A lightweight industrial control process attack and defense simulation method for security environment

Abstract

A lightweight industrial control process attack and defense simulation method for a security protection environment belongs to both the field of industrial control and the field of information security. Aiming at information security incidents of industrial control systems, the present invention designs a security analysis method for lightweight simulation of attack and defense confrontation of industrial control systems for level protection based on information flow analysis and access control. This method takes the business process as the protection object, abstracts the business process into a combination of information flow and computing logic, builds a simulation scenario, and constructs a security deduction scenario similar to "war chess" through abstract simulation of attack mechanism and defense mechanism in this scenario, and judges the security status of the system through attack and defense deduction. This method can simulate the attack and defense confrontation status of the system from the information flow level, and deduce the real security threats and protection effects faced by the system.

Description

Technical Field

[0001] Aiming at information security incidents in industrial control systems, the present invention designs a lightweight industrial control process attack and defense simulation method for a security protection environment based on information flow analysis and access control. This method takes the business process as the protection object, abstracts the business process into a combination of information flow and computing logic, builds a simulation scenario, and constructs a security deduction scenario similar to "war chess" through abstract simulation of attack mechanism and defense mechanism in this scenario, and judges the security status of the system through attack and defense deduction. This method can simulate the attack and defense confrontation status of the system from the information flow level, and deduce the real security threats and protection effects faced by the system. It belongs to both the field of industrial control and the field of information security. Background Art

[0002] Industrial control systems are the core of modern industrial infrastructure and are widely used in the fields of petroleum, petrochemicals, electricity, rail transportation, etc. The attacks faced by industrial control systems around the world are endless, so it is imperative to strengthen network information security construction, solve security protection problems, and improve industrial security protection capabilities. Therefore, the research results of this invention have broad application prospects.

[0003] Industrial control systems belong to information-physical fusion systems and are closely connected to the physical world. Their primary goal is to ensure the stable operation of the system, that is, to follow the principles of availability, integrity, and confidentiality. Industrial control systems have relatively fixed processes, strong real-time communication, diversified communication protocols, systems that are not allowed to be easily restarted, systems that are not allowed to be updated and patched at will, proprietary hardware and software, and equipment with a long life cycle and difficult access. Attack and defense testing of target systems can better study and analyze network security incidents to effectively defend against them. It is an intuitive and effective security testing method. If vulnerability analysis and attack and defense confrontation testing are performed directly on an already used industrial control system, the attack results are difficult to predict, and there is a possibility of irreparable and unrecoverable damage to the system, causing serious losses and excessive costs. However, the cost of the simulation environment is high, and the universality of the network target range is low. Therefore, seeking a low-cost attack and defense simulation environment is an urgent problem to be solved, which has important practical significance.

[0004] Common security analysis methods for network systems include situational awareness methods, formal methods, and simulated real environment testing. Situational awareness technology is mainly achieved by collecting information such as network raw data and dynamic security data generated by system operation, and then analyzing the data in real time. At present, situational awareness mainly relies on mechanisms such as intrusion detection and vulnerability scanning, which is inconsistent with the requirements of security protection. Formal methods are effective means of using mathematical methods to verify the correctness and vulnerability of the system from the source. This method can demonstrate security more strictly, but because the research process is too complicated, it is generally used in relatively simple scenarios and is not suitable for handling complex scenarios. Simulating a real environment is a test method that simulates attacks and defenses on the test end before it is attacked by a real network attack. By detecting and evaluating the attack and defense effects of the tested end, and proposing security improvement plans, the possibility of the system being attacked and the resulting impact can be reduced, but there are problems of high cost and low versatility.

[0005] According to the security requirements and technical characteristics of the multi-level protection system, the present invention proposes a lightweight industrial control process attack and defense simulation method for the multi-level protection environment. This method takes the business process as the protection object, considers the goals of flexibility, low cost and versatility, abstracts the business process into a combination of information flow and computing logic, builds an attack and defense simulation scenario for the industrial control system, and simulates the attack mechanism and defense mechanism in this scenario through abstract simulation. This method can simulate the attack and defense confrontation of the system from the information flow level, verify the effectiveness of the system defense mechanism and defense strategy, and check the defense capability of the defense mechanism against unknown vulnerabilities. This method has practical significance for promoting the multi-level protection of industrial control systems, and assisting the design of multi-level protection schemes and the formulation of strategies. Summary of the invention

