Management and control method based on zero-trust industrial control server operating system

Abstract

The invention discloses a management and control method based on a zero-trust industrial control server operating system. The method comprises the following steps: S1, establishing a zero-trust model; s2, implementing identity authentication and authorization; s3, monitoring and auditing; and S4, continuous evaluation and improvement. According to the invention, a traditional boundary defense mode is broken, and dynamic and fine-grained access control of the industrial control server is realized, so that the security of the industrial control system is improved; by adopting a multi-factor identity authentication technology and an authorization mechanism based on user behaviors and context information, the accuracy and safety of access control can be improved, and loopholes and risks existing in a traditional access control method are avoided; the access behavior of the industrial control server is monitored and audited in real time, abnormal behaviors and safety events can be found in time, alarming and processing are carried out, and then the safety and emergency response capability of the industrial control system are improved.

Description

Technical Field

[0001] The present invention relates to the field of industrial Internet security technology, and in particular to a management and control method based on a zero-trust industrial control server operating system. Background Art

[0002] The Industrial Internet is a new type of infrastructure, application model and industrial ecology that deeply integrates the new generation of information and communication technology with the industrial economy. Through the comprehensive connection of people, machines, objects, systems, etc., it builds a new manufacturing and service system covering the entire industrial chain and the entire value chain, providing a way to achieve the digitalization, networking and intelligent development of industry and even the industry. Since industrial control systems and equipment are connected through the Industrial Internet, they may encounter risks such as network attacks, data leakage or system intrusion, so the security of industrial control systems is particularly important.

[0003] Traditional network security protection methods are usually based on border defense, that is, setting up security devices such as firewalls at the network border to isolate and control access to internal and external networks. However, this protection method has many limitations when facing increasingly complex network attacks and internal threats. Summary of the invention

[0004] The purpose of the present invention is to solve the above-mentioned background technical problems and to propose a management and control method based on a zero-trust industrial control server operating system.

[0005] The purpose of the present invention can be achieved through the following technical solutions:

[0006] A management and control method based on a zero-trust industrial control server operating system, comprising:

[0007] S1. Carry out asset sorting and risk assessment on industrial control servers, establish asset lists and risk models for industrial control servers, and build a zero-trust model based on the asset lists and risk models to dynamically assess access requests to industrial control servers and authorize access requests after assessment.

[0008] S2. Use multi-factor identity authentication technology to authenticate the user's identity, and authorize the user's access request based on the user's identity and behavior information, as well as the risk assessment results of the industrial control server;

[0009] S3. Deploy a monitoring system to monitor the access behavior of industrial control servers in real time, record user access information and system response, analyze and audit the monitoring data, and issue alerts for abnormal behavior and security incidents based on the analysis results;

[0010] S4. Regularly evaluate the security status of industrial control servers and adjust and optimize the zero trust model and access control policy based on the evaluation results.

[0011] As a further solution of the present invention: in the step S1, the dynamic evaluation includes multi-factor analysis, and the multi-factors include user identity, device information, access time, access location, and access purpose.

[0012] As a further solution of the present invention: in the step S2, the multi-factor identity authentication technology includes a password, a challenge, and a token.

[0013] As a further solution of the present invention: in step S2, the authorization of the user's access request may be based on role-based access control, attribute-based access control or a combination of the two.

[0014] As a further solution of the present invention: in step S3, the access information recorded by the monitoring system includes the user's access operation, access time, access location, and access device.

[0015] As a further solution of the present invention: in step S3, a monitoring and auditing strategy is defined for analyzing and auditing the monitoring data.

[0016] As a further solution of the present invention: in step S4, other security technologies can be introduced into the zero trust model and access control policy for assistance.

[0017] As a further solution of the present invention: in the step S1, the following steps are included:

[0018] S11. Determine the required functional and safety objectives;

[0019] S12. Identify and classify relevant assets in the industrial control server;

[0020] S13. Perform a comprehensive virus scan and elimination on the identified assets through the operating system;

[0021] S14. Conduct risk assessment on identified assets and identify potential security threats;

[0022] S15. Based on the results of the risk assessment, formulate a zero-trust strategy controlled by the industrial control host operating system;

[0023] S16. Deploy technical measures to implement zero trust strategies;

[0024] S17. Set up real-time monitoring and auditing mechanisms to record user operations and system responses;

[0025] S18. Regularly evaluate the security status of the system and optimize and improve the zero trust model based on the evaluation results.

