Industrial control equipment security access control and encryption forwarding method and device

Abstract

The invention discloses a security access control and encrypted forwarding method and device for industrial control equipment. The device comprises at least two network ports, after the device is powered on, authentication is firstly carried out between the device and an upper computer, and the device passing the authentication receives an industrial control message by using the network port connected with industrial control automation equipment and analyzes a conventional field; information such as instruction codes, equipment information, application programs, process parameters, access authority, industrial control data and industrial control message communication relations in the industrial control messages continues to be analyzed through conventional fields; matching an analysis result with a configured protocol analysis identification rule white list, and judging according to a matching result; and the industrial control communication data importance level and the required encryption strategy of the message allowed to be accessed are judged according to the industrial control data rule and the encryption algorithm rule, so that encryption security communication in which data transmitted and received by the connected industrial control equipment are limited in a small range is realized on the premise of not influencing the original industrial control system communication network.

Description

Technical Field

[0001] This invention relates to the field of industrial control network communication security, and in particular to a method and apparatus for secure access control and encrypted forwarding of industrial control equipment. Background Technology

[0002] Currently, industrial control systems are deeply integrated with the Internet of Things (IoT) and the Internet, significantly improving the intelligence and informatization of industrial control systems, but also giving rise to a series of new security challenges. Various new attack techniques and methods targeting industrial control systems, such as hijacking, unauthorized attacks, process parameter / operation attacks, and DoS / DDOS attacks, exploit the weaknesses in the software and hardware characteristics, communication protocols, operating commands, and infrastructure of the industrial control systems themselves, making them difficult to detect and track.

[0003] Traditional industrial firewalls and similar devices are mostly limited to recognizing and forwarding or discarding packets based on conventional parameters such as IP, MAC, port, and protocol, as well as basic parameter information such as function codes of industrial control messages. They cannot parse the process parameters, access permissions, and communication relationships implicit in industrial control messages at the industrial control protocol level. Therefore, they have limited effectiveness in blocking attacks based on industrial control protocols, such as hijacking, unauthorized attacks, process parameter / operation attacks, and denial-of-service attacks (DoS / DDOS). Furthermore, industrial control messages that are allowed to be forwarded within the industrial control system are often transmitted directly in plaintext without being encrypted according to the different levels of importance of the industrial control data within the protocol. This results in poor protection of communication links and poses significant risks. Summary of the Invention

[0004] The purpose of this invention is to address the security risks and threats to industrial internet control systems. Traditional firewalls and other filtering devices can only identify and forward messages based on conventional parameters such as address and type, failing to deeply analyze industrial control data, communication relationships, and other information, and lacking data encryption capabilities. This invention provides a secure access control and encryption forwarding method and apparatus for industrial control equipment. It can parse conventional parameters, industrial control command codes, industrial control data, equipment information, application information, process parameters, access permissions, and communication relationships of industrial control messages, and can select different levels of encryption algorithms based on configuration rules to determine the importance level of industrial control data and encrypt and forward messages accordingly.

[0005] The present invention addresses the aforementioned technical problems primarily through the following technical solution: a method for secure access control and encrypted forwarding of industrial control equipment, comprising the following steps: S1. After receiving the industrial control message, parse the common parameters in the industrial control message: S2. Parse the industrial control parameters in the industrial control message based on the routine parameter information obtained from the parsing; S3. Match the regular parameters and industrial control parameters with the information parameters in the protocol parsing and identification rule whitelist to obtain the matching results. The protocol parsing and identification rules include access rules and attack detection rules, industrial control data rules and encryption algorithm rules. S4. If the industrial control message originates from an encrypted communication link, the following judgments are made based on the access rule matching results: Determine whether the industrial control message has read / write access permissions for the locally connected device; Determine whether the locally connected device is the destination device for the industrial control message; Determine whether the locally connected device should receive this industrial control message and its data; If the industrial control message comes from a locally connected device, the following judgment is made based on the access rule matching result: determine whether the locally connected device is the sending device of the industrial control message; S5. Determine whether the industrial control message is an attack message initiated using the industrial control protocol based on the attack detection rule matching results; S6. For industrial control messages from encrypted communication links, if all three judgments of the access rule matching result are yes, and the industrial control message is not an attack message, then the industrial control message is marked as a secure message and forwarded to the locally connected device; if at least one of the three judgments of the access rule matching result is no, or the industrial control message is an attack message, then the industrial control message is marked as an insecure message and not forwarded, and the processing of this industrial control message ends. For industrial control packets from locally connected devices, if all the access rule matching results are yes and the industrial control packet is not an attack packet, the industrial control packet is marked as a secure packet, and then proceed to step S7; if at least one of the three access rule matching results is no, or the industrial control packet is an attack packet, the industrial control packet is marked as an insecure packet and is not forwarded, and the processing of this industrial control packet ends. S7. Based on the matching results of industrial control data rules and encryption algorithm rules, determine the importance level of the security message and the corresponding encryption strategy to be used during forwarding: If the industrial control message is lightweight data, use a lightweight encryption algorithm to encrypt it before forwarding it to the encrypted communication link; if the industrial control message is important data, use a heavyweight encryption algorithm to encrypt it before forwarding it to the encrypted communication link; both lightweight and heavyweight encryption algorithms use dynamic keys.