[0006] The present invention obtains a lightweight industrial control process attack and defense simulation method for a security protection environment. The method builds a simulation environment by lightweight simulating the information flow of the industrial control application process, and simulates both attack and defense aspects: the vulnerabilities of the industrial control system are modeled according to their impact range, and the attacker is authorized based on the modeling to simulate the attack; in accordance with the requirements of the network security level protection system, a depth defense mechanism is deployed for the information flow, and a security policy is set to simulate the defense, and the effect of the attack and defense confrontation is verified through the application process, so as to complete the attack and defense test in the simulation environment, and achieve the purpose of low-cost and universal simulation of the attack and defense confrontation of the industrial control system.

[0007] The present invention adopts the following technical solutions and implementation steps:

[0008] A lightweight industrial control process attack and defense simulation method for security environment

[0009] Based on the existing network attack and defense knowledge, we try to infer the system security status and the effectiveness of the security protection scheme through a lightweight simulation method. By building an environment that simulates the real industrial control application scenario, vulnerabilities and security protection mechanisms are introduced into the simulation environment, and the attack behavior is simulated by authorizing the attacker to map the attack and defense in the real industrial control system. The effect of the attack and defense confrontation is verified through the application process, so as to complete the attack and defense test in the simulation environment.

[0010] It is characterized by comprising the following steps:

[0011] (1) Application scenarios designed for attack and defense simulation of industrial control systems:

[0012] The Cube framework is used to simulate real industrial control application scenarios. The application process in the scenario is used as the analysis object, the node security attributes are abstracted, and the simulation environment is built by simulating the information flow of the industrial control application process.

[0013] Application process selection and decomposition: Select a specific application process in the industrial control system application scenario to be simulated, decompose this application process into multiple sub-processes as the analysis object, and establish a set of instances in the Cube architecture, each instance corresponding to a sub-process.

[0014] Modular implementation of sub-processes: In each instance, the sub-process is further decomposed into sub-process fragments, and different modules and module combinations are used to implement the process fragments.

[0015] Message routing configuration of application process: Set up message routing, connect the sub-process fragments simulated by the module in the instance together to form a sub-process, and then connect the sub-process simulated by the instance together to form an application process.

[0016] Design input messages and test them: Design input messages that conform to the application process and enter them into the message input module of the application process to ensure that they are consistent with the application process expectations.

[0017] (2) Design a method for introducing the specific vulnerability to be simulated into the application scenario:

[0018] ① The vulnerabilities in industrial control systems include known vulnerabilities and unknown vulnerabilities. The relevant information of the vulnerabilities, including the principles, classifications, overall trends, main exploit locations, and threats caused by the vulnerabilities, as well as several major types of attacks on industrial control systems, the scope of attack impact, and vulnerability exploitation, is analyzed in multiple dimensions, and the vulnerabilities and attacks are described;

[0019] Known vulnerability library: For known vulnerabilities, a known vulnerability library can be established based on the vulnerability information of industrial control systems included in the CVE vulnerability library.

[0020] Unknown vulnerability library: An unknown vulnerability library is established by analyzing some industrial control systems. For example, a system may have a vulnerability in the program or kernel. The cause, exploitation method, and impact range of the vulnerability are analyzed and described, and this information is added to the unknown vulnerability library.

[0021] ② Vulnerability analysis model used to establish an industrial control vulnerability library:

[0022] The vulnerability is simulated by opening regional node permissions in the Cube instance, so the vulnerability analysis strategy of the industrial control system is to describe the vulnerability through the binary tuple of the vulnerability's impact range and the permissions opened on the node. The symbolic representation of the vulnerability analysis model is:

[0023] P = {<R,A>} (1)

[0024] Vulnerability P consists of its impact scope and open permissions, i.e., a binary<R,A> Describe as follows, where R = {R1, R2, R3 ... Rn} represents the set of system partition areas, A = {A1, A2, A3 ... An} represents the set of node open permissions, and n ≥ 0 in the above set.

[0025] Due to the variety of attack methods, different attack methods using the same vulnerability will have different impact ranges. A certain vulnerability may require multiple permissions to be opened to simulate, and the impact range may involve many areas in the industrial control system. For example: vulnerability P exists in areas R1 and R2, and requires permissions A1 and A2, then vulnerability P = {<(R1UR2), (A1UA2)>}.

