Security control method for trusted controller and related device

Abstract

The invention belongs to the technical field of industrial control systems, and discloses a security control method for a trusted controller and a related device, and the method comprises the steps: carrying out the identity verification of the trusted controller through a plurality of preset identity verification factors, and obtaining an identity verification result; wherein the preset multi-identity verification factor comprises a known information factor, a physical equipment verification factor and a biological characteristic verification factor; monitoring and analyzing the running state information of the trusted controller in real time according to the identity verification result to obtain a real-time monitoring result; generating a control decision or triggering a preset security measure mechanism according to the identity verification result and the real-time monitoring result; by combining a multi-factor identity verification mechanism and a real-time monitoring technology, strict management of the operation authority of the trusted controller and real-time monitoring of the security state of the trusted controller are achieved, illegal access and security threats can be effectively prevented, and then the reliability and stability of a control system are effectively improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of industrial control systems, and in particular relates to a security control method and related devices for a trusted controller. Background Art

[0002] Distributed Control System (DCS) is a new type of control equipment that uses computer technology to centrally monitor, operate, manage and decentralized control industrial production processes. It is widely used in industrial production fields such as electricity. The trusted DCS system is based on the traditional DCS system and introduces a trusted computing system to improve the security of the system.

[0003] In a trusted DCS system, trusted controllers collaborate with each other through hardware and software to ensure that the system's software and data are trustworthy when they are used; however, existing trusted controllers often use a single authentication method, such as password authentication, which is prone to being cracked; at the same time, existing trusted controllers lack a real-time monitoring mechanism, making it impossible for the system to detect and respond to potential security threats in a timely manner. Summary of the invention

[0004] In response to the technical problems existing in the prior art, the present invention provides a security management and control method and related devices for a trusted controller to solve the technical problems that the existing trusted controller is at risk of being easily cracked and lacks a real-time monitoring mechanism, resulting in the system being unable to promptly detect and respond to potential security threats.

[0005] In order to achieve the above object, the technical solution adopted by the present invention is: The present invention provides a security management and control method for a trusted controller, comprising: Authenticate the trusted controller in sequence using preset multiple authentication factors to obtain an authentication result; wherein the preset multiple authentication factors include known information factors, physical device authentication factors, and biometric authentication factors; Based on the identity authentication results, the operation status information of the trusted controller is monitored and analyzed in real time to obtain real-time monitoring results; Based on the identity authentication results and real-time monitoring results, control decisions are generated or preset security measures mechanisms are triggered.

[0006] Furthermore, the process of using the preset multiple authentication factors to authenticate the trusted controller in turn and obtain the authentication result is as follows: Use known information verification factors to perform the first authentication of the trusted controller; If the first authentication is successful, the second authentication is performed on the trusted controller using the physical device authentication factor; If the second authentication is successful, the third authentication is performed on the trusted controller using biometric authentication factors.

[0007] Furthermore, the known information verification factor includes a password, a PIN code or a security question; the physical device verification factor adopts a physical token; wherein the physical token includes a smart card or a mobile phone with pre-set verification information; the biometric verification factor includes fingerprint recognition, facial recognition or iris recognition.

[0008] Furthermore, the operation status information of the trusted controller includes the operation status of the trusted controller, user behavior, and system security status.

[0009] Furthermore, according to the identity authentication result, the operation status information of the trusted controller is monitored and analyzed in real time to obtain the real-time monitoring result, as follows: If the identity authentication result is passed, the real-time system log, user behavior data and security event information of the trusted controller are read to obtain real-time monitoring data; The real-time monitoring data is analyzed using a preset data analysis method to obtain the operating status of the trusted controller, user behavior and system security status, that is, the real-time monitoring result.

[0010] Furthermore, according to the identity authentication results and real-time monitoring results, a control decision is generated or a preset security measure mechanism is triggered, as follows: If the identity authentication result is passed and the real-time monitoring result is normal, an operation request authorization execution instruction is generated to the trusted controller; wherein the operation request authorization execution instruction is used to authorize the trusted controller to execute the received operation request; If the identity authentication result is not passed or the real-time monitoring result is abnormal, an operation request rejection execution instruction is generated to the trusted controller; wherein the operation request rejection execution instruction is used to trigger the trusted controller to reject the received operation request; If the identity authentication result is passed, but the real-time monitoring result finds an abnormality and the abnormal state of the real-time monitoring result exceeds the preset security state threshold, a preset security measure instruction is generated and sent to the trusted controller; wherein, the preset security measure instruction is used to trigger the trusted controller to execute a preset security warning mechanism, and the preset security warning mechanism includes locking account operations, restricting operation authority operations, or triggering preset security incident response operations.

