Industrial control host remote access control system and method based on multi-factor authentication

Abstract

An embodiment of the present disclosure discloses an industrial control host remote access control system and method based on multi-factor authentication, which relates to the technical field of industrial control host remote access. The system includes: a smart card for generating a smart card key according to the current location information; a client for sending the smart card key generated by the smart card, the user ID input by the user, and the identity key to the system end; the system end for obtaining the verification values of the smart card key and the identity key according to the user ID, and verifying the smart card key and the identity key sent by the client according to the verification values of the smart card key and the identity key. If the verification is passed, the client is allowed to access the industrial control host. The industrial control host remote access control system based on multi-factor authentication provided by this embodiment innovatively uses a smart card to generate a unique smart card key based on the current location information, making the key have timeliness and dynamic change characteristics, and increasing the difficulty of cracking.

Description

Technical Field

[0001] The present disclosure relates to the technical field of remote access control for industrial control hosts, and in particular to a remote access control system and method for industrial control hosts based on multi-factor authentication. Background Art

[0002] The Industrial Control Host Remote Access Control System is a software and hardware solution for remote monitoring and management of Industrial Control Systems (ICS). It allows operators and technicians to access the Industrial Control Host via the internet or a private network, enabling remote monitoring, fault diagnosis, and maintenance of industrial equipment and systems.

[0003] A remote access control system for industrial control hosts based on multi-factor authentication is a remote access solution that enhances security. Multi-factor authentication (MFA) refers to the use of multiple independent authentication methods to verify a user's identity. Typically, these authentication methods include: Knowledge factor: something the user knows, such as a password or PIN code; Possession factor: something the user possesses, such as a mobile phone verification code or email verification code; and Biometric factor: a characteristic of the user, such as a fingerprint, facial recognition, or iris scan.

[0004] Generally speaking, multi-factor authentication is mainly used for business trips, visiting customers, etc. The existing authentication technology is complex and has low security.

[0005] To sum up, how to simplify the authentication process while improving security during multi-factor authentication is a problem that needs to be solved. Summary of the Invention

[0006] In view of this, the embodiments of the present disclosure provide a system and method for a remote access control system for an industrial control host based on multi-factor authentication, which simplifies the authentication process while improving security through location verification.

[0007] In a first aspect, the embodiments of the present disclosure provide a remote access control system for an industrial control host based on multi-factor authentication, which adopts the following technical solutions:

[0008] Including: client, smart card and system end;

[0009] The smart card is used to generate a smart card key according to the current location information and send it to the client;

[0010] The client is used to send the smart card key generated by the smart card, the user ID and identity key input by the user to the system end;

[0011] The system side is used to obtain the verification values of the smart card key and the identity key according to the user ID, and verify the smart card key and the identity key sent by the client according to the verification values of the smart card key and the identity key. If the verification is passed, the client is allowed to access the industrial control host.

[0012] As an optional implementation manner, the smart card includes:

[0013] A first storage module for storing a preset algorithm and verification data;

[0014] A positioning module for obtaining the current location information;

[0015] A main control module for splicing the current location information and the verification data, and calculating the spliced data using a preset algorithm to obtain a smart card key, and sending it to the client.

[0016] As an optional implementation manner, the system side includes:

[0017] A second storage module is used to store preset location information, a preset algorithm, verification data, a user ID, and an identity key verification value corresponding to the user ID;

[0018] A smart card key verification value calculation module for calculating a smart card key verification value according to the preset location information, the preset algorithm, and the verification data;

[0019] An access control module for querying the identity key verification value in the second storage module according to the user ID sent by the user side, verifying the smart card key and the identity key sent by the user side according to the smart card key verification value and the identity key verification value. If the verification is passed, the client is allowed to access the industrial control host.

[0020] As an optional implementation manner, the system side further includes: a preset algorithm and verification data update module for generating a new preset algorithm or verification data after each successful verification by the access control module, and sending it to the client, so that the client changes the preset algorithm or verification data stored in the first storage module according to the new preset algorithm or verification data, and after the client changes successfully, changes the preset algorithm or verification data in the second storage module according to the new preset algorithm or verification data.

[0021] As an optional implementation manner, the client further includes: a preset algorithm and verification data rewriting module for changing the preset algorithm or verification data stored in the first storage module according to the new preset algorithm or verification data received from the system side, and sending the rewriting result to the system side.