[0006] After the industrial control message is encrypted and output, it is uploaded to the encrypted communication link to ensure that the data transmission between the local industrial control equipment connected to the device and the industrial control equipment connected to other groups of devices is limited to a small allowable range, thus achieving secure encrypted data transmission.

[0007] Preferably, in step S1, the standard parameters include source MAC, source IP, destination MAC, destination IP, protocol type, and port number. Source MAC and destination MAC are the physical addresses of the sending and receiving nodes in the industrial control messages sent and received by the industrial control equipment; source IP and destination IP are logical addresses; the industrial control message port number is divided into source port and destination port, used to identify and distinguish the application processes of the source and destination devices; the protocol type indicates the type of protocol to which the industrial control message belongs.

[0008] Preferably, in step S2, the industrial control parameters include instruction codes (operation types between communication devices), device information (device hardware ID, manufacturer, version, serial number, etc.), application information (application process information running within the industrial control system), process parameters (process parameters and their changing relationships transmitted in industrial control network messages), access permissions (data and functions that the industrial control device is allowed to receive and access), and communication relationships between industrial control data and industrial control messages (including report distribution type, client / server type, and publish / subscribe receiving type).

[0009] Device information indicates the identity of the device used within the network to verify the identity of the sending and receiving parties, such as device hardware ID, manufacturer, version, serial number, etc.

[0010] Application information refers to the application processes running within an industrial control system, including functions such as data acquisition, human-machine interface, software applications, process control, database, and data communication.

[0011] Access permission information refers to the information items or control information that each device or user can access based on the user's identity and membership in various predefined groups within an industrial control network. For example, an industrial control device is allowed to receive various industrial control protocols and their embedded data, thus limiting the access scope and ensuring that each industrial control device can only receive messages that meet the permissions, preventing information leakage and theft.

[0012] As a preferred method, the instruction code is parsed to obtain the operation instruction, the process parameters are parsed to obtain the process parameters of the industrial control equipment, and the changes in the operation instruction and process parameters are linked to form related information. The protocol parsing and identification rule whitelist includes the legality of the linked information.

[0013] The instruction code indicates the message transmission service type, i.e., the operation / instruction type between industrial control communication devices. For example, the instruction code (function code) of the Modbus protocol is a numeric code representing the request and response type. Different instruction codes represent different functions; for example, function code 0x01 reads the coil status, 0x02 reads the input status, etc. The device obtains the operation type information to be performed by parsing the instruction code in the industrial control message.

[0014] Process parameter information represents the process parameters (such as temperature, current, water level, valve open / close status, etc.) and their specific values ​​transmitted in the industrial control message. The device records the process parameter values ​​parsed from each industrial control message, analyzes the real-time situation of process parameter changes such as trends and rates of change, and specifically interprets the process parameter parsing results into specific process conditions in industrial production (such as the current at a certain location in A, the temperature at a certain location in degrees Celsius, the opening or closing of a valve at a certain location, etc.) and their change information (such as the range of current change at a certain location within a specific time period, the temperature rise at a certain location over time, etc.). The device combines the parsed industrial control message operation commands to analyze their logical and causal relationships with the changes in process parameters. That is, the change of a specific process parameter in the production process is caused by the issuance of a certain operation control command, such as the gate opening only after a dam gate opening command is issued. In the production process, the value of a variable changes according to other related variables. In addition, the change of the value of this variable will also affect the changes of several other related variables. The device parses the process parameter correlation change information in the above-mentioned industrial control message and stores the process parameters and their change relationships locally.

[0015] Preferably, the industrial control message communication relationship includes: Report Distribution type relationship: Event reports are broadcast to the network by the source device and listened to and received by the collecting device; this communication relationship is queued, user-triggered, and unidirectional (QUU). Queued means that it sends and receives messages through the send and receive queues of the data link layer; user-triggered means that the data link layer only starts to act after the upper-layer user makes a request, and it is unscheduled, that is, the data is only sent out when a pass token (PT) is received outside the time specified in the schedule table; unidirectional means that the event report is only broadcast to the network without requiring acknowledgment, and the receiver only receives and does not send. Client-Server (Client-Server) relationship: A client sends a request, and the server responds. In different communication relationships, a device can be both a client and a server. This communication relationship is queued, user-triggered, and bidirectional (QUB). Queued means that it sends and receives messages through the data link layer's send and receive queues. User-triggered means that the client only starts acting after the upper-layer user sends a request, and it is also unscheduled, meaning that it only sends data when it receives a pass token (PT) outside the time specified in the schedule. Bidirectional means that there are confirmed requests and responses between the client and the server; only this type of communication relationship is bidirectional. Publisher-Subscriber (BNU) relationship: Data is broadcast to the network by the publisher, and subscribers listen to the data broadcast on the network and receive relevant information. This communication relationship is buffered, network-triggered, and unidirectional. Buffered means that it sends and receives messages through the send and receive buffers of the data link layer. Network-triggered means that it sends messages according to the schedule of the data link layer, which is maintained and enforced by the Link Activity Scheduler (LAS). Unidirectional means that it sends messages to one or more receivers without acknowledgment, and the data is transmitted unidirectionally.