[0011] The present invention also provides a security management and control system for a trusted controller, comprising: An identity authentication module, used to authenticate the trusted controller in sequence using preset multiple identity authentication factors to obtain an identity authentication result; wherein the preset multiple identity authentication factors include known information factors, physical device authentication factors, and biometric authentication factors; A real-time monitoring module is used to monitor and analyze the operation status information of the trusted controller in real time according to the identity authentication result to obtain the real-time monitoring result; The management and control module is used to generate control decisions or trigger preset security measures mechanisms based on identity authentication results and real-time monitoring results.

[0012] The present invention also provides a security management and control device for a trusted controller, comprising: a processor suitable for executing a computer program; A computer-readable storage medium, wherein a computer program is stored in the computer-readable storage medium, and when the computer program is executed by the processor, the security management and control method for a trusted controller is executed.

[0013] The present invention also provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the security management and control method for a trusted controller is implemented.

[0014] The present invention also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, the security management and control method for a trusted controller is implemented.

[0015] Compared with the prior art, the present invention has the following beneficial effects: The security management and control device for a trusted controller provided by the present invention authenticates the trusted controller through preset multiple authentication factors, which significantly improves the security of the system and requires attackers to obtain multiple authentication factors at the same time to access the system, thereby greatly reducing the risk of illegal intrusion; based on the authentication results, the operating status information of the trusted controller is monitored and analyzed in real time, so that potential security threats can be discovered and responded to in a timely manner, so that the system can respond quickly when a security incident occurs, and effectively prevent further deterioration of the situation; in the present invention, by combining a multi-factor authentication mechanism and real-time monitoring technology, strict management of the operating permissions of the trusted controller and real-time monitoring of the security status of the trusted controller are achieved, which can effectively prevent illegal access and security threats, thereby effectively improving the reliability and stability of the control system, and providing safe and reliable control solutions for different application scenarios.

[0016] The security management and control system for a trusted controller, the security management and control device for a trusted controller, the computer-readable storage medium and the computer program product provided by the present invention have all the advantages of the above-mentioned security management and control method for a trusted controller. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 A flowchart of a security management and control method for a trusted controller provided in Example 1; Figure 2 A structural block diagram of a security management and control system for a trusted controller provided in Example 2; Figure 3 This is a structural block diagram of a security management and control device for a trusted controller provided in Example 3. DETAILED DESCRIPTION

[0018] In order to make the technical problems, technical solutions and beneficial effects solved by the present invention more clearly understood, the present invention is further described in detail in the following specific embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0019] Example 1 As attached Figure 1 As shown, this embodiment 1 provides a security management and control method for a trusted controller, including the following steps: Step 1: Use multiple authentication factors to authenticate the trusted controller in sequence to obtain an authentication result; wherein the preset multiple authentication factors include known information factors, physical device authentication factors, and biometric authentication factors. Through the multiple authentication mechanism of multiple authentication factors, an attacker must obtain multiple authentication factors at the same time to obtain access to the trusted controller.

[0020] Specifically, multiple authentication factors are used to authenticate the trusted controller in sequence to obtain the authentication result. The process is as follows: Step 11: Perform a first identity authentication on the trusted controller using the known information factor; wherein the known information factor includes a password, a PIN code, or a security question; specifically, the process of performing a first identity authentication on the trusted controller includes the following steps: The known information factors input by the user are received, and the known information factors input by the user are encrypted using a preset encryption algorithm to obtain the encrypted input known information factors.

[0021] The pre-encrypted stored known information factors are read from a preset database, and the encrypted input known information factors are compared with the pre-encrypted stored known information factors.

[0022] If the comparison result of the known information factors is consistent, the first identity authentication result is passed, and jump to step 12; otherwise, the first identity authentication result is failed.

[0023] Step 12: Perform a second identity authentication on the trusted controller using a physical device authentication factor; wherein the physical device authentication factor uses a physical token, and the physical token includes a smart card or a mobile phone with preset authentication information; specifically, the process of performing a second identity authentication on the trusted controller includes the following steps: Receive physical token verification information provided by the user, and use a preset encryption algorithm to encrypt the physical token verification information provided by the user to obtain encrypted input physical token information.

