Industrial application-oriented time-sensitive network security authentication and authorization method

Abstract

The invention relates to a time-sensitive network security authentication and authorization method oriented to industrial application. Comprising three parts: (1) identity authentication; (2) communication authorization; and (3) secure transmission: the three functional modules are specifically implemented in a forwarding engine unit for placing a time-sensitive network gateway node through module functions of a sensitive network gateway and an equipment node so as to be applied to a typical industrial time-sensitive network architecture system. Identity authentication is mutual authentication between a time-sensitive network communication gateway or a routing node and equipment nodes instead of mutual authentication among all equipment nodes, so that calculation and communication overhead can be saved; according to the communication authorization, a time-sensitive network communication gateway or a routing node provides an access control strategy, encryption, key management and communication authorization for a device node; the secure transmission means that the device node completes the transmission of the message based on the communication key shared by the network node, and the process can prevent abnormal traffic attacks of monitoring and non-secure transmission.

Description

Technical Field

[0001] The invention relates to a time-sensitive network security authentication and authorization method for industrial applications. Background Art

[0002] At present, the complex and diverse industrial buses and protocols restrict the networking of the entire device. With the rapid development of Industry 4.0 and intelligent manufacturing, unprecedented requirements have been put forward for the real-time, reliability and determinism of communication networks. Time-Sensitive Networking (TSN) came into being. It aims to solve the shortcomings of traditional Ethernet in real-time and provide strong support for industrial automation, Internet of Vehicles, audio and video transmission and other fields. However, the development of networking has brought serious information security issues to data transmission. The three-layer information protection module of flow filter, flow control gate and flow meter provided by the time-sensitive network standard is essentially a boundary firewall technology. Once the boundary is breached, the entire network will be exposed and thus paralyzed; in addition, this protection technology generates too much computing and communication overhead due to the existence of multiple layers of processing.

[0003] As an important part of time-sensitive networks, the IEEE 802.1 Qci protocol PSFP (Per-Stream Filtering and Policing) provides a set of management mechanisms to ensure network traffic and security. It prevents traffic flooding and malicious node attacks by filtering and supervising data flows. PSFP includes three levels / functions: (1) Identify and filter data flows through filters (StreamFilter), select different filters based on flow ID and priority, and the flow ID is identified by a function of 802.1CB; (2) Stream gate controls data flow. Compared with the flow gate in 802.1Qbv, its position is in front of the queue, and the internal priority value IPV is assigned to the frame passing through the flow gate to determine the traffic category; (3) Perform traffic supervision on the data entering the flow meter (Flow Meter), such as setting a flow limit and discarding data when it exceeds the limit.

[0004] The 802.1Qci protocol (Per-Stream Filtering and Policing, PSFP) proposed by the Time-Sensitive Networking Working Group can indeed prevent traffic overload for messages arriving at the inbound port of the bridge through stream filtering and policing functions, thereby improving network security. At the same time, the data processing process of the stream filtering and policing functions is mainly supported by stream filters, flow control gates, and flow meter components. However, since the protection of this protocol is essentially similar to a border firewall technology, it has the following shortcomings: Defect (1) Although the protocol manages abnormal traffic through filtering and control policies, its processing capacity may be insufficient in high-load or complex network environments and cannot effectively respond to large-scale abnormal traffic attacks; Defect (2) When implementing this protocol, multi-layer processing will have a certain impact on the overall performance of the network, especially under high-load conditions, it will increase the network's latency and packet loss rate; Defect (3) Network security attackers can communicate with the original network by disguising themselves as unauthorized devices and using hijacking and false identities. If the authorization process of the communication system is not adequately protected, it is vulnerable to spoofing attacks. Defect (4) The 802.1Qci protocol lacks an effective encryption and key management mechanism, which will expose detailed information about the encryption method and key, increasing the risk of encryption cracking and information tampering. Summary of the invention

[0005] In view of the problems existing in the prior art, the purpose of the present invention is to provide a technical solution for a time-sensitive network security authentication and authorization method for industrial applications, so as to solve the information security problems of time-sensitive networks in industrial applications in a borderless manner and achieve an integrated protection effect against hijacking, tampering and eavesdropping.

