Trusted switch key management method and device based on TPCM and electronic equipment

Abstract

The invention discloses a trusted switch key management method and device based on TPCM and an electronic device, and relates to the technical field of key trusted management, the method comprises the following steps: obtaining a key of a TPCM device, the key comprising a user signature public key and a user signature private key, the user signature public key comprising a valid date; judging whether the valid date is updated or not, if so, updating the user signature public key according to the valid date, and updating and storing the user signature private key according to the updated user signature public key and an SM9 algorithm; the updated user signature public key is sent to the security management terminal through the trusted switch, so that the updated user signature public key is distributed to other devices; and responding to and executing the trusted policy sent by the trusted switch, or responding to and executing policy information sent by the trusted switch. According to the method, credibility verification can be performed on the node equipment in the key distribution process, effective credible management and control are realized, and key management and dynamic credibility measurement can be realized by a credible strategy.

Description

Technical Field

[0001] The present invention belongs to the technical field of key trusted management, and in particular relates to a trusted switch key management method, device and electronic equipment based on TPCM. Background Art

[0002] Industrial Control System (ICS) is widely used in more than 80% of core areas such as hydropower dispatching, power grid monitoring, and oil and gas pipeline pressure control, and has immeasurable value in maintaining the stable operation of national infrastructure. However, in recent years, with the rapid development of information technology, cyber attacks on ICS have occurred frequently, affecting multiple key information infrastructure fields such as energy, transportation, manufacturing, medical care, and communications.

[0003] According to authoritative disclosure, at least 30% of representative industrial enterprises or organizations around the world have reported that they have suffered cyber attacks. Given the potential impact of unreported statistics, the actual proportion of attacks may be even more severe. In particular, Advanced Persistent Threat (APT) is malware designed specifically for ICS. With its highly concealed diffusion mechanism and destructive capabilities, it can penetrate traditional isolation and protection strategies, making the existing security system seem powerless.

[0004] Faced with this grim situation, strengthening the information security research of ICS, especially implementing efficient information security solutions in core components such as PLC controllers (Programmable Logic Controller), DCS controllers (Distributed Control System), and SIS (Safety Instrumented System), has become an urgent need in the industry. With the widespread application of emerging technologies such as artificial intelligence, big data, the Internet of Things, cloud computing, and fully digital instrumentation and control systems, the industrial control network environment is becoming increasingly complex. Traditional static protection mechanisms are difficult to effectively respond to new attack methods, and the security protection situation urgently needs transformation and upgrading.

[0005] In this context, my country has included industrial control systems in the coverage of the cybersecurity multi-level protection system (MLP 2.0). On the technical level, security strategies have evolved from layered passive protection to active immune protection systems based on scientific security frameworks; in engineering practice, they have shifted from traditional computer information system protection to the construction of active cyberspace defense systems in new computing environments. Trusted verification, as one of the core security protection methods recommended by MLP 2.0, is of great significance for ensuring the security of key nodes such as secure communication equipment and secure area boundary equipment.

[0006] Therefore, in-depth research and construction of an active defense technology system and key technologies for industrial control systems that meet the needs, and carrying out large-scale application demonstrations in hot industries are not only the key path to improving the overall protection capabilities of ICS, but also the choice to ensure the security of the national production system infrastructure and maintain the stable development of the social economy.

[0007] Patent CN111083131A proposes a lightweight identity authentication method for power Internet of Things sensing terminals, which ensures communication security through interactive verification of ciphertext data and signature values, and alerts the terminal when verification fails. Patent CN107579819B discloses an SM9 digital signature method and system, which ensures the security of private keys and enhances the fairness and security of signatures through the joint participation of both parties in generating signatures, and finally outputs the target digital signature of successful verification. Patent CN107579819B discloses an SM9 digital signature method and system, which ensures the security of private keys and enhances the fairness and security of signatures through the joint participation of both parties in generating signatures, and finally outputs the target digital signature of successful verification. Patent CN109951288B discloses a hierarchical signature method based on SM9, which manages keys through a tree structure, realizes secure signatures and verifications for users at different levels, keeps the length of private keys unchanged and verifications efficient, and ensures security under the standard model.

[0008] Some of the above patents are based on agent-based identity authentication and are used in the Internet of Things industry. They are research on the transformation of the SM9 algorithm and the improvement of digital signature security. They are not targeted at related applications in industrial control systems and do not involve trusted key management methods for industrial control systems. Summary of the invention

[0009] In order to solve the above problems, the present invention proposes a trusted switch key management method, device and electronic device based on TPCM, which can perform trusted verification on TPCM devices in industrial control systems during key distribution, and realize effective trusted management and control of TPCM devices; the trusted strategy can realize scientific key management and dynamic trusted measurement of TPCM devices.

[0010] In a first aspect, the present invention provides a TPCM device key management method, wherein the TPCM device is applied to an industrial control system, wherein the industrial control system further comprises a trusted switch, other devices, and a security management terminal, wherein the TPCM device, the other devices, and the security management terminal are respectively connected to the trusted switch, and the method is applied to the TPCM device, and the method comprises:

[0011] Obtaining a key of the TPCM device, wherein the key includes a user signature public key and a user signature private key, wherein the user signature public key includes at least a validity date;

[0012] Determine whether the validity date is updated, and if so, update the user signature public key according to the validity date, and update the user signature private key according to the updated user signature public key and SM9 algorithm and save;

[0013] Sending the updated user signature public key to the security management terminal through the trusted switch, so that the security management terminal sends information to the trusted switch allowing the updated user signature public key of the TPCM device to be distributed to the other devices; and

[0014] In response to the trusted policy sent by the trusted switch, the trusted policy is executed, or, in response to the policy information generated based on the trusted policy sent by the trusted switch, the policy information is executed; wherein the trusted policy is sent by the security management terminal to the trusted switch, and the trusted policy includes a key management policy.