[0026] As a further solution of the present invention: in said step S2, the following steps are included:

[0027] S21, the user sends a request for access;

[0028] S22. Collect user information;

[0029] S23. Verify the user's identity to ensure the authenticity and legitimacy of the user's information;

[0030] S24, classifying the user based on the verification result;

[0031] S25, performing authority determination on the authenticated user to verify the access rights to the requested resources;

[0032] S26. After obtaining the permission, the user can access the requested resource;

[0033] S27, continuously monitor the user's behavior, and generate an alarm message if abnormal or suspicious behavior is found;

[0034] S28. The system notifies the relevant administrator of the alarm information.

[0035] As a further solution of the present invention: in the step S3, the following steps are included:

[0036] S31. Define the overall strategy for monitoring and auditing;

[0037] S32. Configure monitoring tools according to defined policies;

[0038] S33, collect monitoring data, monitor system behavior and user activities;

[0039] S34, analyzing and verifying the collected data, determining the abnormality of the data, detecting the abnormal data, recording the user's behavior data, generating alarm information, and transmitting the alarm information to the administrator;

[0040] S35. Record the behavior data of verified users, and conduct tracking and auditing;

[0041] S36. Verified users can access relevant resources;

[0042] S37. Continuously monitor user behavior to ensure system security;

[0043] S38. If an abnormality occurs during the monitoring process, the system generates an alarm message and transmits the alarm message to the administrator.

[0044] Beneficial effects of the present invention:

[0045] (1) The present invention breaks the traditional border defense mode and implements dynamic and fine-grained access control to industrial control servers, thereby improving the security of industrial control systems.

[0046] (2) In the present invention, by adopting multi-factor identity authentication technology and an authorization mechanism based on user behavior and context information, the accuracy and security of access control can be improved, and the loopholes and risks existing in traditional access control methods can be avoided.

[0047] (3) In the present invention, the access behavior of the industrial control server is monitored and audited in real time, which can timely discover abnormal behavior and security incidents, and issue alarms and handle them, thereby improving the security and emergency response capabilities of the industrial control system. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] The present invention will be further described below in conjunction with the accompanying drawings.

[0049] Figure 1 It is a flow chart of the control method based on the zero-trust industrial control server operating system of the present invention;

[0050] Figure 2 is a flow chart of the present invention for creating a zero trust model;

[0051] Figure 3 It is a flow chart of identity authentication and authorization of the present invention;

[0052] Figure 4 is a flow chart of monitoring and auditing of the present invention;

[0053] Figure 5 is a flow chart of deploying a zero trust strategy according to the present invention;

[0054] Figure 6 It is a flow chart of the specific implementation of the management and control method based on the zero-trust industrial control server operating system of the present invention. DETAILED DESCRIPTION

[0055] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0056] The present invention is a management and control method based on a zero-trust industrial control server operating system, wherein the industrial control server is a computer server in an industrial control system, which provides computing power, data processing, storage and communication functions for the industrial control system.

[0057] See also Figure 1-Figure 6 As shown, the management and control method based on the zero-trust industrial control server operating system includes:

[0058] S1. Establish a zero trust model

[0059] We conduct asset sorting and risk assessment on industrial control servers, establish asset lists and risk models for industrial control servers, and build a zero-trust model based on the asset lists and risk models. This model dynamically evaluates access requests to industrial control servers, and the dynamic evaluation includes multi-factor analysis, including user identity, device information, access time, access location, and access purpose. Only when the request passes the evaluation will the corresponding access rights be granted.

[0060] Specifically, the following steps are included:

[0061] S11. Determine the required functional and safety objectives.

[0062] S12. Identify and classify relevant assets in the industrial control server.

[0063] S13. Perform a comprehensive virus scan on the identified assets through the operating system.

[0064] S14. Conduct risk assessment on identified assets and identify potential security threats.

[0065] S15. Based on the results of the risk assessment, formulate a zero-trust strategy managed by the industrial control host operating system.

[0066] S16. Deploy technical measures to implement zero trust strategies.

[0067] S17. Set up real-time monitoring and auditing mechanisms to record user operations and system responses.

[0068] S18. Regularly evaluate the security status of the system and optimize and improve the zero trust model based on the evaluation results.

[0069] S2. Implement identity authentication and authorization

[0070] Multi-factor authentication technology is used to authenticate the user's identity, including passwords, questions, and tokens. After authentication, the user's access request is authorized based on the user's identity and behavior information, as well as the risk assessment results of the industrial control server, to achieve fine-grained access control, which can effectively prevent illegal access and attacks.

[0071] The authorization of the user's access request may be performed by role-based access control (RBAC), attribute-based access control (ABAC), or a combination of the two.