[0006] The time-sensitive network security authentication and authorization method for industrial applications is characterized by comprising three parts: (1) identity authentication; (2) communication authorization; and (3) secure transmission. The three functional modules are specifically implemented by placing them in the forwarding engine unit of the time-sensitive network gateway node, and are implemented through the module functions of the sensitive network gateway and the device node, so as to be applied to a typical industrial time-sensitive network architecture system. Identity authentication is the mutual authentication between the time-sensitive network communication gateway or routing node and the device node, rather than the mutual authentication between all device nodes, which can save computing and communication overhead; before each device slave node communicates, the mutual identity authentication between the gateway or routing master node and the device slave node must be completed; Communication authorization is to provide access control strategies, encryption, key management and communication authorization for device nodes through the time-sensitive network communication gateway or routing node. That is, the network node security not only shares the communication key with the device node, but also maintains the timeliness and legitimacy of the key, and effectively manages the key. At the same time, only communication authorized devices can send and receive information in the time-sensitive network to prevent device hijacking attacks. After the gateway node and the device node complete the identity authentication in turn, if the device nodes need to send messages to each other, the communication authorization needs to be completed through the gateway node. Secure transmission refers to the transmission of messages by device nodes based on the communication keys shared by network nodes. This process can prevent abnormal traffic attacks such as eavesdropping and insecure transmission.

[0007] The time-sensitive network security authentication and authorization method for industrial applications is characterized in that the steps of identity authentication are as follows: Before each device node communicates, mutual identity authentication must be completed between the time-sensitive network gateway or routing node and the device node. The gateway node is the master node and the device node is the slave node. This includes four processes: (1) The device node sends a digital certificate: The device node sends its own digital certificate to the gateway node, and the gateway node performs identity authentication on the device node; (2) The time-sensitive network gateway or routing node sends a digital certificate and communication key: After receiving the digital certificate of the device node, the gateway node verifies the legitimacy of its digital certificate and obtains the device public key; then the gateway node sends its own digital certificate to the device node so that the device can authenticate the identity of the gateway; at the same time, the gateway sends the symmetric key for communication between the gateway node and the device node, also known as the authorization key, to the device. The gateway uses the device public key to encrypt the authorization key and the gateway node message timestamp, as well as the gateway's digital signature on the authorization key; (3) The device node sends a confirmation message: The device node verifies the digital certificate of the gateway node to obtain the gateway public key, uses the gateway public key to decrypt the ciphertext to obtain the authorization key and gateway node message timestamp in plain text, and verifies the device node message timestamp. If the device node message timestamp minus the gateway node message timestamp is less than or equal to △T, where △T is the maximum time delay between the two nodes, it means that the authorization key has not timed out. The gateway public key is used to verify the digital signature of the gateway. If the verification is successful, the authorization key is used to encrypt the device node message timestamp information and send it to the gateway node. (4) Gateway node confirmation: After receiving the confirmation message, the gateway node uses the authorization key to decrypt the confirmation message and obtain the device node message timestamp. If the gateway node message timestamp minus the device node message timestamp is less than or equal to △T, the mutual authentication between the gateway node and the device node is completed. The above process is the identity authentication process between the gateway node and the device node. The gateway node will complete mutual identity authentication with each device node registered on the network in turn.

[0008] The time-sensitive network security authentication and authorization method for industrial applications is characterized in that the communication authorization step is as follows: After the gateway node and the device node complete identity authentication in turn, if the device nodes need to send messages to each other, communication authorization needs to be completed through the gateway node to ensure the availability of communication. The following uses the communication authorization before two different device nodes communicate as an application scenario to explain the application steps: The gateway node authorizes communication for device node 1 and device node 2 respectively, which is divided into four steps: (1) Device node request: When device node 1 has a message to send to device node 2, device node 1 sends a request message to the gateway node. The request information uses the authorization key of device node 1 to encrypt the message stream and device node message timestamp of the message. The message stream can indicate the number of the communication device node number and the number of the message sent; (2) Gateway node authorization: After receiving the request message from the device node, the gateway node uses the authorization key to decrypt the message to obtain the plaintext message stream and the device node message timestamp. If the gateway node message timestamp minus the device node message timestamp is less than or equal to △T, it means that the authorization request message has not timed out and its validity is guaranteed within the authorization period. After verifying the legitimacy of the message stream, the gateway node generates an authorization message and sends it to device node 1 and device node 2 respectively. The authorization message is encrypted using the authorization keys of device node 1 and device node 2 respectively. The encrypted content is the secure transmission communication key and gateway node message timestamp of both. (3) Device node 1 receives the authorization message. After receiving the authorization message, device node 1 uses the authorization key to decrypt the message and obtain the communication key and gateway node message timestamp in plain text. When the timestamp when device node 1 receives the message minus the gateway node message timestamp is less than or equal to △T, the validity of the communication key is guaranteed within the time limit. (4) Device node 2 receives the authorization message. After receiving the authorization message, device node 2 uses the authorization key to decrypt the message and obtain the communication key and gateway node message timestamp in plain text. When the timestamp when device node 2 receives the message minus the gateway node message timestamp is less than or equal to △T, the validity of the communication key is guaranteed within the time limit. Communication authorization completed.