[0016] The parsed information is matched with the corresponding information parameters of the whitelist of various protocol parsing and identification rules. The rule configuration and distribution method can be achieved by sending or updating various rule information with messages through the host computer configuration management platform. After receiving the rule information message, the device parses the rule data and stores it locally.

[0017] Preferably, lightweight data includes real-time measurements; critical data includes control system algorithm configuration, operating modes, and alarm parameters.

[0018] Real-time measured industrial control data refers to the status and parameters of various devices within the industrial control system that are monitored in real time, such as temperature, pressure, and flow rate. This type of data uses lightweight encryption algorithms such as PRESENT encryption algorithm and KLEIN algorithm to encrypt the message data of the industrial control protocol except for the Ethernet frame part before forwarding it.

[0019] Important data refers to equipment control commands (start, stop, speed adjustment, etc.), production scheduling commands (commands to guide the scheduling and production of the production process), alarm information (alarm information for equipment failure, abnormality, or exceeding thresholds), etc. This type of data uses heavyweight encryption algorithms such as AES encryption algorithm, RSA algorithm, etc. to encrypt the message data of the industrial control protocol except for the Ethernet frame part before forwarding it.

[0020] Preferably, the attack messages include unauthorized attacks, denial-of-service attacks, and parameter tampering attacks.

[0021] An unauthorized attack refers to an attack that uses network resources without authorization or performs illegal operations by using network resources in an unauthorized manner. The device determines whether an attack is unauthorized by matching the parsed packet parameters (source / destination MAC / IP, source / destination port, protocol type, industrial control command code) with the corresponding information in the configured unauthorized attack detection rule whitelist.

[0022] Denial-of-service attacks are often achieved by sending a large number of requests to exhaust server resources. Therefore, the device determines whether a denial-of-service attack has been constituted by analyzing the parameters corresponding to the connection requests in the packets and matching the time interval between each connection request packet with the configured whitelist of connection request detection rules.

[0023] The device determines whether a message constitutes a parameter tampering attack by matching the parsed message process parameters with a whitelist of configured process parameter anomaly detection rules (different protocols use different process parameters, and the corresponding anomaly detection rules are different), and combining this with the industrial parameter change information parsed by the device.

[0024] As a preferred method, the dynamic key update method used for encrypted forwarding is: First, the encryption and decryption ends initialize and generate their respective public and private keys. The encryption end sends its public key to the decryption end, which saves the public key. Then, the decryption end sends its public key to the encryption end, which saves the public key. Simultaneously, the encryption and decryption ends generate a shared key. The encryption end generates a signature using the shared key and sends it to the decryption end. The decryption end receives and verifies the signature. If the verification is successful, it generates the key and the vector required for CBC encryption and sends its own signature to the encryption end for verification. If the encryption end's verification is successful, it generates the key and the vector required for CBC encryption, thus achieving dynamic key updates.

[0025] An industrial control equipment security access control and encrypted forwarding device operates the industrial control equipment security access control and encrypted forwarding method as described above. It includes a processor, a memory, and at least two Ethernet ports. The first Ethernet port connects to an industrial control device (and a locally connected industrial control device), and the second Ethernet port connects to an encrypted communication link. The Ethernet ports send and receive industrial control messages. The processor uses a parallel processing method to first parse the conventional parameters of each acquired industrial control message, and then further parses the industrial control information of the message based on the aforementioned conventional parameters. All the obtained industrial control information is cached in the memory and read later when matching with whitelist configuration rules. After all protocol parsing and identification rules are completed, the information of the current industrial control message is cleared, and the information of the next industrial control message parsing is prepared for caching. For security messages that need to be forwarded, the configured industrial control data rules and encryption algorithm rules are used to further determine the importance level of the industrial control data in the message and the corresponding encryption strategy to be used during forwarding. After the industrial control message is encrypted and output, it is uploaded to the encrypted communication link.

[0026] All Ethernet ports support full / half-duplex and 1000M / 100M port speed auto-adaptive. The Ethernet ports support real-time acquisition and parsing of industrial control communication messages from industrial control equipment, followed by selective encryption and forwarding of the industrial control messages. They also support authentication of the device by the host computer.

