Industrial control system configuration downloading tamper-proofing method realized based on SM4 cryptographic algorithm

Abstract

The invention provides an industrial control system configuration downloading tamper-proofing method realized based on a national cryptographic SM4 algorithm, and relates to the technical field of industrial control network security. In the industrial control system configuration downloading process, external equipment and a data encryption and decryption technology are utilized to intercept, encrypt and decrypt configuration data, so that the security of the industrial control system is improved; and the purpose of data encryption transmission in the configuration downloading process is achieved. The method is specifically implemented as follows: external encryption equipment of an upper computer acquires a network data traffic packet in the downloading process, encrypts data in the traffic packet into a ciphertext by using a cryptographic SM4 algorithm, and then transmits the ciphertext. The external decryption device of the lower computer decrypts the data in the data packet into the plaintext by using the SM4 cryptographic algorithm after receiving the network data flow packet, and the software and hardware structures of the existing control system are not changed, the existing resources of the control system are not occupied, and the real-time performance of the control system is not obviously influenced in the encryption and decryption process.

Description

Technical Field

[0001] The present invention relates to the technical field of industrial control network security, and in particular to an industrial control system configuration and installation anti-tampering method based on the national secret SM4 algorithm. Background Art

[0002] With the development of industrial control technology towards intelligence and wisdom, especially the introduction of industrial Internet technology, information technology has been widely used in industrial control systems. Information security risks have also been introduced into the closed industrial control network environment, increasing the network security risks of industrial control systems.

[0003] In industrial control systems, the host computer is used to write configuration logic, monitor operating data, and perform equipment operations, while the slave computer is used to perform equipment control and monitor equipment status. The host computer and the slave computer are connected via Ethernet. For real-time and reliability considerations, the communication data between the host computer and the slave computer is generally transmitted in plain text, and there is a risk of leakage and tampering of the interactive data during the process.

[0004] Configuration is the execution program of the control system, which defines the execution process of device control and affects the realization of control results. Configuration files are written in the upper computer and executed in the lower computer. The process of transferring configuration files from the upper computer to the lower computer is called downloading. It is an efficient and covert network attack method to deceive the lower computer through network security attack means, simulate configuration downloading, and modify the configuration file to achieve the purpose of changing the control result. Studies have found that it is technically feasible to tamper with configuration data during the downloading process of the control system to change the state of the controlled device or cause the controlled device to malfunction or even damage.

[0005] In order to cope with this situation, information encryption technology is used to solve the security problem of industrial control system data transmission. Figure 1 As shown in the figure, the usual practice is to integrate encryption and decryption modules inside the upper and lower computers to encrypt and decrypt data. However, since the encryption and decryption process will increase the data transmission time and weaken the real-time performance of the control system, this solution of reducing real-time performance to improve security will affect the control process and is difficult to be accepted by the control system. At the same time, the integrated application of information encryption technology in the control system will also change the software and hardware structure of the control system, increase the resource consumption of the control system, and make it difficult to patch and upgrade the existing system. Summary of the invention

[0006] In order to solve the shortcomings of the above-mentioned prior art, the present invention provides an industrial control system configuration and installation anti-tampering method based on the national secret SM4 algorithm. During the encryption and decryption process, the present invention achieves that the existing control system software and hardware structure is not changed, the existing resources of the control system are not occupied, and the real-time performance of the control system is not significantly affected.

[0007] The present invention is achieved through the following technical solutions:

[0008] An industrial control system configuration download anti-tampering method based on the national secret SM4 algorithm is characterized by comprising the following steps:

[0009] S1. During the configuration download process of the industrial control system, the encryption device external to the host computer obtains the network data flow packet sent by the host computer, firstly processes it through the hook function to extract the TCP protocol data packet, then encrypts the data in the TCP protocol data packet from plain text to cipher text through the national secret SM4 algorithm, and finally transmits the encrypted network data flow packet to the switch;

[0010] S2, the switch receives the encrypted network data flow packet and sends it to the external decryption device of the lower computer;

[0011] S3. The decryption device receives the encrypted network data flow packet, firstly processes it through the hook function to extract the TCP protocol data packet, then decrypts the data in the TCP protocol data packet from ciphertext to plaintext through the national secret SM4 algorithm, and finally transmits the decrypted network data flow packet to the lower computer.

