining Figure 3 As shown in the figure, based on the authentication request initiated by the industrial control device, the crowd testing platform performs two-way authentication between the crowd testing platform and the industrial control device, and dynamically updates the authentication information held by the crowd testing platform and the industrial control device. The specific implementation process is as follows:

[0206] Step S3-1: The industrial control device and the crowd-testing platform negotiate based on the SM2-ECDH protocol to generate a new round of temporary session key K′, which is used to protect the communication data in the dynamic authentication phase.

[0207] It should be understood that during the dynamic session authentication phase, the industrial control equipment and the crowd-testing platform re-execute the SM2-ECDH protocol to negotiate and generate the temporary session key K′ for this round. The key negotiation mechanism used is the same as that used during the device boot registration phase, both of which calculate the shared point based on the temporary key pair and derive the symmetric key. This mechanism ensures that the authentication interaction has forward and backward security. Even if the temporary session key of a certain round is leaked, it will not affect the confidentiality of historical communications, nor will it threaten the key generation process of future sessions, thereby achieving key isolation protection in the authentication process. At the same time, this mechanism, combined with dynamic identity identification, can effectively improve identity confidentiality and anti-association capabilities during the authentication phase.

[0208] Step S3-2: The crowd-testing platform receives the authentication request message sent by the industrial control device. In other words, the industrial control device constructs an authentication request message and sends it to the crowd-testing platform. Specifically:

[0209] D→P:||{TID i ,X}|

[0210] Where X is the authentication binding value, which ensures that the message is sent by the industrial control device with HMAC.

[0211] The specific calculation of the authentication binding value is as follows:

[0212]

[0213] Where r2 is a random number generated by the industrial control device using a pseudo-random number generator, which is used to ensure the uniqueness and timeliness of the authentication request; Represents a bitwise exclusive OR operation;

[0214] Step S3-3: The crowd testing platform checks the temporary identity identifier (TID) of the industrial control equipment i If it does not exist, the industrial control equipment authentication request is rejected. That is, the public testing platform receives the authentication request message and first registers the data set locally. Match the corresponding temporary identity TID i If there is no match, the device authentication request is rejected.

[0215] If it exists, that is, the industrial control device identity is successfully identified, then the crowd testing platform reads the temporary identity identifier TID of the industrial control device in the local registration data set i Bound Registration Record (TID i ,C i , R i , HMAC}, and based on this, restore the random number r2 generated by the industrial control equipment, as follows:

[0216]

[0217] The public testing platform constructs an authentication response message based on the random number r2 and sends it to the industrial control device. Specifically:

[0218] P→D:|{C i ,F,Auth,TID i+1 , C i+1 ,T P}|

[0219] Where F is the authentication factor; Auth is the first authentication summary, which is used by the crowd-testing platform to reversely verify its own identity; TID i+1 A new temporary identity assigned by the crowd-testing platform to industrial control equipment to replace the old identity and prevent equipment tracking; C i+1 is the new one-time challenge value; TID i+1 with C i+1 All are generated by the platform calling the pseudo-random number generator; T P The current timestamp prevents the authentication result from being delayed and replayed;

[0220] The specific calculation of the authentication factor is as follows:

[0221]

[0222] Where r3 is the random number generated by the crowd testing platform;

[0223] The specific calculation of the first authentication summary is as follows:

[0224] Auth=SM3(r2||r3||F)

[0225] More specifically, the design of the authentication factor and summary structure makes it impossible for the crowd-testing platform to unilaterally forge a legitimate response. Since only the industrial control device itself holds the random number r2 generated in the previous session, only legitimate devices can use the C provided by the crowd-testing platform to forge a legitimate response. i Together with F, we can correctly restore the random number r3 generated by the platform and proceed with the next verification smoothly.

[0226] Step S3-4: The crowd-testing platform receives the second response message sent by the industrial control device. That is, the industrial control device receives and processes the authentication response message, verifies the identity of the crowd-testing platform, and constructs a second response message and sends it to the crowd-testing platform if the verification is successful. Specifically:

[0227] D→P:|{R i+1 ,Auth′,T D}|

[0228] The second response message sent by the industrial control device is generated by the industrial control device based on the authentication response message, specifically:

[0229] The industrial control equipment verifies the timestamp T according to the authentication response message P The freshness is as follows:

[0230] T cur -T P <Δt

[0231] Where, T cur is the current time; Δt is the maximum delay time for the response between the industrial control device and the crowd testing platform, which is usually set by system experience or synchronization strategy; this mechanism is used to resist the common delay replay scenario in man-in-the-middle attacks and ensure that the authentication response remains within the trusted time window.