[0015] In an optional implementation manner, the key management policy includes a key update frequency policy, a key update permission policy, a mandatory key update policy, and a primary and backup key policy; and the policy information includes key update information.

[0016] In an optional implementation, the trusted policy further includes a dynamic trusted measurement policy, and the policy information further includes current information to be measured of the TPCM device.

[0017] In a second aspect, the present invention provides a trusted switch key management method, wherein the trusted switch is applied to an industrial control system, the industrial control system further includes a TPCM device, other devices and a security management terminal, the TPCM device, the other devices and the security management terminal are respectively connected to the trusted switch, the TPCM device uses a key to perform security protection on the system, the key includes a user signature public key and a user signature private key, wherein the user signature public key at least includes an effective date; the TPCM device updates the user signature public key according to the updated effective date to obtain an updated user signature public key, and updates the user signature private key according to the updated user signature public key and the SM9 algorithm and saves it; the method is applied to the trusted switch, and the method includes:

[0018] In response to the updated user signature public key sent by the TPCM device, sending the updated user signature public key to the security management terminal;

[0019] In response to the information sent by the security management terminal allowing the updated user signature public key of the TPCM device to be distributed to the other devices, distributing the updated user signature public key of the TPCM device to the other devices;

[0020] In response to the trusted policy sent by the security management terminal, the trusted policy is executed, or the trusted policy is sent to the TPCM device, or policy information generated based on the trusted policy is sent to the TPCM device; wherein the trusted policy includes a key management policy.

[0021] In an optional implementation manner, the key management policy includes a key update frequency policy, a key update permission policy, a mandatory key update policy, and a primary and backup key policy; and the policy information includes key update information.

[0022] In an optional implementation manner, the key update information includes key update disallowance information, second mandatory key update information, key update disallowance information, storage of current user signature public key information, and primary and standby key switching information;

[0023] The key update frequency strategy includes:

[0024] Obtaining the updated user signature public key sent by the TPCM device;

[0025] Determining a key update frequency of the TPCM device within a preset first time period according to the updated user signature public key;

[0026] Determine whether the key update frequency exceeds a preset key update frequency threshold, and if so, send key update disallowed information to the TPCM device, and send an alarm message to the security management terminal;

[0027] The key update permission policy includes:

[0028] When the TPCM device is continuously and uninterruptedly running within a preset time period, sending key update disallowance information to the TPCM device within the preset time period to ensure the continuity of the running state of the TPCM device;

[0029] The mandatory key update strategy includes:

[0030] Receiving first mandatory key update information sent by the security management terminal;

[0031] sending second mandatory key update information to the TPCM device according to the first mandatory key update information, so that the TPCM device performs key update according to the second mandatory key update information;

[0032] The primary and backup key strategies include:

[0033] In response to the updated user signature public key sent by the TPCM device, the current user signature public key is stored as a standby user signature public key, or the current user signature public key is sent to the security management terminal so that the security management terminal stores the user signature public key, or the current user signature public key storage information is sent to the TPCM device;

[0034] The primary and backup key strategy also includes:

[0035] In response to the key update failure information sent by the TPCM device, sending the standby user signature public key to the TPCM device, so that the TPCM device uses the standby user signature public key for security protection;

[0036] The primary and backup key strategy also includes:

[0037] Send the primary and backup key switching information to the TPCM device, so that the TPCM device switches to the backup user signature public key for security protection.

[0038] In an optional implementation, the trusted strategy further includes a dynamic trusted measurement strategy, and the dynamic trusted measurement strategy includes:

[0039] Obtaining current information to be measured of the TPCM device;

[0040] The current information to be measured is trusted measured according to a trusted verification model; when the measurement passes, returning to the step of obtaining the current information to be measured of the TPCM device; when the measurement fails, disconnecting the connection between the trusted switch and the TPCM device.

[0041] In a third aspect, the present invention provides a TPCM device key management device, wherein the TPCM device is applied to an industrial control system, wherein the industrial control system further comprises a trusted switch, other devices and a security management terminal, wherein the TPCM device, the other devices and the security management terminal are respectively connected to the trusted switch, and the device is applied to the TPCM device, and the device comprises:

[0042] An acquisition module, used to acquire a key of the TPCM device, wherein the key includes a user signature public key and a user signature private key, and the user signature public key at least includes a validity date;

[0043] A judgment module, used to judge whether the validity date is updated, and if so, update the user signature public key according to the validity date, and update the user signature private key according to the updated user signature public key and SM9 algorithm and save it;

[0044] A first distribution module, configured to send the updated user signature public key to the security management terminal through the trusted switch, so that the security management terminal sends information to the trusted switch allowing the updated user signature public key of the TPCM device to be distributed to the other devices;

[0045] A first trusted policy module is used to execute the trusted policy in response to the trusted policy sent by the trusted switch, or to execute the policy information generated based on the trusted policy sent by the trusted switch; wherein the trusted policy is sent by the security management terminal to the trusted switch, and the trusted policy includes a key management policy.