[0012] Furthermore, in the step S1, the specific steps are:

[0013] S1.1. The encryption device is configured with network interface A and network interface B. Network interface A is connected to the host computer, and network interface B is connected to the switch. The two interfaces are set as network bridges in the operating system of the encryption device.

[0014] S1.2, during the transmission of the network data flow packet from the network interface A to the network interface B, the kernel module Netfilter in the encryption device processes the network data flow packet and extracts the TCP protocol data packet;

[0015] S1.3. After encrypting the TCP protocol data packet, the encrypted network data flow packet is sent to the switch through the network interface B of the encryption device.

[0016] Furthermore, in the step S1.2, the specific processing process includes the following steps:

[0017] S1.2.1. Netfilter sets three hook points at the second layer link layer of the OSI network, NF_BR_PRE_ROUTING, NF_BR_FORWARD and NF_BR_POST_ROUTING, and registers the function at the hook point NF_BR_FORWARD. The registration process is as follows:

[0018] First, set the hook setting parameters simple_nf_opt, including setting the protocol layer to the data link layer; setting the hook point to network bridge forwarding; setting the processing priority to the highest; setting the hook function to the custom function packet_filter;

[0019] Then call the nf_register_net_hook function in Netfilter, pass the hook setting parameter simple_nf_opt into the nf_register_net_hook function to register the hook function;

[0020] S1.2.2. Call the registered hook function packet_filter to obtain the first address and length of the TCP protocol data packet to extract the TCP protocol data packet.

[0021] Furthermore, in the step S1.3, the specific encryption steps are: first set the SM4ctr encryption algorithm, then perform data encryption on the TCP protocol data packet to generate ciphertext, the length of the generated ciphertext is the same as the length of the plaintext, and the generated ciphertext replaces the plaintext in the TCP protocol data packet to complete the encryption of the TCP protocol data packet.

[0022] Furthermore, in the step S3, the specific steps are:

[0023] S3.1. The decryption device is configured with network interface A and network interface B. Network interface A is connected to the switch, and network interface B is connected to the lower computer. The two interfaces are set as network bridges in the operating system of the decryption device.

[0024] S3.2, in the process of transmitting the network data flow packet from the network interface A to the network interface B, the kernel module Netfilter in the decryption device processes the encrypted network data flow packet and extracts the encrypted TCP protocol data packet;

[0025] S3.3, after decrypting the extracted TCP protocol data packet, the decrypted network traffic data packet is then transmitted to the lower computer via the network interface B of the decryption device.

[0026] Furthermore, in the step S3.2, the specific processing process includes the following steps:

[0027] S3.2.1. Netfilter sets three hook points at the second layer link layer of the OSI network, NF_BR_PRE_ROUTING, NF_BR_FORWARD and NF_BR_POST_ROUTING, and registers the function at the hook point NF_BR_FORWARD. The registration process is as follows:

[0028] First, set the hook setting parameters simple_nf_opt, including setting the protocol layer to the data link layer; setting the hook point to network bridge forwarding; setting the processing priority to the highest; setting the hook function to the custom function packet_filter;

[0029] Then call the nf_register_net_hook function in Netfilter, pass the hook setting parameter simple_nf_opt into the nf_register_net_hook function to register the hook function;

[0030] S3.2.2. Call the registered hook function packet_filter to obtain the first address and length of the TCP protocol data packet to extract the TCP protocol data packet.

[0031] Furthermore, in the S3.3 step, the specific steps of decryption are: first set the SM4ctr decryption algorithm, then perform data decryption on the TCP protocol data packet to generate plaintext, the length of the generated plaintext is the same as the length of the ciphertext, and the generated plaintext replaces the ciphertext in the TCP protocol data packet to complete the decryption of the TCP protocol data packet.