[0022] As an alternative embodiment, the first storage module includes: a first preset algorithm storage unit, a first verification data storage unit, a second preset algorithm storage unit, and a second verification data storage unit;

[0023] The first preset algorithm storage unit is used to store the newly changed preset algorithm, and the second preset algorithm storage unit is used to store the previously changed preset algorithm;

[0024] The first verification data storage unit is used to store the newly changed verification data, and the second verification data storage unit is used to store the previously changed verification data;

[0025] The preset algorithm and verification data rewriting module writes the new preset algorithm into the first preset algorithm storage unit. After successful writing, when the main control module reads the preset algorithm again, it reads from the first preset algorithm storage unit. After failed writing, when the main control module reads the preset algorithm again, it reads from the second preset algorithm storage unit;

[0026] The preset algorithm and verification data rewriting module writes the new verification data into the first verification data storage unit. After successful writing, when the main control module reads the verification data again, it reads from the first verification data storage unit. After failed writing, when the main control module reads the verification data again, it reads from the second verification data storage unit.

[0027] As an alternative embodiment, the access control module is further configured to obtain a location-free key instruction. If the location-free key instruction is obtained, it queries the identity key verification value in the second storage module according to the user ID sent by the user terminal, and verifies the identity key sent by the user terminal according to the identity key verification value. If the verification is passed, the client is allowed to access the industrial control host.

[0028] As an alternative embodiment, the location-free key instruction is generated after the user applies to the administrator for a location-free verification application and the administrator approves it.

[0029] In a second aspect, the embodiments of the present disclosure further provide a method for remotely accessing and controlling an industrial control host based on multi-factor authentication. Based on the above-mentioned remote access control system for an industrial control host based on multi-factor authentication, it includes:

[0030] Using the smart card to generate a smart card key according to the current location information and sending it to the client;

[0031] Using the client to send the smart card key generated by the smart card, the user ID input by the user, and the identity key to the system side;

[0032] The system end obtains the verification value of the smart card key and the identity key according to the user ID, and verifies the smart card key and the identity key sent by the client according to the verification value of the smart card key and the identity key. If the verification is successful, the client is allowed to access the industrial control host.

[0033] As an optional implementation manner, using the system end to obtain the verification value of the smart card key and the identity key according to the user ID, and verifying the smart card key and the identity key sent by the client according to the verification value of the smart card key and the identity key, and if the verification is successful, allowing the client to access the industrial control host includes:

[0034] Using the second storage module to store preset location information, a preset algorithm, verification data, a user ID, and an identity key verification value corresponding to the user ID;

[0035] Utilizing the smart card key verification value calculation module to calculate the smart card key verification value according to preset location information, a preset algorithm and verification data;

[0036] The access control module is used to query the identity key verification value in the second storage module according to the user ID sent by the user terminal, and the smart card key and identity key sent by the user terminal are verified according to the smart card key verification value and the identity key verification value. If the verification is successful, the client is allowed to access the industrial control host.

[0037] In summary, the technical effects of the industrial control host remote access control system based on multi-factor authentication provided by the present disclosure are:

[0038] The multi-factor authentication-based remote access control system for industrial control hosts provided in this embodiment implements multiple authentication mechanisms by combining the client, smart card, and system, ensuring that only authorized users can access the industrial control host. The innovative use of a smart card to generate a unique smart card key based on the current location information makes the key time-sensitive and dynamically changing, increasing the difficulty of cracking. The client sends the smart card-generated smart card key, along with the user ID and identity key entered by the user, to the system for comprehensive verification.

[0039] On the other hand, by updating the two storage units in turn, a write failure does not affect the original preset algorithm and verification data, thereby increasing system stability.

[0040] On the other hand, in cases where the positioning module signal is poor, for example, in an underground parking lot or indoors in a high-rise building, the user can apply to the administrator to not verify the position, thereby increasing convenience of use.

[0041] The above description is only an overview of the technical solution of the present disclosure. In order to understand the technical means of the present disclosure more clearly, it can be implemented according to the content of the specification. In order to make the above and other purposes, features and advantages of the present disclosure more obvious and understandable, the following preferred embodiments are specifically given and described in detail in conjunction with the accompanying drawings as follows. Description of the Drawings

[0042] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the accompanying drawings required for use in the embodiments will be briefly introduced below. Obviously, the accompanying drawings in the following description are only some embodiments of the present disclosure. For those of ordinary skill in the art, without creative efforts, other accompanying drawings can be obtained based on these drawings.

