PLC security access authentication method and system based on identification cryptographic algorithm

Abstract

The invention provides a PLC secure access authentication method and system based on an identification cryptographic algorithm, and the method comprises the steps: a PLC device to be accessed to an industrial control network sends an identity registration request to a key generation center, and the key generation center completes the registration of the PLC device to be accessed to the industrial control network according to the identity registration request, the PLC equipment is allowed to be accessed; the to-be-accessed industrial control network PLC equipment initiates an access authentication request to equipment needing to be connected with the to-be-accessed industrial control network PLC equipment, and safety access authentication between the equipment is completed; the equipment needing to be connected with the equipment comprises PLC (Programmable Logic Controller) equipment or running state monitoring equipment; and an encryption security communication channel is established between the PLC equipment allowed to be accessed and the equipment needing to be connected with the PLC equipment. According to the invention, access authentication and establishment of an encrypted secure communication channel are needed when any PLC equipment accesses the industrial control network, so that the communication security and reliable operation of the PLC equipment in the industrial control network are effectively guaranteed.

Description

Technical Field

[0001] The present invention relates to the field of industrial automation, and in particular to a PLC security access authentication method and system based on an identification password algorithm. Background Art

[0002] In the field of modern industrial automation, the Programmable Logic Controller (PLC) is an important basic control device of industrial control systems, and its security is directly related to the security of the entire industrial system. With the continuous advancement of industrialization, the horizontal and vertical connections of industrial control system networks are becoming closer, and the interconnectivity between PLCs and between PLCs and business networks is constantly increasing; while the level of informatization is constantly improving, its information security issues are becoming increasingly prominent. The original PLC communication protocol has evolved and accumulated over a long period of time. At the beginning of the design of the protocol, due to the real-time requirements of industrial control and the limitations of the computing power of the central processing unit (CPU), the necessary authentication conditions such as encryption and authentication to ensure the security of PLC communication were not considered.

[0003] Since the communication protocol in the PLC industrial control network lacks the protection of cryptographic technology, attackers can easily forge identities to access the industrial control network, eavesdrop on and analyze the data in the industrial control network, forge data to control the PLC devices in the industrial control network, and deceive the operating status monitoring equipment in the business network, posing a huge security risk to the entire industrial control system.

[0004] The Internet usually adopts a cryptographic system based on Public Key Infrastructure (PKI), using digital certificates issued by Certificate Authority (CA) and public key encryption technology to achieve identity authentication and data encryption in Internet communications. Although the PKI cryptographic system plays an important role in identity authentication and data encryption, it has problems such as the complexity of certificate management, dependence on centralized CA, performance overhead, storage and bandwidth requirements, which limit its flexibility and efficiency in resource-constrained and large-scale deployment scenarios.

[0005] Considering the real-time requirements of PLC industrial control, the limitations of CPU computing power and the characteristics of flexible deployment, although the PKI cryptographic system can play a role in identity authentication and data encryption, it cannot meet the usage requirements of PLC industrial control networks.

[0006] Therefore, researching and developing a safe and efficient PLC security access authentication method and system is of great significance to ensuring the security of industrial control systems. Summary of the invention

[0007] The present invention aims to provide a PLC security access authentication method and system based on an identification cryptographic algorithm to solve the above-mentioned problems.

[0008] The present invention provides a PLC security access authentication method based on an identification password algorithm, comprising the following steps:

[0009] S100, the industrial control network PLC device to be connected sends an identity registration request to the key generation center, and the key generation center completes device registration for the industrial control network PLC device to be connected according to the identity registration request. The industrial control network PLC device to be connected that has completed device registration is a PLC device that is allowed to access;

[0010] S200, the PLC device to be connected to the industrial control network initiates an access authentication request to the device to be connected to it, and completes the secure access authentication between the devices; the device to be connected to it includes a PLC device or an operation status monitoring device;

[0011] S300, establishing an encrypted secure communication channel between the PLC device that is allowed to access and the device that needs to be connected.