[0032] The beneficial effects of the present invention are as follows:

[0033] 1. Compared with the prior art, the encryption and decryption functions of the present invention are no longer integrated into the existing equipment, but run as an independent device. During installation, it is only necessary to connect the device in series to the network connection between the existing equipment and the switch. There is no need to change the hardware settings of the existing host and slave computers, nor is there any need to increase or modify the software functions of the existing host and slave computers.

[0034] 2. Compared with the prior art, the encryption and decryption operations of the data packets in the present invention are completed at the link layer of the communication, and no modification or setting is required at the network layer and the transport layer. The existing network structure of the upper computer and the lower computer will not perceive the existence of the encryption device and the decryption device, and will not have any impact on the existing normal network functions.

[0035] 3. Compared with the prior art, the present invention sets up independent external encryption equipment and decryption equipment, and the encryption and decryption of data are run in independent equipment, which will not occupy the software and hardware resources of the upper computer and the lower computer, and will not affect the functions and performances of the upper computer and the lower computer.

[0036] 4. Compared with the prior art, the present invention reduces the impact on the real-time performance of the upper and lower computer systems during the encryption and decryption process by adopting three aspects:

[0037] (1) The present invention only enables the data encryption and decryption functions for the configuration download function of the industrial control system. The configuration download function is more about the requirements for data integrity and accuracy, but the real-time requirements are not very high;

[0038] (2) The present invention only processes the TCP protocol commonly used in the configuration download function;

[0039] (3) In the TCP protocol, the data transmission process includes steps such as handshake, transmission, and confirmation. The present invention only enables the data encryption and decryption functions for the transmission steps in the TCP protocol that affect data security, and ignores other steps. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 It is a schematic diagram of the prior art;

[0041] Figure 2 It is the principle diagram of the present invention;

[0042] Figure 3 This is a schematic diagram showing the implementation principle of the encryption and decryption functions of the present invention;

[0043] Figure 4 This is a schematic diagram of the bridge principle of the present invention;

[0044] Figure 5 Encryption device structure diagram;

[0045] Figure 6 Decryption equipment structure diagram;

[0046] Figure 7 It is the Netfilter Layer 2 network HOOK point. DETAILED DESCRIPTION

[0047] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0048] Example 1

[0049] like Figure 2-Figure 3 As shown, a method for anti-tampering of industrial control system configuration download based on the national secret SM4 algorithm includes the following steps:

[0050] S1. During the configuration download process of the industrial control system, the encryption device external to the host computer obtains the network data flow packet sent by the host computer, firstly processes it through the hook function to extract the TCP protocol data packet, then encrypts the data in the TCP protocol data packet from plain text to cipher text through the national secret SM4 algorithm, and finally transmits the encrypted network data flow packet to the switch;

[0051] S2, the switch receives the encrypted network data flow packet and sends it to the external decryption device of the lower computer;

[0052] S3. The decryption device receives the encrypted network data flow packet, firstly processes it through the hook function to extract the TCP protocol data packet, then decrypts the data in the TCP protocol data packet from ciphertext to plaintext through the national secret SM4 algorithm, and finally transmits the decrypted network data flow packet to the lower computer.

[0053] During the download process, the encrypted data is transmitted in ciphertext on the network. If there is no correct key, forged illegal data will not be correctly decrypted, will not be recognized by the lower computer, cannot be stored and executed, and will be discarded, thus achieving the purpose of anti-tampering.

[0054] In this embodiment, the encryption device is an embedded computer running the Linux operating system, configured with network interfaces A and B, network interface A is connected to the host computer, network interface B is connected to the switch, and interfaces A and B are set as network bridges in the operating system; the decryption device is also an embedded computer running the Linux operating system, configured with network interfaces A and B, network interface A is connected to the switch, and network interface B is connected to the lower computer.

[0055] Example 2

[0056] This embodiment further elaborates and supplements the implementation mode of the present invention on the basis of Embodiment 1.

[0057] In the step S1, the specific steps are:

[0058] S1.1, if Figure 4-Figure 5 As shown, the encryption device is configured with network interface A and network interface B. Network interface A is connected to the host computer, and network interface B is connected to the switch. The two interfaces are set as network bridges in the operating system of the encryption device.