[0026] ③ Methods for introducing specific vulnerabilities to be simulated into application scenarios:

[0027] According to the specific vulnerability P we want to simulate, we compare it with the industrial control vulnerability library established by formula (1), lock the vulnerability's impact range R and open permissions A, simulate the vulnerability by opening regional node permissions, and introduce the vulnerability P into the simulation environment. The attacker uses the vulnerability P introduced in the simulation environment to attack the system and perform attack simulation.

[0028] (3) Design of security protection mechanism for industrial control system defense simulation:

[0029] Defense simulation mainly simulates defense mechanisms such as access control, trusted computing, and password protection required by the security protection system, and manages these defense mechanisms in a unified manner through a security management center. The management method of the security management center is to collect audit information of each defense mechanism for analysis and issue policies to each defense mechanism. The method of accessing the defense mechanism to the business process is similar to the attack mechanism, and measures such as replication and interception are also taken to add security mechanisms to the message routing of the simulated business process. The simulation methods of different security mechanisms are described below:

[0030] ① Password mechanism

[0031] When simulating the data encryption mechanism, add aspect routing to intercept messages at both ends of the encryption channel, encrypt the intercepted messages at the encryption end, and decrypt the encrypted messages at the decryption end. The encryption and decryption ends implement key exchange through a separately defined key management mechanism and key management message routing. In this way, attackers in the encryption channel will not be able to eavesdrop on the information. The implementation method is similar when simulating the data signature verification mechanism.

[0032] ②Access control mechanism

[0033] When simulating the access control mechanism, the transmitted message is copied and intercepted at the location of the system vulnerability. The copied message is forwarded to the monitoring module, and the monitoring module analyzes the information to simulate the monitoring behavior of the system. After intercepting the message, the message content can be marked according to the monitoring results, marking the attributes of the message content (object attributes) and the attributes of the message operator (subject attributes). The access control mechanism implements the access control operation according to the security tag and access control policy, where the message extension provides the addition of security tags for the message, and the security tags and access control policies are connected to the message routing of the instance through the aspect routing.

[0034] ③Trust measurement mechanism

[0035] When simulating the trusted measurement mechanism, add aspect routing to intercept messages at each instance, obtain the subject and object information in the message, and summarize and analyze it with historical records to perform trusted measurement. After trusted measurement, access control or audit operations can be performed based on the measurement results.

[0036] (4) After the business process and attack and defense simulation are ready, the attacker and defender can enter the scene to conduct attack and defense confrontation drills. During the drill, both parties select appropriate locations to deploy attack points and defense mechanisms, program the attack and defense logic of the attack points and defense mechanisms, configure the attack and defense message routing, implement the attack and defense execution process, and simulate the business process in the environment where the attack and defense mechanism is deployed to observe the attack and defense confrontation effect. After that, both parties can modify the attack and defense plan and conduct the next round of attack and defense simulation.

[0037] The creativity of the present invention is mainly reflected in:

[0038] (1) The present invention aims to solve the information security problem of industrial control systems and improve security protection capabilities. The method of simulating the attack and defense confrontation of industrial control systems is used to realize the abstract simulation of attack mechanisms and defense mechanisms, and the security status of the system is judged through attack and defense deduction. The attack and defense confrontation status of the system can be simulated from the information flow level, and the real security threats and protection effects faced by the system can be deduced.

[0039] (2) The present invention aims at the requirements of level protection for network system security defense. It uses a lightweight method with a small amount of computer resources and can simulate various application scenarios at low cost, analyze the security of applications and try the effects of different security improvement solutions. It also has the advantages of being universal and flexible.