[0027] Preferably, after the device is powered on, it performs authentication with the host computer. The specific authentication process is as follows: A1. The device sends a device heartbeat message TCAnnounce every 10 seconds to notify the host computer of the current authentication status of the device. A2. After receiving the heartbeat message, if the authentication status information carried by the heartbeat message is "NA", indicating that the device is not authenticated, the host computer sends an authentication start message TCAuthStartup, carrying a digital signature and certificate (CRT) generated by the host computer. The digital signature is generated by calculating the message digest using SM3 and encrypting it using PRI1. The message content is the string "TCAuthStartup". If the authentication status information carried by the heartbeat message received by the host computer is not "NA", indicating that the device is not authenticated, then no further procedures are performed. A3. After receiving the authentication start message, the device performs a signature verification operation. The specific process is as follows: A31. Use public key PUB2 to decrypt the certificate content and obtain the DM public key PUB1 from the certificate; A32. Use the DM public key PUB1 to decrypt the digital signature to obtain the digest, and compare it with the digest calculated locally. If they match, it means that the other party's identity is the host computer, and the signature verification is successful. If they do not match, it means that the other party's identity is not the host computer, and the authentication process is stopped. A4. After the signature verification is successful, the device uses the DM public key PUB1 to encrypt the symmetric key, which is then carried by the authentication verification message TCAuthVerification and sent to the host computer. A5. After receiving the authentication verification message carrying the encrypted symmetric key, the host computer decrypts it using the local PRI1 and compares the locally stored symmetric key value with the decryption result. If they match, the host computer sends an authentication confirmation message TCAuthConfirm to the device; otherwise, it does not send an authentication confirmation message. A6. After receiving TCAuthConfirm, the device completes the authentication and marks the authentication status field as authenticated. If it does not receive TCAuthConfirm within 2 seconds, it resets the authentication process and marks itself as unauthenticated.

[0028] The symmetric key (KEY) here is the one used between the host computer and the device, and it is not the same as the one used in the previous dynamic key update process. The dynamic key update uses the key used for encrypting forwarded industrial control messages. The host computer has a built-in SM2 digital certificate (CRT), public key (PUB1), private key (PRI1), and symmetric key (KEY). The device has a built-in certification authority's public key (PUB2) and symmetric key (KEY). The device uses PUB2, the digital certificate, and the digital signature to verify signatures with the host computer.

[0029] The substantial effect of this invention is that it enables in-depth analysis of conventional parameters of industrial control messages, as well as information such as industrial control command codes, industrial control data, equipment information, application information, process parameters, access permissions, and communication relationships. Furthermore, it allows for the selection of different levels of encryption algorithms based on configuration rules to determine the importance level of industrial control data and encrypt and forward messages accordingly. This provides a secure access control and encryption forwarding method and apparatus for industrial control equipment. Without affecting the existing industrial control system communication network, it limits the communication and data transmission of connected industrial control equipment to a small scope. Attached Figure Description

[0030] Figure 1 This is a schematic diagram of a message parsing and encrypted forwarding process according to the present invention; Figure 2 This is a schematic diagram of an authentication process structure according to the present invention; Figure 3 This is a schematic diagram of the message blocking / forwarding connection between an industrial control equipment security access control and encryption forwarding device and a connected local device according to the present invention; Figure 4 This is a schematic diagram of a dynamic key generation process used in this invention. Detailed Implementation

[0031] The technical solution of the present invention will be further described in detail below through embodiments and in conjunction with the accompanying drawings.

[0032] Example: A method for secure access control and encrypted forwarding of industrial control equipment, such as... Figure 1 As shown, it includes the following steps: S1. After receiving the industrial control message, parse the common parameters in the industrial control message: S2. Parse the industrial control parameters in the industrial control message based on the routine parameter information obtained from the parsing; S3. Match the regular parameters and industrial control parameters with the information parameters in the protocol parsing and identification rule whitelist to obtain the matching results. The protocol parsing and identification rules include access rules and attack detection rules, industrial control data rules and encryption algorithm rules. S4. If the industrial control message originates from an encrypted communication link, the following judgments are made based on the access rule matching results: Determine whether the industrial control message has read / write access permissions for the locally connected device; Determine whether the locally connected device is the destination device for the industrial control message; Determine whether the locally connected device should receive this industrial control message and its data; If the industrial control message comes from a locally connected device, the following judgment is made based on the access rule matching result: determine whether the locally connected device is the sending device of the industrial control message; S5. Determine whether the industrial control message is an attack message initiated using the industrial control protocol based on the attack detection rule matching results; S6. For industrial control messages from encrypted communication links, if all three judgments of the access rule matching result are yes, and the industrial control message is not an attack message, then the industrial control message is marked as a secure message and forwarded to the locally connected device; if at least one of the three judgments of the access rule matching result is no, or the industrial control message is an attack message, then the industrial control message is marked as an insecure message and not forwarded, and the processing of this industrial control message ends. For industrial control packets from locally connected devices, if all the access rule matching results are yes and the industrial control packet is not an attack packet, the industrial control packet is marked as a secure packet, and then proceed to step S7; if at least one of the three access rule matching results is no, or the industrial control packet is an attack packet, the industrial control packet is marked as an insecure packet and is not forwarded, and the processing of this industrial control packet ends. S7. Based on the matching results of industrial control data rules and encryption algorithm rules, determine the importance level of the security message and the corresponding encryption strategy to be used during forwarding: If the industrial control message is lightweight data, use a lightweight encryption algorithm to encrypt it before forwarding it to the encrypted communication link; if the industrial control message is important data, use a heavyweight encryption algorithm to encrypt it before forwarding it to the encrypted communication link; both lightweight and heavyweight encryption algorithms use dynamic keys.