[0012] In some embodiments, in step S100, device registration is completed based on the identity identifier and the temporary symmetric key. Further, step S100 specifically includes:

[0013] S101, the PLC device to be connected to the industrial control network generates a temporary symmetric key, encrypts its own identity and the temporary symmetric key using the public key corresponding to the identity of the key generation center, and sends an identity registration request to the key generation center;

[0014] S102, after receiving the identity registration request of the industrial control network PLC device to be connected, the key generation center uses the private key of the key generation center to decrypt the identity and temporary symmetric key of the industrial control network PLC device to be connected;

[0015] S103, the key generation center queries the device registration information according to the identity identifier of the industrial control network PLC device to be connected, and reviews the device registration information of the industrial control network PLC device to be connected; if the review is passed, the device is registered, and a private key corresponding to the identity identifier of the industrial control network PLC device to be connected is generated, and the private key generated for it is encrypted using the temporary symmetric key to obtain the identity identifier private key ciphertext, and the identity identifier private key ciphertext is sent to the industrial control network PLC device to be connected;

[0016] S104, the PLC device to be connected to the industrial control network receives the identity identification private key ciphertext, uses the temporary symmetric key generated by it, decrypts the private key generated by the key generation center for it and saves it, thus completing the device registration of the PLC device to be connected to the industrial control network.

[0017] In some embodiments, in step S200, secure access authentication between devices is completed based on identity, time and hash signature. Further, step S200 specifically includes:

[0018] S201, the industrial control network PLC device to be connected is used as a device requesting authentication, and a hash value is calculated for its current time and its own identity through a hash algorithm, and the hash value is signed using the private key, and the current time and its own identity and their signature values ​​are used as an access authentication request to send to the device to be connected to it; wherein the current time of the industrial control network PLC device to be connected is the time of requesting authentication, and the identity of the industrial control network PLC device to be connected is the identity of the device requesting authentication;

[0019] S202, the device receiving the access authentication request parses the request authentication time, the request authentication device identity and the signature value; firstly, it is determined whether the request authentication time is within a reasonable range, and if the request authentication time is unreasonable, the access authentication request is directly rejected; if the request authentication time is reasonable, the hash value of the request authentication time and the request authentication identity is calculated by a hash algorithm, and the public key corresponding to the request authentication identity is used to verify the legitimacy of the signature value. If the signature verification fails, the access authentication request is rejected, and if the signature verification succeeds, it proves that the identity of the request authentication device is legitimate, and then step S203 is executed;

[0020] S203, after proving the legality of the identity of the device requesting authentication, the device receiving the access authentication request calculates a hash value for the current time and its own identity through a hash algorithm, signs the hash value with a private key, and sends the current time and its own identity and its signature value as access authentication confirmation to the device requesting authentication that initiated the access authentication request; wherein the current time of the device receiving the access authentication request is the authentication confirmation time;

[0021] S204, when the authentication requesting device receives the access authentication confirmation, it parses the authentication confirmation time, the device identity to be connected and the signature value; firstly, it determines whether the authentication confirmation time is within a reasonable range. If the authentication confirmation time is unreasonable, it proves that the access authentication has failed; if the authentication confirmation time is reasonable, the hash value of the authentication confirmation time and the device identity to be connected is calculated through a hash algorithm, and the public key corresponding to the device identity to be connected is used to verify the legitimacy of the signature value. If the signature verification fails, it proves that the access authentication has failed; if the signature verification succeeds, it proves that the device identity to be connected is legitimate and the access authentication is successful.

[0022] In some embodiments, in step S300, an encrypted secure communication channel is established based on the identity, time, session symmetric key and hash signature. Further, step S300 specifically includes:

[0023] S301, after the access PLC device and the device it needs to connect to complete the secure access authentication between the devices, either party as the communication initiator generates a session symmetric key and calculates the hash value through the hash algorithm, signs the hash value using the private key corresponding to the identity of the communication initiator, encrypts the session symmetric key and its signature value using the public key corresponding to the identity of the peer device, and sends it and its own identity to the peer device, initiating a request to establish an encrypted secure communication channel;

[0024] S302, after receiving the request to establish an encrypted secure communication channel, the peer device first confirms whether the communication initiator device is an authenticated device. If not, the request is rejected. If it is an authenticated device, the peer device uses the private key corresponding to its own identity to decrypt the session symmetric key and its signature value, calculates the hash value of the session symmetric key through a hash algorithm, and uses the public key corresponding to the identity of the communication initiator device to verify the legitimacy of the signature. If the signature verification fails, it proves that the session symmetric key has been tampered with and the request is rejected. If the signature verification succeeds, it proves that the required session symmetric key is valid, and it is set as the session symmetric key with the communication initiator device.