[0072] Specifically, the following steps are included:

[0073] S21. The user sends an access request.

[0074] S22. Collect user information.

[0075] S23. Verify the user's identity to ensure the authenticity and legitimacy of the user's information.

[0076] S24. Classify users based on the verification results. If the user identity verification fails, the system prohibits the corresponding business request. If the user identity verification succeeds, the next step of authority determination is carried out.

[0077] S25. Perform authority determination on the authenticated user to verify his / her access rights to the requested resources. If the user does not have sufficient authority, the system denies access and prohibits the corresponding business request. If the user has sufficient access rights, the system grants him / her the corresponding authority.

[0078] S26. After obtaining the permission, the user can access the requested resources.

[0079] S27. Continuously monitor user behavior to ensure the legality of their access operations and promptly detect potential security threats. If abnormal or suspicious behavior is found, generate an alarm message.

[0080] S28. The system notifies the relevant administrator of the alarm information so that they can respond and handle it in a timely manner.

[0081] S3, Monitoring and Auditing

[0082] Deploy a monitoring system to monitor the access behavior of industrial control servers in real time, record user access information and system response. The access information recorded by the monitoring system includes the user's access operation, access time, access location, and access device. You can define monitoring and audit policies, analyze and audit monitoring data, and issue alarms for abnormal behavior and security events based on the analysis results.

[0083] Specifically, the following steps are included:

[0084] S31. Define the overall strategy for monitoring and auditing.

[0085] S32. Configure the corresponding monitoring tools according to the defined strategies to ensure that the required information can be effectively collected.

[0086] S33. Collect monitoring data to monitor system behavior and user activities.

[0087] S34. Analyze and verify the collected data to determine any abnormalities in the data.

[0088] If the data analysis is normal, it passes the verification; if the data analysis is abnormal, the abnormal data is detected, the user's behavior data is recorded, an alarm message is generated, and the alarm message is passed to the administrator to quickly respond to possible security incidents.

[0089] S35. Record behavioral data of verified users and conduct tracking and auditing.

[0090] S36. Verified users can access related resources.

[0091] S37. Continuously monitor user behavior to ensure the security of the system.

[0092] S38. If an abnormality occurs during the monitoring process, the system generates an alarm message and passes it to the administrator to quickly respond to possible security incidents.

[0093] S4. Continuous evaluation and improvement

[0094] Regularly evaluate the security status of industrial control servers, and adjust and optimize the zero-trust model and access control strategy based on the evaluation results to improve the security and adaptability of industrial control systems. At the same time, pay attention to the development and changes of industrial Internet security technology, and introduce other security technologies to assist in the zero-trust model and access control strategy. Other security technologies include but are not limited to micro-segmentation, endpoint detection and response, data encryption and data loss prevention, vulnerability scanning, and blockchain technology.

[0095] It should be noted that traditional network security protection methods are usually based on perimeter defense. Once an attacker breaks through the network perimeter, he can move freely in the internal network and access and control various resources. Moreover, traditional access control methods usually authorize based on the user's identity and role, while ignoring the vulnerabilities of the industrial control system itself, which allows attackers to obtain illegal access rights by stealing the user's identity information or exploiting authorization vulnerabilities, resulting in low security.

[0096] The present invention breaks the traditional border defense mode and realizes dynamic and fine-grained access control to the industrial control server, thereby improving the security of the industrial control system.

[0097] Specifically, the zero-trust model can dynamically evaluate and authorize access requests to industrial control servers, achieve fine-grained access control, and effectively prevent illegal access and attacks. By adopting multi-factor identity authentication technology and authorization mechanisms based on user behavior and contextual information, the accuracy and security of access control can be improved, avoiding the vulnerabilities and risks existing in traditional access control methods. Real-time monitoring and auditing of access behaviors of industrial control servers can timely detect abnormal behaviors and security incidents, and issue alarms and handle them, such as blocking illegal access and isolating infected processes, which can reduce the impact of security incidents on industrial control systems and improve the security and emergency response capabilities of industrial control systems.

[0098] In addition, this management and control method based on the zero-trust industrial control server operating system has the function of deep defense. It not only performs zero-trust management and control at the network level, but also goes deep into the operating system level. It can perform fine-grained access control and monitoring of the operating system's processes, file systems, registries, etc., effectively preventing malware and attackers from infiltrating and destroying the operating system level.