[0033] A method and apparatus for secure access control and encrypted forwarding of industrial control equipment are disclosed. The apparatus includes at least two Ethernet ports, both supporting full / half-duplex operation and 1000M / 100M adaptive speed control. These ports are RJ45 ports and support industrial control message acquisition and forwarding, as well as host computer authentication. The connection diagram between the apparatus and the industrial control equipment / host computer is shown below. Figure 3 As shown, a host computer simultaneously controls all industrial control access control devices. Each device is connected to an industrial control device. Industrial control message communication between two or more devices uses encrypted communication, while industrial control messages between devices and industrial control devices use plaintext communication. The device collects industrial control messages, parses them in real time, and selectively forwards them to the encrypted communication link.

[0034] After the device is powered on, it first initiates an authentication process (see...). Figure 2The device sends a heartbeat message TCAnnounce every 10 seconds to notify the host computer of the device's current authentication status. Upon receiving the heartbeat message, the host computer determines whether to initiate the authentication process based on the authentication status field within the message. If the heartbeat message carries an authentication status of "NA" (unauthenticated), the host computer sends an authentication start message TCAuthStartup, carrying a digital signature and certificate (CRT) generated by the host computer. The digital signature is generated by calculating the message digest using SM3 and encrypting it with PRI1. The message content is the string "TCAuthStartup".

[0035] Upon receiving the authentication initiation message, the device performs a signature verification operation: it decrypts the certificate content using the public key (PUB2) to obtain the DM public key (PUB1) from the certificate; it then decrypts the digital signature using PUB1 to obtain a digest, which is compared with the digest calculated locally. If they match, it indicates that the other party's identity is the host computer, and the signature verification is successful. The device then uses PUB1 to encrypt the symmetric key, which is carried by the authentication verification message TCAuthVerification and sent to the host computer. If they do not match, the authentication verification message TCAuthVerification is not sent.

[0036] After receiving the authentication verification message and the encrypted symmetric key it carries, the host computer decrypts it using its local PRI1 and compares the locally stored symmetric key value with the decryption result. If they match, the host computer sends an authentication confirmation message TCAuthConfirm to the device; otherwise, it does not send an authentication confirmation message.

[0037] Upon receiving TCAuthConfirm, the device completes authentication and marks the authentication status field as authenticated. If no TCAuthConfirm is received within 2 seconds, the authentication process is reset, and the device is marked as unauthenticated. The above authentication process uses UDP protocol for communication, with authentication information carried in the UDP data portion.

[0038] The authenticated device uses two network ports to collect and parse industrial control communication messages from industrial control equipment in real time, and then selects to encrypt and forward the messages. The device first receives industrial control communication messages from industrial control equipment through its network ports, and parses the source MAC / IP, destination MAC / IP, protocol type, port number, and other common parameters.

[0039] The device connects to the communication node of the industrial control equipment through an authenticated device, receives industrial control communication messages from the industrial control equipment, and parses the source MAC / IP, destination MAC / IP, protocol type, port number and other common parameters.

[0040] The source and destination MAC addresses are the physical addresses of the sending and receiving nodes in the industrial control messages sent and received by the industrial control equipment; the source and destination IP addresses are logical addresses; the industrial control message port number is divided into a source port number and a destination port number, which are used to identify and distinguish the application processes of the source and destination devices; the protocol type indicates the type of protocol for the industrial control message.

[0041] Based on the aforementioned conventional parameter information, the device then parses the instruction codes, device information, application programs, process parameters and their changes, access permissions, industrial control data, and industrial control message communication relationships within the industrial control message. The parsed industrial control instruction codes represent the message transmission service type, i.e., the operation type between industrial control communication devices. The device obtains the operation type information to be executed by the industrial control message by parsing the instruction codes within the message. Process parameter information represents the process parameters transmitted in the industrial control message (such as temperature, current, water level, valve open / close status, etc.) and their specific values. The device records the process parameter values ​​of each parsed industrial control message, analyzes the real-time situation of process parameter changes such as trends and rates of change, and specifically parses the process parameter parsing results into specific process conditions in industrial production (such as the current at a certain location in A, the temperature at a certain location in degrees Celsius, the valve at a certain location being open or closed, etc.) and their change information (such as the range of current change at a certain location within a specific time period, the temperature rise at a certain location over time, etc.). The device then analyzes the changing trends of the process parameters in conjunction with the parsed industrial control message instructions. Device information indicates the identity of the device used within the network to verify the identity of the sending and receiving parties, such as device hardware ID, manufacturer, version, serial number, etc.

[0042] Access permission information parsed within industrial control messages refers to the information items or control information that each device or user can access based on the user's identity and membership in various predefined groups. For example, an industrial control device is allowed to receive various industrial control protocols and their embedded data, thus limiting the access scope and ensuring that each industrial control device can only receive messages that meet the permissions, preventing information leakage and theft.

