Security authentication method, device and system of test platform, and storage medium

Abstract

The embodiment of the invention provides a security authentication method, device and system for a test platform, and a storage medium, and relates to the technical field of network security. The method comprises the following steps: performing fingerprint acquisition on virtual and real equipment to generate a unique identifier, dynamically slicing based on a software defined network to form an isolated test environment, and injecting a zero-trust access strategy associated with the fingerprint; and based on the zero-trust access policy and the device fingerprint, allocating a minimum permission through an attribute-based access control model, continuously evaluating device behaviors to calculate a dynamic trust score, and adaptively updating the permission according to the trust score. By constructing a full-process security certification system and through multi-dimensional mechanism cooperation, dynamic risk perception and timely strategy adjustment, fine-grained control of virtual and real equipment access in an industrial control scene is realized, the dynamic adaptability and risk resistance of a test platform in a complex network environment are improved, and the test efficiency is improved. Equipment access safety, authority distribution minimization and behavior monitoring continuity are ensured, and the safety risk of the industrial control system is reduced.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to a security authentication method and device, system and storage medium of a test platform. BACKGROUND

[0002] At present, with the in-depth development of Industry 4.0 and Internet of Things technology, the digitization and networking process of industrial control systems is accelerating, and industrial control software is increasingly widely used in critical infrastructure. At the same time, network attack events targeting industrial control systems frequently occur, posing a serious threat to national security, economic operation and social order. The traditional security protection system mainly relies on boundary defense strategy and internal network trust mechanism, and gradually exposes the problem of insufficient flexibility of the protection system when facing new complex attacks.

[0003] To address the above challenges, related technologies attempt to improve protection capabilities by optimizing the configuration of boundary security devices, such as deploying high-performance firewalls and upgrading the rule base of intrusion detection systems to strengthen access control at the network boundary. At the same time, some related technologies attempt to guarantee the safe operation of industrial control systems within a certain range by formulating fixed access control strategies and restricting the network access rights of some key devices.

[0004] In the process of implementing the embodiments of the present disclosure, it is found that at least the following problems exist in the related art:

[0005] The related technology improves the security of the industrial control system to some extent. However, in actual application, the related technology adopts a fixed boundary protection and static trust management mode, which is difficult to realize real-time perception and response to dynamic risks in the network environment. When the device state changes or encounters new security threats, the security strategy cannot be adjusted in time, resulting in a large security risk of the industrial control system in a complex network environment. SUMMARY

[0006] The present application provides a security authentication method and device, system and storage medium of a test platform.

[0007] The first aspect of the embodiments of the present application provides a security authentication method of a test platform, comprising:

[0008] Fingerprint collection is performed on virtual and real devices to generate a unique identifier, an isolated test environment is formed based on software-defined network dynamic slicing, and a zero-trust access policy associated with the fingerprint is injected;

[0009] Based on the zero-trust access policy and the device fingerprint, the minimum permission is allocated through an attribute-based access control model, the device behavior is continuously evaluated to calculate a dynamic trust score, and the permission is adaptively updated according to the trust score.

[0010] In an optional embodiment of the present application, the virtual-real device is subjected to fingerprint collection, comprising:

[0011] The hardware features of the physical device and the virtual features of the virtual device are collected through the multi-modal perception layer;

[0012] The collected features are processed based on a hash algorithm to generate a device unique fingerprint;

[0013] The unique runtime attributes of the industrial control device are collected to associate the fingerprint with the industrial control scene characteristics.

[0014] In an optional embodiment of the present application,

[0015] The hardware features include a hardware serial number, a firmware hash, and / or a physical address; and / or,

[0016] The virtual features include an image identification, a hypervisor signature, and / or a virtual trusted platform module measurement value; and / or,

[0017] The runtime attributes are used to construct an access policy rule of the industrial control protocol perception.

[0018] In an optional embodiment of the present application, based on software-defined network dynamic slicing, comprising:

[0019] The production test slice and the vulnerability reproduction slice are divided by a software-defined network controller;

[0020] Independent flow tables are set for each slice to isolate broadcast traffic; wherein the flow table rules are generated based on the industrial control protocol control requirements;

[0021] The slice is associated with a security partition corresponding to the device unique fingerprint.

[0022] In an optional embodiment of the present application,

[0023] The industrial control protocol includes an industrial control dedicated communication protocol; and / or,

[0024] The flow table rules are used to control the protocol port and the instruction.

[0025] In an optional embodiment of the present application, a zero-trust access policy associated with the fingerprint is injected, comprising:

[0026] The access rules are compiled into a micro-isolation policy based on the device fingerprint by a policy engine;

[0027] The policy is issued to a software-defined network controller and a terminal agent to be executed in the slice;

[0028] The initial trust corresponding to the device fingerprint triggers a pre-set dynamic policy trigger condition.

[0029] In an optional embodiment of the present application, the minimum permission is assigned through an attribute-based access control model, comprising:

[0030] calculating real-time permission based on subject attributes and environment attributes associated with the device fingerprint;

[0031] generating a temporary token corresponding to the slice environment to authorize the device;

[0032] limiting token permission according to security partition strategy and access strategy for industrial control devices.

[0033] In an optional embodiment of the present application,

[0034] The subject attributes include device roles and / or historical behavior scores; and / or,

[0035] The environment attributes include network load and / or threat intelligence level; and / or,

[0036] The validity period of the temporary token is adaptively adjusted based on dynamic trust score.