[0024] The pre-encrypted and stored physical token verification information is read from a preset database, and the encrypted input physical token information is compared with the pre-encrypted and stored physical token verification information.

[0025] If the comparison result of the physical token verification information is consistent, the second identity authentication result is passed and jumps to step 13; otherwise, the second identity authentication result is failed.

[0026] Step 13: Perform a third identity authentication on the trusted controller using a biometric authentication factor; wherein the biometric authentication factor includes fingerprint recognition, facial recognition, or iris recognition; specifically, the process of performing a third identity authentication on the trusted controller includes the following steps: Receive biometric verification information provided by the user, and use a preset encryption algorithm to encrypt the biometric verification information provided by the user to obtain encrypted input biometric verification information.

[0027] The pre-encrypted stored biometric verification information is read from a preset database, and the encrypted input biometric verification information is compared with the pre-encrypted stored biometric verification information.

[0028] If the comparison result of the biometric verification information is consistent, the third-factor identity authentication result is passed and jump to step 2; otherwise, the third-factor identity authentication result is failed.

[0029] It should be noted that during the identity authentication process, the multi-factor authentication mechanism requires all preset authentication factors to be passed in sequence. Only when all authentications are successful can access to the trusted controller be obtained. The multi-level identity authentication method greatly improves the security of the system and effectively prevents illegal access and identity fraud.

[0030] Step 2: Monitor and analyze the operation information of the trusted controller in real time to obtain real-time monitoring results. The operation status information of the trusted controller includes the operation status of the trusted controller, user behavior and system security status. Specifically, the process of monitoring and analyzing the operation status information of the trusted controller in real time includes the following steps: Step 21: Use the preset data access method to read the real-time system log, user behavior data and security event information of the trusted controller to obtain real-time monitoring data.

[0031] Step 22: Analyze the real-time monitoring data using a preset data analysis method to obtain the operating status of the trusted controller, user behavior, and system security status, that is, obtain real-time monitoring results; wherein the preset data analysis method includes a predetermined machine learning method or clustering algorithm.

[0032] Step 3: Generate a control decision or trigger a preset security measure mechanism based on the identity verification result and the real-time monitoring result. Specifically, the implementation process of generating a control decision or triggering a preset security measure mechanism is as follows: Step 31: If the identity authentication result is passed and the real-time monitoring result is normal, an operation request authorization execution instruction is generated to the trusted controller; wherein the operation request authorization execution instruction is used to authorize the trusted controller to execute the received operation request; Step 32: If the identity authentication result is not passed or the real-time monitoring result is abnormal, an operation request refusal execution instruction is generated to the trusted controller, and log information of the operation request refusal execution is recorded for subsequent audit or tracing; wherein the operation request refusal execution instruction is used to trigger the trusted controller to refuse to execute the received operation request; Step 33: If the identity authentication result is passed, but the real-time monitoring result finds an abnormality and the abnormal state of the real-time monitoring result exceeds the preset security state threshold, a preset security measure instruction is generated and sent to the trusted controller; wherein the preset security measure instruction is used to trigger the trusted controller to execute a preset security warning mechanism; preferably, the preset security warning mechanism includes locking account operations, restricting operation authority operations, or triggering preset security event response operations.

[0033] In this embodiment 1, by combining a multi-factor identity authentication mechanism and real-time monitoring technology, strict management of controller operating permissions and real-time monitoring of the system security status are achieved, and control decisions are generated or preset security measures mechanisms are triggered based on the identity authentication results and real-time monitoring results, thereby achieving dynamic security decisions for trusted controllers. Security measures can be flexibly adjusted according to actual conditions, so that the nature and scope of impact of security incidents can be judged more accurately, thereby reducing false alarms and missed alarms, and ensuring the stable operation of the system and accurate transmission of data.

[0034] Example 2 As attached Figure 2 As shown, this embodiment 2 provides a security management and control system for a trusted controller, including an identity authentication module, a real-time monitoring module and a management and control module; the identity authentication module is used to use preset multiple identity authentication factors to authenticate the trusted controller in sequence to obtain an identity authentication result; wherein the preset multiple identity authentication factors include known information factors, physical device verification factors and biometric verification factors; the real-time monitoring module is used to monitor and analyze the operating status information of the trusted controller in real time according to the identity authentication result to obtain a real-time monitoring result; the management and control module is used to generate a control decision or trigger a preset security measure mechanism according to the identity authentication result and the real-time monitoring result.

