Industrial terminal edge dynamic credit gateway based on classification and grading and its implementation method

Abstract

The present invention discloses a dynamic credit gateway for industrial terminal edge based on classification and grading and an implementation method, the implementation method includes the following steps: step 1, classify and grade industrial terminals and store them in a local cache module; step 2, collect terminal device information; step 3, obtain the classification and grading information of industrial terminal device identity, obtain the credit access to industrial cloud platform application resources, and perform synchronous access credit on the device; step 4, obtain and monitor the dynamic information of industrial terminals in real time, comprehensively assign the dynamic information of each industrial terminal device to obtain the initial comprehensive trust score, and combine the security event log to obtain the final comprehensive trust score; step 5, determine whether the real-time trust score of each terminal device is within the safe range, and send the dynamic credit result to realize edge dynamic credit control. The method realizes flexible dynamic credit for industrial edge devices by integrating static identity factors and dynamic information indicators.

Description

Technical Field

[0001] The present invention relates to an industrial terminal edge dynamic credit gateway based on classification and grading and an implementation method thereof, belonging to the field of industrial cloud platform edge security technology. Background Art

[0002] Industrial cloud platform edge security technology is one of the key technologies in the field of industrial Internet, which aims to protect industrial cloud platforms from unauthorized edge device access and potential security threats. With the digital transformation of industrial equipment and the popularization of industrial cloud platforms, edge computing and edge security have become urgent issues to be solved.

[0003] Traditional industrial Internet security technology mainly relies on static authorization mechanisms, that is, once a device is authorized, its permissions remain unchanged. However, with the rapid development of the industrial Internet, this static authorization method can no longer meet the complex and changing security needs. Static authorization has the following problems:

[0004] 1. Static authorization cannot adapt to the dynamic changes in the status of industrial equipment. Industrial equipment will be affected by various internal and external factors during operation, and its security status will change, but static authorization cannot be dynamically adjusted according to these changes.

[0005] 2. Static authorization cannot cope with new security threats. With the continuous evolution of network attack methods, static authorization mechanisms are vulnerable to bypass and attacks by malicious attackers.

[0006] 3. Static authorization makes it difficult to achieve fine-grained control of edge devices. In the industrial Internet environment, different devices may require different levels of authorization, and static authorization cannot meet such fine-grained control requirements.

[0007] It can be seen that in the existing technology, some studies have focused on the issue of industrial Internet security, but most of them still remain in the scope of static authorization, lacking real-time evaluation and authorization adjustment of the dynamic state of the device. For example, Smith et al. discussed the challenges and solutions of industrial Internet of Things security in "Industrial IoT Security: Challenges, Solutions, and Opportunities", but did not explore dynamic authorization technology in depth. In addition, Jones et al. detailed the security challenges of edge computing in "Edge Computing Security: State of the Art and Challenges", but have not yet explored the technical solutions for dynamic authorization in depth. Summary of the invention

[0008] The purpose of this invention is to solve the security challenges faced by industrial cloud platforms. In view of the problem that traditional static authorization methods cannot meet the needs of the rapid development of the industrial Internet, a dynamic credit gateway for industrial terminal edges based on classification and grading and an implementation method are proposed. By integrating static identity factors and dynamic information indicators, flexible dynamic credit for industrial edge devices is achieved.

[0009] The technical solution of the present invention is as follows:

[0010] A dynamic credit gateway for industrial terminal edge based on classification and grading, characterized by comprising a device information collection module, a local cache module, an identity linkage module, a multi-point deployment linkage module, a security log linkage module, a credit result receiving module and a security policy execution module;

[0011] Device information collection module: responsible for establishing connections with industrial terminal devices and actively collecting multi-dimensional device information, including IoT status, operating system version, application software version, software authorization period, hardware configuration information, network address, and communication protocol; and transmitting the collected information to the local cache module and the credit result receiving module;

[0012] Security event log linkage module: Linked with the security event logs of industrial control security equipment and industrial IoT security equipment. By exchanging information and sharing events with these security devices and transmitting data to the credit result receiving module, the edge dynamic credit gateway can obtain more comprehensive security event information and device status data, thereby more accurately evaluating the trust and security of the device.