[0025] S303, after receiving the request to establish an encrypted secure communication channel and completing the session symmetric key setting, the peer device uses the session symmetric key to encrypt the session symmetric key and sends it to the communication initiator device to confirm the establishment of the encrypted secure communication channel;

[0026] S304, after the communication initiator device receives the confirmation request for establishing an encrypted secure communication channel from the peer device, it uses the session symmetric key to decrypt and determine whether the decrypted plaintext is the session symmetric key sent by itself. If not, the establishment of the encrypted secure communication fails. If so, the establishment of the encrypted secure communication succeeds, and data encryption can be transmitted between devices through the encrypted secure communication channel.

[0027] In some embodiments, the device that needs to be connected includes a PLC device or an operation status monitoring device.

[0028] The present invention also provides a PLC security access authentication system based on an identification cryptographic algorithm, comprising a key generation center, an industrial control network PLC device to be connected, and a device that needs to be connected to the industrial control network PLC device to be connected; the key generation center, the industrial control network PLC device to be connected, and the device that needs to be connected to the industrial control network PLC device to be connected are used to execute the above-mentioned PLC security access authentication method based on the identification cryptographic algorithm.

[0029] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are:

[0030] The present invention saves the process of public key exchange and certificate verification by adopting an identification cryptographic algorithm, reduces the time for PLC access authentication and establishing an encrypted secure communication channel, and can take into account the real-time requirements of PLC industrial control and the limitations of CPU computing power while achieving the requirements of PLC secure access authentication; at the same time, it simplifies the management of keys and facilitates the deployment and use of PLC devices. Through the method of the present invention, any PLC device that accesses the industrial control network must first undergo access authentication, which avoids the access of illegal and counterfeit devices and ensures that the identity of the access device is credible; before allowing the accessed device to communicate, an encrypted secure communication channel is first established, and the communication data is transmitted through the encrypted secure communication channel to avoid illegal eavesdropping, effectively ensuring the communication security and reliable operation of the PLC device in the industrial control network. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 The present invention is a flowchart of a PLC security access authentication method based on an identification password algorithm in an embodiment of the present invention.

[0032] Figure 2 This is a flow chart of a PLC device to be connected to an industrial control network sending a registration request to a key generation center in an embodiment of the present invention.

[0033] Figure 3 This is a flow chart of a PLC device to be connected initiating an access authentication request to a PLC device or an operation status monitoring device to be connected in an embodiment of the present invention.

[0034] Figure 4 This is a flow chart of an embodiment of the present invention that allows an encrypted secure communication channel to be established between an access PLC device and a PLC device or an operation status monitoring device to which it needs to be connected.

[0035] Figure 5 It is a structural diagram of a PLC security access authentication system based on an identification password algorithm in an embodiment of the present invention. DETAILED DESCRIPTION

[0036] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings here can be arranged and designed in various different configurations.

[0037] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention claimed for protection, but merely represents selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0038] like Figure 1 As shown, this embodiment proposes a PLC security access authentication method based on an identification password algorithm, including:

[0039] S100, the industrial control network PLC device to be connected sends an identity registration request to a key generation center (KGC), and the key generation center completes device registration for the industrial control network PLC device to be connected according to the identity registration request. The industrial control network PLC device to be connected that has completed device registration is a PLC device that is allowed to access;

[0040] S200, the PLC device to be connected to the industrial control network initiates an access authentication request to the device to be connected to it, and completes the secure access authentication between the devices; the device to be connected to it includes a PLC device or an operation status monitoring device;

[0041] S300, establishing an encrypted secure communication channel between the PLC device that is allowed to access and the device that needs to be connected.

[0042] In some embodiments, Figure 2 As shown, the device registration is completed based on the identity identifier and the temporary symmetric key in step S100, which specifically includes:

[0043] S101, the PLC device to be connected to the industrial control network generates a temporary symmetric key, encrypts its own identity and the temporary symmetric key using the public key corresponding to the identity of the key generation center, and sends an identity registration request to the key generation center;

[0044] S102, after receiving the identity registration request of the industrial control network PLC device to be connected, the key generation center uses the private key of the key generation center to decrypt the identity and temporary symmetric key of the industrial control network PLC device to be connected;

[0045] S103, the key generation center queries the device registration information according to the identity identifier of the industrial control network PLC device to be connected, and reviews the device registration information of the industrial control network PLC device to be connected; if the review is passed, the device is registered, and a private key corresponding to the identity identifier of the industrial control network PLC device to be connected is generated, and the private key generated for it is encrypted using the temporary symmetric key to obtain the identity identifier private key ciphertext, and the identity identifier private key ciphertext is sent to the industrial control network PLC device to be connected;

[0046] S104, the PLC device to be connected to the industrial control network receives the identity identification private key ciphertext, uses the temporary symmetric key generated by it, decrypts the private key generated by the key generation center for it and saves it, thus completing the device registration of the PLC device to be connected to the industrial control network.