[0043] Industrial control message parsing communication relationships are categorized into three types: 1. Report Distribution; 2. Client / Server; 3. Publish / Reserve Reception. Report Distribution refers to event reports being broadcast from the source device to the network and received by the collecting device. This communication relationship is queued, user-triggered, and unidirectional (QUU). Queuing means it sends and receives messages through the data link layer's send and receive queues; user-triggered means the data link layer only initiates action after a request is made by an upper-layer user, and it is unscheduled, meaning data is only sent when a pass token (PT) is received outside the time specified in the schedule; unidirectional means the event report is only broadcast to the network without requiring acknowledgment, and the receiver only receives without sending. Client / Server refers to a client issuing a request and the server responding. In different communication relationships, a device can be both a client and a server. This communication relationship is queued, user-triggered, and bidirectional (QUB). Queued means it sends and receives messages through the data link layer's send and receive queues; user-triggered means the client only initiates action after a request is made by the upper-layer user, and it is unscheduled, meaning data is only sent when a pass token (PT) is received outside the time specified in the schedule; bidirectional means there is acknowledged request and response between the client and server. Only this type of communication relationship is bidirectional. Publisher / Subscriber type refers to data being broadcast to the network by the publisher, and subscribers listening to the data broadcast on the network and receiving relevant information. This communication relationship is buffered, network-triggered, and unidirectional (BNU). Buffered means it sends and receives messages through the data link layer's send and receive buffers; network-triggered means it sends messages according to the data link layer's schedule, which is maintained and enforced by the Link Activity Scheduler (LAS); unidirectional means it sends messages to one or more receivers without acknowledgment, and data is transmitted unidirectionally.

[0044] The device parses the source MAC / IP, destination MAC / IP, protocol type, port number, industrial control instruction code, industrial control data, device information, application information, process parameters, access permissions, and communication relationships implicit in the industrial control message, and matches them with the corresponding information parameters in the whitelist of various protocol parsing and identification rules (including access rules, attack detection rules, industrial control data rules, and encryption algorithm rules) configured within the device to obtain the matching result.

[0045] One embodiment of the protocol parsing and identification rule configuration / update method for the device is as follows: A host computer configuration software can connect to the device and send a custom communication message group containing all configuration rule data. The main information in this communication message includes: rule identification information (used to distinguish rule types), rule sequence number and rule data, and rule update information. The device parses and extracts the rule data from the message and stores it locally. Based on the rule identification information defined in the message, it generates corresponding rule repositories for each protocol parsing and identification rule (including access rules, attack detection rules, industrial control data rules, and encryption algorithm rules) and stores the issued rule information. If a rule already exists in the device and the rule update information in the message is valid, the latest issued corresponding rule content is used to overwrite it. For rule items that do not exist, a new rule repository is created and stored. After the host computer configuration software sends all rule configuration messages, the configuration / update of the rules stored inside the device is completed.

[0046] After the protocol parsing and identification rules are matched with the industrial control messages, the system determines whether the industrial control messages have read / write permissions for the locally connected devices, whether the locally connected devices are the destination / sending devices of the industrial control messages, and whether the devices should receive the industrial control messages and their data. Based on the attack detection rules, it determines whether the message is an attack message initiated using the industrial control protocol (such as unauthorized attacks, denial-of-service attacks, parameter tampering attacks, etc.). Non-attack industrial control messages that meet the whitelist configuration and are allowed access are identified as secure messages and subsequently subjected to encryption policy judgment and encryption processing before forwarding. Otherwise, they are considered insecure messages and are not forwarded, thus blocking messages that the devices should not receive.

[0047] Message acquisition is achieved by the PHY chip inside the device, which collects the messages sent and received by industrial control equipment connected to the RJ45 network port. Message parsing is achieved by the FPGA chip inside the device. The FPGA uses a parallel processing method to first parse the conventional parameters of each acquired message, and then further parse the industrial control information such as industrial control instruction codes, industrial control data, process parameters, equipment identifiers, application program identifiers, access permissions, and communication relationships implied in the industrial control message based on the above conventional parameters. All the obtained industrial control information is arranged in a specific format and cached in the RAM register inside the FPGA. It is read when matching with the whitelist configuration rules. After all the protocol parsing and identification rules are judged, the information of this industrial control message is cleared and the information of the next industrial control message parsing is prepared for caching.

[0048] The system analyzes security messages that need to be forwarded, using configured industrial control data rules and encryption algorithm rules to further determine the importance level of the industrial control data within the message and the corresponding encryption strategy to be used during forwarding: If the industrial control message data is real-time measurement data such as temperature, pressure, flow rate, etc., production line data of industrial control equipment, this type of data uses lightweight encryption algorithms such as PRESENT encryption algorithm and KLEIN algorithm to encrypt and forward the message data; if it is important data such as control system algorithm configuration, operation mode, alarm parameters, etc., such as equipment control commands (start, stop, speed adjustment, etc.), production scheduling commands (guiding production process scheduling and production scheduling commands), alarm information (equipment failure, abnormality, or alarm information exceeding threshold), this type of data uses heavyweight encryption algorithms such as AES encryption algorithm and RSA algorithm to encrypt and forward the message data. After the industrial control message is encrypted and output, it is uploaded to the encrypted communication link, enabling the device to block communication traffic other than normal business access needs without affecting the original industrial control system communication network, and to limit the communication and data transmission of connected industrial control equipment to encrypted and secure communication within a small range.