[0013] Identity linkage module: The edge dynamic trust gateway obtains the classification and grading information of industrial terminal equipment through close linkage with the cloud control center, and synchronously updates it to the trust result receiving module of the edge dynamic trust gateway;

[0014] Multi-point deployment support module: Closely linked with the cloud control center, the edge dynamic trust gateway supports linkage and information synchronization in multi-point deployment. When multiple edge dynamic trust gateways are deployed at the same time, they can work together to jointly maintain device information and security policies to ensure the consistency and security of the entire system;

[0015] Local cache module: The edge dynamic trust gateway has a local cache function, which is used to receive information from the device information collection module and store predefined device classification and grading information, including the device's security level, authorized access scope, and trust score;

[0016] Trust result receiving module: The edge dynamic trust gateway reports the comprehensive trust score of the device to the cloud control center. The cloud control center determines whether the real-time trust score of the device is within the safe range based on this information, and updates the trust credentials and access control level in a timely manner. The updated dynamic trust result will be sent to the edge dynamic trust gateway to realize dynamic authorization management of the device;

[0017] Security policy execution module: The edge dynamic trust gateway is responsible for executing security policies, including device access control, traffic monitoring, and security incident response. After obtaining the latest device information and authorization policies, the edge dynamic trust gateway will authorize access to the device based on this information, monitor device behavior and traffic conditions, and respond to security incidents in a timely manner.

[0018] A method for implementing an industrial terminal edge dynamic credit gateway based on classification and grading, using the above-mentioned edge dynamic credit gateway, includes the following steps:

[0019] Step 1: Classify and grade the industrial terminals using a preset classification and grading template and store them in a local cache module, wherein the classification and grading template includes classification based on static identity factors and classification based on security levels;

[0020] Step 2: Use the device information collection module to actively establish a connection with the industrial terminal and collect terminal device information;

[0021] Step 3: Obtain the industrial terminal device identity classification and grading information from the cloud control center through the identity linkage module, obtain the trusted access to the industrial cloud platform application resources, conduct synchronous access trust for the device, and establish a communication connection with the industrial cloud platform or the industrial cloud platform security agent;

[0022] Step 4: The dynamic information of industrial terminals is acquired and monitored in real time through the device information collection module. The initial comprehensive trust score is obtained by comprehensively assigning the dynamic information of each industrial terminal device. The final comprehensive trust score is obtained by combining the initial comprehensive trust score, the security event logs of industrial control security equipment and industrial Internet of Things security equipment through the credit result receiving module, and then uploaded to the cloud control center by the identity linkage module;

[0023] Step 5. The cloud control center determines whether the real-time trust score of each terminal device is within the safe range based on the comprehensive trust score of each industrial terminal device reported by the identity linkage module and the setting of the trust score range for each type and level of industrial terminal devices, and promptly updates the trust credentials and access control level, sends the dynamic trust result to the identity linkage module, and transmits it to the security policy execution module to realize edge dynamic trust control.

[0024] Preferably, the above-mentioned industrial terminals include industrial control systems, production equipment, industrial Internet of Things sensors, and industrial access terminals.

[0025] Preferably, in the above step 1, the static identity factors include the characteristics and functions of the industrial terminal device, combined with the cloud application type, access method and interactive data flow type of accessing the industrial cloud platform; the security level is divided into five levels, namely: unauthorized access, authenticated access, limited access, controlled access and managed access.

[0026] Preferably, in the above step 2, the terminal device information includes the IoT status, embedded operating system version, application software version, software authorization period, hardware composition information, hardware version information, network address information, network port information, communication protocol and version information.

[0027] Preferably, in the above step 4, the dynamic information includes network connection quality, industrial terminal device session status, traffic type and size, cloud application access type and interface call frequency, publish and subscribe message queue status, data access type and read and write frequency.

[0028] Preferably, in the above step 4, the method for obtaining the comprehensive trust score is:

[0029] First, for each dynamic indicator information, by considering its feature F i 、Historical behavior i and the impact range R i The specific characteristics of the device are used to determine its importance to the trustworthiness of the device; this step is expressed by the following formula:

[0030] I i =f(F i ,H i ,R i )

[0031] Secondly, assign corresponding weight W to each dynamic indicator information i , if there are N dynamic indicator information, for the i-th indicator, its weight is expressed as W i ;

[0032] Then, according to the information indicator trust score P in the preset classification and grading template i and determine the importance of i and weight W i , score each dynamic indicator information S i ; The scoring is calculated as follows:

[0033] S i =P i ×I i ×W i

[0034] Finally, the scores of all dynamic indicator information are weighted and summed to obtain the initial comprehensive trust score T of the first industrial terminal device:

[0035] The beneficial effects of the present invention are:

[0036] The edge dynamic trust technology and gateway implementation of this application have many advantages and positive effects, and are of great significance to the security and stable operation of the industrial cloud platform. First, this technology can realize flexible dynamic trust for industrial edge devices. By integrating static identity factors and dynamic information indicators, the system can dynamically manage authorization according to the real-time status of the device, so that the industrial cloud platform can better adapt to the complex and changing industrial Internet environment. This flexibility and intelligence help improve the security management and control capabilities of the industrial cloud platform for edge devices. Secondly, the edge dynamic trust technology and gateway implementation can effectively respond to new security threats. Traditional static authorization methods are vulnerable to bypass and attack by malicious attackers, while this technology can detect and respond to security threats more promptly by evaluating the device trust score in real time, thereby improving the overall security of the industrial Internet system. In addition, this technology realizes fine-grained control of edge devices. Different devices may require different levels of authorization, and the edge dynamic trust technology can dynamically adjust the authorization level according to the device status, realize the refined management of the device, and help improve the security and flexibility of the entire system. Most importantly, this technology provides a full range of security management solutions for the industrial cloud platform. Through edge dynamic credit technology and gateway implementation, the industrial cloud platform can realize intelligent dynamic authorization management of edge devices, thereby improving the security and stability of the entire system and providing important support for the development and safe operation of the industrial Internet.

[0037] In summary, edge dynamic credit technology and gateway implementation have brought new technological breakthroughs and solutions to the edge security field of industrial cloud platforms, with important application prospects and social benefits. The promotion and application of this technology is expected to significantly improve the security and stability of industrial Internet systems and make positive contributions to the sustainable development and safe operation of the industrial Internet. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 is a system architecture diagram of an embodiment of the present invention;

[0039] Figure 2 is a flow chart of an embodiment of the present invention. DETAILED DESCRIPTION

[0040] The present invention will be further described below in conjunction with the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solution of the present invention, and cannot be used to limit the protection scope of the present invention.

[0041] like Figure 1 As shown, a dynamic credit gateway for industrial terminal edge based on classification and grading includes a device information collection module, a local cache module, an identity linkage module, a multi-point deployment linkage module, a security log linkage module, a credit result receiving module and a security policy execution module;

[0042] Device information collection module: responsible for establishing connections with industrial terminal devices and actively collecting multi-dimensional device information, including IoT status, operating system version, application software version, software authorization period, hardware configuration information, network address, and communication protocol; this information constitutes an important basis for the device's identity characteristics and security status. The collected information is transmitted to the local cache module and the credit result receiving module;

[0043] Security event log linkage module: Linked with the security event logs of industrial control security equipment and industrial Internet of Things security equipment, by exchanging information and sharing events with these security devices and transmitting data to the credit result receiving module, the edge dynamic credit gateway can obtain more comprehensive security event information and device status data, thereby more accurately evaluating the trust and security of the device; this linkage mechanism improves the system's ability to perceive security events and monitor device status.

[0044] Identity linkage module: The edge dynamic trust gateway obtains the classification and grading information of industrial terminal equipment through close linkage with the cloud control center, and synchronously updates it to the trust result receiving module of the edge dynamic trust gateway; this linkage mechanism ensures that the edge dynamic trust gateway obtains the latest device information and authorization policies, and also enables the entire system to respond to changes in device information and the occurrence of security incidents in a timely manner.

[0045] Multi-point deployment support module: Closely linked with the cloud control center, the edge dynamic trust gateway supports linkage and information synchronization in multi-point deployment. When multiple edge dynamic trust gateways are deployed at the same time, they can work together to jointly maintain device information and security policies to ensure the consistency and security of the entire system;

[0046] Local cache module: The edge dynamic trust gateway has a local cache function, which is used to receive information from the device information collection module and store predefined device classification and grading information, including the device's security level, authorized access scope, and trust score; the existence of local cache improves the system's response speed, reduces dependence on cloud resources, and also enhances the system's stability and security.

[0047] Trust result receiving module: The edge dynamic trust gateway reports the comprehensive trust score of the device to the cloud control center. The cloud control center determines whether the real-time trust score of the device is within the safe range based on this information, and updates the trust credentials and access control level in a timely manner. The updated dynamic trust result will be sent to the edge dynamic trust gateway to realize dynamic authorization management of the device; this dynamic trust mechanism ensures the system's real-time monitoring and security control of the device.