[0037] In an optional embodiment of the present application, the device behavior is continuously evaluated to calculate the dynamic trust score, comprising:

[0038] collecting behavior indicators related to permission assignment results from network layer, host layer, protocol layer and / or user layer;

[0039] calculating the dynamic trust score based on the behavior indicators and / or access strategy compliance requirements;

[0040] For industrial scenarios, evaluation rules are set based on the device type corresponding to the device fingerprint.

[0041] In an optional embodiment of the present application,

[0042] The network layer indicators include traffic anomaly detection results; and / or,

[0043] The host layer indicators include system call sequence analysis results; and / or,

[0044] The protocol layer indicators include industrial control instruction compliance detection results; and / or,

[0045] The user layer indicators include operation timing and permission assignment result matching degree detection results.

[0046] In an optional embodiment of the present application, the permission is adaptively updated according to the trust score, comprising:

[0047] Adjusting authentication strength and validity period of the temporary token based on the dynamic trust score;

[0048] Immediately revoke the permission of high-risk equipment and start forensics;

[0049] Real-time synchronization of policy and trust score is realized through a software-defined network fast path update mechanism.

[0050] In an optional embodiment of the present application, the security authentication method of the test platform further includes:

[0051] Chain storage of key events containing device fingerprints, access policies, permission allocation results and / or trust scores to generate compliance audit reports.

[0052] In an optional embodiment of the present application, chain storage of key events containing device fingerprints, access policies, permission allocation results and / or trust scores to generate compliance audit reports includes:

[0053] Chain storage of permission change records containing device fingerprints and policy violation events containing access policies;

[0054] Generate industrial control compliance reports associated with dynamic trust scores through smart contracts;

[0055] Sign the blockchain data containing device fingerprints and trust scores using a national secret algorithm.

[0056] The second aspect of the embodiments of the present application provides a security authentication device of a test platform, including a processor and a memory storing program instructions, the processor is configured to execute the security authentication method of the test platform as the first aspect of the embodiments of the present application when running the program instructions.

[0057] The third aspect of the embodiments of the present application provides a security authentication system, including:

[0058] The security authentication system itself; and

[0059] The security authentication device of the test platform as the second aspect of the embodiments of the present application is installed in the security authentication system itself.

[0060] The fourth aspect of the embodiments of the present application provides a computer readable storage medium storing program instructions, the program instructions are used to make the computer execute the security authentication method of the test platform as the first aspect of the embodiments of the present application when running.

[0061] The security authentication method and device, system and storage medium of the test platform provided in the embodiments of the present application have the following beneficial effects:

[0062] The embodiment of the present application generates a unique identifier by collecting fingerprints of virtual and real devices, combines dynamic slicing of software-defined networks to form an isolated environment, injects a zero-trust policy associated with the fingerprint, assigns minimum permissions based on the attribute-based model, continuously evaluates behavior to calculate dynamic trust scores and adaptively updates permissions, and builds a full-process security authentication system. This system, through the coordination of multi-dimensional mechanisms, effectively solves the problems of difficult dynamic risk perception and untimely policy adjustments in traditional static trust management, realizes fine-grained control of virtual and real device access in industrial control scenarios, improves the dynamic adaptability and risk resistance of the test platform in complex network environments, ensures device access security, minimizes permission allocation, and continuously monitors behavior, reducing the security risks of industrial control systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0064] Figure 1 This is a schematic diagram of a security authentication method for a test platform provided in an embodiment of the present application;

[0065] Figure 2 This is a schematic diagram of a security authentication device for a test platform provided in an embodiment of the present application.

[0066] Reference numerals:

[0067] 800: security authentication device of the test platform; 801: processor; 802: memory; 803: communication interface; 804: bus. DETAILED DESCRIPTION

[0068] In order to make the technical solutions and advantages of the embodiments of the present application more clearly understood, the exemplary embodiments of the present application are further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, and are not an exhaustive list of all the embodiments. It should be noted that the embodiments and features in the embodiments of the present application can be combined with each other unless they conflict.

[0069] Figure 1 This is a schematic diagram of the security authentication method of the test platform provided in the embodiment of the present application. Any of the following methods can be executed in the system or in a server or terminal device that is connected to the system for communication.

[0070] like Figure 1 As shown, the embodiment of the present application provides a security authentication method for a test platform, including:

[0071] S01, fingerprint collection is performed on virtual and real devices to generate a unique identifier, a software-defined network dynamic slice is formed to form an isolated test environment, and a zero-trust access policy associated with the fingerprint is injected.

[0072] S02, based on the zero-trust access policy and the device fingerprint, the minimum permission is allocated through the attribute-based access control model, the device behavior is continuously evaluated to calculate the dynamic trust score, and the permission is adaptively updated according to the trust score.

[0073] The security authentication method of the test platform provided by the embodiment of the application generates a unique identifier by collecting fingerprints on virtual and real devices, which can accurately identify the device identity and lay the foundation for subsequent security authentication. The isolated test environment is formed based on the software-defined network dynamic slice, which can realize network isolation in different test scenarios and prevent broadcast traffic interference and security risk diffusion. The zero-trust access policy associated with the fingerprint is injected, which can strictly control all access requests. The minimum permission is allocated through the attribute-based access control model, which can dynamically calculate and grant the minimum required permission according to the device attributes and environmental conditions, avoiding misuse of permissions. The device behavior is continuously evaluated to calculate the dynamic trust score, which can real-time perceive whether the device behavior is compliant. The permission is adaptively updated according to the trust score, which can dynamically adjust the authentication strength and the validity period of the permission, revoke the permission for high-risk devices in a timely manner, and realize real-time synchronization of the policy and the trust score with the help of the software-defined network fast path update mechanism. Finally, a full-process security authentication system covering device identity recognition, network isolation, dynamic authorization, behavior monitoring and real-time response is built, which effectively improves the security, dynamic adaptability and risk resistance of the test platform in the industrial control scenario.