[0009] The time-sensitive network security authentication and authorization method for industrial applications is characterized in that the secure transmission steps are as follows: After the communication nodes device node 1 and device node 2 are authorized with the communication key, they can conduct mutual secure transmission communication. The secure transmission communication is divided into two processes: (1) Device node 1 sends. Device node 1 uses the communication key to encrypt the message body and the message timestamp of device node 1 to be sent. At the same time, the HMAC algorithm is used to generate the HMAC value of the message to ensure data integrity, and it is sent to device node 2 together with the encrypted message; (2) Device node 2 receives the message from device node 1. After receiving the message from device node 1, device node 2 uses the communication key to decrypt the message to obtain the plaintext message body and the message timestamp of device node 2, and uses the HMAC algorithm to calculate the HMAC value of the message and compare it with the received HMAC value. If the two are equal, it means that the message has not been tampered with, and device node 2 adopts the message to complete the secure transmission; When device node 2 sends and device node 1 receives, the above process is the opposite.

[0010] The time-sensitive network security authentication and authorization method for industrial applications is characterized in that: when the time-sensitive network gateway node and n device nodes are in the same topology network and the network IP is set, the n device nodes will perform identity authentication and communication authorization with the gateway node in turn. After completion, each device node will perform secure message transmission as needed.

[0011] The present invention includes three main security authentication and authorization functional parts: (1) identity authentication; (2) communication authorization; and (3) secure transmission. The three functional modules are specifically implemented in the forwarding engine unit of the time-sensitive network gateway node. The method is implemented through the module functions of the sensitive network gateway and the device node and is applied to a typical industrial time-sensitive network architecture system.

[0012] Identity authentication is a mutual authentication between a time-sensitive network communication gateway or routing node and a device node (rather than a mutual authentication between all device nodes), which effectively saves computational and communication overheads and solves the defect (2) in the background technology.

[0013] Communication authorization is to provide access control strategies, encryption and key management and communication authorization for device nodes (slave nodes) through a time-sensitive network communication gateway or routing node (master node). That is, the network node security not only shares the communication key with the device node, but also maintains the timeliness and legality of the key, and effectively manages the key. At the same time, only communication authorized devices can send and receive information within the time-sensitive network, preventing device hijacking attacks and effectively solving the defects in the background technology (3) (4).

[0014] Secure transmission refers to the transmission of messages by device nodes based on the communication key shared by network nodes. This process effectively prevents attacks such as eavesdropping and abnormal traffic in non-secure transmission, thus resolving the background technology defect (1).

[0015] This method can be used to authenticate and authorize all time-sensitive network message flows, including time-triggered (TT) flows and audio video bridging (AVB) flows. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 This is the function implementation diagram of the time-sensitive network gateway node; Figure 2 This is a schematic diagram of the identity authentication process; Figure 3 This is a schematic diagram of the communication authorization process; Figure 4 This is a schematic diagram of the secure transmission process. DETAILED DESCRIPTION

[0017] The present invention will be further described below in conjunction with the accompanying drawings: The present invention proposes a time-sensitive network security authentication and authorization method for industrial applications. The method includes three main security authentication and authorization functional parts: (1) identity authentication; (2) communication authorization; (3) secure transmission. The three functional modules are specifically implemented in the forwarding engine unit of the time-sensitive network gateway node, such as Figure 1 This method is implemented through the module functions of sensitive network gateway and device nodes and is applied to a typical industrial time-sensitive network architecture system.

[0018] Identity authentication is the mutual authentication between the time-sensitive network communication gateway or routing node and the device node (rather than the mutual authentication between all device nodes), which effectively saves computing and communication overhead. Communication authorization is to provide access control policies, encryption and key management and communication authorization for the device node (slave node) by the time-sensitive network communication gateway or routing node (master node), that is, the network node security not only shares the communication key with the device node, but also maintains the timeliness and legitimacy of the key, and effectively manages the key. At the same time, only communication authorized devices can send and receive information within the time-sensitive network to prevent device hijacking attacks. Secure transmission refers to the device node completing the transmission of messages based on the communication key shared by the network node. This process effectively prevents attacks such as eavesdropping and abnormal traffic of non-secure transmission. This method can authenticate and authorize all time-sensitive network message flows, including time-triggered (TT) flows and audio video bridge (AVB) flows.