[0046] In a fourth aspect, the present invention provides a trusted switch key management device, wherein the trusted switch is applied to an industrial control system, wherein the industrial control system further includes a TPCM device, other devices and a security management terminal, wherein the TPCM device, the other devices and the security management terminal are respectively connected to the trusted switch, and the TPCM device uses a key to perform security protection on the system, wherein the key includes a user signature public key and a user signature private key, wherein the user signature public key includes at least a validity date; the TPCM device updates the user signature public key according to the updated validity date to obtain an updated user signature public key, and updates the user signature private key according to the updated user signature public key and the SM9 algorithm and saves it; the device is applied to the trusted switch, and the device includes:

[0047] a sending module, configured to send the updated user signature public key to the security management terminal in response to the updated user signature public key sent by the TPCM device;

[0048] A second distribution module, configured to distribute the updated user signature public key of the TPCM device to other devices in response to the information sent by the security management terminal allowing the updated user signature public key of the TPCM device to be distributed to the other devices;

[0049] The second trusted policy module is used to execute the trusted policy in response to the trusted policy sent by the security management terminal, or send the trusted policy to the TPCM device, or send policy information generated based on the trusted policy to the TPCM device; wherein the trusted policy includes a key management policy.

[0050] In a fifth aspect, the present invention provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the method described in any one of the aforementioned implementations when executing the computer program.

[0051] In a sixth aspect, the present invention provides a computer-readable medium having a non-volatile program code executable by a processor, wherein the program code enables the processor to execute the method described in any one of the aforementioned embodiments.

[0052] The technical solution provided by the embodiment of the present invention has the following beneficial effects: the trusted switch key management method, device and electronic device based on TPCM of the present invention updates the user signature public key and the user signature private key after detecting that the validity date of the TPCM device is updated; and after the update, the user signature public key is sent to the security management terminal for verification, and after the verification is passed, the user signature public key is distributed to other devices using the trusted switch, thereby realizing trusted verification of the TPCM device and realizing effective trusted management and control of the TPCM device; and the TPCM device can automatically update the key, realize decentralization, easy implementation, and economical and practical; the security management terminal of the present invention also issues a trusted policy, and realizes scientific and effective management of the key through the key management policy in the trusted policy, ensuring that the TPCM device can operate safely and efficiently during and after the key update. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 A schematic diagram of a process flow of a TPCM device key management method provided by an embodiment of the present invention;

[0054] Figure 2 This is a schematic diagram of the principle of an industrial control system;

[0055] Figure 3 A schematic diagram of the key update principle provided by an embodiment of the present invention;

[0056] Figure 4 A schematic diagram of a flow chart of a trusted switch key management method provided by an embodiment of the present invention;

[0057] Figure 5 A schematic diagram of the system principle of the TPCM device key management device provided by an embodiment of the present invention;

[0058] Figure 6 A schematic diagram of the system principle of a trusted switch key management device provided by an embodiment of the present invention;

[0059] Figure 7 A schematic diagram of the system principle of an electronic device provided by an embodiment of the present invention.

[0060] In the figure: 110-acquisition module; 120-judgment module; 130-first distribution module; 140-first trusted policy module; 210-sending module; 220-second distribution module; 230-second trusted policy module; 21-trusted switch; 22-security management terminal; 23-industrial embedded controller; 24-host computer; 25-TPCM module; 400-electronic device; 401-communication interface; 402-processor; 403-memory; 404-bus. DETAILED DESCRIPTION

[0061] The present invention will be described in detail below with reference to the accompanying drawings and in conjunction with embodiments.

[0062] See also Figure 1 This embodiment provides a TPCM device key management method. The industrial control system in this embodiment includes a trusted switch, a TPCM device, other devices and a security management terminal. The TPCM device, other devices and the security management terminal are respectively connected to the trusted switch. The TPCM device and other devices are respectively connected to the trusted switch as nodes. The TPCM device and other devices can be industrial embedded controllers or host computers. Figure 2 , the security management terminal 22, the trusted switch 21 and each node in the system together form a local area network. The node may be installed with an industrial embedded controller 23 or a host computer 24 in an industrial control system. The industrial embedded controller 23 and the host computer 24 are respectively installed with a TPCM module 25 (Trusted Platform Control Module) or the functions of the TPCM module 25 are integrated to implement the method of this embodiment through the TPCM module 25. The method of this embodiment is applied to a TPCM device, and the method of this embodiment includes the following steps S110 to S140.

[0063] Step S110, obtaining the key of the TPCM device, the key includes a user signature public key and a user signature private key, and the user signature public key at least includes a validity date.

[0064] Specifically, the keys in the TPCM device are usually stored in its own storage (for example, in the memory), and the keys include the user signature public key, the user signature private key, the signature master private key, the signature master public key, and the parameters used to generate the user signature private key. Among them, the signature master private key, the signature master public key and the parameters are all preset in the TPCM device at the factory for secret storage and are never exported, thereby ensuring the security of the core key through hardware. The user signature public key includes the ID (abbreviation of Identifier, indicating identifier or identification code) of the TPCM device, the validity date and other data, among which the validity date refers to the deadline for updating the key. For example, the built-in validity date of a device is: December 30, 2024. Other data can be MAC address (Media Access Control Address, media access control address), chip serial number in the TPCM device, etc.

[0065] Step S120, determine whether the validity date is updated. If yes, update the user signature public key according to the validity date, and update the user signature private key according to the updated user signature public key and SM9 algorithm (an identity-based cryptographic algorithm, abbreviated as IBC) and save it.