[0074] In an optional embodiment of the application, the fingerprint collection on virtual and real devices includes: collecting hardware features of physical devices and virtual features of virtual devices through a multi-modal perception layer; processing the collected features based on a hash algorithm to generate a device unique fingerprint; and collecting unique runtime attributes for industrial control devices to associate the fingerprint with industrial control scenario characteristics.

[0075] In this way, the hardware features of physical devices and the virtual features of virtual devices are collected through the multi-modal perception layer, which can comprehensively obtain the unique identification information of the device and avoid the problem that a single feature is easy to be forged, laying a foundation for accurately identifying the device identity. The collected features are processed based on the hash algorithm to generate a device unique fingerprint, which utilizes the one-wayness and collision resistance of the hash algorithm to ensure the uniqueness and tamper resistance of the fingerprint, realizing reliable binding of the device identity. The unique runtime attributes for industrial control devices, such as the IEC61131-3 runtime fingerprint of PLC, are collected to associate the device fingerprint with the industrial control scenario characteristics, so that the fingerprint can not only identify the device identity, but also reflect the running characteristics of the device in the industrial control environment, providing a basis for subsequent construction of access policy rules for industrial protocol perception, thereby better adapting to the security authentication needs of the industrial control scenario.

[0076] In an optional embodiment of the present application, the hardware features include a hardware serial number, a firmware hash, and / or a physical address; and / or, the virtual features include an image identification, a hypervisor signature, and / or a virtual trusted platform module measurement value; and / or, the runtime attributes are used to build an access policy rule aware of industrial control protocols.

[0077] In this way, by collecting hardware features such as hardware serial numbers, firmware hashes, and physical addresses, the identification information inherent to the device and difficult to tamper with is used to effectively avoid the use of a single identification that is easy to forge, thereby generating a device fingerprint with uniqueness and reliability, providing support for accurate identification of the physical device identity. Collecting virtual features such as image identification, hypervisor signature, and virtual trusted platform module measurement value can verify the integrity and legitimacy of the virtual device, prevent the virtual environment from being tampered with, and achieve reliable binding of the virtual device identity. Using runtime attributes to build an access policy rule aware of industrial control protocols can make the access policy combine the unique running characteristics of industrial control devices, finely control the ports and instructions of industrial control dedicated communication protocols, and further improve the adaptability and accuracy of security authentication in industrial control scenarios.

[0078] In an optional embodiment of the present application, dynamic slicing based on software-defined networks includes: dividing a production test slice and a vulnerability reproduction slice by a software-defined network controller; setting independent flow tables for each slice to isolate broadcast traffic; wherein the flow table rules are generated based on industrial control protocol management requirements; and associating the slice with a security partition corresponding to a unique device fingerprint.

[0079] In this way, by dividing a production test slice and a vulnerability reproduction slice by a software-defined network controller, network resources can be isolated according to the security requirements of different test scenarios, avoiding interference of broadcast traffic between different slices. Setting independent flow tables for each slice based on industrial control protocol management requirements can finely control the ports and instructions of industrial control dedicated communication protocols, effectively isolate ARP / DHCP broadcast traffic, and prevent the spread of security risks. Associating the slice with a security partition corresponding to a unique device fingerprint can dynamically match the slice and the security partition based on the device identity, thereby building a security authentication environment in the industrial control scenario that takes into account network isolation and fine-grained access control, and improving the precise control capability of the test platform for industrial control protocol traffic.

[0080] In an optional embodiment of the present application, the industrial control protocol includes an industrial control dedicated communication protocol; and / or, the flow table rules are used to manage and control protocol ports and instructions.

[0081] In this way, the special communication protocol in the industrial control scene is vulnerable to attacks (such as illegal port access or malicious instruction injection), and the traditional static policy is difficult to adapt to dynamic risks in real time. By defining industrial control protocols including industrial control special communication protocols (such as Modbus, IEC61850, etc.), and combining flow table rules for controlling protocols and instructions, the flow table rules generated based on the control requirements of the industrial control protocol (for example, isolating ARP / DHCP broadcast traffic, and finely controlling the access permission of the ModbusTCP port 502) can realize fine-grained isolation of network slicing, prevent broadcast interference and security risks from spreading across regions, and at the same time reduce the probability of industrial control system vulnerability exploitation through instruction-level control (such as limiting unauthorized write operations), thereby improving the dynamic adaptability and risk resistance of the test platform, and ensuring the safe access and continuous and effective behavior monitoring of virtual and real devices in complex environments.

[0082] In an optional embodiment of the present application, the zero-trust access policy associated with the fingerprint is injected, including: compiling the access rule into a micro-isolation policy based on the device fingerprint through the policy engine; issuing the policy to the software-defined network controller and the terminal agent to execute in the slice; and setting a preset dynamic policy trigger condition based on the initial trust corresponding to the device fingerprint.