[0043] Figure 1 It is a schematic structural diagram of an industrial control host remote access control system based on multi-factor authentication provided by an embodiment of the present disclosure;

[0044] Figure 2 It is a schematic flowchart of a method for remotely accessing and controlling an industrial control host based on multi-factor authentication provided by an embodiment of the present disclosure. Detailed Embodiments

[0045] The embodiments of the present disclosure will be described in detail below in conjunction with the accompanying drawings.

[0046] It should be clear that the following specific examples illustrate the implementation manners of the present disclosure. Those skilled in the art can easily understand other advantages and effects of the present disclosure from the content disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of the present disclosure, rather than all of the embodiments. The present disclosure can also be implemented or applied through other different specific implementation manners. Various details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of the present disclosure. It should be noted that, without conflict, the following embodiments and the features in the embodiments can be combined with each other. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present disclosure without creative efforts belong to the scope of protection of the present disclosure.

[0047] It should be noted that the following describes various aspects of embodiments within the scope of the appended claims. It will be apparent that the aspects described herein can be embodied in a wide variety of forms, and any specific structure and / or function described herein is illustrative only. Based on this disclosure, those skilled in the art should understand that one aspect described herein can be implemented independently of any other aspect, and two or more of these aspects can be combined in various ways. For example, any number of aspects set forth herein can be used to implement a device and / or practice a method. Additionally, this device can be implemented and this method can be practiced using other structures and / or functionality in addition to one or more of the aspects set forth herein.

[0048] It should also be noted that the diagrams provided in the following embodiments only illustrate the basic concept of the present disclosure schematically. Only the components related to the present disclosure are shown in the diagrams, rather than being drawn according to the number, shape, and size of the components in actual implementation. The type, quantity, and ratio of each component in actual implementation can be arbitrarily changed, and the component layout type may also be more complex.

[0049] In addition, in the following description, specific details are provided to facilitate a thorough understanding of the examples. However, those skilled in the art will understand that the aspects can be practiced without these specific details.

[0050] To solve the problem of how to simplify the authentication process while improving security in multi-factor authentication, with reference to Figure 1 , the first aspect of the present invention provides an industrial control host remote access control system based on multi-factor authentication, including: a client, a smart card, and a system end; generally speaking, the client runs on the user's computer, the system end runs on the server, the smart card is a separate hardware device, and can be inserted into the user's computer through a USB interface or other means to interact with the client for data.

[0051] The smart card is used to generate a smart card key according to the current location information and send it to the client;

[0052] The client is used to send the smart card key generated by the smart card, the user ID input by the user, and the identity key to the system end;

[0053] The system end is used to obtain the verification values of the smart card key and the identity key according to the user ID, and verify the smart card key and the identity key sent by the client according to the verification values of the smart card key and the identity key. If the verification is passed, the client is allowed to access the industrial control host.

[0054] The industrial control host remote access control system based on multi-factor authentication provided in this embodiment realizes multi-factor authentication by combining a client, a smart card, and a system end, ensuring that only authorized users can access the industrial control host. Innovatively, the smart card generates a unique smart card key based on the current location information, making the key time-sensitive and dynamically changing, increasing the difficulty of cracking. The client sends the smart card key generated by the smart card, the user ID input by the user, and the identity key to the system end for comprehensive verification by the client.

[0055] As an optional implementation, the smart card includes:

[0056] A first storage module for storing a preset algorithm and verification data;

[0057] A positioning module for obtaining the current location information;

[0058] A main control module for splicing the current location information and the verification data, and calculating the spliced data using a preset algorithm to obtain the smart card key, and sending it to the client. For example, the current location information and the verification data can be spliced, and then the smart card key verification value can be calculated using a preset algorithm.

[0059] As an optional implementation, the system end includes:

[0060] A second storage module for storing preset location information, a preset algorithm, verification data, a user ID, and an identity key verification value corresponding to the user ID; it can be known that, under normal circumstances, the preset algorithm stored in the second storage module is the same as the preset algorithm stored in the first storage module. For example, the preset algorithm can adopt a hash algorithm and its similar verification algorithms.

[0061] Specifically, when a user applies for access approval during a business trip and records the location information in the application, after the application is approved, the location information recorded in the application will be stored in the second storage module as the preset location information.

[0062] The verification data can adopt a random number or a time stamp, mainly used to increase security and will be changed after each verification is passed.

[0063] A smart card key verification value calculation module for calculating the smart card key verification value according to the preset location information, the preset algorithm, and the verification data; for example, the preset location information and the verification data can be spliced, and then the smart card key verification value can be calculated using a preset algorithm.