[0066] Specifically, when the validity date changes, the user signature public key is updated to form a new user signature public key. Figure 3 The updated user signature public key is then used through the user signature key generation algorithm in the SM9 algorithm, combined with the signature master public key (Ppub-s), signature master private key (ks) and parameters (para) to generate the user signature private key (ds) and keep it secret.

[0067] Step S130, the trusted report of the TPCM device and the updated user signature public key are sent to the security management terminal through the trusted switch, so that the security management terminal verifies the trusted report. When the verification is successful, the security management terminal sends information to the trusted switch allowing the updated user signature public key of the TPCM device to be distributed to other devices.

[0068] Specifically, this step is a step of distributing the key of the TPCM device in the node n. After the key is updated, the TPCM device connected to a certain node n will send the trusted report generated by the TPCM device and the user signed public key to the trusted switch. The trusted switch will then send the trusted report and the MAC address of the node n to the security management terminal for verification. Before the TPCM device is connected to the node n, the MAC address has been registered in the security management terminal. Now, the security management terminal judges the legitimacy of the MAC address and verifies the trusted report. After the judgment and verification are passed, the trusted switch is notified so that the trusted switch sends the public key of the TPCM device to other nodes.

[0069] Step S140: executing the trusted policy in response to the trusted policy sent by the trusted switch, or executing the policy information generated based on the trusted policy in response to the trusted switch.

[0070] Specifically, the trusted policy is sent by the security management terminal to the trusted switch, that is, the security management terminal will send the trusted policy to the trusted switch. The trusted policy includes the key management policy and the trusted measurement policy. The key management policy is used to implement key management of the devices connected to each node, and the trusted measurement policy is used to implement security and trusted measurement of the devices connected to each node.

[0071] More specifically, the key management policy includes a key update frequency policy, a key update permission policy, a forced key update policy, and a primary and backup key policy; and the policy information includes key update information. The key update frequency policy is used to limit the key update frequency of the TPCM device, the key update permission policy is used to limit whether the key of the TPCM device is allowed to be updated or not allowed to be updated, the forced key update policy is used to force the key of the TPCM device to be updated or force the TPCM device not to update the key, and the primary and backup key policy is used to use the key of the TPCM device before the update as a backup key.

[0072] The trusted measurement strategy ensures that the behavior of devices connected to the switch remains trustworthy by dynamically measuring the trusted TPCM devices, effectively preventing devices connected to the switch from launching malicious attacks on the network and improving the overall security of the network.

[0073] After the TPCM device is registered with the security management terminal, the security management terminal sets a trusted policy according to the type of TPCM device and sends the trusted policy to the trusted switch. The trusted switch dynamically measures the trusted TPCM device according to the trusted policy, monitors the network behavior and data transmission of the device in real time, and takes isolation, alarm and other measures in time when abnormal behavior is found. At the same time, the trusted report of the device is periodically obtained and sent to the security management terminal for judgment.

[0074] In the key distribution process, this embodiment realizes the trusted verification of nodes through the security management platform and the trusted switch, and realizes effective trusted management and control. The nodes can automatically update the keys. From this perspective, decentralization is achieved, the implementation is convenient, and it is economical and practical. In the industrial embedded controller, the signature master private key, signature master public key, and parameters are preset in the TPCM at the factory, stored secretly and never exported, and the security of the core key is guaranteed by hardware.

[0075] See also Figure 4This embodiment provides a trusted switch key management method, which is applied to a trusted switch. The method includes the following steps S210 to S230.

[0076] Step S210, in response to the updated user signature public key sent by the TPCM device, the updated user signature public key is sent to the security management terminal.

[0077] Specifically, after the user signature public key is updated, the TPCM device will send the updated user signature public key together with the trusted report to the security management terminal through the trusted switch.

[0078] Step S220: In response to the information sent by the security management terminal allowing the updated user signature public key of the TPCM device to be distributed to other devices, the updated user signature public key of the TPCM device is distributed to other devices.

[0079] Specifically, when the security management terminal verifies the trusted report, the trusted switch is allowed to send the user signature public key of node n to each node after the verification is passed. The trusted report refers to the information generated when the device is started using the trusted computing 3.0 technology. The trusted report can include the following information: whether the firmware has been verified; update the trusted status when the target is running; when the TPCM device is detected to be attacked or the code is tampered with, record the attack information and code tampering information.

[0080] Step S230, in response to the trusted policy sent by the security management terminal, execute the trusted policy, or send the trusted policy to the TPCM device, or send policy information generated based on the trusted policy to the TPCM device; wherein the trusted policy includes a key management policy.

[0081] Specifically, some trusted policies need to be executed by the trusted switch and send policy information to the TPCM device; while some trusted policies need to be executed by the TPCM device, in which case the trusted switch may need to feedback information to the security management terminal or the TPCM device.

[0082] The trust policy of this embodiment includes at least two categories, one is the key management policy, and the other is the dynamic trust measurement policy. The key management policy includes the key update frequency policy, the key update permission policy, the mandatory key update policy and the primary and backup key policy; the policy information includes the key update information.

[0083] When the key of the TPCM device changes frequently due to attacks, this situation not only seriously consumes the TPCM device itself, but also affects the computing resources of the trusted switch, security management terminal and related devices, and causes significant occupation of network bandwidth. To address this problem, it is necessary to impose necessary restrictions on the key update frequency. In this scenario, the corresponding key update frequency strategy should be communicated and executed to the trusted switch through the security management terminal to balance security requirements and the reasonable use of system resources. The key update frequency strategy includes the following steps (11)-(13).

