A numerical control system security protection method and device based on a national secret algorithm

Abstract

The application discloses a kind of based on national secret algorithm's numerical control system security protection method and device, it is related to the information security technical field of numerical control system.It includes: the construction numerical control equipment security module;Numerical control network boundary security module is constructed;Numerical control system software security module is constructed;Numerical control system data security module is constructed;Based on national secret algorithm, numerical control equipment security module, numerical control network boundary security module, numerical control system software security module and numerical control system data security module, numerical control system is carried out security protection.The application proposes a kind of based on national secret algorithm's numerical control system security protection system, security protection points include equipment security, network boundary protection security, system software security, data security etc..Realize that commercial code is applied in depth in multiple links of numerical control system, and successfully expand the application of commercial code security technology in numerical control system.

Claims

1. A security protection method for CNC systems based on national cryptographic algorithms, characterized in that, The method includes: S1. Construct a safety module for CNC equipment, the safety module for CNC equipment including a field control equipment safety unit and a storage media safety unit; Among them, the field control equipment security unit is used to achieve the security and trustworthiness of field control equipment based on national cryptographic algorithms by using built-in security embedding functions, on the basis of using identity authentication and access control policies. The storage media security unit is used to complete media management and access authentication through a PKI management system based on national cryptographic algorithms, ensuring the security and controllability of access peripherals; S2. Construct a CNC network boundary security module, which includes an inter-network boundary protection unit, a remote access security unit, and an identity authentication unit. Among them, the inter-network boundary protection unit is used to connect security protection equipment between the production network and the office network, and to perform trusted verification of the access equipment based on the national cryptographic algorithm on the security protection equipment. The inter-network boundary protection unit is user-centric for user identity authentication and access control. The remote access security unit is used to protect the confidentiality, integrity, authenticity, and non-repudiation of access sessions based on national cryptographic algorithms. For confidentiality, it uses the symmetric cryptographic algorithm SM4 and the asymmetric cryptographic algorithms SM2 and SM9 to protect data confidentiality. For integrity, it uses the digital signature mechanism or message authentication code mechanism of SM2 and SM9. For authenticity, it uses identity authentication technology, implemented through SM4, SM2, and SM9. Non-repudiation provides reliable evidence to help resolve disputes, and is achieved using digital signature technology. The identity authentication unit is used to perform identity authentication using dynamic passwords during host login, application service resource access, and cloud platform access. The dynamic password is based on the SM4 or SM3 algorithm of the national cryptographic algorithm. Before authentication, both parties share a key. During authentication, the user and the authentication server generate and compare the dynamic authentication passwords based on the shared key, the same random parameters, and the cryptographic algorithm. The steps to calculate a dynamic password are as follows: S21. Assemble the time factor T and event factor C sequentially into a parameter ID of at least 128 bits; S22. The parameter ID and the key K are used together as input to the cryptographic algorithm. If the cryptographic algorithm is SM4, the encryption scheme SM4-OTP is executed to obtain the calculation result S, as shown in the following formula (1): S = SM4 - OTP(K, ID) (1) S23. If the algorithm is SM3, then SM3-OTP is executed to calculate S, as shown in equation (2) below: S = SM3 - OTP(K, ID) (2) S24. The calculation result S is truncated to obtain 32-bit data D; the truncation algorithm used varies depending on the cryptographic algorithm selected, as shown in equation (3) below: D = Truncate(S) (3) S25. Take the modulo of the truncated result to obtain the dynamic password P; this dynamic password is an N-digit decimal number, as shown in the following formula (4): P=Dmod10 N (4) S3. Construct a CNC system software security module, which includes a security configuration unit, a configuration change unit, an account management unit, a control command protection unit, and a security audit unit; S4. Construct a data security module for the CNC system, which includes a data classification and hierarchical management unit, a differentiated protection unit, a data backup and recovery unit, and a test data protection unit. S5. Based on the national cryptographic algorithm, the CNC equipment security module, the CNC network boundary security module, the CNC system software security module, and the CNC system data security module, the CNC system is protected for security.

2. The method according to claim 1, characterized in that, The PKI management system based on the national cryptographic algorithm adopts a security architecture based on public key cryptography theory (PKI) and designs the SM2 signature function algorithm and the SM2 signature verification function algorithm.

3. The method according to claim 2, characterized in that, The SM2 signature function algorithm includes: Obtain the raw plaintext data input by the access user, and preprocess the raw plaintext data; A hash operation is performed on the preprocessed original plaintext data to obtain the hash operation result; wherein, the hash operation adopts the SM3 algorithm; Extract the private key, digitally sign the hash result to obtain a signature result file, and output the signature result file to the disk.

4. The method according to claim 3, characterized in that, The SM2 signature verification function algorithm includes: Based on the SM2 signature function algorithm, the digital signature of the original plaintext data is recalculated to obtain the signature result; The certificate is obtained from the certificate pool and the public key is extracted. The signature result file in the disk is then decrypted to obtain the decryption result. Compare the signature result and the decryption result. If they are completely consistent, the signature verification is successful; otherwise, the signature verification fails.

5. The method according to claim 1, characterized in that, The access authentication process, based on the PKI management system using national cryptographic algorithms, includes: Obtain digital certificate application for new users; The Certificate Authority (CA) in the PKI management system based on national cryptographic algorithms reviews the digital certificate application, generates public and private keys and issues a certificate for the new user, and puts the public and private keys and the issued certificate into a USB key and delivers it to the new user. The supervisory layer of the CNC system verifies the authenticity of the certificate of the newly connected user based on the certificate verification strategy. After successful verification, the newly connected user is added to the supervisory layer.

6. The method according to claim 1, characterized in that, The account management unit in S3 is used to verify the access time of the CNC system management account based on the national cryptographic algorithm signature timestamp. The control command protection unit is used for the encrypted storage and transmission of control commands based on the national cryptographic algorithm. The security audit unit is used for storing and transmitting audit logs of CNC systems based on national cryptographic algorithms.

7. The method according to claim 1, characterized in that, The classification and hierarchical management unit in S4 is used to verify the integrity of important data based on the national cryptographic algorithm and to encrypt and store important data, and to form a digital identifier through signature; Differentiated protection units are used to encrypt the transmission of important data in dynamic transmission or protect it using a Virtual Private Network (VPN); and to encrypt or isolate important data in static storage.

8. A CNC system security protection device based on national cryptographic algorithms, the device being used to implement the CNC system security protection method based on national cryptographic algorithms as described in any one of claims 1-7, characterized in that, The device includes: The CNC equipment safety module includes a field control equipment safety unit and a storage media safety unit; The CNC network boundary security module includes an inter-network boundary protection unit, a remote access security unit, and an identity authentication unit; The CNC system software security module includes a security configuration unit, a configuration change unit, an account management unit, a control command protection unit, and a security audit unit; The CNC system data security module includes a data classification and hierarchical management unit, a differentiated protection unit, a data backup and recovery unit, and a test data protection unit.

Images