[0049] The dynamic key generation process used for encryption forwarding by the device is described in [link to documentation]. Figure 4 First, the encryption and decryption ends initialize and generate their respective public and private keys. The encryption end sends its public key to the decryption end, which saves the public key. Then, the decryption end sends its public key to the encryption end, which saves the public key. The encryption and decryption ends simultaneously generate a shared key. The encryption end generates a signature using the shared key and sends it to the decryption end. The decryption end receives and verifies the signature. If the verification is successful, it generates the key and the vector required for CBC encryption and sends its own signature to the encryption end for verification. If the encryption end's verification is successful, it generates the key and the vector required for CBC encryption, thus achieving dynamic key updates.

[0050] For encrypting critical industrial control data, a powerful encryption algorithm is the national standard SM4 encryption algorithm. It employs a 32-round non-linear iterative structure, using a 32-bit round key in each round. This structure gives SM4 high security and resistance to attacks, making it suitable for various data protection and encryption applications. The data portion, excluding the 14-byte Ethernet frame, is encrypted every 16 bytes. If less than 16 bytes, zero bytes are added at the end before encryption. After encryption, the CRC checksum is recalculated and inserted at the end of the Ethernet message before forwarding to the encrypted communication link. This ensures secure encrypted transmission of data between the local industrial control equipment connected to the device and other industrial control equipment connected to other groups of devices, achieving encrypted communication link transmission of critical industrial control data messages.

[0051] The specific embodiments described herein are merely illustrative of the spirit of the invention. Those skilled in the art to which this invention pertains may make various modifications or additions to the described specific embodiments or use similar methods to substitute them, without departing from the spirit of the invention or exceeding the scope defined by the appended claims.

[0052] Although this paper uses terms such as conventional parameters, industrial control parameters, and protocol parsing and identification rules extensively, the possibility of using other terms is not excluded. These terms are used merely to facilitate the description and explanation of the essence of this invention; interpreting them as any additional limitation would contradict the spirit of this invention.

Claims

1. A method for secure access control and encrypted forwarding of industrial control equipment, characterized in that: The following steps are involved: S1. After receiving the industrial control message, analyze the general parameters in the industrial control message: S2. parse the industrial control parameters in the industrial control message according to the conventional parameter information obtained by parsing; S3. Match the conventional parameters and industrial control parameters with the information parameters in the whitelist of protocol analysis and identification rules to obtain matching results. The protocol analysis and identification rules include access rules and attack detection rules, industrial control data rules and encryption algorithm rules. S4. If the industrial control message comes from an encrypted communication link, the following judgment is made based on the access rule matching result: Determine whether the industrial control message has read and write access rights to the locally connected device; Determine whether the locally connected device is the destination device of the industrial control message; Determine whether the locally connected device should receive the industrial control message and its data; If the industrial control message comes from a locally connected device, the following judgment is made based on the access rule matching result: whether the locally connected device is the sending device of the industrial control message; S5. judging whether the industrial control message is an attack message initiated using the industrial control protocol according to the attack detection rule matching result; S6. For industrial control messages from the encrypted communication link, if the three judgment results of the access rule matching result are all yes, and the industrial control message is not an attack message, the industrial control message is marked as a safe message and then forwarded to the locally connected device; If at least any one of the three judgments of the access rule matching result is negative, or the industrial control message is an attack message, the industrial control message is marked as a non-safe message and is not forwarded, and the processing of this industrial control message ends; For industrial control messages from locally connected devices, if the access rule matching results are all yes and the industrial control messages are not attack messages, the industrial control messages are marked as safe messages, and then the process goes to step S7; If at least any one of the three judgments of the access rule matching result is negative, or the industrial control message is an attack message, the industrial control message is marked as a non-safe message and is not forwarded, and the processing of this industrial control message ends; S7. Determine the importance of the security message and the corresponding encryption strategy to be adopted during forwarding processing based on the industrial control data rule matching results and the encryption algorithm rule matching results: if the industrial control message is lightweight data, it is encrypted using a lightweight encryption algorithm and then forwarded to the encrypted communication link; if the industrial control message is important data, it is encrypted using a heavyweight encryption algorithm and then forwarded to the encrypted communication link; both lightweight encryption algorithms and heavyweight encryption algorithms use dynamic keys.

2. According to claim 1, a method for secure access control and encrypted forwarding of industrial control equipment is characterized in that: In step S1, conventional parameters include source MAC, source IP, destination MAC, destination IP, protocol type and port number.