[0064] An access control module is used to query the identity key verification value in the second storage module according to the user ID sent by the client, verify the smart card key and identity key sent by the client based on the smart card key verification value and the identity key verification value. If the verification is passed, the client is allowed to access the industrial control host.

[0065] As an optional implementation manner, the system side further includes: a preset algorithm and verification data update module, which is used to generate a new preset algorithm or verification data after each successful verification by the access control module and send it to the client, so that the client changes the preset algorithm or verification data stored in the first storage module according to the new preset algorithm or verification data, and after the client changes successfully, changes the preset algorithm or verification data in the second storage module according to the new preset algorithm or verification data.

[0066] In this implementation manner, after each successful verification, the preset algorithm or verification data is changed to improve the security of the system. At the same time, after the client changes successfully, the system side is modified to avoid the problem of data inconsistency between the system side and the smart card due to the unsuccessful writing of the smart card in special cases.

[0067] As an optional implementation manner, the client further includes: a preset algorithm and verification data rewriting module, which is used to change the preset algorithm or verification data stored in the first storage module according to the new preset algorithm or verification data received from the system side and send the rewriting result to the system side.

[0068] As an optional implementation manner, the first storage module includes: a first preset algorithm storage unit, a first verification data storage unit, a second preset algorithm storage unit, and a second verification data storage unit;

[0069] The first preset algorithm storage unit is used to store the newly changed preset algorithm, and the second preset algorithm storage unit is used to store the previously changed preset algorithm;

[0070] The first verification data storage unit is used to store the newly changed verification data, and the second verification data storage unit is used to store the previously changed verification data;

[0071] The preset algorithm and verification data rewriting module writes the new preset algorithm into the first preset algorithm storage unit. After the writing is successful, when the main control module reads the preset algorithm again, it reads from the first preset algorithm storage unit. After the writing fails, when the main control module reads the preset algorithm again, it reads from the second preset algorithm storage unit;

[0072] The preset algorithm and verification data rewriting module write the new verification data into the first verification data storage unit. After the writing is successful, the main control module reads the verification data from the first verification data storage unit when reading it again. After the writing fails, the main control module reads the verification data from the second verification data storage unit when reading it again.

[0073] In this embodiment, two storage units are updated in turn, so that the original preset algorithm and verification data are not affected when writing fails, thereby increasing the stability of the system.

[0074] As an optional implementation, the access control module is further used to obtain a location-free key instruction. If a location-free key instruction is obtained, the identity key verification value is queried in the second storage module based on the user ID sent by the user terminal, and the identity key sent by the user terminal is verified based on the identity key verification value. If the verification is successful, the client is allowed to access the industrial control host.

[0075] As an optional implementation, the location-free key instruction is generated by the user applying for location-free verification from the administrator, and the administrator approves it. The location-free key instruction can be generated in this system or in other OA systems or attendance systems and then sent to this system.

[0076] In this embodiment, in the case of poor positioning module signal, for example, in an underground parking lot or indoors of a high-rise building, the user can apply to the administrator to not verify the position, thereby increasing convenience of use.

[0077] On the other hand, refer to Figure 2 The present invention provides a method for controlling remote access to an industrial control host based on multi-factor authentication, which comprises:

[0078] Step S1, using the smart card to generate a smart card key according to the current location information, and sending it to the client;

[0079] Step S2, using the client to send the smart card key generated by the smart card, the user ID and identity key input by the user to the system end;

[0080] In step S3, the system obtains the verification value of the smart card key and the identity key according to the user ID, and verifies the smart card key and the identity key sent by the client according to the verification value of the smart card key and the identity key. If the verification is successful, the client is allowed to access the industrial control host.

[0081] The industrial control host remote access control method based on multi-factor authentication provided by this embodiment realizes multi-factor authentication by combining the client, smart card, and system end, ensuring that only authorized users can access the industrial control host. Innovatively, the smart card generates a unique smart card key based on the current location information, making the key time-sensitive and dynamically changing, increasing the difficulty of cracking. The smart card key generated by the smart card, the user ID entered by the user, and the identity key are sent to the system end through the client, and the client performs comprehensive verification.

[0082] As an optional implementation, using the system end to obtain the verification values of the smart card key and the identity key according to the user ID, and verifying the smart card key and the identity key sent by the client according to the verification values of the smart card key and the identity key. If the verification is passed, allowing the client to access the industrial control host includes:

[0083] Using the second storage module to store the preset location information, preset algorithm, verification data, user ID, and the identity key verification value corresponding to the user ID; it can be known that under normal circumstances, the preset algorithm stored in the second storage module is the same as the preset algorithm stored in the first storage module. For example, a hash algorithm and its similar verification algorithms can be used.