[0040] (3) Based on the present invention, a safe and reliable systematic attack and defense confrontation can be carried out under various preset conditions, and the defense capability of the system can be evaluated through confrontation to find a better defense method. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 This is the industrial control application process simulation process diagram of the present invention

[0042] Figure 2 This is a vulnerability analysis flow chart of the industrial control system of the present invention

[0043] Figure 3 This is the in-depth defense system architecture diagram of the industrial control system of the present invention

[0044] Figure 4 It is the business process node state diagram of the present invention

[0045] Figure 5 It is the node state diagram of the attack mechanism of the present invention

[0046] Figure 6 This is the node status result diagram of the industrial control system attack and defense drill of the present invention DETAILED DESCRIPTION

[0047] The present invention obtains a lightweight industrial control process attack and defense simulation method for a security protection environment. The method builds a simulation environment by simulating the information flow of the industrial control application process, and simulates both attack and defense aspects: the vulnerabilities of the industrial control system are modeled according to their impact range, and the attacker is authorized based on the modeling to simulate the attack; in accordance with the requirements of the network security level protection system, a depth defense mechanism is deployed for the information flow, and a security policy is set to simulate the defense, and the effect of the attack and defense confrontation is verified through the application process, so as to complete the attack and defense test in the simulation environment, and achieve the purpose of low-cost and universal simulation of the attack and defense confrontation of the industrial control system.

[0048] The present invention adopts the following technical solutions and implementation steps:

[0049] (1) Application scenarios designed for attack and defense simulation of industrial control systems:

[0050] The Cube framework is used to simulate the real industrial control application scenario. The application process in the scenario is used as the analysis object, the node security attributes are abstracted, and the simulation environment is built by simulating the information flow of the industrial control application process. Figure 1 .

[0051] Application process selection and decomposition: Select a specific application process in the industrial control system application scenario to be simulated, decompose this application process into multiple sub-processes as the analysis object, and establish a set of instances in the Cube architecture, each instance corresponding to a sub-process.

[0052] Modular implementation of sub-processes: In each instance, the sub-process is further decomposed into sub-process fragments, and different modules and module combinations are used to implement the process fragments.

[0053] Message routing configuration of application process: Set up message routing, connect the sub-process fragments simulated by the module in the instance together to form a sub-process, and then connect the sub-process simulated by the instance together to form an application process.

[0054] Design input messages and test them: Design input messages that conform to the application process and enter them into the message input module of the application process to ensure that they are consistent with the application process expectations.

[0055] (2) Design a method for introducing the specific vulnerability to be simulated into the application scenario:

[0056] ① The vulnerabilities in industrial control systems include known vulnerabilities and unknown vulnerabilities. The relevant information of the vulnerabilities, including the principles, classifications, overall trends, main exploit locations, and threats caused by the vulnerabilities, as well as several major types of attacks on industrial control systems, the scope of attack impact, and vulnerability exploitation, is analyzed in multiple dimensions, and the vulnerabilities and attacks are described;

[0057] Known vulnerability library: For known vulnerabilities, a known vulnerability library can be established based on the vulnerability information of industrial control systems included in the CVE vulnerability library.

[0058] Unknown vulnerability library: An unknown vulnerability library is established by analyzing some industrial control systems. For example, a system may have a vulnerability in the program or kernel. The cause, exploitation method, and impact range of the vulnerability are analyzed and described, and this information is added to the unknown vulnerability library.

[0059] ② Vulnerability analysis model used to establish an industrial control vulnerability library:

[0060] The vulnerability is simulated by opening regional node permissions in the Cube instance, so the vulnerability analysis strategy of the industrial control system is to describe the vulnerability through the binary tuple of the vulnerability's impact range and the permissions opened on the node. The symbolic representation of the vulnerability analysis model is:

[0061] P = {<R,A>} (1)

[0062] Vulnerability P consists of its impact scope and open permissions, i.e., a binary<R,A> Describe as follows, where R = {R1, R2, R3 ... Rn} represents the set of system partition areas, A = {A1, A2, A3 ... An} represents the set of node open permissions, and n ≥ 0 in the above set.

[0063] Due to the variety of attack methods, different attack methods using the same vulnerability will have different impact ranges. A certain vulnerability may require multiple permissions to be opened to simulate, and the impact range may involve many areas in the industrial control system. For example: vulnerability P exists in areas R1 and R2, and requires permissions A1 and A2, then vulnerability P = {<(R1UR2), (A1UA2)>}.

[0064] ③ Methods for introducing specific vulnerabilities to be simulated into application scenarios:

[0065] According to the specific vulnerability P we want to simulate, we compare it with the industrial control vulnerability library established by formula (1), lock the vulnerability's impact range R and open permissions A, simulate the vulnerability by opening regional node permissions, and introduce the vulnerability P into the simulation environment. The attacker uses the vulnerability P introduced in the simulation environment to attack the system and perform attack simulation. Figure 2 The vulnerability analysis process of industrial control system is given.