[0059] S1.2, during the transmission of the network data flow packet from the network interface A to the network interface B, the kernel module Netfilter in the encryption device processes the network data flow packet and extracts the TCP protocol data packet;

[0060] S1.3. After encrypting the TCP protocol data packet, the encrypted network data flow packet is sent to the switch through the network interface B of the encryption device.

[0061] As another implementation of this embodiment, in the step S1.2, the specific processing process includes the following steps:

[0062] S1.2.1, if Figure 7 As shown, Netfilter sets three hook points at the second layer link layer of the OSI network, NF_BR_PRE_ROUTING, NF_BR_FORWARD and NF_BR_POST_ROUTING, and registers the function at the hook point NF_BR_FORWARD. The registration process is as follows:

[0063] First, set the hook setting parameters simple_nf_opt, including setting the protocol layer to the data link layer, pf = NFPROTO_BRIDGE; setting the hook point to network bridge forwarding, that is, hooknum = NF_BR_FORWARD; setting the processing priority to the highest, that is, priority = NF_BR_PRI_FIRST; setting the hook function to the custom function packet_filter, that is, hook = (nf_hookfn*)packet_filter

[0064] Then call the nf_register_net_hook function in Netfilter, pass the hook setting parameter simple_nf_opt into the nf_register_net_hook function to register the hook function;

[0065] As shown below:

[0066]

[0067] S1.2.2. Call the registered hook function packet_filter to obtain the first address and length of the TCP protocol data packet to extract the TCP protocol data packet.

[0068] In the private communication protocol of industrial control systems, the configuration download function is generally implemented using the TCP protocol at the transport layer, and functions with high real-time requirements such as numerical transmission are generally implemented using the UDP protocol at the transport layer. Based on this feature, it is only necessary to filter the TCP protocol data packets and combine them with the filtering of TCP data transmission characteristics to complete the extraction of the configuration download TCP protocol data packets.

[0069] The following is the implementation of extracting TCP protocol data packets in the hook function

[0070]

[0071] The code "iph->protocol==IPPROTO_TCP" implements the screening of TCP protocol data packets. The code "tcph->psh==1" implements the screening of data transmission characteristic values ​​in the TCP protocol. "tcph->psh" is the PSH flag in the TCP protocol, which prompts the receiving application to immediately read data from the TCP receiving buffer. If the PSH flag is 1, it can be considered that the current traffic data packet contains transmission data content.

[0072] At the same time, the hook function can obtain the skb address plus the IP header address and TCP header address to obtain the first address of the TCP protocol data packet:

[0073] char*tcp_content=skb->data+(iph->ihl*4)+(tcph->doff*4);

[0074] Among them, tcp_content is the first address of the obtained TCP protocol data packet.

[0075] Get the length of the IP packet minus the length of the IP header and the length of the TCP header to get the length of the TCP protocol data packet:

[0076]

[0077] Among them, tcp_content_len is the length of the obtained TCP protocol data packet.

[0078] As another implementation method of this embodiment, in the S1.3 step, the specific steps are: first set the SM4ctr encryption algorithm, then perform data encryption on the TCP protocol data packet, generate ciphertext, the length of the generated ciphertext is the same as the length of the plaintext, replace the plaintext in the TCP protocol data packet with the generated ciphertext, complete the data encryption, and transmit the encrypted TCP protocol data packet to the switch via network interface B.

[0079] In practice, the encryption function is implemented as follows:

[0080]

[0081] The above parameters EVP_sm4_ctr() settings select the SM4ctr algorithm. The parameter key is the key. The parameter tcp_content is the first address of the TCP protocol data packet, the parameter tcp_content_len is the length of the TCP protocol data packet, the parameter ciphertext is the first address of the encrypted ciphertext, and the parameter ciphertextLen is the length of the encrypted ciphertext.

[0082] The length of the ciphertext generated after encryption using the sm4_ctr algorithm is the same as the length of the plaintext. Therefore, the generated ciphertext can be directly used to replace the plaintext in the data packet, and the ciphertext ciphertext can be used to replace the plaintext in the TCP protocol data packet to complete the encryption of the TCP protocol data packet.

[0083] Example 3

[0084] This embodiment further elaborates and supplements the implementation manner of the present invention on the basis of Embodiment 1 or Embodiment 2.