[0084] Specifically, when a user applies for access approval during a business trip and records the location information in the application, after the application is approved, the location information recorded in the application will be stored as the preset location information in the second storage module.

[0085] The verification data can be a random number or a timestamp, mainly used to increase security and will be changed after each successful verification.

[0086] Using the smart card key verification value calculation module to calculate the smart card key verification value according to the preset location information, preset algorithm, and verification data; for example, the preset location information and verification data can be concatenated, and then the preset algorithm is used for calculation to obtain the smart card key verification value.

[0087] Using the access control module to query the identity key verification value in the second storage module according to the user ID sent by the user end, and verifying the smart card key and the identity key sent by the user end according to the smart card key verification value and the identity key verification value. If the verification is passed, allowing the client to access the industrial control host.

[0088] For the detailed description of this embodiment, reference can be made to the corresponding descriptions in the foregoing embodiments, and details will not be repeated here.

[0089] The basic principles of the present disclosure have been described above in conjunction with specific embodiments. However, it should be noted that the advantages, strengths, and effects mentioned in this disclosure are merely illustrative and not restrictive, and should not be construed as necessarily possessed by each embodiment of the present disclosure. Furthermore, the specific details disclosed above are provided for illustrative purposes and to facilitate understanding, rather than as limitations. These details do not limit the present disclosure to necessarily being implemented using these specific details.

[0090] In the present disclosure, relational terms such as first and second, etc. are merely used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that there is any such actual relationship or order between these entities or operations. The block diagrams of the devices, devices, equipment, and systems involved in the present disclosure are merely illustrative examples and are not intended to require or imply that they must be connected, arranged, or configured in the manner shown in the block diagrams. As will be appreciated by those skilled in the art, these devices, devices, equipment, and systems can be connected, arranged, or configured in any manner. Words such as "including," "comprising," "having," and the like are open-ended words, meaning "including but not limited to," and can be used interchangeably therewith. The words "or" and "and" used herein refer to the words "and / or" and can be used interchangeably therewith, unless the context clearly indicates otherwise. The word "such as" used herein refers to the phrase "such as but not limited to," and can be used interchangeably therewith.

[0091] Additionally, as used herein, "or" used in a list of items beginning with "at least one" indicates a separate list, so that, for example, a list of "at least one of A, B, or C" means A or B or C, or AB or AC or BC, or ABC (i.e., A and B and C). Furthermore, the word "exemplary" does not mean that the example described is preferred or better than other examples.

[0092] It should also be noted that in the system and method of the present disclosure, each component or each step can be decomposed and / or recombined. Such decomposition and / or recombination should be regarded as equivalent solutions of the present disclosure.

[0093] Various changes, substitutions, and modifications may be made to the technology described herein without departing from the teachings defined by the appended claims. Moreover, the scope of the claims of this disclosure is not limited to the specific aspects of the processes, machines, manufactures, compositions of things, means, methods, and actions described above. Currently existing or later developed processes, machines, manufactures, compositions of things, means, methods, or actions that perform substantially the same function or achieve substantially the same results as the corresponding aspects described herein may be utilized. Accordingly, the appended claims include within their scope such processes, machines, manufactures, compositions of things, means, methods, or actions.

[0094] The foregoing description of the disclosed aspects is provided to enable any person skilled in the art to make or use the present disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects without departing from the scope of the present disclosure. Thus, the present disclosure is not intended to be limited to the aspects shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

[0095] The foregoing description has been presented for purposes of illustration and description. Furthermore, this description is not intended to limit the embodiments of the present disclosure to the forms disclosed herein. Although several example aspects and embodiments have been discussed above, those skilled in the art will recognize some of their variations, modifications, alterations, additions, and subcombinations.

Claims

1. An industrial control host remote access control system based on multi-factor authentication, characterized in that, Including: A client, a smart card, and a system side; The smart card is used to generate a smart card key according to the current location information and send it to the client; The client is used to send the smart card key generated by the smart card, the user ID input by the user, and the identity key to the system side; The system side is used to obtain the verification values of the smart card key and the identity key according to the user ID, and verify the smart card key and the identity key sent by the client according to the verification values of the smart card key and the identity key. If the verification is passed, the client is allowed to access the industrial control host; The system side includes: A second storage module for storing preset location information, a preset algorithm, check data, user IDs, and identity key verification values corresponding to the user IDs; A smart card key verification value calculation module for calculating the smart card key verification value according to the preset location information, the preset algorithm, and the check data; An access control module for querying the identity key verification value in the second storage module according to the user ID sent by the user side, verifying the smart card key and the identity key sent by the user side according to the smart card key verification value and the identity key verification value. If the verification is passed, the client is allowed to access the industrial control host; When a user applies for access approval during a business trip and records the location information in the application, after the application approval is passed, the location information recorded in the application will be stored in the second storage module as the preset location information.