[0083] In this way, the access rule is compiled into a micro-isolation policy based on the device fingerprint through the policy engine, which can realize fine-grained access control according to the unique identification of the device, so that the policy accurately matches the identity characteristics of the device and avoids unauthorized access. The policy is issued to the software-defined network controller and the terminal agent to execute in the slice, which can take advantage of the flexibility of the software-defined network and the real-time nature of the terminal agent to implement the access control policy synchronously at the network layer and the device layer, ensuring that the policy is effectively executed in the isolated test environment. The preset dynamic policy trigger condition based on the initial trust corresponding to the device fingerprint can set a policy adjustment threshold according to the initial trust state of the device, providing a benchmark for subsequent adaptive update of permissions based on dynamic trust score, so that the system can pre-establish a response mechanism for device state changes and potential threats.

[0084] In an optional embodiment of the present application, the minimum permission is allocated through the attribute-based access control model, including: calculating real-time permissions based on the subject attributes and environment attributes associated with the device fingerprint; generating a temporary token corresponding to the slice environment to authorize the device; and limiting the token permission according to the security partition strategy and the access policy for the industrial control device.

[0085] In this way, by calculating real-time permissions based on subject attributes (such as device roles, historical behavior scores) and environment attributes (such as network load, threat intelligence level) associated with the device fingerprint, the access permissions can be accurately matched according to the current state of the device and the dynamic changes of the network environment, the principle of least privilege allocation is realized, and the abuse of permissions is avoided. The temporary token (such as JWT format, valid period ≤ 15 minutes) corresponding to the slice environment is generated to authorize the device, which can reduce the risk of token leakage through short validity period design, and ensure that the permissions only take effect in a specific test environment in combination with the slice isolation feature. According to the security partition strategy and access policy, the token permissions of the industrial control device are limited (such as power device test token automatically inherits security partition strategy, prohibits cross-zone jumping), which can deeply bind the security partition requirements in the industrial control scene with the access control policy, prevent security risks caused by cross-zone access, and thus build a dynamic adaptation, fine-grained control permission allocation system in the industrial control test environment.

[0086] In an optional embodiment of the present application, the subject attributes include device roles and / or historical behavior scores; and / or, the environment attributes include network load and / or threat intelligence level; and / or, the temporary token validity period is adaptively adjusted based on dynamic trust score.

[0087] In this way, based on device roles and historical behavior scores and other subject attributes, and in combination with network load and threat intelligence level and other environment attributes, real-time permissions are calculated, which can accurately match access permissions according to the identity characteristics of the device and the dynamic changes of the network environment, realize the principle of least privilege allocation to reduce the risk of abuse of permissions. The validity period of the generated temporary token is adaptively adjusted based on the dynamic trust score, the token validity period is automatically extended when the device behavior compliance is high and the trust score is high, reducing the interference of frequent authentication on the test process, and when the trust score is lower than the threshold, the validity period is shortened or the permissions are revoked immediately, which can respond to device abnormal behavior and network threats in a timely manner, and thus a dynamic permission management mechanism with security and flexibility is built in the industrial control test scene.

[0088] In an optional embodiment of the present application, the device behavior is continuously evaluated to calculate the dynamic trust score, including: collecting behavior indicators related to the permission allocation result from the network layer, the host layer, the protocol layer and / or the user layer; calculating the dynamic trust score based on the behavior indicators and / or the access policy compliance requirements; setting evaluation rules based on the device type corresponding to the device fingerprint for industrial scenarios.

[0089] In this way, by collecting behavior indicators related to the permission allocation result (such as network layer traffic anomaly detection results, host layer system call sequence analysis results, and the like) from the network layer, the host layer, the protocol layer, and the user layer, device running state data can be obtained in multiple dimensions, and it can be comprehensively reflected whether the device behavior conforms to the expectation. Based on the behavior indicators and the access policy compliance requirements, the dynamic trust score is calculated, the compliance of the device behavior can be quantified as a specific numerical value, and the dynamic evaluation of the device trustworthiness is realized. For the industrial scene, the evaluation rules are set based on the device type corresponding to the device fingerprint (such as the abnormal write operation detection rule of the FTU for the power device), which can combine the specific behavior mode and safety requirements of different industrial control devices, so that the evaluation rules are more targeted. Through multi-dimensional behavior collection, dynamic quantitative evaluation, and scenario-based rule setting, data support is provided for real-time perception of device behavior risks and accurate adjustment of security policies.

[0090] In an optional embodiment of the present application, the network layer indicators include traffic anomaly detection results; and / or, the host layer indicators include system call sequence analysis results; and / or, the protocol layer indicators include industrial control instruction compliance detection results; and / or, the user layer indicators include matching degree detection results of operation timing and permission allocation results.

[0091] In this way, by collecting network layer traffic anomaly detection results (such as identifying sudden traffic increase using the DBSCAN algorithm), abnormal network behavior can be discovered in real time, which provides a basis for judging whether the device is attacked or abnormal. Collecting host layer system call sequence analysis results (such as analyzing system call sequences through an LSTM model) can identify abnormal behavior patterns of the device during operation from the operating system layer, and discover potential malicious program execution in a timely manner. Collecting protocol layer industrial control instruction compliance detection results (such as verifying whether the Modbus TCP instruction conforms to the IEC62443 standard) can ensure the legality of the industrial control device communication instruction, and prevent security risks caused by instruction violations. Collecting user layer matching degree detection results of operation timing and permission allocation results (such as predicting operation timing anomalies through a Markov chain) can verify whether the user operation conforms to the permission range, and avoid unauthorized operations. Through the collection and analysis of behavior indicators at different levels, multi-dimensional data support is provided for the calculation of the dynamic trust score, so that the system can comprehensively and accurately evaluate the device behavior risk, and further provide a reliable basis for the permission adaptive update and security policy adjustment based on the trust score.