[0085] In the step S3, the specific steps are:

[0086] S3.1, if Figure 6 As shown, the decryption device is configured with network interface A and network interface B. Network interface A is connected to the switch, and network interface B is connected to the lower computer. The two interfaces are set as network bridges in the operating system of the decryption device.

[0087] S3.2, in the process of transmitting the network data flow packet from the network interface A to the network interface B, the kernel module Netfilter in the decryption device processes the encrypted network data flow packet and extracts the encrypted TCP protocol data packet;

[0088] S3.3, after decrypting the extracted TCP protocol data packet, the decrypted network traffic data packet is then transmitted to the lower computer via the network interface B of the decryption device.

[0089] As another implementation of this embodiment, in the step S3.2, the specific processing process includes the following steps:

[0090] S3.2.1. Netfilter sets three hook points at the second layer link layer of the OSI network, NF_BR_PRE_ROUTING, NF_BR_FORWARD and NF_BR_POST_ROUTING, and registers the function at the hook point NF_BR_FORWARD. The registration process is as follows:

[0091] First, set the hook setting parameters simple_nf_opt, including setting the protocol layer to the data link layer, pf = NFPROTO_BRIDGE; setting the hook point to network bridge forwarding, that is, hooknum = NF_BR_FORWARD; setting the processing priority to the highest, that is, hooknum = NF_BR_FORWARD; setting the hook function to the custom function packet_filter, that is, hook = (nf_hookfn*)packet_filter;

[0092] Then call the nf_register_net_hook function in Netfilter, pass the hook setting parameter simple_nf_opt into the nf_register_net_hook function to register the hook function;

[0093] S3.2.2. Call the registered hook function packet_filter to obtain the first address and length of the TCP protocol data packet to extract the TCP protocol data packet.

[0094] In this embodiment, the method for extracting the TCP protocol data packet from the network data flow packet by the decryption device is completely consistent with the method for extracting the TCP protocol data packet from the network data flow packet by the encryption device.

[0095] As another implementation method of this embodiment, in the S3.3 step, the specific steps are: first set the SM4ctr decryption algorithm, then perform data decryption on the TCP protocol data packet to generate plaintext, the length of the generated plaintext is the same as the length of the ciphertext, the generated plaintext replaces the ciphertext in the TCP protocol data packet, completes the decryption of the TCP protocol data packet, and then transmits the processed network traffic data packet to the lower computer via the network interface B of the decryption device.

[0096] In practice, the decryption function is implemented as follows:

[0097]

[0098] The above parameter key is the key, the parameter tcp_content is the first address of the TCP protocol data packet ciphertext, and the parameter tcp_content_len is the length of the TCP protocol data packet ciphertext. The parameter plaintext is the first address of the decrypted plaintext, and the parameter plaintext_len is the length of the decrypted plaintext.

[0099] Since the length of the plaintext and ciphertext after decryption using the sm4_ctr algorithm is the same, the ciphertext in the data packet can be directly replaced with the plaintext, and the plaintext can be used to replace the TCP protocol data packet ciphertext tcp_content to complete the decryption of the TCP protocol data packet.

Claims

1. A method for anti-tampering of industrial control system configuration download based on the national secret SM4 algorithm, characterized in that: The steps include: S1. During the configuration download process of the industrial control system, the encryption device external to the host computer obtains the network data flow packet sent by the host computer, firstly processes it through the hook function to extract the TCP protocol data packet, then encrypts the data in the TCP protocol data packet from plain text to cipher text through the national secret SM4 algorithm, and finally transmits the encrypted network data flow packet to the switch; S2, the switch receives the encrypted network data flow packet and sends it to the external decryption device of the lower computer; S3. The decryption device receives the encrypted network data flow packet, firstly processes it through the hook function to extract the TCP protocol data packet, then decrypts the data in the TCP protocol data packet from ciphertext to plaintext through the national secret SM4 algorithm, and finally transmits the decrypted network data flow packet to the lower computer.

2. The method for anti-tampering of industrial control system configuration download based on the national secret SM4 algorithm as claimed in claim 1, characterized in that: In the step S1, the specific steps are: S1.