[0019] 1) Identity Authentication Before each device node communicates, mutual identity authentication must be completed between the time-sensitive network gateway or routing node and the device node. The gateway node is the master node and the device node is the slave node. This includes four processes: (1) The device node sends a digital certificate: The device node sends its own digital certificate to the gateway node, and the gateway node authenticates the device node identity. A digital certificate is an electronic digital certificate issued by a certificate authority (CA), which includes a device public key, identifier, and other information. In addition to authenticating the node identity through a digital certificate, the device public key in the digital certificate is also required. (2) The time-sensitive network gateway or routing node sends the digital certificate and communication key: After the gateway node receives the digital certificate of the device node, it verifies the legitimacy of its digital certificate and obtains the device public key; then the gateway node sends its own digital certificate to the device node so that the device can authenticate the identity of the gateway; at the same time, the gateway sends the symmetric key for communication between the gateway node and the device node, also known as the authorization key DevAK, to the device. The gateway uses the device public key to encrypt the authorization key and the gateway node message timestamp, as well as the gateway's digital signature on the authorization key; (3) The device node sends a confirmation message: The device node verifies the digital certificate of the gateway node to obtain the gateway public key, uses the gateway public key to decrypt the ciphertext to obtain the authorization key and gateway node message timestamp in plain text, and verifies the device node message timestamp. If the device node message timestamp minus the gateway node message timestamp is less than or equal to △T, where △T is the maximum time delay between the two nodes, it means that the authorization key has not timed out. The gateway public key is used to verify the digital signature of the gateway. If the verification is successful, the authorization key is used to encrypt the device node message timestamp information and send it to the gateway node. (4) Gateway node confirmation: After receiving the confirmation message, the gateway node uses the authorization key to decrypt the confirmation message and obtain the device node message timestamp. If the gateway node message timestamp minus the device node message timestamp is less than or equal to △T, the mutual authentication between the gateway node and the device node is completed. The above process is the identity authentication process between the gateway node and the device node. In the actual industrial application process, the gateway node will complete mutual identity authentication with each device node registered on the network in turn.

[0020] 2) Communication authorization After the gateway node and the device node complete identity authentication in turn, if the device nodes need to send messages to each other, communication authorization needs to be completed through the gateway node to ensure the availability of communication; the following application steps are described using the communication authorization before two different device nodes communicate as an application scenario. Of course, the communication authorization protection of the present invention is not limited to the communication authorization of two devices: The gateway node authorizes communication for device node 1 (slave node) and device node 2 (slave node) respectively, which is divided into 4 steps: (1) Device node request: When device node 1 has a message to send to device node 2, device node 1 sends a request message to the gateway node (master node). The request information uses the authorization key of device node 1 to encrypt the message stream and device node message timestamp of the message. The message stream can indicate the number of the communication device node number and the number of the message sent; (2) Gateway node authorization: After receiving the request message from the device node, the gateway node uses the authorization key to decrypt the message to obtain the plaintext message stream and the device node message timestamp. If the gateway node message timestamp minus the device node message timestamp is less than or equal to △T, it means that the authorization request message has not timed out and its validity is guaranteed within the authorization period. After verifying the legitimacy of the message stream, the gateway node generates an authorization message and sends it to device node 1 and device node 2 respectively. The authorization message is encrypted using the authorization keys of device node 1 and device node 2 respectively. The encrypted content is the secure transmission communication key and gateway node message timestamp of both. (3) Device node 1 receives the authorization message. After receiving the authorization message, device node 1 uses the authorization key to decrypt the message and obtain the communication key and gateway node message timestamp in plain text. When the timestamp when device node 1 receives the message minus the gateway node message timestamp is less than or equal to △T, the validity of the communication key is guaranteed within the time limit. (4) Device node 2 receives the authorization message. After receiving the authorization message, device node 2 uses the authorization key to decrypt the message and obtain the communication key and gateway node message timestamp in plain text. When the timestamp when device node 2 receives the message minus the gateway node message timestamp is less than or equal to △T, the validity of the communication key is guaranteed within the time limit. Communication authorization completed.