[0066] (3) Design of security protection mechanism for industrial control system defense simulation:

[0067] Defense simulation mainly simulates the access control, trusted computing, password protection and other defense mechanisms required by the security system, and manages these defense mechanisms in a unified manner through a security management center. The management method of the security management center is to collect audit information of each defense mechanism for analysis and issue policies to each defense mechanism. The method of defense mechanism accessing the business process is similar to the attack mechanism, and measures such as replication and interception are also taken to add security mechanisms to the message routing of the simulated business process. Figure 3 .

[0068] ① Password mechanism

[0069] When simulating the data encryption mechanism, add aspect routing to intercept messages at both ends of the encryption channel, encrypt the intercepted messages at the encryption end, and decrypt the encrypted messages at the decryption end. The encryption and decryption ends implement key exchange through a separately defined key management mechanism and key management message routing. In this way, attackers in the encryption channel will not be able to eavesdrop on the information. The implementation method is similar when simulating the data signature verification mechanism.

[0070] ②Access control mechanism

[0071] When simulating the access control mechanism, the transmitted message is copied and intercepted at the location of the system vulnerability. The copied message is forwarded to the monitoring module, and the monitoring module analyzes the information to simulate the monitoring behavior of the system. After intercepting the message, the message content can be marked according to the monitoring results, marking the attributes of the message content (object attributes) and the attributes of the message operator (subject attributes). The access control mechanism implements the access control operation according to the security tag and access control policy, where the message extension provides the addition of security tags for the message, and the security tags and access control policies are connected to the message routing of the instance through the aspect routing.

[0072] ③Trust measurement mechanism

[0073] When simulating the trusted measurement mechanism, add aspect routing to intercept messages at each instance, obtain the subject and object information in the message, and summarize and analyze it with historical records to perform trusted measurement. After trusted measurement, access control or audit operations can be performed based on the measurement results.

[0074] (4) In the normal business process of the industrial control application scenario, deploy the attack mechanism on the node and observe the node status; then deploy the defense mechanism; after the attack and defense simulation is ready, the attacker and defender can enter the scene to conduct the attack and defense confrontation drill. During the drill, both parties select appropriate locations to deploy the attack point and defense mechanism, program the attack and defense logic of the attack point and defense mechanism, configure the attack and defense message routing, implement the attack and defense execution process, and simulate the business process in the environment where the attack and defense mechanism is deployed to observe the attack and defense confrontation effect. After that, both parties can modify the attack and defense plan and conduct the next round of attack and defense simulation.

[0075] Figure 4 When the business process of the industrial control system is running normally, an attack mechanism is added. From the status diagram of each node, it can be found that the nodes in the system process are affected, and 4 nodes are in abnormal status. A total of 30 nodes are set (among which, solid circles represent nodes in normal status, X represents nodes that are successfully attacked, and hollow circles represent nodes where the defense mechanism successfully prevents the attack). Figure 5 This is the result of the continuous attack when no defense mechanism is set. There are 21 nodes in abnormal status. Figure 6 After adding the defense mechanism, 6 nodes were in an abnormal state. It can be found that after the defense mechanism was deployed on the nodes, the attack was significantly resisted and the business process was protected. The attack and defense process was repeatedly deduced, and the results proved the effectiveness of the method. The deployment of the simulation environment used fewer computer nodes, and different simulation environments could be deployed according to different industrial control application scenarios. The lightweight architecture was adopted to achieve the purpose of low cost and versatility.