[0048] Security policy execution module: The edge dynamic trust gateway is responsible for executing security policies, including device access control, traffic monitoring, and security incident response. After obtaining the latest device information and authorization policies, the edge dynamic trust gateway will authorize access to the device based on this information, monitor device behavior and traffic conditions, and respond to security incidents in a timely manner. This security policy execution capability is an important guarantee for the system to ensure device security.

[0049] Based on the above-mentioned edge dynamic trust gateway, this embodiment provides an implementation method of an industrial terminal edge dynamic trust gateway based on classification and grading, such as Figure 2 As shown, the following steps are included:

[0050] Step 1: Classify and grade the industrial terminals using a preset classification and grading template and store them in a local cache module. The classification and grading template includes classification based on static identity factors and classification based on security levels.

[0051] Specifically, in the preset classification and grading template, the static identity factors of industrial terminal devices: according to the characteristics and functions of industrial terminal devices, combined with static identity factors such as the cloud application type, access method, and interactive data flow type of accessing the industrial cloud platform, the industrial terminals are graded and classified. In this embodiment, industrial control systems, production equipment, industrial IoT sensors, industrial access terminals, etc. have different functions and access requirements, and need to be classified according to their characteristics.

[0052] In the preset classification and grading template, security level grading: formulate a more detailed security level grading scheme to meet the special needs of industrial terminal equipment, and divide the security level into five levels, of which the five levels are: unauthorized access: refers to unauthorized or unauthenticated attempts to access the system or data; authenticated access: has passed the authentication, but still needs to be restricted; limited access: limited access to the system or data, usually limited to specific functions or data; controlled access: has a higher level of access, including broader access to system functions and data; management access: has the highest level of access to the system or data, usually including the ability to configure, manage and monitor the system.

[0053] Further, static identity factor template: For each security level, the corresponding static identity factor template is detailed. These factors may include but are not limited to device type, device identification, access rights, data interaction type, etc. These factors will serve as the basis for evaluating the security level of industrial terminals.

[0054] It should be noted that the assessment of the security level of industrial terminals is a conventional technical means. In this embodiment, the specific "factors" of the static identity factors listed in the text (device type, device identification, access rights, data interaction type, etc.) are used to set the actual enumeration values ​​in each specific factor from low to high for scoring (the scoring value can also be taken from 1 to 10), and then add the weight value of each specific factor (for example, the weight value can be taken from 1 to 10), and then comprehensively add and judge. This is relatively simple. For example, the weight of the device type factor can be 5, and then for example, there are plc, sensor, CNC machine Each type corresponds to a score. For example, these three can be assigned 5, 3, and 5 respectively. Low scores represent lower levels, and high scores represent higher levels. The weight values ​​in the total level of each factor mentioned above are also low scores representing low-level weights, and high scores representing high-level weights. In this way, the total evaluation score of the static identity factors of each actual industrial terminal device (the score of each factor multiplied by the weight value, and then the sum of all these products is the final evaluation score) is higher. The higher the level, the higher the level. Then, according to the various intervals of the overall score, they can be divided into the five security levels mentioned above.

[0055] Predefined dynamic identity identification and maintenance: Predefined dynamic identity identification and maintenance are implemented at each level to ensure that identity identification and access control can be performed dynamically according to real-time situations during the actual access process.

[0056] In this embodiment, according to the level determined by the static factors above, the dynamic factors described later are also scored and weighted in the same way. The difference here is that the dynamic factors can be assigned negative points, which may reduce the original level assessment points. Therefore, there is a possibility of a level reduction. This is mainly the role of dynamic judgment, that is, if the score is reduced, the access rights of the industrial terminal equipment will be reduced accordingly.

[0057] Storage of industrial terminal classification and grading library: Form an industrial terminal classification and grading library and store it in the industrial cloud, including third-party cloud service providers that provide industrial terminal identity services, and a private industrial terminal identity control platform deployed simultaneously with the industrial cloud platform.

[0058] This method ensures that the classification and grading information of industrial terminals can be centrally managed and maintained in the cloud, and can be linked by the edge dynamic trust gateway and the cloud identity control center, and stored in the local cache to support real-time access control and identity identification.

[0059] Step 2: Use the device information collection module to actively establish a connection with the industrial terminal and collect terminal device information.

[0060] The edge dynamic credit gateway involved in this embodiment is deployed near the industrial equipment terminal side, actively establishes a connection with the industrial terminal and collects multi-dimensional terminal equipment information, including but not limited to the Internet of Things status, embedded operating system version, application software version, software authorization period, hardware composition information, hardware version information, network address information, network port information, communication protocol and version information, etc.