[0021] 3) Secure transmission After the communication nodes device node 1 and device node 2 are authorized with the communication key, they can conduct mutual secure transmission communication. The secure transmission communication is divided into two processes: (1) Device node 1 sends. Device node 1 uses the communication key to encrypt the message body and the message timestamp of device node 1 to be sent. At the same time, the HMAC algorithm is used to generate the HMAC value of the message to ensure data integrity, and it is sent to device node 2 together with the encrypted message; (2) Device node 2 receives the message from device node 1. After receiving the message from device node 1, device node 2 uses the communication key to decrypt the message to obtain the plaintext message body and the message timestamp of device node 2, and uses the HMAC algorithm to calculate the HMAC value of the message and compare it with the received HMAC value. If the two are equal, it means that the message has not been tampered with, and device node 2 adopts the message to complete the secure transmission; When device node 2 sends and device node 1 receives, the above process is the opposite. Example

[0022] 1. The steps of identity authentication are as follows: 1.1) Device node sends identity authentication digital certificate When a device node goes online and obtains an IP address or receives a gateway node identity authentication rejection message, it actively sends a digital certificate to the time-sensitive network gateway node. The digital certificate contains: device information and device public key; 1.2) The time-sensitive network gateway sends the identity authentication digital certificate and communication key 1.2.1) Gateway node verifies the legitimacy of the device digital certificate When the gateway receives the digital certificate of the new device node, it will verify the legitimacy of its digital certificate; 1.2.2) The gateway node sends the identity authentication result and related messages If the digital certificate verification result in step 1.2.1) is legal, the gateway node obtains the device public key contained in the device digital certificate and authenticates the device. At the same time, it sends a request message to the device node. The request message includes the gateway node message timestamp T M , authorization key, authorization key digital signature, and the gateway's own digital certificate, so that the device authenticates the gateway's identity; among them, the gateway node message timestamp T M , the authorization key is encrypted by the obtained device public key, and the authorization key digital signature is encrypted by the gateway key; if the digital certificate verification result in step 1.2.1) is illegal, the gateway node will reject the identity authentication, and will send a rejection message to the device node, and re-enter the step 1.1) process; 1.3) The device node sends a confirmation message 1.3.1) Device Node Verification Gateway Node When the device node receives the gateway node request message, it first obtains the gateway public key through the digital certificate in the request message, and then uses the gateway public key to decrypt the ciphertext to obtain the plaintext authorization key DevAK and the gateway node message timestamp T M , and check the device node message timestamp T Dev ; 1.3.2) Device node sends confirmation message If T Dev-T M ≤△T, the authorization key DevAK has not timed out, and the gateway public key is used to decrypt and verify the digital signature of the gateway. If the verification is successful, the authorization key DevAK is used to encrypt the device node message timestamp T Dev Form device timestamp information and send a confirmation message to the gateway node; if T Dev -T M ≥△T, if the authorization key DevAK times out or if the gateway digital signature verification fails, the authorization key is discarded, the device sends a confirmation failure message to the gateway node, and re-enters step 1.1) process; where △T is the maximum time delay between nodes, which is a preset value; 1.4) Gateway Node Confirmation After receiving the confirmation message, the gateway uses the authorization key DevAK to decrypt the confirmation message and obtain the device node message timestamp T Dev , if T M -T Dev ≤△T holds, the mutual identity authentication between the gateway and the device is completed; if T M -T Dev If ≤△T does not hold, the gateway node reenters step 1.2). The above process is the identity authentication process between the gateway node and a single device node. In actual industrial applications, the gateway node will complete mutual identity authentication with each device node registered on the network in turn.

[0023] 2. The communication authorization steps are as follows: 2.1) Device node sends communication authorization request Device node 1 sends a request message to the gateway node The request message uses the authorization key DevAK1 of device node 1 to encrypt the message stream ID of the sent message i and device node 1 message timestamp T Dev1 , message stream ID i It indicates that the device node number and the number of the sent message form a label ID. At the same time, device node 2 also performs step 2.1); 2.2) Gateway Node Authorization 2.2.1) Gateway Node Verification Request After receiving the request message from device node 1, the gateway node uses the device authorization key DevAK1 to decrypt the message and obtain the message stream ID in plain text. i and device node 1 message timestamp T Dev1 , if T M -T Dev1If ≤△T holds, the verification is successful, otherwise the verification fails, and the gateway node sends a verification request failure message. After receiving the failure message, device node 1 re-enters step 2.1) to apply for communication authorization; similarly, after receiving the request message from device node 2, the gateway node uses the device authorization key DevAK2 to decrypt the message and obtain the message stream ID in plain text. i And device node 2 message timestamp T Dev2 , if T M -T Dev2 If ≤△T holds, the verification is successful, otherwise the verification fails, and the gateway node sends a verification request failure message. After receiving the failure message, device node 2 re-enters step 2.1) to apply for communication authorization; 2.2.2) Gateway node sends authorization information After the gateway node passes the verification, it generates authorization messages and sends them to two device nodes, namely device node 1 and device node 2. The authorization messages are encrypted using device node 1 authorization key DevAK1 and device node 2 authorization key DevAK2, and the encrypted contents are the two device node secure transmission communication keys DevCK. i (ie, DevCK1 and DevCK2) and the gateway node message timestamp T M ; 2.3) Device node 1 receives authorization information When device node 1 receives the authorization message, it uses the authorization key DevAK1 to decrypt the message and obtain the communication key DevCK in plain text. i and gateway node message timestamp T M , if T * Dev1 -T M ≤△T,T * Dev1 Device node 1 receives the message timestamp, then receives and saves the communication key DevCK i , otherwise, device node 1 discards the message and re-enters step 2.1) to apply for communication authorization; 2.4) Device node 2 receives authorization information When device node 2 receives the authorization message, it uses the authorization key DevAK2 to decrypt the message and obtain the communication key DevCK in plain text. i and gateway node message timestamp T M , if T * Dev2 -T M ≤△T,T * Dev2 Device node 2 receives the message timestamp, then receives and saves the communication key DevCK i, otherwise, device node 2 discards the message and re-enters step 2.1) to apply for communication authorization.