[0232] After verification, the industrial control device extracts the one-time challenge value C from the authentication response message i As input, call the PUF module to restore the challenge response R sent by the industrial control equipment i ;

[0233] Subsequently, the industrial control equipment restores the random number r3 as follows:

[0234]

[0235] The industrial control device combines the locally stored random number r2 and random number r3 to calculate the second authentication digest, as follows:

[0236] Auth * =SM3(r2||r3||F)

[0237] The industrial control device compares Auth with Auth. If the two are not equal, the industrial control device fails to authenticate the crowd testing platform and the authentication process is terminated.

[0238] If the two are equal, the industrial control device constructs a second response message, the structure of which is as follows:

[0239] {R i+1 ,Auth′,T D}

[0240] Where Ri+1 The new one-time challenge value C i+1 A new challenge response is generated by the local PUF, where Auth′ is the third authentication digest; T D The current timestamp; this message is used to complete the closed-loop interaction of this round of authentication, ensuring the achievement of two-way authentication between the crowd-testing platform and the industrial control equipment, while also achieving rolling updates of the device identity, and improving the anti-correlation and long-term anonymity of the authentication process.

[0241] The third authentication summary is calculated as follows:

[0242] Auth′=SM3(r2||r3||C i ||R i )

[0243] Step S3-5: The public testing platform verifies the identity of the industrial control device based on the second response message. If the verification is successful, the authentication information held by the public testing platform and the industrial control device is updated. Specifically:

[0244] The crowd testing platform verifies the timestamp T according to the second response message D The freshness is as follows:

[0245] T′ cur -T D <Δt

[0246] Where, T cur is the current time;

[0247] Crowd-testing platform reconstructs the fourth authentication summary Auth′ * , as follows:

[0248] Auth′ * =SM3(r2||r3||C i ||R i )

[0249] The public testing platform combines Auth′ and Auth′ * Perform consistency comparison. If the two are not equal, the crowd-testing platform fails to authenticate the industrial control equipment.

[0250] If the two are equal, the crowd-testing platform successfully authenticates the industrial control device, and then records the new temporary identity and new challenge response {TID i+1 , R i+1}, after this round of conversation, the crowd testing platform will Delete the old {TID i , C i , R i ,HMAC}, save the new

[0251] More specifically: Through the above mechanism, dynamic rolling updates of device identities are achieved, effectively preventing long-term identification from being associated and tracked. At the same time, a closed-loop process of authentication process from challenge, response to status update is established, ensuring that authentication interactions have continuous anonymity and security verifiability.

[0252] Step 4: After the two-way authentication is completed, the public testing platform uses the Bloom filter and makes access permission judgments on the resource access requests initiated by the industrial control equipment based on the set of controlled resource identifiers and the corresponding permissions granted to the industrial control equipment.

[0253] In other words, this step is the resource authorization verification phase, which is used to quickly determine access rights for industrial control devices before they access specific crowd-testing platform resources (such as functional interfaces, data modules, or control channels). This is a key step in implementing refined access control and dynamic permission management on the crowd-testing platform. This phase relies on CBF to efficiently store and verify authorization information, offering significant advantages such as low time complexity, minimal space usage, and ease of concurrent access.

[0254] In one possible implementation, combining Figure 4 As shown in the figure, the crowd-testing platform uses Bloom filters and makes access permission decisions for resource access requests initiated by industrial control devices based on a set of controlled resource identifiers and the corresponding permissions granted to the industrial control devices. The specific implementation process is as follows:

[0255] Step S4-1: The crowd-testing platform receives the resource access request sent by the industrial control device. That is, the industrial control device constructs a resource access request message and initiates a resource access request to the crowd-testing platform. Specifically:

[0256] D→P:||{HAMC,AR}|

[0257] The resource identifier set that the industrial control device expects to access has the following structure:

[0258]

[0259] Where AR represents the set of resource identifiers that the industrial control equipment expects to access; RRID j Indicates the identifier of a resource that the industrial control device expects to access.

[0260] More specifically, this structure supports industrial control devices declaring access requirements for multiple target resources in a single request, making it suitable for efficient access scenarios such as batch access and parallel scheduling. By binding the industrial control device identity to the access resource set, it provides basic information for subsequent permission verification on the public testing platform, achieving fine-grained access control based on the principle of least authorization.