1. The encryption device is configured with network interface A and network interface B. Network interface A is connected to the host computer, and network interface B is connected to the switch. The two interfaces are set as network bridges in the operating system of the encryption device. S1.2, during the transmission of the network data flow packet from the network interface A to the network interface B, the kernel module Netfilter in the encryption device processes the network data flow packet and extracts the TCP protocol data packet; S1.

3. After encrypting the TCP protocol data packet, the encrypted network data flow packet is sent to the switch through the network interface B of the encryption device.

3. The method for anti-tampering of industrial control system configuration download based on the national secret SM4 algorithm as claimed in claim 2, characterized in that: In the step S1.2, the specific processing process includes the following steps: S1.2.

1. Netfilter sets three hook points at the second layer link layer of the OSI network, NF_BR_PRE_ROUTING, NF_BR_FORWARD and NF_BR_POST_ROUTING, and registers the function at the hook point NF_BR_FORWARD. The registration process is as follows: First, set the hook setting parameters simple_nf_opt, including setting the protocol layer to the data link layer; setting the hook point to network bridge forwarding; setting the processing priority to the highest; setting the hook function to the custom function packet_filter; Then call the nf_register_net_hook function in Netfilter, pass the hook setting parameter simple_nf_opt into the nf_register_net_hook function to register the hook function; S1.2.

2. Call the registered hook function packet_filter to obtain the first address and length of the TCP protocol data packet to extract the TCP protocol data packet.

4. The method for preventing tampering of industrial control system configuration and downloading based on the national secret SM4 algorithm as claimed in claim 2 is characterized in that: In the step S1.3, the specific encryption steps are: first set the SM4 ctr encryption algorithm, then perform data encryption on the TCP protocol data packet to generate ciphertext, the length of the generated ciphertext is the same as the length of the plaintext, and the generated ciphertext replaces the plaintext in the TCP protocol data packet to complete the encryption of the TCP protocol data packet.

5. The method for anti-tampering of industrial control system configuration download based on the national secret SM4 algorithm as claimed in claim 1, characterized in that: In the step S3, the specific steps are: S3.

1. The decryption device is configured with network interface A and network interface B. Network interface A is connected to the switch, and network interface B is connected to the lower computer. The two interfaces are set as network bridges in the operating system of the decryption device. S3.2, in the process of transmitting the network data flow packet from the network interface A to the network interface B, the kernel module Netfilter in the decryption device processes the encrypted network data flow packet and extracts the encrypted TCP protocol data packet; S3.3, after decrypting the extracted TCP protocol data packet, the decrypted network traffic data packet is then transmitted to the lower computer via the network interface B of the decryption device.

6. The method for preventing tampering of industrial control system configuration and downloading based on the national secret SM4 algorithm as claimed in claim 5 is characterized in that: In the step S3.2, the specific processing process includes the following steps: S3.2.

1. Netfilter sets three hook points at the second layer link layer of the OSI network, NF_BR_PRE_ROUTING, NF_BR_FORWARD and NF_BR_POST_ROUTING, and registers the function at the hook point NF_BR_FORWARD. The registration process is as follows: First, set the hook setting parameters simple_nf_opt, including setting the protocol layer to the data link layer; setting the hook point to network bridge forwarding; setting the processing priority to the highest; setting the hook function to the custom function packet_filter; Then call the nf_register_net_hook function in Netfilter, pass the hook setting parameter simple_nf_opt into the nf_register_net_hook function to register the hook function; S3.2.

2. Call the registered hook function packet_filter to obtain the first address and length of the TCP protocol data packet to extract the TCP protocol data packet.

7. The method for anti-tampering of industrial control system configuration download based on the national secret SM4 algorithm as claimed in claim 6, characterized in that: In the step S3.3, the specific steps of decryption are: first set the SM4 ctr decryption algorithm, then perform data decryption on the TCP protocol data packet to generate plaintext, the length of the generated plaintext is the same as the length of the ciphertext, and the generated plaintext replaces the ciphertext in the TCP protocol data packet to complete the decryption of the TCP protocol data packet.

Images