[0035] It should be noted that the security management and control system for the trusted controller described in this embodiment 2 can also achieve more comprehensive security protection through integration with other security modules or systems; for example, it can be linked with security devices such as intrusion detection systems (IDS), security event management systems (SIEM) or firewalls to jointly build a multi-level, comprehensive security protection system.

[0036] Example 3 As attached Figure 3 As shown, this embodiment 3 provides a security management and control device for a trusted controller, including: a memory for storing a computer program; a processor for implementing the steps of a security management and control method for a trusted controller when executing the computer program.

[0037] When the processor executes the computer program, the steps of the above-mentioned security management and control method for the trusted controller are implemented; for example: using preset multiple identity authentication factors to authenticate the trusted controller in sequence to obtain an identity authentication result; wherein the preset multiple identity authentication factors include known information factors, physical device authentication factors and biometric authentication factors; based on the identity authentication result, the operating status information of the trusted controller is monitored and analyzed in real time to obtain a real-time monitoring result; based on the identity authentication result and the real-time monitoring result, a control decision is generated or a preset security measure mechanism is triggered.

[0038] Alternatively, when the processor executes the computer program, it implements the functions of each module in the above-mentioned security management and control system for the trusted controller, for example: an identity authentication module, which is used to use preset multiple identity authentication factors to authenticate the trusted controller in sequence to obtain an identity authentication result; wherein the preset multiple identity authentication factors include known information factors, physical device verification factors and biometric verification factors; a real-time monitoring module, which is used to monitor and analyze the operating status information of the trusted controller in real time according to the identity authentication result to obtain a real-time monitoring result; a management and control module, which is used to generate a control decision or trigger a preset security measure mechanism according to the identity authentication result and the real-time monitoring result.

[0039] Exemplarily, the computer program may be divided into one or more modules / units, which are stored in the memory and executed by the processor to complete the present invention. The one or more modules / units may be a series of computer program instruction segments capable of completing preset functions, and the instruction segments are used to describe the execution process of the computer program in the security management and control device for the trusted controller.

[0040] The security control device for the trusted controller may be a computing device such as a desktop computer, a notebook, a PDA, and a cloud server. The security control device for the trusted controller may include, but is not limited to, a processor and a memory. Those skilled in the art will appreciate that the above are examples of security control devices for trusted controllers and do not constitute a limitation on security control devices for trusted controllers. More components may be included than the above, or some components may be combined, or different components may be included. For example, the security control device for the trusted controller may also include input and output devices, network access devices, buses, etc.

[0041] The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or the processor may be any conventional processor, etc. The processor is the control center of the security control device for the trusted controller, and uses various interfaces and lines to connect the various parts of the entire security control device for the trusted controller.

[0042] The memory can be used to store the computer program and / or module, and the processor implements various functions of the security management and control device for the trusted controller by running or executing the computer program and / or module stored in the memory, and calling the data stored in the memory.

[0043] The memory may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area may store data created according to the use of the mobile phone (such as audio data, a phone book, etc.), etc. In addition, the memory may include a high-speed random access memory, and may also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (SmartMediaCard, SMC), a secure digital (SecureDigital, SD) card, a flash card (FlashCard), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0044] Example 4 This embodiment 4 also provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the steps of the security management and control method for a trusted controller are implemented.

[0045] If the module / unit for security management and control system integration of a trusted controller is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium.

[0046] Based on this understanding, the present invention implements all or part of the processes in the above-mentioned security control method for a trusted controller, and can also be completed by instructing related hardware through a computer program, and the computer program can be stored in a computer-readable storage medium, and when the computer program is executed by a processor, the steps of the above-mentioned security control method for a trusted controller can be implemented. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or preset intermediate form, etc.

[0047] The computer-readable storage medium may include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signal, telecommunication signal and software distribution medium, etc.

[0048] It should be noted that the content contained in the computer-readable storage medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable storage media do not include electrical carrier signals and telecommunication signals.

[0049] Example 5 This embodiment 5 provides a computer product, which computer program product includes a computer program, which is stored in a computer-readable storage medium; the processor of the security management and control device for the trusted controller reads the computer program from the computer-readable storage medium, and the processor executes the computer program, so that the security management and control device for the trusted controller can execute the security management and control method for the trusted controller described in embodiment 1, which will not be repeated here.

[0050] It should be noted that a person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing related hardware through a computer program. The program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods.