[0024] 3. The steps for secure transmission are as follows: 3.1) Device node 1 sends information Device node 1 uses the communication key DevCK1 to encrypt the message body to be sent and the device node 1 message timestamp T Dev1 , and at the same time, the HMAC value of the message is generated using the HMAC algorithm to ensure data integrity, and is sent to device node 2 together with the encrypted message; 3.2) Device node 2 receives information After receiving the message from device node 1, device node 2 uses the communication key DevCK1 to decrypt the message to obtain the plaintext message body and the message timestamp T of device node 1. Dev1 , and use the HMAC algorithm to calculate the HMAC value of the message, and compare it with the received HMAC value. If the two are equal, the message is received and stored, otherwise the message is discarded and a rejection message is sent to device node 1. After receiving the rejection message, device node 1 re-enters step 3.1) to send the message; 3.3) Device node 2 sends information Device node 2 uses the communication key DevCK2 to encrypt the message body to be sent and the device node 2 message timestamp T Dev2 , and at the same time, the HMAC value of the message is generated using the HMAC algorithm to ensure data integrity, and is sent to device node 1 together with the encrypted message; 3.4) Device node 1 receives information After receiving the message from device node 2, device node 1 uses the communication key DevCK2 to decrypt the message to obtain the plaintext message body and the message timestamp T of device node 2. Dev2 , and use the HMAC algorithm to calculate the HMAC value of the message, and compare it with the received HMAC value. If the two are equal, the message is received and stored, otherwise the message is discarded and a rejection message is sent to device node 2. After receiving the rejection message, device node 2 re-enters step 3.3) to send the message.

[0025] In summary, when the time-sensitive network gateway node and n device nodes are in the same topology network and the network IP and other settings are performed, the n device nodes will perform identity authentication and communication authorization with the gateway node in turn. After completion, each device node can transmit messages securely as needed. The specific steps are as follows: Of course, the introduction of security authentication and authorization methods will have two effects: (1) Security authentication and authorization require the signing and authentication of signatures, which will increase security tasks and time overhead in the forwarding engine and device nodes of the gateway node; (2) Security authentication and authorization will generate additional message flows, and the signature needs to be attached to the original message body, reducing the effective message carrying capacity. Therefore, this scheme uses the AES-128 cryptographic algorithm in the key algorithm of security authentication and authorization, and uses Rivest Shamir Adleman (RSA) as an asymmetric encryption algorithm, digital signature and digital certificate, and uses the Secure Hash Algorithm-1 (SHA-1) as the core content of the HMAC algorithm. The reason for the selection is that AES-128 and SHA-1 have the lowest encryption and decryption overhead time in the time-sensitive network gateway node based on the NXP LS1028A application processor, both less than 1μs. The HMAC algorithm (Hash-based Message Authentication Code) is a method that uses a cryptographic hash function and an encryption key to generate a message authentication code (MAC).

[0026] The key innovations of the present invention are: (1) A time-sensitive network security authentication and authorization method for industrial applications is proposed to solve the information security problem of time-sensitive networks in industrial applications and achieve an integrated protection effect of anti-hijacking, anti-tampering and anti-eavesdropping.

[0027] (2) The new method includes three main security authentication and authorization functional parts: identity authentication, communication authorization, and secure transmission, which are implemented in the forwarding engine unit in the time-sensitive network gateway or routing node respectively.