[0047] In some embodiments, Figure 3 As shown, in step S200, the secure access authentication between devices is completed based on the identity, time and hash signature, specifically including:

[0048] S201, the industrial control network PLC device to be connected is used as a device requesting authentication, and a hash value is calculated for its current time and its own identity through a hash algorithm, and the hash value is signed using the private key, and the current time and its own identity and their signature values ​​are used as an access authentication request to send to the device to be connected to it; wherein the current time of the industrial control network PLC device to be connected is the time of requesting authentication, and the identity of the industrial control network PLC device to be connected is the identity of the device requesting authentication;

[0049] S202, the device receiving the access authentication request parses the request authentication time and the authentication device identity and signature value; firstly, it is determined whether the authentication request time is within a reasonable range (for example, whether the authentication request time exceeds the first time threshold); if the authentication request time is unreasonable, the access authentication request is directly rejected; if the authentication request time is reasonable, the hash value of the authentication request time and the authentication request identity is calculated by a hash algorithm, and the public key corresponding to the authentication request identity is used to verify the legitimacy of the signature value; if the signature verification fails, the access authentication request is rejected; if the signature verification succeeds, it proves that the authentication device identity is legitimate, and then step S203 is executed;

[0050] S203, after proving the legality of the identity of the device requesting authentication, the device receiving the access authentication request calculates a hash value for the current time and its own identity through a hash algorithm, signs the hash value with a private key, and sends the current time and its own identity and its signature value as access authentication confirmation to the device requesting authentication that initiated the access authentication request; wherein the current time of the device receiving the access authentication request is the authentication confirmation time;

[0051] S204, when the authentication requesting device receives the access authentication confirmation, it parses the authentication confirmation time, the device identity to be connected and the signature value; firstly, it determines whether the authentication confirmation time is within a reasonable range (for example, whether the authentication confirmation time exceeds the second time threshold); if the authentication confirmation time is unreasonable, it proves that the access authentication has failed; if the authentication confirmation time is reasonable, the hash value of the authentication confirmation time and the device identity to be connected is calculated by the hash algorithm, and the public key corresponding to the device identity to be connected is used to verify the legitimacy of the signature value; if the signature verification fails, it proves that the access authentication has failed; if the signature verification succeeds, it proves that the device identity to be connected is legitimate and the access authentication is successful.

[0052] In some embodiments, Figure 4 As shown, the step S300 specifically includes:

[0053] S301, after the access PLC device and the device it needs to connect to complete the secure access authentication between the devices, either party as the communication initiator generates a session symmetric key and calculates the hash value through the hash algorithm, signs the hash value using the private key corresponding to the identity of the communication initiator, encrypts the session symmetric key and its signature value using the public key corresponding to the identity of the peer device, and sends it and its own identity to the peer device, initiating a request to establish an encrypted secure communication channel;

[0054] S302, after receiving the request to establish an encrypted secure communication channel, the peer device first confirms whether the communication initiator device is an authenticated device. If not, the request is rejected. If it is an authenticated device, the peer device uses the private key corresponding to its own identity to decrypt the session symmetric key and its signature value, calculates the hash value of the session symmetric key through a hash algorithm, and uses the public key corresponding to the identity of the communication initiator device to verify the legitimacy of the signature. If the signature verification fails, it proves that the session symmetric key has been tampered with and the request is rejected. If the signature verification succeeds, it proves that the required session symmetric key is valid, and it is set as the session symmetric key with the communication initiator device.

[0055] S303, after receiving the request to establish an encrypted secure communication channel and completing the session symmetric key setting, the peer device uses the session symmetric key to encrypt the session symmetric key and sends it to the communication initiator device to confirm the establishment of the encrypted secure communication channel;

[0056] S304, after the communication initiator device receives the confirmation request for establishing an encrypted secure communication channel from the peer device, it uses the session symmetric key to decrypt and determine whether the decrypted plaintext is the session symmetric key sent by itself. If not, the establishment of the encrypted secure communication fails. If so, the establishment of the encrypted secure communication succeeds, and data encryption can be transmitted between devices through the encrypted secure communication channel.