[0092] In an optional embodiment of the present application, the permissions are adaptively updated according to the trust score, including: adjusting the authentication strength and the validity period of the temporary token based on the dynamic trust score; immediately revoking the permissions of the high-risk device and starting the forensics; and realizing real-time synchronization of the policy and the trust score through a software-defined network fast path update mechanism.

[0093] In this way, by adjusting the authentication strength and the validity period of the temporary token based on the dynamic trust score, the authentication requirements can be dynamically adapted according to the device behavior compliance. When the trust score is high, the token validity period is extended to reduce the interference of frequent authentication on the test process. When the trust score is low, the authentication strength is improved to reduce the security risk. The rights of high-risk devices are revoked immediately and the forensics are started, which can quickly block potential threats when abnormal behavior is detected, and at the same time, evidence is retained through the forensics process for subsequent security event analysis. With the help of the software-defined network fast path update mechanism, the real-time synchronization of the policy and the trust score is realized, which can ensure that the rights adjustment policy takes effect within 50ms, avoiding security management loopholes caused by policy update delay, thereby building a dynamic response and real-time linkage security authentication system.

[0094] In an optional embodiment of the present application, the security authentication method of the test platform further comprises: chaining and storing key events containing device fingerprints, access policies, permission allocation results and / or trust scores, and generating a compliance audit report.

[0095] In this way, by chaining and storing key events (such as permission change records and policy violation events) containing device fingerprints, access policies, permission allocation results and trust scores (using the Hyperledger Fabric platform and the SM2 algorithm of the national secret algorithm to sign), the immutability of the blockchain is used to ensure the authenticity and integrity of the security event record. At the same time, the industrial control compliance report (such as meeting the NERC CIP standard) associated with the dynamic trust score and the CVE vulnerability library is automatically generated through the smart contract, which can not only meet the compliance audit requirements in the industrial scene, but also provide a credible evidence chain for security event tracing, thereby effectively improving the auditability and responsibility tracing ability of the security authentication process of the test platform, and providing data support for the security compliance management of industrial control systems.

[0096] In an optional embodiment of the present application, chaining and storing key events containing device fingerprints, access policies, permission allocation results and / or trust scores, and generating a compliance audit report, comprises: chaining and storing permission change records containing device fingerprints and policy violation events containing access policies; generating an industrial control compliance report associated with the dynamic trust score through the smart contract; and signing the blockchain data containing the device fingerprint and the trust score using the national secret algorithm.

[0097] In this way, by chaining and storing the permission change record containing the device fingerprint and the policy violation event containing the access policy, the authenticity and integrity of the key event record are ensured by using the tamper-proof characteristics of the blockchain, providing reliable data support for security audit. The industrial control compliance report associated with the dynamic trust score generated by the smart contract can automatically associate the device behavior trust evaluation result with the industrial compliance standard (such as NERCCIP), improving the efficiency and accuracy of the compliance report generation. The national cryptographic algorithm is used to sign the blockchain data containing the device fingerprint and the trust score, which can enhance the security and legal effectiveness of the blockchain data, and ensure that the evidence data meets the national password management requirements. Through the synergistic effect of blockchain evidence, smart contract report generation and national cryptographic algorithm signature, the auditability, compliance and data credibility of the test platform security certification process are effectively improved, providing a reliable technical guarantee for the security event traceability and compliance management of industrial control systems.

[0098] In the embodiments of the present disclosure, the hardware serial number, firmware hash, MAC address of the physical device, and the image ID, Hypervisor signature, vTPM measurement value of the virtual device are collected by the multi-modal perception layer, the device unique fingerprint is generated based on the SM3 hash algorithm, and the IEC61131-3 runtime fingerprint of the PLC is specially collected to adapt to the industrial control scene. Secondly, the OpenDaylight controller is used to divide the production test slice (using the OVSDB protocol) and the vulnerability reproduction slice (using the P4 programmable data plane) according to the test requirements, an independent flow table is set for each slice to isolate the ARP / DHCP broadcast traffic, and the flow table rule supports fine control of industrial control protocols such as ModbusTCP port 502. At the same time, the access rules are compiled into micro-isolation strategies by the policy engine (such as allowing the SCADA system to only read the RTU register 40001-40010, and rejecting all write operations to the relay protection device), and are issued to the SDN controller and terminal agent, and a dynamic policy is preset to refuse access to critical assets when the device trust score is <0.6. Based on the ABAC model, the real-time permissions are calculated by combining the subject attributes such as the tester's role and historical behavior score, and the environmental attributes such as network load and threat intelligence level, and are authorized through the JWT format temporary token (validity period ≤15 minutes), and the power equipment test token automatically inherits the security partition policy to prohibit cross-zone jumping. Next, the indicators are collected from the network layer (using the DTW algorithm to detect traffic mutations), the host layer (using the LSTM model to analyze system call sequences), the protocol layer (checking the compliance of industrial control instructions according to the IEC62443 standard), and the user layer (using Markov chain to predict operation timing anomalies), and the dynamic trust score in the range of 0-1 with a precision of 0.01 is calculated, such as detecting abnormal frequency write operations on the FTU. Then, the authentication policy is dynamically adjusted according to the trust score, the token validity period is extended when the trust score is >0.8, and the permissions are revoked immediately and the forensics is started when the trust score is <0.3, and the multi-factor authentication of SMS verification code for low-risk scenarios and iris+hardware key for high-risk scenarios is adopted, and the policy takes effect with a delay of <50ms by means of the SDN fast path update mechanism. Finally, the key events such as permission change records and policy violation events are stored and evidenced on the HyperledgerFabric, the industrial control compliance report that meets the NERCCIP standard and is associated with the CVE vulnerability library is generated by using the smart contract, and the block signature is signed by using the national standard SM2 algorithm to ensure that it cannot be tampered with.