[0061] Specifically, the deployment location of the edge dynamic trust gateway: the edge dynamic trust gateway is deployed close to the industrial equipment terminal to ensure the real-time collection and processing of terminal equipment information.

[0062] Furthermore, the edge dynamic trust gateway actively connects with industrial terminals and collects multi-dimensional terminal equipment information. This information covers the state of the Internet of Things, operating system version, application software version, software license period, hardware composition information, hardware version information, network address information, network port information, communication protocol and version information, etc., to fully understand the state and characteristics of industrial equipment.

[0063] Furthermore, the security classification and grading information in the local cache is obtained. According to the configured industrial cloud application and terminal type that needs to be accessed, the edge dynamic trust gateway obtains the security classification and grading information from the local cache. This ensures that for devices of known types, their security classification and grading information can be directly obtained locally for subsequent access control and identity authentication.

[0064] Furthermore, for the processing of unknown type devices, if there are unknown type devices, the edge dynamic trust gateway immediately generates identity credentials and sends them to the cloud control center, while obtaining the classification and grading information of industrial equipment. This ensures that even for unknown types of devices, their classification and grading information can be obtained through the cloud control center for subsequent access control and identity authentication.

[0065] The cloud control center processes the device. If the cloud control center does not have the classification and grading information for this type of device, the cloud control center will re-classify it and send it to the edge dynamic trust gateway simultaneously. This ensures that for new device types, the necessary classification and grading can be performed in the cloud, and the information can be sent to the edge dynamic trust gateway simultaneously to ensure the security and consistency of the entire system.

[0066] Synchronous delivery in the case of multi-point deployment of edge dynamic trust gateways. If there are multi-point deployed edge dynamic trust gateways, the new device classification and grading information will be synchronously delivered to all edge dynamic trust gateways to ensure the consistency and accuracy of the entire system.

[0067] Step 3: Obtain the industrial terminal device identity classification and grading information from the cloud control center through the identity linkage module, obtain trusted access to the industrial cloud platform application resources, synchronize access to the device, and establish a communication connection with the industrial cloud platform or the industrial cloud platform security agent.

[0068] Specifically, the edge dynamic trust gateway obtains industrial terminal device identity classification and grading information from the cloud control center, obtains trusted access to industrial cloud platform application resources, synchronizes access trust for devices, and establishes a communication connection with the industrial cloud platform or the industrial cloud platform security agent. Each edge dynamic trust gateway supports the connection and identity maintenance of multiple terminal devices.

[0069] Furthermore, in this embodiment, the identity classification and grading information of industrial terminal devices is obtained, and the edge dynamic trust gateway obtains the identity classification and grading information of industrial terminal devices from the cloud control center, ensuring that the edge dynamic trust gateway has the latest information required for access control and identity authentication of the terminal devices.

[0070] It should be noted that trusted access to industrial cloud platform application resources is obtained: the edge dynamic trusted gateway obtains trusted access to industrial cloud platform application resources to ensure that the device can be authorized when accessing industrial cloud platform application resources, thereby ensuring the security and controllability of the entire system.

[0071] Synchronous access authorization: Synchronous access authorization for devices ensures timely identity authentication and authorization when devices are accessed to ensure the security and compliance of the system.

[0072] Establish a communication connection with the industrial cloud platform or the industrial cloud platform security agent. The edge dynamic trust gateway establishes a communication connection with the industrial cloud platform or the industrial cloud platform security agent to ensure secure communication and data transmission between the device and the cloud, ensuring the overall security and stability of the system.

[0073] The edge dynamic trust gateway supports the connection and identity maintenance of multiple terminal devices, ensuring the management and control of multiple devices to adapt to complex industrial environments and diverse device connection requirements.

[0074] Step 4: Use the device information collection module to obtain and monitor the dynamic information of industrial terminals in real time, obtain an initial comprehensive trust score by comprehensively assigning values ​​to the dynamic information of each industrial terminal device, and obtain the final comprehensive trust score by combining the security event logs of industrial control security equipment and industrial Internet of Things security equipment.

[0075] It should be noted that the edge dynamic trust gateway obtains and monitors dynamic information such as network connection quality, industrial terminal device session status, traffic type and size, cloud application access type and interface call frequency, publish and subscribe message queue status, data access type and read and write frequency in real time, and assigns a comprehensive value to the dynamic information of each terminal device based on the information indicator trust score in the preset classification and grading template. At the same time, it can be linked with the security event logs of industrial control security equipment and industrial Internet of Things security equipment to comprehensively evaluate the trust score of industrial terminal equipment.