[0084] (11) Obtain the updated user signature public key sent by the TPCM device.

[0085] (12) Determine the key update frequency of the TPCM device within a preset first time period according to the updated user signature public key.

[0086] The trusted switch records the update times of the TPCM device, and when the user signature is updated, updates the update times again, and then calculates the value of the update frequency; or, the trusted switch records the update frequency of the TPCM device, and when the user signature is updated, updates the value of the update frequency.

[0087] (13) Determine whether the key update frequency exceeds a preset key update frequency threshold. If yes, send key update disallowance information to the TPCM device and send an alarm message to the security management terminal.

[0088] According to the preset key update frequency threshold, for example, m times / day, it is determined whether the current key update frequency exceeds the threshold. If it exceeds the threshold, it means that the key is updated frequently. The trusted switch refuses the TPCM device to update the key, generates an alarm, and reports it to the security management terminal.

[0089] In actual industrial control systems, when the TPCM device is an embedded device such as a PLC controller, a DCS controller, etc., it is sometimes necessary to ensure that the TPCM device runs continuously and uninterruptedly (for example, when the device is connected to a trusted switch). In this scenario, key updates may affect the access and communication status of the TPCM device; therefore, for such devices, a key update permission policy needs to be implemented to set the TPCM device to not allow key updates. Therefore, the key update permission policy includes the following steps (21).

[0090] (21) When the TPCM device runs continuously and uninterruptedly within a preset time period, a key update prohibition message is sent to the TPCM device within the preset time period to ensure the continuity of the operation status of the TPCM device.

[0091] When the key update permission policy is executed, if it is set not to allow key update and the TPCM device attempts to update, the trusted switch will reject the update and generate an alarm message to report to the security management terminal.

[0092] When the equipment is shut down or under maintenance, and key update is indeed required, the security management terminal issues a mandatory key update policy. For example, the TPCM equipment is overhauled and key updated once a year. At this time, the security management terminal initiates a mandatory key update policy, which includes the following steps (31)-(32).

[0093] (31) receiving first mandatory key update information sent by the security management terminal;

[0094] (32) Sending second mandatory key update information to the TPCM device according to the first mandatory key update information, so that the TPCM device performs key update according to the second mandatory key update information.

[0095] The mandatory key update policy is initiated by the security management terminal, so the first mandatory key update information and the second mandatory key update information may have the same content, that is, the trusted switch forwards the mandatory key update information to the target terminal.

[0096] For high-availability devices such as PLC controllers and DCS controllers, in order to ensure the continuity of device operation, the security management terminal can issue a master-slave key strategy to continue to save the original key to ensure that when a special situation such as a key update failure occurs, it can quickly switch to the original key to avoid the situation where no key is available due to a key update failure. This embodiment lists three master-slave key strategies, and the first master-slave key strategy includes the following steps (41).

[0097] (41) In response to the updated user signature public key sent by the TPCM device, the current user signature public key is stored as a backup user signature public key, or the current user signature public key is sent to the security management terminal so that the security management terminal stores the user signature public key, or the information of storing the current user signature public key is sent to the TPCM device. Specifically, the method of this embodiment is intended to illustrate that the original key can be stored as a backup key in a trusted switch or a security management terminal or a TPCM device.

[0098] The second primary-backup key strategy includes the following step (51), which is intended to illustrate that when the key update fails, the original key is sent to the TPCM device as a backup key.

[0099] (51) In response to the key update failure information sent by the TPCM device, the backup user signature public key is sent to the TPCM device, so that the TPCM device uses the backup user signature public key for security protection.

[0100] The third master-slave key strategy includes the following steps (61) to illustrate that in a scenario where a key update needs to be performed quickly, only the master-slave key switching information can be sent to achieve rapid key switching without going through the process of new key generation and distribution, thereby saving computing resources and network bandwidth.

[0101] (61) Send the primary and backup key switching information to the TPCM device, so that the TPCM device switches to the backup user signature public key for security protection.

[0102] The key management strategy of this embodiment can achieve scientific management of the keys of node devices, ensuring that the devices can operate safely and reliably before, during and after key updates.

[0103] The trusted policy also includes a trusted measurement policy executed by the trusted switch, and the dynamic trusted measurement policy includes the following steps (71)-(72).

[0104] (71) Obtain the current information to be measured of the TPCM device.

[0105] (72) Perform trust measurement on the current information to be measured according to the trust verification model; when the measurement passes, return to step (71); when the measurement fails, disconnect the connection between the trusted switch and the TPCM device.

[0106] In an industrial control system, the types of TPCM devices can be engineer stations, operator stations, and PLC controllers. In this embodiment, the engineer station is used as the TPCM device. The communication relationship of the engineer station is relatively simple, usually including communication with the PLC controller (i.e., the aforementioned other devices) within a fixed range. The security management terminal in this embodiment can be used as a trusted third-party adjudication system, responsible for formulating and issuing dynamic trusted measurement strategies and adjudicating trusted reports.

[0107] The trusted verification model is used to characterize the communication characteristics between the TPCM device and other devices; the trusted verification model includes a logical combination of one or more sub-verification models. Here, the communication characteristics refer to the characteristics of the network behavior of the TPCM device, such as communication relationship, data bandwidth, communication duration, communication direction and data packet size. Among them, the communication relationship refers to the communication relationship between the TPCM device and other devices. "Logic" includes AND logic and OR logic. Therefore, the logical combination can be that the first sub-verification model and the second sub-verification model simultaneously meet their respective corresponding threshold ranges, or it can be that only two of the first sub-verification model, the second sub-verification model or the second sub-verification model meet their respective corresponding threshold ranges.