[0057] Based on the same technical concept, Figure 5 As shown, an embodiment of the present invention also provides a PLC security access authentication system based on an identification password algorithm, including a key generation center, an industrial control network PLC device to be connected, and a device that needs to be connected to the industrial control network PLC device to be connected; the key generation center, the industrial control network PLC device to be connected, and the device that needs to be connected to the industrial control network PLC device to be connected are used to execute the PLC security access authentication method based on the identification password algorithm provided in the above embodiment. The device to be connected includes a PLC device or an operation status monitoring device. Some execution logic is as follows:

[0058] The key generation center completes device registration for the PLC device to be connected to the industrial control network and the device to be connected;

[0059] The PLC device to be connected to the industrial control network requests registration from the key generation center, receives the private key corresponding to the identity generated by the key generation center, and completes the device registration;

[0060] After receiving the access authentication request from the industrial control network PLC device to be connected, the device to be connected verifies the legitimacy of the identity of the industrial control network PLC device to be connected through the signature value of the industrial control network PLC device to be connected. After the verification is passed, the industrial control network PLC device to be connected is allowed to access, and an access authentication confirmation is initiated to the industrial control network PLC device to be connected. The industrial control network PLC device to be connected verifies the signature value of the device to be connected, reversely verifies the legitimacy of the identity of the device to be connected, and verifies that the device security access authentication is successfully completed;

[0061] Between the PLC device that has completed access authentication and the device that needs to be connected, an encrypted secure communication channel can be established through the session symmetric key to perform data encryption transmission, avoiding illegal eavesdropping and effectively ensuring the communication security and reliable operation of the PLC device in the industrial control network.

[0062] In the present invention, the identification cryptographic algorithm used is the SM9 algorithm but not limited thereto, the symmetric key used is the SM4 symmetric key but not limited thereto, and the hash algorithm used is the SM3 algorithm but not limited thereto. When the PLC device performs the above cryptographic operation, it can decide whether to add an external security chip to assist in completing the cryptographic operation according to the needs.

[0063] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A PLC security access authentication method based on an identification password algorithm, characterized in that: The steps include: S100, the industrial control network PLC device to be connected sends an identity registration request to the key generation center, and the key generation center completes device registration for the industrial control network PLC device to be connected according to the identity registration request. The industrial control network PLC device to be connected that has completed device registration is a PLC device that is allowed to access; S200, the PLC device to be connected to the industrial control network initiates an access authentication request to the device to be connected to it, and completes the secure access authentication between the devices; the device to be connected to it includes a PLC device or an operation status monitoring device; S300, establishing an encrypted secure communication channel between the PLC device that is allowed to access and the device that needs to be connected.

2. The PLC security access authentication method based on identification password algorithm according to claim 1 is characterized in that: In the step S100, device registration is completed based on the identity identifier and the temporary symmetric key.

3. The PLC security access authentication method based on identification password algorithm according to claim 2 is characterized in that: The step S100 specifically includes: S101, the PLC device to be connected to the industrial control network generates a temporary symmetric key, encrypts its own identity and the temporary symmetric key using the public key corresponding to the identity of the key generation center, and sends an identity registration request to the key generation center; S102, after receiving the identity registration request of the industrial control network PLC device to be connected, the key generation center uses the private key of the key generation center to decrypt the identity and temporary symmetric key of the industrial control network PLC device to be connected; S103, the key generation center queries the device registration information according to the identity identifier of the industrial control network PLC device to be connected, and reviews the device registration information of the industrial control network PLC device to be connected; if the review is passed, the device is registered, and a private key corresponding to the identity identifier of the industrial control network PLC device to be connected is generated, and the private key generated for it is encrypted using the temporary symmetric key to obtain the identity identifier private key ciphertext, and the identity identifier private key ciphertext is sent to the industrial control network PLC device to be connected; S104, the PLC device to be connected to the industrial control network receives the identity identification private key ciphertext, uses the temporary symmetric key generated by it, decrypts the private key generated by the key generation center for it and saves it, thus completing the device registration of the PLC device to be connected to the industrial control network.

4. The PLC security access authentication method based on identification password algorithm according to claim 1 is characterized in that: In step S200, secure access authentication between devices is completed based on identity, time and hash signature.