[0028] (3) Identity authentication, communication authorization, and secure transmission use digital signatures, authorization keys, communication keys, and HMAC algorithms to implement security authentication and authorization services, and the core algorithm is selected based on the characteristics of time-sensitive networks and task time overhead in industrial applications.

[0029] The present invention makes up for the deficiency of the time-sensitive network protocol itself in that it cannot effectively deal with large-scale abnormal traffic attacks in high-load or complex network environments. At the same time, it solves the security attacks of disguising as unauthorized devices or hijacking and false identities in the network with low time and network traffic overhead.

[0030] In summary, time-sensitive networks, through their determinism and reliability, meet the needs of multiple fields for high real-time and low latency, and promote the further development of these fields.

[0031] In order to facilitate the understanding of the present invention, the present invention introduces some contents of the prior art as follows: (1) Introduction to Time-Sensitive Networking Time-Sensitive Networking (TSN) is a set of data link layer protocol specifications developed by the Institute of Electrical and Electronics Engineers (IEEE) 802.1 Working Group to build a more reliable, low-latency, low-jitter Ethernet. TSN ensures the determinism and reliability of data transmission through a series of technical standards. It is suitable for industrial automation, vehicle communications, smart grids and other fields to meet the needs of these fields for precise synchronization and low latency.

[0032] (2) Technical background and history The predecessor of Time Sensitive Network was the AVB Working Group in the IEEE 802.1 Working Group, which was renamed the TSN Working Group in 2012. It inherited the existing technical foundation of AVB and further formulated and proposed more feasible technical standards for real-time communication application scenarios. These standards are particularly important in the era of Industry 4.0 and Internet of Vehicles, and have promoted the development of Ethernet technology.

[0033] (3) Technical characteristics and application scenarios The main technical features of time-sensitive networking include: Deterministic service: TSN provides microsecond-level deterministic services to ensure the real-time requirements of various industries. It can achieve a 10-microsecond periodic transmission, which is better than mainstream industrial Ethernet.

[0034] Low latency and low jitter: Through the priority application mechanism, it ensures that key data packets are processed first, reducing transmission delay and jitter, and is suitable for application scenarios that require high real-time performance25.

[0035] Unified network transmission: It can unify information technology (IT) and operational technology (OT), simplify network complexity and improve economic efficiency.

[0036] (4) Practical application cases Time-sensitive networking has been applied in many fields: Industrial Automation: Able to meet the stringent transmission requirements of the industrial field, such as flexible production lines, robot wireless control and other scenarios.

[0037] Smart Grid: Capable of providing precise synchronization and low-latency data transmission services, suitable for real-time monitoring and management of smart grids.

Claims

1. A time-sensitive network security authentication and authorization method for industrial applications, characterized in that It includes three parts: (1) identity authentication; (2) communication authorization; (3) secure transmission. The three functional modules will be placed in the forwarding engine unit of the time-sensitive network gateway node and applied to the typical industrial time-sensitive network architecture system through the module functions of the sensitive network gateway and device node. Identity authentication is the mutual authentication between the time-sensitive network communication gateway or routing node and the device node, rather than the mutual authentication between all device nodes, which can save computing and communication overhead; before each device slave node communicates, the mutual identity authentication between the gateway or routing master node and the device slave node must be completed; Communication authorization is to provide access control strategies, encryption, key management and communication authorization for device nodes through the time-sensitive network communication gateway or routing node. That is, the network node security not only shares the communication key with the device node, but also maintains the timeliness and legitimacy of the key, and effectively manages the key. At the same time, only communication authorized devices can send and receive information in the time-sensitive network to prevent device hijacking attacks. After the gateway node and the device node complete the identity authentication in turn, if the device nodes need to send messages to each other, the communication authorization needs to be completed through the gateway node. Secure transmission refers to the transmission of messages by device nodes based on the communication keys shared by network nodes. This process can prevent abnormal traffic attacks such as eavesdropping and insecure transmission.