[0099] In the embodiments of the present disclosure, the security authentication system specifically includes an SDN controller, an authentication server, a monitoring and analysis module, a security policy engine, and a virtual / physical device interface. The SDN controller adopts OpenDaylight, is responsible for network configuration and traffic control according to the rules generated by the security policy engine, realizes isolation of the production test slice (OVSDB protocol) and the vulnerability reproduction slice (P4 programmable data plane) through issuing OpenFlow protocol flow tables, and supports fine control of industrial control protocols such as ModbusTCP port 502. The authentication server performs identity verification based on device fingerprints (generated by an SM3 hash algorithm) and block chain storage (HyperledgerFabric), dynamically calculates subject attributes (tester role, historical behavior score) and environment attributes (network load, threat intelligence level) in combination with an ABAC model, generates a JWT format temporary token (validity period ≤ 15 minutes) to realize minimum permission allocation. The monitoring and analysis module collects four-dimensional indicators from the network layer (DTW algorithm detects traffic mutations), the host layer (LSTM model analyzes system call sequences), the protocol layer (IEC62443 standard checks instruction compliance), and the user layer (Markov chain predicts operation time sequence anomalies), and calculates a 0-1 range dynamic trust score. The security policy engine generates micro-isolation policies (such as allowing the SCADA system to only read RTU registers 40001-40010) based on the monitoring and analysis results, and generates a compliance report by associating NERCCIP standards and CVE vulnerability libraries through a smart contract, and when the trust score < 0.3, triggers an SDN fast path update mechanism (policy effective delay < 50 ms) to revoke permissions and start forensics. The virtual / physical device interface provides standard APIs, supports access of physical devices (collects hardware serial numbers, firmware hashes) and virtual devices (image ID, vTPM measurement value), especially collects IEC61131-3 runtime fingerprints for industrial control devices, and realizes dynamic association with security partition policies.

[0100] In practical applications, first of all, environmental preparation, through the deployment of SDN controller and related hardware facilities, to ensure network connectivity and stability. Secondly, the device registration, all participating in the test of the device must be registered in the platform, submit the necessary information (such as model, serial number, etc.), and pass the preliminary authentication. Among them, the device preliminary authentication process is as follows: first, the device uploads the JSON format metadata containing the device type (such as RTU), manufacturer (such as Siemens), model (such as SIPROTEC5), serial number, firmware version and network interface (MAC address and IP) through the secure API, and attaches the X.509 format manufacturer digital signature device certificate, while filling in the power safety partition (such as production control area Ⅰ area) it belongs to; Then the platform issues a lightweight probe program running in the TEE environment to the device, collects hardware features such as CPU microcode hash (Intel ME / AMD PSP), TPM / PUF non-clonable identifier and UEFI startup image SM3 hash, returns data through the national encryption SM4 channel and prohibits the use of simple MAC address, generates a unique device fingerprint; After comparing the industrial control device security baseline library, check the compliance of default password (mandatory modification does not meet the items), open port (only allow 502 / 2404 port) and protocol encryption (TLS1.2+ or IEC62351), dynamically assess the risk level (high risk such as the existence of CVE-2022-26377 vulnerability, then isolate the device, medium risk such as insufficient password strength, then forced reset); Again verify that the physical device is running in a trusted machine room (GPS coordinate verification), virtual device Hypervisor signature (such as VMware ESXi official certificate), and detect whether the network environment is accessed through the power special APN / VPDN and the IP belongs to the substation intranet segment and other pre-defined whitelist; Finally, register the device identity on the Hyperledger Fabric power_grid_channel channel through the DeviceRegistry.sol smart contract, generate an unforgeable certificate containing device ID, fingerprint, trust level (such as 0.8) and validity period, write to the blockchain and synchronize to the SDN controller, complete the preliminary authentication. Then access test, the device tries to access the platform, the authentication server verifies its identity, and checks whether it meets the current security policy; If passed, it is allowed to access.The device access test process is as follows: the device sends an access request to the authentication server through HTTPS, uses the SM2 algorithm to encrypt the communication and adds a timestamp to prevent replay attacks; the authentication server first performs certificate chain verification, checks whether the issuer of the device X.509 certificate is in the trust chain of State Grid CA, etc., and verifies that the certificate is not expired and revoked through OCSP query, and then calls the verifyDevice function in the DeviceRegistry smart contract of Hyperledger Fabric to verify whether the state corresponding to the device ID is ACTIVE to complete the blockchain identity verification; then the policy engine evaluates the security policy from multiple dimensions, including checking whether it is within the time range of 8:00-18:00 on weekdays, whether the GPS coordinates are within the 50-meter error range of the substation electronic fence, whether the IP belongs to the power special APN network segment, whether the device fingerprint does not appear in the malicious device library containing CVE-2023-XXX vulnerabilities, and whether there are recent abnormal operation behaviors such as high-frequency port scanning; when the identity verification is successful, the risk score is ≥0.6, and the requested resource is within the device permission matrix, the SDN flow table rules are issued through the OpenFlow protocol (such as ovs-ofctl add-flow br0 "priority=100,ip,nw_src=10.100.1.23,nw_dst=10.100.1.0 / 24,actions=output:2") to allow access, otherwise record security events such as "geofencing verification failed" and store them on the chain; after the device accesses, the DBSCAN algorithm is used to detect traffic anomalies >100Mbps, the Modbus / IEC60870-5-104 instructions are deeply analyzed, and the write operation of function code 0x10 and register address >40000 is prohibited, and the DTW algorithm is used to compare the current operation with the historical behavior baseline to realize continuous monitoring of the session. The DTW (Dynamic Time Warping) algorithm is a nonlinear alignment algorithm that can effectively solve the stretching and shifting problem of time series on the time axis. Its core logic is to search for the optimal matching path between two time series through dynamic programming, supporting local acceleration or deceleration comparison of sequences. In specific implementation, input two types of time series to be compared, such as device current operation behavior sequence A=[a1,a2,...,a m ] and historical normal behavior baseline sequence B=[b1,b2,...,b n ]; first construct the distance matrix, calculate the Euclidean distance d(i,j)=||a i -b j || of each pair of sequence points (a i ,b j ); then perform dynamic programming recursion, starting from the top left corner of the matrix, and calculating the minimum cumulative distance D(i,j) point by point according to the following formula:

[0101]

[0102] After calculating the minimum cumulative distance D(i, j), traverse to the lower right corner of the matrix to obtain D(m, n); finally, backtrack from D(m, n) to D(1, 1) to excavate the alignment path that minimizes the total distance, and output the minimum cumulative distance between sequences (as a similarity score) and the optimal alignment path, which is used to accurately compare the differences between the current operation and the historical baseline to identify behavior deviation. Then real-time monitoring, once the device successfully accesses, the monitoring and analysis module begins to track its behavior and records all communication activities. First, raw traffic capture, with the help of SDN controller mirroring to obtain network layer traffic, and through device agent to collect host layer system call logs, covering MODBUS, IEC60870, IEC61850 and other industrial control protocols, buffer data and key metadata are synchronously collected; then protocol analysis and normalization processing is carried out on the traffic, ModbusTCP protocol is deeply analyzed, function code (such as 0x03 read holding register) is extracted and register address range (such as 40001-40010) is recorded, for IEC61850 GOOSE protocol, APPID, data set members are analyzed, and message interval (default 2ms) is checked; then multi-dimensional feature extraction is carried out, key information is mined from time sequence features (such as instruction interval time variance, used to identify slow scanning attacks), statistical features (such as unit time write operation proportion, to detect abnormal control instruction storm), semantic features (such as access to unauthorized registers, to prevent misadjustment leading to protection malfunction), context features (such as operation sequence, to match known attack patterns) and other dimensions; then dynamic baseline comparison is carried out based on device-level baseline (learn historical normal behavior patterns through time series clustering K-means DTW, such as FTU daily average 500 read operations) and group baseline (behavior comparison of devices of the same type, such as instruction distribution of 20 RTUs of the same version); then abnormal risk assessment is carried out according to the risk matrix, the risk values and impacts of abnormal types such as high-frequency write protection (risk value 90, which may cause protection rejection / malfunction), unconventional period operation (risk value 60, which may be unauthorized maintenance), and protocol field format error (risk value 30, which may be device failure or exploratory attack) are clarified, and aggregate calculation is completed; according to risk level classification response, risk ≥ 80 immediately disconnects, freezes device account, and triggers SDN flow table isolation; 60-79 limits bandwidth to 1Mbps and only allows read operation; ≤59 records logs and notifies operation and maintenance personnel; finally, audit evidence is implemented, key events are hashed into Hyperledger Fabric, compliance reports are automatically generated through smart contracts, and real-time and comprehensive monitoring and security protection of industrial control systems are realized. The following methods are used to implement the aggregation calculation link: for each type of anomaly detected in the real-time monitoring scenario of the industrial control system, the preset risk matrix is used to determine the abnormal value v iAnd according to the importance of each abnormal type in the influence of industrial control safety risk, the corresponding weight w is assigned i The weight is determined comprehensively according to the safety requirements of industrial control scene, historical fault statistics and expert experience, etc., to ensure that the threat difference of different abnormalities to power and other industrial control systems can be accurately reflected, and is aggregated and calculated through the following formula:

[0103] Risk=∑(w i ×v i );