[0261] Step S4-2: The crowd-testing platform uses a Bloom filter to determine access permission for resource access requests initiated by industrial control equipment based on the resource access request. Specifically,

[0262] The crowd testing platform uses the resource access request and the hash function set that matches the Bloom filter to generate each resource identifier RRID in the resource identifier set AR that the industrial control device expects to access. j Construct the corresponding Bloom filter hash index set as follows:

[0263] idx i,j =h i (HMAC||RRID j ),i=1,...,γ

[0264] The crowd testing platform has a resource identifier RRID for each j The corresponding Bloom filter hash index set is queried. If the corresponding set of indexes idx in the Bloom filter hash index set is i.j , all satisfy:

[0265]

[0266] It is determined that the industrial control device has the resource identifier RRID j Access permissions for the corresponding resources.

[0267] More specifically, this access permission determination process must be executed for each resource access request, and the crowd-testing platform will not trust the access rights of industrial control equipment by default based on historical authentication status. This mechanism implements a continuous authentication process based on resource granularity, which complies with the core principles of the "zero trust security model", namely: untrusted by default, minimum authorization, and re-verification for each access. Unlike the traditional design of long-term trust by default after access authentication, this solution ensures that even if the industrial control equipment has completed identity authentication, each time it accesses resources, it still needs to re-verify the authorization conditions on the platform side, thereby effectively preventing security risks such as identity impersonation, permission abuse, and permission drift, and strengthening the dynamic verifiability of access control boundaries.

[0268] An embodiment of the present invention further provides a device for securely accessing a crowd-testing platform for industrial control equipment, which is used to implement the above-mentioned method for securely accessing a crowd-testing platform for industrial control equipment. The device includes:

[0269] The initialization module is used to initialize the crowd testing platform. The initialization includes generating public and private key pairs and configuring digital certificates, configuring Bloom filters, selecting a set of hash functions that match the Bloom filters, and building a set of controlled resource identifiers.

[0270] The registration processing module is used to receive the registration information of the industrial control device, grant corresponding permissions to the industrial control device according to the registration information and generate a minimum authorized resource set corresponding to the permissions, write the minimum authorized resource set into the Bloom filter and save the identity information of the industrial control device.

[0271] The two-way authentication module is used to perform two-way authentication between the crowd-testing platform and the industrial control equipment based on the authentication request initiated by the industrial control equipment, and dynamically update the authentication information held by the crowd-testing platform and the industrial control equipment respectively.

[0272] The access admission determination module is used to perform access admission determination on resource access requests initiated by industrial control devices using Bloom filters based on a set of controlled resource identifiers and corresponding permissions granted to the industrial control devices after two-way authentication is completed.

[0273] All relevant contents of the steps involved in the aforementioned embodiment of the method for securely accessing a crowd-testing platform for industrial control equipment can be referred to the functional description of the functional modules corresponding to the device for securely accessing a crowd-testing platform for industrial control equipment in the embodiment of the present invention, and will not be repeated here. The division of modules in the embodiment of the present invention is schematic and is only a logical functional division. There may be other division methods in actual implementation. In addition, the functional modules in the various embodiments of the present invention can be integrated into a processor, or they can exist physically separately, or two or more modules can be integrated into one module. The above-mentioned integrated modules can be implemented in the form of hardware or in the form of software functional modules.

[0274] In the present invention, the terms "one embodiment", "some embodiments", "examples", "specific examples", or "some examples" mean that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic expressions of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art can combine and combine different embodiments or examples described in this specification and the features of different embodiments or examples without contradiction.

[0275] Finally, it should be noted that the above-described embodiments are only specific implementation methods of the present invention, which are used to illustrate the technical solutions of the present invention rather than to limit them. The protection scope of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the above-mentioned embodiments, ordinary technicians in this field should understand that any technician familiar with this technical field can still modify the technical solutions recorded in the above-mentioned embodiments within the technical scope disclosed by the present invention, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered by the protection scope of the present invention.

Claims

1. A method for securely accessing an industrial control device to a crowd testing platform, characterized in that: include: Initializing the crowd testing platform, including generating a public-private key pair and configuring a digital certificate, configuring a Bloom filter, selecting a set of hash functions that match the Bloom filter, and constructing a set of controlled resource identifiers; The crowd-testing platform receives the registration information of industrial control devices, grants corresponding permissions to the industrial control devices based on the registration information, generates a minimum authorized resource set corresponding to the permissions, writes the minimum authorized resource set into the Bloom filter, and saves the identity information of the industrial control devices; Based on the authentication request initiated by the industrial control device, the public testing platform performs two-way authentication between the public testing platform and the industrial control device, and dynamically updates the authentication information held by the public testing platform and the industrial control device respectively; After the two-way authentication is completed, the crowd-testing platform uses Bloom filters and, based on the set of controlled resource identifiers and the corresponding permissions granted to the industrial control equipment, makes access permission decisions on resource access requests initiated by the industrial control equipment.