2. A time-sensitive network security authentication and authorization method for industrial applications according to claim 1, characterized in that The steps of identity authentication are as follows: Before each device node communicates, mutual identity authentication must be completed between the time-sensitive network gateway or routing node and the device node. The gateway node is the master node and the device node is the slave node. This includes four processes: (1) The device node sends a digital certificate: The device node sends its own digital certificate to the gateway node, and the gateway node performs identity authentication on the device node; (2) The time-sensitive network gateway or routing node sends the digital certificate and communication key: After the gateway node receives the digital certificate of the device node, it verifies the legitimacy of its digital certificate and obtains the device public key; The gateway node then sends its own digital certificate to the device node, allowing the device to authenticate the identity of the gateway. At the same time, the gateway sends the symmetric key for communication between the gateway node and the device node, also known as the authorization key, to the device. The gateway uses the device public key to encrypt the authorization key and the gateway node message timestamp, as well as the gateway's digital signature on the authorization key. (3) The device node sends a confirmation message: The device node verifies the digital certificate of the gateway node to obtain the gateway public key, uses the gateway public key to decrypt the ciphertext to obtain the authorization key and gateway node message timestamp in plain text, and verifies the device node message timestamp. If the device node message timestamp minus the gateway node message timestamp is less than or equal to △T, where △T is the maximum time delay between the two nodes, it means that the authorization key has not timed out. The gateway public key is used to verify the digital signature of the gateway. If the verification is successful, the authorization key is used to encrypt the device node message timestamp information and send it to the gateway node. (4) Gateway node confirmation: After receiving the confirmation message, the gateway node uses the authorization key to decrypt the confirmation message and obtain the device node message timestamp. If the gateway node message timestamp minus the device node message timestamp is less than or equal to △T, the mutual authentication between the gateway node and the device node is completed; The above process is the identity authentication process between the gateway node and the device node. The gateway node will complete mutual identity authentication with each device node registered on the network in turn.

3. A time-sensitive network security authentication and authorization method for industrial applications according to claim 2, characterized in that The communication authorization steps are as follows: After the gateway node and the device node complete identity authentication in turn, if the device nodes need to send messages to each other, communication authorization needs to be completed through the gateway node to ensure the availability of communication. The following uses the communication authorization before two different device nodes communicate as an application scenario to explain the application steps: The gateway node authorizes communication for device node 1 and device node 2 respectively, which is divided into four steps: (1) Device node request: When device node 1 has a message to send to device node 2, device node 1 sends a request message to the gateway node. The request information uses the authorization key of device node 1 to encrypt the message stream and device node message timestamp of the message. The message stream can indicate the number composed of the communication device node number and the number of the message sent; (2) Gateway node authorization: After receiving the request message from the device node, the gateway node uses the authorization key to decrypt the message to obtain the plaintext message stream and the device node message timestamp; If the timestamp of the gateway node message minus the timestamp of the device node message is less than or equal to △T, it means that the authorization request message has not timed out and the validity is guaranteed within the authorization period; After verifying the legitimacy of the message flow, the gateway node generates an authorization message and sends it to device node 1 and device node 2 respectively. The authorization message is encrypted using the authorization keys of device node 1 and device node 2 respectively. The encrypted contents are the secure transmission communication keys of both and the gateway node message timestamp. (3) Device node 1 receives the authorization message. After receiving the authorization message, device node 1 uses the authorization key to decrypt the message and obtain the communication key and gateway node message timestamp in plain text. When the timestamp when device node 1 receives the message minus the gateway node message timestamp is less than or equal to △T, the validity of the communication key is guaranteed within the time limit. (4) Device node 2 receives the authorization message. After receiving the authorization message, device node 2 uses the authorization key to decrypt the message and obtain the communication key and gateway node message timestamp in plain text. When the timestamp when device node 2 receives the message minus the gateway node message timestamp is less than or equal to △T, the validity of the communication key is guaranteed within the time limit. Communication authorization completed.

4. A time-sensitive network security authentication and authorization method for industrial applications according to claim 3, characterized in that The steps of secure transmission are as follows: After the communication nodes device node 1 and device node 2 are authorized with the communication key, they can conduct mutual secure transmission communication. The secure transmission communication is divided into two processes: (1) Device node 1 sends. Device node 1 uses the communication key to encrypt the message body and the message timestamp of device node 1 to be sent. At the same time, the HMAC algorithm is used to generate the HMAC value of the message to ensure data integrity, and it is sent to device node 2 together with the encrypted message; (2) Device node 2 receives the message from device node 1. After receiving the message from device node 1, device node 2 uses the communication key to decrypt the message to obtain the plaintext message body and the message timestamp of device node 2, and uses the HMAC algorithm to calculate the HMAC value of the message and compare it with the received HMAC value. If the two are equal, it means that the message has not been tampered with, and device node 2 adopts the message to complete the secure transmission; When device node 2 sends and device node 1 receives, the above process is the opposite.

5. A time-sensitive network security authentication and authorization method for industrial applications according to claim 4, characterized in that: When the time-sensitive network gateway node and n device nodes are in the same topology network and the network IP is set, the n device nodes will perform identity authentication and communication authorization with the gateway node in turn. After completion, each device node will transmit messages securely as needed.

Images