[0108] Preferably, when the TPCM device is an engineer station in an industrial control system and the other devices are PLC controllers in the industrial control system, the trusted verification model of the engineer station includes a logical combination of one or more sub-verification models in the long-term bandwidth sub-verification model, the burst bandwidth sub-verification model, the high bandwidth duration sub-verification model, and the high bandwidth occurrence times per unit time sub-verification model. In some possible embodiments, these sub-verification models are all provided with a threshold range; therefore, after obtaining the trusted verification model of the TPCM device sent by the security management terminal, it is also necessary to determine the threshold range corresponding to each sub-verification model to determine the threshold line of the trusted verification model.

[0109] When configuring the threshold line, consider that the engineer station is usually only monitoring the status and the data volume is small. A large amount of data will be sent only when performing engineering configuration or upgrading the firmware. The modification of engineering configuration and firmware must be very low frequency. Therefore, the threshold line can be set as follows: the long-term bandwidth is less than the first threshold, the burst bandwidth increases, the high bandwidth duration is less than the second threshold, and the number of high bandwidth occurrences per unit time is less than the third threshold.

[0110] The information to be measured is sent by the TPCM device to the trusted switch. The information to be measured refers to the communication characteristics of the TPCM device, such as the communication characteristics of the engineer station, including communication bandwidth and communication duration.

[0111] Since the trusted verification model includes a logical combination of multiple sub-verification models, the value of each sub-verification model is calculated using the current information to be measured. For example, in the burst bandwidth sub-verification model, the value of the burst bandwidth is calculated using the current information to be measured. For some sub-verification models, it is necessary to record and store information to be measured for a certain duration, such as the long-term bandwidth sub-verification model and the high-bandwidth duration sub-verification model. The long-term bandwidth sub-verification model needs to record the bandwidth of a preset duration and then calculate the bandwidth of the preset duration; the high-bandwidth duration sub-verification model needs to record the duration of the bandwidth that meets the preset bandwidth threshold to obtain the duration value.

[0112] Whether the measurement is passed is determined by the threshold line, and the threshold line includes threshold ranges corresponding to multiple sub-verification models. The threshold ranges corresponding to the multiple sub-verification models are used to determine whether each sub-verification model exceeds the corresponding threshold range. If so, the measurement fails. If it does not exceed the corresponding threshold range, the measurement passes. For example, whether the long-term bandwidth value obtained by the long-term bandwidth sub-verification model is less than the first threshold, whether the high bandwidth duration value obtained by the high bandwidth duration sub-verification model is less than the second threshold, whether the high bandwidth occurrence times per unit time value obtained by the high bandwidth occurrence times per unit time sub-verification model is less than the third threshold, and whether the burst bandwidth value obtained by the burst bandwidth sub-verification model is greater than the fourth threshold. If one of the above exceeds the threshold range, the measurement fails. If all of them meet the threshold range, the measurement passes. When the measurement fails, the connection between the trusted switch and the TPCM device is disconnected. When the measurement passes, return to (71) to continue dynamic measurement.

[0113] The dynamic trust measurement strategy of this embodiment can continuously measure the trustworthiness of the behavior of the access device, effectively prevent the occurrence of malicious behavior, and ensure the security and trustworthiness of the entire industrial control network.

[0114] See also Figure 5 The present embodiment provides a TPCM device key management device, the industrial control system includes a trusted switch, a TPCM device, other devices and a security management terminal, the TPCM device, other devices and the security management terminal are respectively connected to the trusted switch, the device is applied to the TPCM device, and the device includes:

[0115] An acquisition module 110 is used to acquire a key of the TPCM device, where the key includes a user signature public key and a user signature private key, and the user signature public key at least includes a validity date;

[0116] The judging module 120 is used to judge whether the validity date is updated. If yes, the user signature public key is updated according to the validity date, and the user signature private key is updated and saved according to the updated user signature public key and SM9 algorithm;

[0117] The first distribution module 130 is used to send the updated user signature public key to the security management terminal through the trusted switch, so that the security management terminal sends the information allowing the updated user signature public key of the TPCM device to be distributed to other devices to the trusted switch;

[0118] The first trusted policy module 140 is used to execute the trusted policy in response to the trusted policy sent by the trusted switch, or to execute the policy information generated based on the trusted policy sent by the trusted switch; wherein the trusted policy is sent by the security management terminal to the trusted switch, and the trusted policy includes a key management policy.

[0119] In an optional embodiment, the key management policy includes a key update frequency policy, a key update permission policy, a mandatory key update policy, and a primary and backup key policy; and the policy information includes key update information.

[0120] In an optional embodiment, the trust policy further includes a dynamic trust metric policy.

[0121] See also Figure 6 The present embodiment provides a trusted switch key management device, the industrial control system includes a trusted switch, a TPCM device, other devices and a security management terminal, the TPCM device, the other devices and the security management terminal are respectively connected to the trusted switch, the TPCM device uses a key to protect the system, the key includes a user signature public key and a user signature private key, wherein the user signature public key at least includes an effective date; the TPCM device updates the user signature public key according to the updated effective date to obtain the updated user signature public key, and updates the user signature private key according to the updated user signature public key and the SM9 algorithm and saves it; the device is applied to the trusted switch, and the device includes:

[0122] The sending module 210 is used to send the updated user signature public key to the security management terminal in response to the updated user signature public key sent by the TPCM device;

[0123] The second distribution module 220 is used to distribute the updated user signature public key of the TPCM device to other devices in response to the information sent by the security management terminal allowing the updated user signature public key of the TPCM device to be distributed to other devices;

[0124] The second trusted policy module 230 is used to execute the trusted policy in response to the trusted policy sent by the security management terminal, or send the trusted policy to the TPCM device, or send policy information generated based on the trusted policy to the TPCM device; wherein the trusted policy includes the key management policy.