3. According to claim 2, a method for secure access control and encrypted forwarding of industrial control equipment is characterized in that: In step S2, the industrial control parameters include instruction codes, equipment information, application information, process parameters, access rights, industrial control data and industrial control message communication relationships.

4. The method for secure access control and encrypted forwarding of industrial control equipment according to claim 3 is characterized in that: The instruction code is parsed to obtain the operation instruction, the process parameters are parsed to obtain the process parameters of the industrial control equipment, and the changes in the operation instructions and process parameters are formed into related information. The protocol parsing identification rule whitelist includes the legitimacy of the related information.

5. The method for secure access control and encrypted forwarding of industrial control equipment according to claim 3 is characterized in that: The industrial control message communication relationship includes: Report distribution relationship: Event reports are broadcast to the network by the source device and listened and received by the collection device; Client-server relationship: the client makes a request and the server responds; Publish-subscribe relationship: Data is broadcast to the network by the publisher, and the subscriber listens to the data broadcast on the network and receives related information.

6. A method for secure access control and encrypted forwarding of industrial control equipment according to claim 1 or 3, characterized in that: Light data includes real-time measurements; important data includes control system algorithm configuration, operating mode and alarm parameters.

7. The method for secure access control and encrypted forwarding of industrial control equipment according to claim 1, characterized in that: The attack messages include unauthorized attacks, denial of service attacks and parameter tampering attacks.

8. The method for secure access control and encrypted forwarding of industrial control equipment according to claim 1, characterized in that: The dynamic key update method used by encrypted forwarding is: First, the encryption end and the decryption end initialize and generate their own public keys and private keys. The encryption end sends its own public key to the decryption end, and the decryption end saves the public key. Then the decryption end sends its own public key to the encryption end, and the encryption end saves the public key. The encryption end and the decryption end generate a shared key at the same time; the encryption end generates a signature through the shared key and sends it to the decryption end. The decryption end receives and verifies the signature. If the verification is successful, the key and the vector required for CBC encryption are generated, and its own signature is sent to the encryption end for verification. If the encryption end verifies successfully, the encryption end generates the key and the vector required for CBC encryption to achieve dynamic key update.

9. An industrial control equipment security access control and encryption forwarding device, running the industrial control equipment security access control and encryption forwarding method as claimed in claim 1, characterized in that: The invention comprises a processor, a memory and at least two Ethernet ports, wherein the first Ethernet port is connected to an industrial control device, the second Ethernet port is connected to an encrypted communication link, the Ethernet port receives and sends industrial control messages, the processor uses a parallel processing method to first parse conventional parameters for each collected industrial control message, and then further parses the industrial control information of the industrial control message according to the conventional parameters, and caches all the obtained industrial control information in the memory, and reads it when it matches the whitelist configuration rules later, and after all the protocol parsing and identification rules are judged to be completed, the current industrial control message information is cleared and the information of the next industrial control message parsing is prepared to be cached; the security message parsed to be forwarded uses the configured industrial control data rules and encryption algorithm rules to continue to judge the importance level of the industrial control data in the message and the corresponding encryption strategy to be adopted during forwarding processing, and after the industrial control message is encrypted and output, it is uploaded to the encrypted communication link.

10. The industrial control equipment security access control and encryption forwarding device according to claim 9, characterized in that: After the device is powered on, it will conduct authentication with the host computer. The specific authentication process is as follows: A1. The device sends a heartbeat message TCAnnounce every 10 seconds to notify the host computer of the current authentication status of the device. A2. After the host computer receives the heartbeat message, if the authentication status information carried by the heartbeat message is "NA", indicating that the device is not authenticated, the host computer sends an authentication startup message TCAuthStartup, carrying a digital signature and certificate generated by the host computer. The digital signature is generated by the message after SM3 digest calculation and PRI1 encryption. information The content is the string "TCAuthStartup"; If the authentication status information carried in the heartbeat message received by the host computer is not "NA", indicating that the device and authentication are not available, the subsequent process will not be carried out; A3. After receiving the authentication start message, the device performs the signature verification operation. The specific process is as follows: A31. Use the public key PUB2 to decrypt the certificate content and obtain the DM public key PUB1 in the certificate; A32, use DM public key PUB1 to decrypt the digital signature to get the digest, and compare it with the locally calculated digest. If they are consistent, it means that the other party is the host computer and the signature verification is successful. If they are inconsistent, it means that the other party is not the host computer and the authentication process is stopped. A4. After the signature verification is passed, the device uses the DM public key PUB1 to encrypt the symmetric key, which is carried by the authentication verification message TCAuthVerification and sent to the host computer; A5. After receiving the authentication verification message carrying the encrypted symmetric key, the host computer uses the local PRI1 to decrypt it and compare the locally stored symmetric key value with the decryption result to see if they are the same. If they are the same, it sends the authentication confirmation message TCAuthConfirm to the device, otherwise it does not send the authentication confirmation message; A6. After receiving TCAuthConfirm, the device completes the authentication and marks the authentication status field as authenticated. If it does not receive it within 2 seconds, it resets the authentication process and marks itself as unauthenticated.

Images