2. The industrial control host remote access control system based on multi-factor authentication according to claim 1, wherein The smart card includes: A first storage module for storing a preset algorithm and check data; A positioning module for obtaining the current location information; A main control module for splicing the current location information and the check data, and calculating the spliced data using the preset algorithm to obtain the smart card key and sending it to the client.

3. The industrial control host remote access control system based on multi-factor authentication according to claim 2, wherein The system side further includes: a preset algorithm and check data update module for generating a new preset algorithm or check data after each successful verification by the access control module, and sending it to the client, so that the client changes the preset algorithm or check data stored in the first storage module according to the new preset algorithm or check data, and after the client changes successfully, changes the preset algorithm or check data in the second storage module according to the new preset algorithm or check data.

4. The industrial control host remote access control system based on multi-factor authentication according to claim 3, characterized in that, The client further includes: a preset algorithm and check data rewriting module for changing the preset algorithm or check data stored in the first storage module according to the new preset algorithm or check data received from the system side, and sending the rewriting result to the system side.

5. The industrial control host remote access control system based on multi-factor authentication according to claim 4, characterized in that, The first storage module includes: a first preset algorithm storage unit, a first check data storage unit, a second preset algorithm storage unit, and a second check data storage unit; The first preset algorithm storage unit is used to store the newly changed preset algorithm, and the second preset algorithm storage unit is used to store the previously changed preset algorithm; The first check data storage unit is used to store the newly changed check data, and the second check data storage unit is used to store the previously changed check data; The preset algorithm and verification data rewriting module writes the new preset algorithm into the first preset algorithm storage unit. After successful writing, when the main control module reads the preset algorithm again, it reads from the first preset algorithm storage unit. After failed writing, when the main control module reads the preset algorithm again, it reads from the second preset algorithm storage unit. The preset algorithm and verification data rewriting module writes the new verification data into the first verification data storage unit. After successful writing, when the main control module reads the verification data again, it reads from the first verification data storage unit. After failed writing, when the main control module reads the verification data again, it reads from the second verification data storage unit.

6. The industrial control host remote access control system based on multi-factor authentication according to claim 5, wherein, The access control module is further configured to obtain a location-free key instruction. If the location-free key instruction is obtained, it queries the identity key verification value in the second storage module according to the user ID sent by the client, and verifies the identity key sent by the client according to the identity key verification value. If the verification is passed, the client is allowed to access the industrial control host.

7. The industrial control host remote access control system based on multi-factor authentication according to claim 6, wherein The location-free key instruction is generated after the user applies for a location-free verification application to the administrator and the administrator approves it.

8. A remote access control method for industrial control hosts based on multi-factor authentication, based on the multi-factor authentication-based industrial control host remote access control system according to any one of claims 1-7, characterized in that, Including: Using the smart card to generate a smart card key according to the current location information and sending it to the client; Using the client to send the smart card key generated by the smart card, the user ID input by the user, and the identity key to the system side; Using the system side to obtain the verification values of the smart card key and the identity key according to the user ID, and verifying the smart card key and the identity key sent by the client according to the verification values of the smart card key and the identity key. If the verification is passed, the client is allowed to access the industrial control host; Using the system side to obtain the verification values of the smart card key and the identity key according to the user ID, and verifying the smart card key and the identity key sent by the client according to the verification values of the smart card key and the identity key. If the verification is passed, the client is allowed to access the industrial control host includes: Using the second storage module to store the preset location information, preset algorithm, verification data, user ID, and the identity key verification value corresponding to the user ID; Using the smart card key verification value calculation module to calculate the smart card key verification value according to the preset location information, preset algorithm, and verification data; Using the access control module to query the identity key verification value in the second storage module according to the user ID sent by the client, and verifying the smart card key and the identity key sent by the client according to the smart card key verification value and the identity key verification value. If the verification is passed, the client is allowed to access the industrial control host; When the user applies for access approval during a business trip and records the location information in the application, after the application is approved, the location information recorded in the application will be stored in the second storage module as the preset location information.

Images