[0125] In an optional embodiment, the key update information includes key update disallowance information, second mandatory key update information, key update disallowance information, storage of current user signature public key information, and primary and standby key switching information;

[0126] The key update frequency strategy includes a user signature public key module, an update frequency module and an information sending module. The user signature public key module is used to obtain the updated user signature public key sent by the TPCM device. The update frequency module is used to determine the key update frequency of the TPCM device within a preset first time period according to the updated user signature public key. The information sending module is used to determine whether the key update frequency exceeds the preset key update frequency threshold, and if so, send key update disallowed information to the TPCM device, and send an alarm message to the security management terminal;

[0127] The key update permission policy includes a key update information module, which is used to send key update disallowance information to the TPCM device within a preset time period when the TPCM device runs continuously and uninterruptedly within a preset time period, so as to ensure the continuity of the running state of the TPCM device.

[0128] The mandatory key update strategy includes an information receiving module and a key update module. The information receiving module is used to receive the first mandatory key update information sent by the security management terminal. The key update module is used to send the second mandatory key update information to the TPCM device according to the first mandatory key update information, so that the TPCM device performs key update according to the second mandatory key update information.

[0129] The primary-backup key strategy includes a first storage module, which is used to store the current user signature public key as a backup user signature public key in response to the updated user signature public key sent by the TPCM device, or to send the current user signature public key to the security management terminal so that the security management terminal stores the user signature public key, or to send information to the TPCM device to store the current user signature public key.

[0130] The primary and backup key strategy also includes a security protection module, which is used to send the backup user signature public key to the TPCM device in response to the key update failure information sent by the TPCM device, so that the TPCM device uses the backup user signature public key for security protection;

[0131] The primary and backup key strategy also includes a switching information module, which is used to send primary and backup key switching information to the TPCM device, so that the TPCM device switches to the backup user signature public key for security protection.

[0132] In an optional embodiment, the trusted policy also includes a dynamic trusted measurement policy, which includes a current information to be measured module and a trusted measurement module. The current information to be measured module is used to obtain the current information to be measured of the TPCM device. The trusted measurement is used to perform trusted measurement on the current information to be measured according to the trusted verification model; when the measurement passes, return to the step of obtaining the current information to be measured of the TPCM device; when the measurement fails, disconnect the connection between the trusted switch and the TPCM device.

[0133] The device provided in the embodiment of the present application is adopted. Since the device adopts the same inventive concept as the above-mentioned method provided in the embodiment of the present application, on the premise that the method can solve the technical problem, the device can also solve the technical problem, which will not be repeated here.

[0134] Reference Figure 7An embodiment of the present invention further provides an electronic device 400, including a communication interface 401, a processor 402, a memory 403 and a bus 404, wherein the processor 402, the communication interface 401 and the memory 403 are connected via the bus 404; the memory 403 is used to store a computer program that supports the processor 402 to execute the method, and the processor 402 is configured to execute the program stored in the memory 403.

[0135] Optionally, an embodiment of the present invention further provides a computer-readable medium having a non-volatile program code executable by the processor 402 , where the program code enables the processor 402 to execute the method in the above embodiment.

[0136] It is known from common technical knowledge that the present invention can be implemented by other embodiments that do not deviate from its spirit or essential features. Therefore, the above disclosed embodiments are only illustrative in all respects and are not exclusive. All changes within the scope of the present invention or within the scope equivalent to the present invention are included in the present invention.

Claims

1. A TPCM device key management method, characterized in that: The TPCM device is applied to an industrial control system, the industrial control system further includes a trusted switch, other devices and a security management terminal, the TPCM device, the other devices and the security management terminal are respectively connected to the trusted switch, the method is applied to the TPCM device, and the method includes: Obtaining a key of the TPCM device, wherein the key includes a user signature public key and a user signature private key, wherein the user signature public key includes at least a validity date; Determine whether the validity date is updated, and if so, update the user signature public key according to the validity date, and update the user signature private key according to the updated user signature public key and SM9 algorithm and save; Sending the updated user signature public key to the security management terminal through the trusted switch, so that the security management terminal sends information to the trusted switch allowing the updated user signature public key of the TPCM device to be distributed to the other devices; and In response to the trusted policy sent by the trusted switch, the trusted policy is executed, or, in response to the policy information generated based on the trusted policy sent by the trusted switch, the policy information is executed; wherein the trusted policy is sent by the security management terminal to the trusted switch, and the trusted policy includes a key management policy.

2. The TPCM device key management method according to claim 1, characterized in that: The key management policy includes a key update frequency policy, a key update permission policy, a mandatory key update policy and a primary and backup key policy; and the policy information includes key update information.

3. The TPCM device key management method according to claim 1, characterized in that: The trust policy also includes a dynamic trust measurement policy.