2. A method for securely accessing a crowd-testing platform for industrial control equipment according to claim 1, characterized in that: The specific implementation process of generating the public and private key pairs and configuring the digital certificate is as follows: The public testing platform executes the national secret SM2 key generation algorithm to generate a public and private key pair (p k P , s k P ), as follows: SM2.KeyGen(1 λ )→(sk P ,pk P ) The public-private key pair (pk P ,sk P ) satisfies the following relationship: pk P =[en P ]G Where λ represents the security parameter, SM2.KeyGen(·) is the key generation algorithm in the SM2 elliptic curve cryptosystem, and sk P It is the private key of the public testing platform, pk P It is the public key of the crowd testing platform. G is the base point defined by the SM2 elliptic curve, [sk P ]G represents scalar multiplication on the SM2 elliptic curve; The public testing platform will pk the public testing platform public key P Submit to an authoritative digital certificate authority for signature and obtain a digital certificate Cert P ; The Bloom filter configuration and the selection of a set of hash functions that match the Bloom filter are specifically implemented as follows: The Bloom filter adopts a counting Bloom filter; The crowd testing platform initializes the counting Bloom filter, initializes all counting units to 0, and predefines the hash function set H required by the counting Bloom filter = {h1, h2, ...h γ }, each hash function satisfies the following mapping form: h i :{0,1} * →[0, n-1], i=1, 2,...c Where η is the bitmap length of the counting Bloom filter, and γ is the number of hash functions; The specific implementation process of constructing the controlled resource identifier set is as follows: The crowd testing platform predefines a set of controlled resource identifiers that can be accessed by industrial control equipment The details are as follows: Where RID i Indicates the identifier corresponding to a controlled resource, and n indicates the number of controlled resources.

3. The method for securely accessing a crowd-testing platform for industrial control equipment according to claim 2, characterized in that: The crowd-testing platform receives the registration information of the industrial control device, grants the corresponding permissions to the industrial control device according to the registration information, generates a minimum authorized resource set corresponding to the permissions, and writes the minimum authorized resource set into the Bloom filter. The specific implementation process is as follows: Step S2-1: The industrial control device and the crowd-testing platform negotiate to generate a temporary session key based on the SM2-ECDH protocol. Specifically: Industrial control equipment receives digital certificate Cert from the public testing platform P , and complete signature verification to confirm the identity of the crowd testing platform; The industrial control device calls the PUF module to derive the temporary private key of the industrial control device and generate the temporary private key of the industrial control device And calculate the temporary public key of the corresponding industrial control equipment based on the elliptic curve point multiplication rule The details are as follows: The crowd testing platform runs the SM2.KeyGen(·) algorithm to generate a temporary key pair for the crowd testing platform. The crowd testing platform and the industrial control equipment exchange their respective temporary public keys, and the industrial control equipment uses and Use of crowd testing platform and Execute the SM2-ECDH protocol to generate the temporary session key K, as follows: Wherein, ECDH is a key agreement protocol based on elliptic curve; Step S2-2: The crowd testing platform receives the registration request message sent by the industrial control device, specifically: D→P:|{Manu,Func,Usage,HMAC} In the formula, Manu represents the manufacturer identifier of the industrial control device; Func represents the functional type of the industrial control device; Usage represents the intended use or deployment scenario of the industrial control device; HMAC represents the industrial control device identifier, HMAC = SM3(MAC), MAC represents the MAC address of the industrial control device; |·| represents the message encrypted using a temporary session key by SM4; D represents the industrial control device; and P represents the crowd testing platform. Step S2-3: The crowd testing platform determines whether the industrial control device is allowed to be registered based on the access rules and the registration request message. If allowed, a registration response message is constructed and sent to the industrial control device. Specifically: P→D:|{TIME i ,C i }| In the formula, TID i Temporary identification for industrial control equipment; C i It is a one-time challenge value; TID i with C i All are generated by calling the pseudo-random number generator on the crowd-testing platform; Step S2-4: The crowd-testing platform receives the first response message sent by the industrial control device, specifically: D→P:|R i | The first response message sent by the industrial control device is generated by the industrial control device based on the registration response message, specifically: R i =PUF(C i ) Where R i Challenge response sent by industrial control equipment; Step S2-5: The crowd-testing platform grants the industrial control device corresponding permissions based on the registration request message and the preset authorization policy and generates the minimum authorized resource set corresponding to the permissions, specifically: Where RE is the minimum authorized resource set; ARID j The unique identifier of the jth controlled resource; Step S2-6: The crowd testing platform generates a unique identifier ARID for each controlled resource in the minimum authorized resource set RE. j Connect with the HMAC of the industrial control equipment and perform hashing, calling the hash function set H = {h1, h2, ..., h γ }, calculate the index position of the unique identifier of the controlled resource in the counting Bloom filter as follows: idx i，j =h i (HMAC||ARID j ),i=1,...,γ In the formula, || represents the connection operation; The crowd-testing platform writes the minimum authorized resource set of the industrial control device into the counting Bloom filter according to the index position, as follows: CBF[idx i,j ]←CBF[idx i,j ]+1。 4. The method for securely accessing a crowd-testing platform for industrial control equipment according to claim 3, characterized in that: The industrial control device calls the PUF module to derive the temporary private key of the industrial control device and generate a temporary private key of the industrial control device. Specifically: The industrial control device uses a pseudo-random number generator to generate a random number r1, inputs the random number r1 into the PUF module, and obtains a unique response σ = PUF(r1). The unique response is then processed using a key derivation function to generate a temporary private key for the industrial control device, as follows: Where KDF(·) is the key derivation function.