[0076] Specifically, dynamic information acquired and monitored in real time: network connection quality, industrial terminal device session status, traffic type and size, cloud application access type and interface call frequency, publish and subscribe message queue status, data access type and read and write frequency, etc. are acquired and monitored in real time by the device information collection module to fully understand the operating status and behavioral characteristics of the equipment and network.

[0077] The information indicator trust score in the preset classification and grading template is used. The edge gateway comprehensively assigns values ​​to the dynamic information of each terminal device according to the information indicator trust score in the preset classification and grading template. The specific method adopts a weighted scoring method. First, for each dynamic indicator information, its importance to the trust of the device is determined, and a corresponding weight is assigned to each indicator. Then, each dynamic indicator information is scored according to the information indicator trust score and weight in the preset classification and grading template, and the weighted sum of each score is performed to obtain the initial comprehensive trust score of the device. This method can make a more accurate and comprehensive assessment of the trust of the device based on the specific dynamic indicator information, and improve the ability to control the security of the device. This method ensures that the assessment of the behavior and status of the device is based on the pre-set trust indicator, so as to make subsequent trust assessments and control decisions.

[0078] Furthermore, the edge gateway is linked with the security event logs of industrial control security equipment and industrial Internet of Things security equipment to obtain information about security incidents and abnormal behaviors, so that this information can be included in the scope of comprehensive evaluation, ensuring the comprehensiveness and accuracy of the equipment trust assessment.

[0079] Finally, the trust scores of industrial terminal devices are comprehensively evaluated. The credit result receiving module comprehensively evaluates the trust scores of industrial terminal devices, combines dynamic information with preset trust indicators, and considers the information of security event logs to obtain the final comprehensive trust score for the comprehensive evaluation of the device, which is uploaded to the cloud control center by the identity linkage module. Step 5. The cloud control center determines whether the real-time trust score of each terminal device is within the safe range based on the comprehensive trust scores of each industrial terminal device reported by the identity linkage module and the settings of the trust score range of each type and level of industrial terminal devices by the identity control center, and promptly updates the credit credentials and access control levels, sends the dynamic credit results to the identity linkage module, and transmits them to the security policy execution module to realize edge dynamic credit control.

[0080] (The marked "what" was originally implemented through the "Edge Dynamic Trust Gateway", but the "Edge Dynamic Trust Gateway" is not available, so it needs to be described through the subordinates of the "Edge Dynamic Trust Gateway", that is, which module in the "Edge Dynamic Trust Gateway" is used to implement it. If these modules are not standard modules, specific descriptions of these modules are required)

[0081] Specifically, the cloud control center calculates the comprehensive trust score of each terminal device based on the trust score reported by the identity linkage module.

[0082] It should be noted that, in this embodiment, there are two conditions for triggering trust score reporting: one is periodic reporting, and the administrator can manually configure the score validity period; the other is real-time reporting when there is a significant change in the score.

[0083] Furthermore, in combination with the identity control center's trusted score range for various types and levels of industrial terminal devices, it determines whether the real-time trust score of each terminal device is within a safe range, and promptly updates the trust credentials and access control levels. The dynamic trust results are sent to the identity linkage module and transmitted to the security policy execution module to achieve edge dynamic credit control.

[0084] In this embodiment, for key production equipment, the trust score range of the equipment can be set to 90-100 points to ensure strict security control and monitoring thereof.

[0085] For general production equipment, the trust score range can be between 70-90 points, enabling relatively loose authorization management and monitoring.

[0086] For non-critical devices or test equipment, the trust score range can be between 50-70 points to ensure basic security control and monitoring.

[0087] Comprehensive trust score reporting conditions: The comprehensive trust scores of each terminal device reported by the edge gateway can be triggered and reported according to two conditions: one is periodic reporting, and the administrator can manually configure the validity period of the score; the other is real-time reporting when the score changes significantly. This flexible reporting mechanism ensures timely perception and control of changes in device trust.

[0088] Combined with the judgment of the trust score range by the identity control center: The cloud control center combines the trust score range of various types and levels of industrial terminal devices by the identity control center to determine whether the real-time trust score of each terminal device is within the safe range. This ensures that the evaluation of device trust is based on the preset safe range, so that abnormal device trust can be discovered and responded to in a timely manner.

[0089] Timely update of trust credentials and access control levels: Based on the judgment results of the real-time trust score of the device, the cloud control center promptly updates the trust credentials and access control levels to ensure that the device's access rights and control levels match its actual trust level, thereby improving the security and control accuracy of device access.