4. A trusted switch key management method, characterized in that: A trusted switch is applied to an industrial control system, the industrial control system further comprising a TPCM device, other devices and a security management terminal, the TPCM device, the other devices and the security management terminal are respectively connected to the trusted switch, the TPCM device uses a key to perform security protection on the system, the key comprises a user signature public key and a user signature private key, wherein the user signature public key comprises at least a validity date; the TPCM device updates the user signature public key according to the updated validity date to obtain an updated user signature public key, and updates the user signature private key according to the updated user signature public key and an SM9 algorithm and saves the updated user signature public key; the method is applied to the trusted switch, the method comprising: In response to the updated user signature public key sent by the TPCM device, sending the updated user signature public key to the security management terminal; In response to the information sent by the security management terminal allowing the updated user signature public key of the TPCM device to be distributed to the other devices, distributing the updated user signature public key of the TPCM device to the other devices; In response to the trusted policy sent by the security management terminal, the trusted policy is executed, or the trusted policy is sent to the TPCM device, or policy information generated based on the trusted policy is sent to the TPCM device; wherein the trusted policy includes a key management policy.

5. The trusted switch key management method according to claim 4, characterized in that: The key management policy includes a key update frequency policy, a key update permission policy, a mandatory key update policy and a primary and backup key policy; and the policy information includes key update information.

6. The trusted switch key management method according to claim 5, characterized in that: The key update information includes key update disallowed information, second mandatory key update information, key update disallowed information, storage of current user signature public key information and primary and standby key switching information; The key update frequency strategy includes: Obtaining the updated user signature public key sent by the TPCM device; Determining a key update frequency of the TPCM device within a preset first time period according to the updated user signature public key; Determine whether the key update frequency exceeds a preset key update frequency threshold, and if so, send key update disallowed information to the TPCM device, and send an alarm message to the security management terminal; The key update permission policy includes: When the TPCM device is continuously and uninterruptedly running within a preset time period, sending key update disallowance information to the TPCM device within the preset time period to ensure the continuity of the running state of the TPCM device; The mandatory key update strategy includes: Receiving first mandatory key update information sent by the security management terminal; sending second mandatory key update information to the TPCM device according to the first mandatory key update information, so that the TPCM device performs key update according to the second mandatory key update information; The primary and backup key strategies include: In response to the updated user signature public key sent by the TPCM device, the current user signature public key is stored as a standby user signature public key, or the current user signature public key is sent to the security management terminal so that the security management terminal stores the user signature public key, or the current user signature public key storage information is sent to the TPCM device; The primary and backup key strategy also includes: In response to the key update failure information sent by the TPCM device, sending the standby user signature public key to the TPCM device, so that the TPCM device uses the standby user signature public key for security protection; The primary and backup key strategy also includes: Send the primary and backup key switching information to the TPCM device, so that the TPCM device switches to the backup user signature public key for security protection.

7. The trusted switch key management method according to claim 5, characterized in that: The trusted policy also includes a dynamic trusted measurement policy, and the executing the trusted policy in response to the trusted policy sent by the security management terminal includes: Obtaining current information to be measured of the TPCM device; Perform trust measurement on the current information to be measured according to the dynamic trust measurement strategy; when the measurement passes, return to the step of obtaining the current information to be measured of the TPCM device; when the measurement fails, disconnect the connection between the trusted switch and the TPCM device.

8. A TPCM device key management device, characterized in that: The TPCM device is applied to an industrial control system, the industrial control system further includes a trusted switch, other devices and a security management terminal, the TPCM device, the other devices and the security management terminal are respectively connected to the trusted switch, the device is applied to the TPCM device, and the device includes: An acquisition module, used to acquire a key of the TPCM device, wherein the key includes a user signature public key and a user signature private key, and the user signature public key at least includes a validity date; A judgment module, used to judge whether the validity date is updated, and if so, update the user signature public key according to the validity date, and update the user signature private key according to the updated user signature public key and SM9 algorithm and save it; A first distribution module, configured to send the updated user signature public key to the security management terminal through the trusted switch, so that the security management terminal sends information to the trusted switch allowing the updated user signature public key of the TPCM device to be distributed to the other devices; A first trusted policy module is used to execute the trusted policy in response to the trusted policy sent by the trusted switch, or to execute the policy information generated based on the trusted policy sent by the trusted switch; wherein the trusted policy is sent by the security management terminal to the trusted switch, and the trusted policy includes a key management policy.

9. A trusted switch key management device, characterized in that: The trusted switch is applied to an industrial control system, the industrial control system further comprising a TPCM device, other devices and a security management terminal, the TPCM device, the other devices and the security management terminal are respectively connected to the trusted switch, the TPCM device uses a key to perform security protection on the system, the key comprises a user signature public key and a user signature private key, wherein the user signature public key comprises at least a validity date; the TPCM device updates the user signature public key according to the updated validity date to obtain an updated user signature public key, and updates the user signature private key according to the updated user signature public key and an SM9 algorithm and saves the updated user signature public key; the device is applied to a trusted switch, the device comprising: a sending module, configured to send the updated user signature public key to the security management terminal in response to the updated user signature public key sent by the TPCM device; A second distribution module, configured to distribute the updated user signature public key of the TPCM device to other devices in response to the information sent by the security management terminal allowing the updated user signature public key of the TPCM device to be distributed to the other devices; The second trusted policy module is used to execute the trusted policy in response to the trusted policy sent by the security management terminal, or send the trusted policy to the TPCM device, or send policy information generated based on the trusted policy to the TPCM device; wherein the trusted policy includes a key management policy.

10. An electronic device, characterized in that: The method comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the method described in any one of claims 1 to 7 when executing the computer program.

Images