5. The PLC security access authentication method based on identification password algorithm according to claim 4 is characterized in that: The step S200 specifically includes: S201, the industrial control network PLC device to be connected is used as a device requesting authentication, and a hash value is calculated for its current time and its own identity through a hash algorithm, and the hash value is signed using the private key, and the current time and its own identity and their signature values ​​are used as an access authentication request to send to the device to be connected to it; wherein the current time of the industrial control network PLC device to be connected is the time of requesting authentication, and the identity of the industrial control network PLC device to be connected is the identity of the device requesting authentication; S202, the device receiving the access authentication request parses the request authentication time, the request authentication device identity and the signature value; firstly, it is determined whether the request authentication time is within a reasonable range, and if the request authentication time is unreasonable, the access authentication request is directly rejected; if the request authentication time is reasonable, the hash value of the request authentication time and the request authentication identity is calculated by a hash algorithm, and the public key corresponding to the request authentication identity is used to verify the legitimacy of the signature value. If the signature verification fails, the access authentication request is rejected, and if the signature verification succeeds, it proves that the identity of the request authentication device is legitimate, and then step S203 is executed; S203, after proving the legality of the identity of the device requesting authentication, the device receiving the access authentication request calculates a hash value for the current time and its own identity through a hash algorithm, signs the hash value with a private key, and sends the current time and its own identity and its signature value as access authentication confirmation to the device requesting authentication that initiated the access authentication request; wherein the current time of the device receiving the access authentication request is the authentication confirmation time; S204, when the authentication requesting device receives the access authentication confirmation, it parses the authentication confirmation time, the device identity to be connected and the signature value; firstly, it determines whether the authentication confirmation time is within a reasonable range. If the authentication confirmation time is unreasonable, it proves that the access authentication has failed; if the authentication confirmation time is reasonable, the hash value of the authentication confirmation time and the device identity to be connected is calculated through a hash algorithm, and the public key corresponding to the device identity to be connected is used to verify the legitimacy of the signature value. If the signature verification fails, it proves that the access authentication has failed; if the signature verification succeeds, it proves that the device identity to be connected is legitimate and the access authentication is successful.

6. The PLC security access authentication method based on identification password algorithm according to claim 1 is characterized in that: In step S300, an encrypted secure communication channel is established based on identity, time, session symmetric key and hash signature.

7. The PLC security access authentication method based on identification password algorithm according to claim 6 is characterized in that: The step S300 specifically includes: S301, after the access PLC device and the device it needs to connect to complete the secure access authentication between the devices, either party as the communication initiator generates a session symmetric key and calculates the hash value through the hash algorithm, signs the hash value using the private key corresponding to the identity of the communication initiator, encrypts the session symmetric key and its signature value using the public key corresponding to the identity of the peer device, and sends it and its own identity to the peer device, initiating a request to establish an encrypted secure communication channel; S302, after receiving the request to establish an encrypted secure communication channel, the peer device first confirms whether the communication initiator device is an authenticated device. If not, the request is rejected. If it is an authenticated device, the peer device uses the private key corresponding to its own identity to decrypt the session symmetric key and its signature value, calculates the hash value of the session symmetric key through a hash algorithm, and uses the public key corresponding to the identity of the communication initiator device to verify the legitimacy of the signature. If the signature verification fails, it proves that the session symmetric key has been tampered with and the request is rejected. If the signature verification succeeds, it proves that the required session symmetric key is valid, and it is set as the session symmetric key with the communication initiator device. S303, after receiving the request to establish an encrypted secure communication channel and completing the session symmetric key setting, the peer device uses the session symmetric key to encrypt the session symmetric key and sends it to the communication initiator device to confirm the establishment of the encrypted secure communication channel; S304, after the communication initiator device receives the confirmation request for establishing an encrypted secure communication channel from the peer device, it uses the session symmetric key to decrypt and determine whether the decrypted plaintext is the session symmetric key sent by itself. If not, the establishment of the encrypted secure communication fails. If so, the establishment of the encrypted secure communication succeeds, and data encryption can be transmitted between devices through the encrypted secure communication channel.

8. The PLC security access authentication method based on identification password algorithm according to claim 1 is characterized in that: The equipment to be connected includes a PLC device or an operation status monitoring device.

9. A PLC security access authentication system based on identification password algorithm, characterized in that: It includes a key generation center, an industrial control network PLC device to be connected, and a device that needs to be connected to the industrial control network PLC device to be connected; the key generation center, the industrial control network PLC device to be connected, and the device that needs to be connected to the industrial control network PLC device to be connected are used to execute the PLC security access authentication method based on the identification password algorithm as described in any one of claims 1-8.

Images