Claims

1. A lightweight industrial control process attack and defense simulation method for a security protection environment, characterized by The following steps are involved: (1) Application scenarios designed for attack and defense simulation of industrial control systems: Use the Cube framework to simulate real industrial control application scenarios; The application process in the scenario is taken as the analysis object, the node security attributes are abstracted, and the simulation environment is built by simulating the information flow of the industrial control application process; Application process selection and decomposition: Select a specific application process in the industrial control system application scenario to be simulated, decompose this application process into multiple sub-processes as the analysis object, and establish a group of instances in the Cube architecture, each instance corresponding to a sub-process; Modular implementation of sub-processes: In each instance, the sub-process is further decomposed into sub-process fragments, and different modules and module combinations are used to implement the process fragments; Message routing configuration of application process: set up message routing, connect the sub-process fragments simulated by the module in the instance together to form a sub-process, and then connect the sub-process simulated by the instance together to form an application process; Design input messages and test them; (2) Design a method for introducing the specific vulnerability to be simulated into the application scenario: ① The vulnerabilities in the industrial control system include known vulnerabilities and unknown vulnerabilities. The relevant information of the vulnerabilities, including the principle, classification, overall trend, exploitation location, and threats caused by the vulnerabilities, as well as the attack methods, attack impact scope and vulnerability exploitation of the industrial control system, are analyzed in multiple dimensions, and the vulnerabilities and attacks are described; Known vulnerability library: For known vulnerabilities, a known vulnerability library is established based on the vulnerability information of industrial control systems included in the CVE vulnerability library; Unknown vulnerability library: Establish an unknown vulnerability library by analyzing some industrial control systems. ② Vulnerability analysis model used to establish an industrial control vulnerability library: The vulnerability is simulated by opening regional node permissions in the Cube instance. Therefore, the vulnerability analysis strategy of the industrial control system is to describe the vulnerability through the binary tuple of the vulnerability's impact range and the permissions opened on the node. The symbolic representation of the vulnerability analysis model is: P = {<R,A>} (1) Vulnerability P consists of its impact scope and open permissions, i.e., a binary<R,A> Describe, where R = {R1, R2, R3 ... Rn} represents the set of system partition areas, A = {A1, A2, A3 ... An} represents the set of node open permissions, and n ≥ 0 in the above set; ③ Methods for introducing specific vulnerabilities to be simulated into application scenarios: According to the vulnerability P to be simulated, the industrial control vulnerability library established by formula (1) is compared, the impact range R of the vulnerability and the open permission A are locked, and the vulnerability is simulated by opening the regional node permissions, and the vulnerability P is introduced into the simulation environment; the attacker uses the vulnerability P introduced in the simulation environment to attack the system and perform attack simulation; (3) Design of security protection mechanism for industrial control system defense simulation: Defense simulation simulates the access control, trusted computing and password protection required by the security protection system, and manages these defense mechanisms in a unified manner through a security management center. The management method of the security management center is to collect audit information of each defense mechanism for analysis and issue strategies to each defense mechanism; The method of accessing the defense mechanism to the business process is also to copy and intercept the transmitted messages, and add security mechanisms to the message routing of the simulated business process; the simulation methods of different security mechanisms are described below: ① Password mechanism When simulating the data encryption mechanism, add aspect routing to intercept messages at both ends of the encryption channel, encrypt the intercepted messages at the encryption end, and decrypt the encrypted messages at the decryption end. The encryption and decryption ends implement key exchange through a separately defined key management mechanism and key management message routing. In this way, attackers in the encryption channel will not be able to eavesdrop on information. The implementation method is similar when simulating the data signature verification mechanism. ②Access control mechanism When simulating the access control mechanism, the transmitted messages are copied and intercepted at the vulnerable locations of the system; the copied messages are forwarded to the monitoring module, which analyzes the information to simulate the monitoring behavior of the system; After intercepting the message, the message content is marked according to the monitoring results, and the attributes of the message content and the message operator are marked. The access control mechanism implements the access control operation according to the security tag and access control policy. The extension of the message provides the addition of security tags for the message. The security tags and access control policies are connected to the message routing of the instance through the aspect routing. ③Trustworthy measurement mechanism When simulating the trusted measurement mechanism, add a facet routing to intercept messages at each instance, obtain the subject and object information in the message, and summarize and analyze it with historical records to perform trusted measurement. After trusted measurement, perform access control or audit operations based on the measurement results. (4) After the business process and attack and defense simulation are ready, the attacker and defender enter the scene to conduct an attack and defense confrontation drill. During the drill, both parties deploy attack points and defense mechanisms, program the attack and defense logic of the attack points and defense mechanisms, configure the attack and defense message routing, implement the attack and defense execution process, and simulate the business process in the environment where the attack and defense mechanism is deployed to observe the attack and defense confrontation effect. After that, both parties modify the attack and defense plan and conduct the next round of attack and defense simulation.

Images