5. The method for securely accessing a crowd-testing platform for industrial control equipment according to claim 3, characterized in that: The key agreement protocol based on elliptic curve is specifically as follows: The crowd-testing platform and the industrial control equipment each use their own temporary private key and the other party's temporary public key to perform a point multiplication operation to calculate the shared point P = sk·pk, extract the horizontal coordinate from the shared point P, and pass the horizontal coordinate as input to the key derivation function to generate a temporary session key K of a fixed length.

6. The method for securely accessing a crowd-testing platform for industrial control equipment according to claim 4, characterized in that: The specific implementation process of saving the identity information of the industrial control equipment is as follows: The public testing platform saves the identity information of the industrial control device based on the first response message and registration request message sent by the industrial control device. Specifically: Where, It is a collection of local registration data for the crowd testing platform.

7. The method for securely accessing a crowd-testing platform for industrial control equipment according to claim 6, characterized in that: The crowd-testing platform performs two-way authentication between the crowd-testing platform and the industrial control device based on the authentication request initiated by the industrial control device, and dynamically updates the authentication information held by the crowd-testing platform and the industrial control device respectively. The specific implementation process is as follows: Step S3-1: The industrial control device and the crowd-testing platform negotiate to generate a new round of temporary session key K′ based on the SM2-ECDH protocol; Step S3-2: The public testing platform receives the authentication request message sent by the industrial control equipment, specifically: D→P:|{TIME i ,X}| Where X is the authentication binding value; r2 is the random number generated by the industrial control device using a pseudo-random number generator; Represents a bitwise exclusive OR operation; Step S3-3: The crowd testing platform checks the temporary identity identifier (TID) of the industrial control equipment i If it does not exist, the industrial control equipment authentication request is rejected; if it exists, the temporary identity TID of the industrial control equipment is read from the local registration data set. i Bound Registration Record {TID i , C i , R i , HMAC}, and based on this, restore the random number r2 generated by the industrial control equipment, as follows: The public testing platform constructs an authentication response message based on the random number r2 and sends it to the industrial control device. Specifically: P→D:|{C i ,F,Auth,TID i+1 ,C i+1 T P }| Auth=SM3(r2||r3||F) Where F is the authentication factor; Auth is the first authentication summary; TID i+1 A new temporary identity assigned by the crowd-testing platform to industrial control equipment; C i+1 is the new one-time challenge value; TID i+1 with C i+1 All are generated by the platform calling the pseudo-random number generator; T P is the current timestamp; r3 is the random number generated by the crowd testing platform; Step S3-4: The crowd-testing platform receives the second response message sent by the industrial control device, specifically: D→P:|{R i+1 ,Auth′,T D }| The second response message sent by the industrial control device is generated by the industrial control device based on the authentication response message, specifically: The industrial control equipment verifies the timestamp T according to the authentication response message P The freshness is as follows: T cur -T P <Δt Where, T cur is the current time; Δt is the maximum response delay between the industrial control equipment and the crowd testing platform; After verification, the industrial control device extracts the one-time challenge value C from the authentication response message i As input, call the PUF module to restore the challenge response R sent by the industrial control equipment i ; The industrial control equipment restores the random number r3 as follows: The industrial control device combines the locally stored random number r2 and random number r3 to calculate the second authentication digest, as follows: <h2 style=";text-align:left;direction:ltr">Auth<h2 style=";text-align:left;direction:ltr"> * <h2 style=";text-align:left;direction:ltr"> =SM3(r2||r3||F) Industrial control equipment will use Auth and Auth * A comparison is performed. If the two are not equal, the industrial control equipment fails to authenticate the crowd testing platform and the authentication process is terminated. If the two are equal, the industrial control device constructs a second response message, the structure of which is as follows: {R i+1 Auth′,T D } Auth′=SM3(r2||r3||C i ||R i ) Where R i+1 The new one-time challenge value C i+1 A new challenge response is generated by the local PUF, where Auth′ is the third authentication digest; T D is the current timestamp; Step S3-5: The crowd-testing platform verifies the identity of the industrial control device according to the second response message. If the verification is successful, the authentication information held by the crowd-testing platform and the industrial control device is updated.