[0099] It is understandable that the present invention controls the industrial control server operating system, which is more in line with the special needs and environment of the industrial control system. Since the industrial control system has high requirements for stability and reliability, this targeted control method can better ensure the safe operation of the industrial control server while reducing the potential impact on the production process. In the process of implementing security control, the present application takes into account the particularity of the industrial control system to avoid unnecessary impact on the production process, thereby ensuring the normal operation of the industrial control system.

[0100] The above is a detailed description of an embodiment of the present invention, but the content is only a preferred embodiment of the present invention and cannot be considered to limit the scope of implementation of the present invention. All equivalent changes and improvements made according to the scope of application of the present invention should still fall within the scope of the claims of the present invention.

Claims

1. A management and control method based on a zero-trust industrial control server operating system, characterized in that: include: S1. Carry out asset sorting and risk assessment on industrial control servers, establish asset lists and risk models for industrial control servers, and build a zero-trust model based on the asset lists and risk models to dynamically assess access requests to industrial control servers and authorize access requests after assessment. S2. Use multi-factor identity authentication technology to authenticate the user's identity, and authorize the user's access request based on the user's identity and behavior information, as well as the risk assessment results of the industrial control server; S3. Deploy a monitoring system to monitor the access behavior of industrial control servers in real time, record user access information and system response, analyze and audit the monitoring data, and issue alerts for abnormal behavior and security incidents based on the analysis results; S4. Regularly evaluate the security status of industrial control servers and adjust and optimize the zero trust model and access control policy based on the evaluation results.

2. A management and control method based on a zero-trust industrial control server operating system according to claim 1, characterized in that: In the step S1, the dynamic evaluation includes multi-factor analysis, and the multi-factors include user identity, device information, access time, access location, and access purpose.

3. According to claim 1, a management and control method based on a zero-trust industrial control server operating system is characterized in that: In the step S2, the multi-factor identity authentication technology includes a password, a challenge, and a token.

4. A management and control method based on a zero-trust industrial control server operating system according to claim 3, characterized in that: In step S2, the authorization of the user's access request may be based on role-based access control, attribute-based access control, or a combination of the two.

5. A management and control method based on a zero-trust industrial control server operating system according to claim 1, characterized in that: In step S3, the access information recorded by the monitoring system includes the user's access operation, access time, access location, and access device.

6. A management and control method based on a zero-trust industrial control server operating system according to claim 5, characterized in that: In step S3, monitoring and auditing strategies are defined for analyzing and auditing monitoring data.

7. A management and control method based on a zero-trust industrial control server operating system according to claim 1, characterized in that: In step S4, other security technologies may be introduced into the zero trust model and access control policy for assistance.

8. A management and control method based on a zero-trust industrial control server operating system according to claim 1, characterized in that: In step S1, the following steps are included: S11. Determine the required functional and safety objectives; S12. Identify and classify relevant assets in the industrial control server; S13. Perform a comprehensive virus scan and elimination on the identified assets through the operating system; S14. Conduct risk assessment on identified assets and identify potential security threats; S15. Based on the results of the risk assessment, formulate a zero-trust strategy controlled by the industrial control host operating system; S16. Deploy technical measures to implement zero trust strategies; S17. Set up real-time monitoring and auditing mechanisms to record user operations and system responses; S18. Regularly evaluate the security status of the system and optimize and improve the zero trust model based on the evaluation results.

9. A management and control method based on a zero-trust industrial control server operating system according to claim 1, characterized in that: In step S2, the following steps are included: S21, the user sends a request for access; S22. Collect user information; S23. Verify the user's identity to ensure the authenticity and legitimacy of the user's information; S24, classifying the user based on the verification result; S25, performing authority determination on the authenticated user to verify the access rights to the requested resources; S26. After obtaining the permission, the user can access the requested resource; S27, continuously monitor the user's behavior, and generate an alarm message if abnormal or suspicious behavior is found; S28. The system notifies the relevant administrator of the alarm information.

10. A management and control method based on a zero-trust industrial control server operating system according to claim 1, characterized in that: In step S3, the following steps are included: S31. Define the overall strategy for monitoring and auditing; S32. Configure monitoring tools according to defined policies; S33, collect monitoring data, monitor system behavior and user activities; S34, analyzing and verifying the collected data, determining the abnormality of the data, detecting the abnormal data, recording the user's behavior data, generating alarm information, and transmitting the alarm information to the administrator; S35. Record the behavior data of verified users, and conduct tracking and auditing; S36. Verified users can access relevant resources; S37. Continuously monitor user behavior to ensure system security; S38. If an abnormality occurs during the monitoring process, the system generates an alarm message and transmits the alarm message to the administrator.

Images