[0051] The security management and control method for a trusted controller described in the present invention significantly improves the security and reliability of the trusted controller through multi-factor identity authentication, real-time monitoring and analysis, dynamic security decision-making and other means; at the same time, it also helps to promote the localization replacement process of the trusted DCS system, improve management efficiency and user experience.

[0052] The above embodiment is only one of the implementation methods that can realize the technical solution of the present invention. The scope of protection claimed by the present invention is not limited only to this embodiment, but also includes changes, replacements and other implementation methods that can be easily thought of by any technician familiar with the technical field within the technical scope disclosed by the present invention.

Claims

1. A security management and control method for a trusted controller, characterized in that: include: Authenticate the trusted controller in sequence using preset multiple authentication factors to obtain an authentication result; wherein the preset multiple authentication factors include known information factors, physical device authentication factors, and biometric authentication factors; Based on the identity authentication results, the operation status information of the trusted controller is monitored and analyzed in real time to obtain real-time monitoring results; Based on the identity authentication results and real-time monitoring results, control decisions are generated or preset security measures mechanisms are triggered.

2. A security management and control method for a trusted controller according to claim 1, characterized in that: The process of using the preset multiple authentication factors to authenticate the trusted controller in sequence and obtain the authentication result is as follows: Use known information verification factors to perform the first authentication of the trusted controller; If the first authentication is successful, the second authentication is performed on the trusted controller using the physical device authentication factor; If the second authentication is successful, the third authentication is performed on the trusted controller using biometric authentication factors.

3. A security management and control method for a trusted controller according to claim 2, characterized in that: The known information verification factor includes a password, PIN code or security question; the physical device verification factor uses a physical token; wherein the physical token includes a smart card or mobile phone with pre-set verification information; the biometric verification factor includes fingerprint recognition, facial recognition or iris recognition.

4. A security management and control method for a trusted controller according to claim 1, characterized in that: The running status information of the trusted controller includes the operation status of the trusted controller, user behavior, and system security status.

5. A security management and control method for a trusted controller according to claim 4, characterized in that: According to the identity authentication result, the operation status information of the trusted controller is monitored and analyzed in real time to obtain the real-time monitoring result. The specific process is as follows: If the identity authentication result is passed, the real-time system log, user behavior data and security event information of the trusted controller are read to obtain real-time monitoring data; The real-time monitoring data is analyzed using a preset data analysis method to obtain the operating status of the trusted controller, user behavior and system security status, that is, the real-time monitoring result.

6. A security management and control method for a trusted controller according to claim 1, characterized in that: The process of generating control decisions or triggering preset security measures mechanisms based on identity authentication results and real-time monitoring results is as follows: If the identity authentication result is passed and the real-time monitoring result is normal, an operation request authorization execution instruction is generated to the trusted controller; wherein the operation request authorization execution instruction is used to authorize the trusted controller to execute the received operation request; If the identity authentication result is not passed or the real-time monitoring result is abnormal, an operation request rejection execution instruction is generated to the trusted controller; wherein the operation request rejection execution instruction is used to trigger the trusted controller to reject the received operation request; If the identity authentication result is passed, but the real-time monitoring result finds an abnormality and the abnormal state of the real-time monitoring result exceeds the preset security state threshold, a preset security measure instruction is generated and sent to the trusted controller; wherein, the preset security measure instruction is used to trigger the trusted controller to execute a preset security warning mechanism, and the preset security warning mechanism includes locking account operations, restricting operation authority operations, or triggering preset security incident response operations.

7. A security management and control system for a trusted controller, characterized in that: include: An identity authentication module, used to authenticate the trusted controller in sequence using preset multiple identity authentication factors to obtain an identity authentication result; wherein the preset multiple identity authentication factors include known information factors, physical device authentication factors, and biometric authentication factors; A real-time monitoring module is used to monitor and analyze the operation status information of the trusted controller in real time according to the identity authentication result to obtain the real-time monitoring result; The management and control module is used to generate control decisions or trigger preset security measures mechanisms based on identity authentication results and real-time monitoring results.

8. A security control device for a trusted controller, characterized in that: include: a processor suitable for executing a computer program; A computer-readable storage medium, wherein a computer program is stored in the computer-readable storage medium, and when the computer program is executed by the processor, the security management and control method for a trusted controller according to any one of claims 1 to 6 is executed.

9. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the security management and control method for a trusted controller according to any one of claims 1 to 6 is implemented.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the security management and control method for a trusted controller according to any one of claims 1 to 6 is implemented.

Images