[0090] Dynamic trust results are sent to the edge gateway: The cloud control center sends the dynamic trust results to the identity linkage module and transmits them to the security policy execution module to achieve dynamic trust control at the edge. This ensures that the edge gateway can dynamically control access and authorization of devices based on the latest trust assessment results to adapt to the real-time changing security environment and device behavior.

[0091] Through the description of the above embodiments, it can be understood that:

[0092] The edge dynamic trust gateway is the core component of this system. It is deployed near the industrial equipment terminal to collect equipment information and implement authorization management. The edge gateway actively collects multi-dimensional equipment information by establishing a connection with the industrial terminal, including the state of the Internet of Things, the version of the operating system, the version of the application software, the period of software authorization, the hardware composition information, the network address, the communication protocol, etc. This information constitutes an important basis for the identity characteristics and security status of the device.

[0093] The edge dynamic trust gateway has a local cache function to store predefined device classification and grading information. This information includes the device's security level, authorized access scope, trust score, etc. to support dynamic trust control. The existence of local cache can improve the system's response speed, reduce dependence on cloud resources, and enhance the stability and security of the system.

[0094] The edge dynamic trust gateway is closely linked with the cloud identity control center. It interacts with the cloud control center to obtain the classification and grading information of industrial terminal devices and synchronizes it to the local cache of the edge gateway. This linkage mechanism ensures that the edge gateway obtains the latest device information and authorization policies, and also enables the entire system to respond to changes in device information and the occurrence of security incidents in a timely manner.

[0095] The edge dynamic trust gateway is linked with the security event logs of industrial control security equipment and industrial IoT security equipment. By exchanging information and sharing events with these security devices, the edge gateway can obtain more comprehensive security event information and device status data, thereby more accurately evaluating the trust and security of the device. This linkage mechanism improves the system's ability to perceive security events and monitor device status.

[0096] The edge dynamic trust gateway reports the comprehensive trust score of the device to the cloud control center. The cloud control center determines whether the real-time trust score of the device is within the safe range based on this information, and updates the trust credentials and access control level in a timely manner. The updated dynamic trust results will be sent to the edge gateway to achieve dynamic authorization management of the device. This dynamic trust mechanism ensures the system's real-time monitoring and security control of the device.

[0097] The edge dynamic trust gateway is responsible for executing security policies, including access control, traffic monitoring, and security incident response to devices. After obtaining the latest device information and authorization policies, the edge gateway will authorize access to the device based on this information, monitor the device's behavior and traffic, and respond to security incidents in a timely manner. This security policy execution capability is an important guarantee for the system to ensure device security.

[0098] The edge dynamic trust gateway supports linkage and information synchronization in multi-point deployment. When multiple edge gateways are deployed at the same time, they can work together to maintain device information and security policies to ensure the consistency and security of the entire system.

[0099] This embodiment combines various elements of the edge gateway system module, from device information collection to dynamic authorization management, to security event linkage and local cache synchronization, to build a comprehensive industrial Internet security management system. In practical applications, the parameters of security policies and authorization management can be adjusted according to the specific industrial environment and device characteristics to achieve the best balance between security and efficiency.

[0100] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A dynamic credit gateway for industrial terminal edge based on classification and grading, characterized in that It includes device information collection module, local cache module, identity linkage module, multi-point deployment linkage module, security log linkage module, credit result receiving module and security policy execution module; Device information collection module: responsible for establishing connections with industrial terminal devices and actively collecting multi-dimensional device information, including IoT status, operating system version, application software version, software authorization period, hardware configuration information, network address, and communication protocol; and transmitting the collected information to the local cache module and the credit result receiving module; Security event log linkage module: Linked with the security event logs of industrial control security equipment and industrial IoT security equipment. By exchanging information and sharing events with these security devices and transmitting data to the credit result receiving module, the edge dynamic credit gateway can obtain more comprehensive security event information and device status data, thereby more accurately evaluating the trust and security of the device. Identity linkage module: The edge dynamic trust gateway obtains the classification and grading information of industrial terminal equipment through close linkage with the cloud control center, and synchronously updates it to the trust result receiving module of the edge dynamic trust gateway; Multi-point deployment support module: Closely linked with the cloud control center, the edge dynamic trust gateway supports linkage and information synchronization in multi-point deployment. When multiple edge dynamic trust gateways are deployed at the same time, they can work together to jointly maintain device information and security policies to ensure the consistency and security of the entire system; Local cache module: The edge dynamic trust gateway has a local cache function, which is used to receive information from the device information collection module and store predefined device classification and grading information, including the device's security level, authorized access scope, and trust score; Trust result receiving module: The edge dynamic trust gateway reports the comprehensive trust score of the device to the cloud control center. The cloud control center determines whether the real-time trust score of the device is within the safe range based on this information, and updates the trust credentials and access control level in a timely manner. The updated dynamic trust result will be sent to the edge dynamic trust gateway to realize dynamic authorization management of the device; Security policy execution module: The edge dynamic trust gateway is responsible for executing security policies, including device access control, traffic monitoring, and security incident response. After obtaining the latest device information and authorization policies, the edge dynamic trust gateway will authorize access to the device based on this information, monitor device behavior and traffic conditions, and respond to security incidents in a timely manner.