8. The method for securely accessing an industrial control device to a crowd-testing platform according to claim 7, characterized in that: The crowd-testing platform verifies the identity of the industrial control device according to the second response message. If the verification is successful, the authentication information held by the crowd-testing platform and the industrial control device is updated. Specifically, The crowd testing platform verifies the timestamp T according to the second response message D The freshness is as follows: T′ cur -T D <Δt Where, T cur is the current time; Crowd-testing platform reconstructs the fourth authentication summary Auth′ * , as follows: Auth′ * =SM3(r2||r3||C i ||R i ) The public testing platform combines Auth′ and Auth′ * Perform consistency comparison. If the two are not equal, the crowd-testing platform fails to authenticate the industrial control equipment. If the two are equal, the crowd-testing platform successfully authenticates the industrial control device, and then records the new temporary identity and new challenge response {TID i+1 , R i+1 }, after this round of conversation, the crowd testing platform will Delete the old {TID i , C i , R i , HMAC}, save the new 9. The method for securely accessing a crowd-testing platform for industrial control equipment according to claim 3, characterized in that: The crowd-testing platform uses a Bloom filter and, based on a set of controlled resource identifiers and the corresponding permissions granted to the industrial control devices, performs access permission determination on resource access requests initiated by the industrial control devices. The specific implementation process is as follows: Step S4-1: The crowd-testing platform receives a resource access request from the industrial control device, specifically: D→P:|{HAMC,AR}| Where AR represents the set of resource identifiers that the industrial control equipment expects to access; RRID j Indicates the identifier of a resource that the industrial control device expects to access; Step S4-2: The crowd-testing platform uses a Bloom filter to determine access permission for resource access requests initiated by industrial control equipment based on the resource access request. Specifically, The crowd testing platform uses the resource access request and the hash function set that matches the Bloom filter to generate each resource identifier RRID in the resource identifier set AR that the industrial control device expects to access. j Construct the corresponding Bloom filter hash index set as follows: idx i,j =h i (HMAC||RRID j ),i=1,...,γ The crowd testing platform has a resource identifier RRID for each j The corresponding Bloom filter hash index set is queried. If the corresponding set of indexes dix in the Bloom filter hash index set is i，j , all satisfy: It is determined that the industrial control device has the resource identifier RRID j Access permissions for the corresponding resources.

10. A device for securely accessing a crowd-testing platform for industrial control equipment, characterized in that: include: An initialization module, used for initializing the crowd-testing platform, including generating public and private key pairs and configuring digital certificates, configuring Bloom filters, selecting a set of hash functions that match the Bloom filters, and constructing a set of controlled resource identifiers; A registration processing module is used to receive the registration information of the industrial control device, grant corresponding permissions to the industrial control device based on the registration information and generate a minimum authorized resource set corresponding to the permissions, write the minimum authorized resource set into the Bloom filter and save the identity information of the industrial control device; The two-way authentication module is used to perform two-way authentication between the public testing platform and the industrial control device based on the authentication request initiated by the industrial control device, and dynamically update the authentication information held by the public testing platform and the industrial control device respectively; The access admission determination module is used to perform access admission determination on resource access requests initiated by industrial control devices using Bloom filters based on a set of controlled resource identifiers and corresponding permissions granted to the industrial control devices after two-way authentication is completed.

Images