2. A method for implementing a dynamic credit gateway at the edge of an industrial terminal based on classification and grading, characterized in that Using the edge dynamic credit gateway described in claim 1, comprising the following steps: Step 1: Classify and grade the industrial terminals using a preset classification and grading template and store them in a local cache module, wherein the classification and grading template includes classification based on static identity factors and classification based on security levels; Step 2: Use the device information collection module to actively establish a connection with the industrial terminal and collect terminal device information; Step 3: Obtain the industrial terminal device identity classification and grading information from the cloud control center through the identity linkage module, obtain the trusted access to the industrial cloud platform application resources, conduct synchronous access trust for the device, and establish a communication connection with the industrial cloud platform or the industrial cloud platform security agent; Step 4: The dynamic information of industrial terminals is acquired and monitored in real time through the device information collection module. The initial comprehensive trust score is obtained by comprehensively assigning the dynamic information of each industrial terminal device. The final comprehensive trust score is obtained by combining the initial comprehensive trust score, the security event logs of industrial control security equipment and industrial Internet of Things security equipment through the credit result receiving module, and then uploaded to the cloud control center by the identity linkage module; Step 5. The cloud control center determines whether the real-time trust score of each terminal device is within the safe range based on the comprehensive trust score of each industrial terminal device reported by the identity linkage module and the setting of the trust score range for each type and level of industrial terminal devices, and promptly updates the trust credentials and access control level, sends the dynamic trust result to the identity linkage module, and transmits it to the security policy execution module to realize edge dynamic trust control.

3. The method for implementing a dynamic credit gateway for industrial terminal edge based on classification and grading according to claim 2 is characterized in that The industrial terminals include industrial control systems, production equipment, industrial IoT sensors, and industrial access terminals.

4. The method for implementing a dynamic credit gateway for industrial terminal edge based on classification and grading according to claim 2 is characterized in that In step 1, the static identity factors include the characteristics and functions of the industrial terminal equipment, combined with the cloud application type, access method and interactive data flow type of accessing the industrial cloud platform; the security level is divided into five levels, namely: unauthorized access, authenticated access, limited access, controlled access and managed access.

5. The method for implementing a dynamic credit gateway for industrial terminal edge based on classification and grading according to claim 2 is characterized in that In step 2, the terminal device information includes the IoT status, embedded operating system version, application software version, software authorization period, hardware composition information, hardware version information, network address information, network port information, communication protocol and version information.

6. The method for implementing a dynamic credit gateway for industrial terminal edge based on classification and grading according to claim 2 is characterized in that In step 4, the dynamic information includes network connection quality, industrial terminal device session status, traffic type and size, cloud application access type and interface call frequency, publish and subscribe message queue status, data access type and read and write frequency.

7. The method for implementing a dynamic credit gateway for industrial terminal edge based on classification and grading according to claim 2 is characterized in that In step 4, the method for obtaining the comprehensive trust score is: First, for each dynamic indicator information, by considering its feature F i 、Historical behavior i and the impact range R i The specific characteristics of the device are used to determine its importance to the trustworthiness of the device; this step is expressed by the following formula: I i =f(F i ,H i ,R i ) Secondly, assign corresponding weight W to each dynamic indicator information i , if there are N dynamic indicator information, for the i-th indicator, its weight is expressed as W i ; Then, according to the information indicator trust score P in the preset classification and grading template i and determine the importance of i and weight W i , score each dynamic indicator information S i ; The scoring is calculated as follows: S i =P i ×I i ×W i Finally, the scores of all dynamic indicator information are weighted and summed to obtain the initial comprehensive trust score T of the first industrial terminal device:

Images