[0104] The integrated risk value of the device or operation is calculated according to the aggregation calculation, which quantitatively evaluates the risk degree of the anomaly and provides accurate data support for subsequent hierarchical response (such as immediately disconnecting when the risk is greater than or equal to 80, limiting bandwidth when the risk is between 60 and 79, etc.), realizes scientific and dynamic evaluation of the abnormal risk of industrial control system, and guarantees the safe and stable operation of industrial control network. This aggregation calculation method is suitable for the abnormal risk analysis scene of real-time monitoring of power industrial control devices, effectively integrates multi-dimensional abnormal information, and improves the accuracy and pertinence of risk assessment. Then is the behavior evaluation, which analyzes the behavior of the device regularly or irregularly to determine whether there is an anomaly or potential threat. A multi-dimensional evaluation system is constructed to deeply analyze the behavior of the device. From the time sequence behavior dimension, the standard deviation of operation frequency and the entropy value of instruction interval time are monitored. For example, if the RTU device changes from sending telemetry once every 5 minutes to once every second, combined with this dimension index, it can identify the possible controlled risk. In the protocol compliance dimension, the proportion of illegal function code and the detection of abnormal message length are counted. For the ModbusTCP protocol, it can accurately find the unconventional function code 0x2B and effectively identify the risk of vulnerability exploitation. Based on the data access mode dimension, the number of sensitive register access and cross-zone access attempts are focused on. When the relay protection setting value area (address 40000-40050) is frequently read, the anomaly can be detected in time. From the resource consumption dimension, the CPU / memory usage fluctuation rate and network bandwidth occupancy peak value are tracked. If the CPU of the FTU device is continuously above 90%, combined with this dimension, it can be determined that there may be risks such as mining viruses. With the help of the context association dimension, the DTW algorithm is used to calculate the operation sequence matching degree, and multiple device cooperative anomalies are monitored, such as multiple RTUs simultaneously initiating time request, which can identify time synchronization attack and other threats. Through the specific index monitoring and scene analysis of the above-mentioned multi-dimensional (time sequence behavior, protocol compliance, data access mode, resource consumption, context association), the behavior risk of industrial control devices is comprehensively and accurately evaluated, which provides strong support for the security protection of industrial control system, adapts to the security needs of industrial control scenes such as power, and effectively improves the ability of abnormal behavior identification and risk prevention and control. Finally, dynamic response, once an anomaly is found, the security policy engine takes immediate action, such as disconnecting, issuing an alarm, starting a deep investigation, etc.The policy rule library of the policy engine stores security policy rules pre-defined based on threat intelligence, historical attack patterns and compliance requirements, covering access control, anomaly behavior detection, data protection and other rules; the detection and analysis module of the policy engine collects network traffic, system logs, user behavior and other data in real time, and uses machine learning, deep learning and other technologies to accurately monitor and analyze potential abnormal behaviors or security threats (such as Modbus TCP protocol unconventional function code, multi-RTU cooperative time attack, etc.) in industrial control scenarios (such as RTU, FTU and other device interactions in power systems); the decision and execution module of the policy engine, according to the detection and analysis results, combined with the rules of the policy rule library, makes decisions such as disconnecting the connection, triggering SDN flow table isolation, freezing device account, etc. for different risk levels (such as risk ≥ 80), and executes, and for medium and low risk, it executes actions such as limiting bandwidth, recording logs and notifying operation and maintenance; the log and report module of the policy engine records security events and response actions, generates logs and reports containing abnormal details and disposal process, which are used for subsequent audit, policy optimization, adaptation to industrial control system security requirements, protection of power and other critical infrastructure operation safety, and realization of dynamic, closed-loop response control of security threats. In addition, feedback optimization is also carried out, according to the actual operation situation, the security policy and the authentication process are continuously optimized, and the overall performance of the system is improved.

[0105] In the embodiments of the present disclosure, all communications are encrypted using the TLS1.3 protocol and the SM4 algorithm, to protect the transmitted device fingerprints, policy rules and other data, prevent data leakage and tampering; identity verification uses a multi-factor mechanism, integrating iris recognition, SM2 hardware tokens (such as USBKey) and other on the basis of traditional username and password, when high-risk access is detected, the enhanced authentication process is automatically triggered; the log audit module records the authentication process and network activity in real time, stores it through the Hyperledger Fabric blockchain, and generates a compliance audit report using a smart contract to ensure traceability; key components (such as SDN controllers and authentication servers) use hot standby redundancy design, implement fault switching through the VRRP protocol, synchronize the state of the distributed cache, and ensure high availability of the system; in terms of privacy protection, field-level desensitization is implemented on user data, access control lists are used to limit data access permissions, and relevant laws and regulations are strictly followed.

[0106] In combination with Figure 2As shown, the embodiment of the present application provides a security authentication device 800 of a test platform, which comprises a processor 801 and a memory 802. Optionally, the device can further comprise a communication interface 803 and a bus 804. The processor 801, the communication interface 803 and the memory 802 can complete mutual communication through the bus 804. The communication interface 803 can be used for information transmission. The processor 801 can invoke the logical instructions in the memory 802 to execute the security authentication method of the test platform of the above-mentioned embodiment.

[0107] In addition, the logical instructions in the memory 802 described above can be realized in the form of a software functional unit and sold or used as an independent product, which can be stored in a computer readable storage medium.

[0108] The memory 802 as a computer readable storage medium can be used to store software programs, computer executable programs, such as program instructions / modules corresponding to the method in the embodiment of the present application. The processor 801 executes the function application and data processing by running the program instructions / modules stored in the memory 802, that is, realizes the security authentication method of the test platform in the above-mentioned embodiment.

[0109] The memory 802 can include a program storage area and a data storage area, wherein the program storage area can store an operating system and at least one application required by a function; the data storage area can store data created according to the use of the terminal device, etc. In addition, the memory 802 can include a high-speed random access memory and can also include a non-volatile memory.

[0110] The embodiment of the present application provides a security authentication system, which comprises a security authentication system body and the security authentication device 800 of the test platform described above. The security authentication device 800 of the test platform of the security authentication system is installed in the security authentication system body. The installation relationship described herein is not limited to being placed in the security authentication system, but also includes the installation connection with other components of the security authentication system, including but not limited to physical connection, electrical connection or signal transmission connection, etc. Those skilled in the art can understand that the security authentication device 800 of the test platform of the security authentication system can be adapted to a feasible security authentication system body, and thus realize other feasible embodiments.

[0111] The embodiment of the present application provides a computer readable storage medium, which stores computer executable instructions, and the computer executable instructions are set to execute the security authentication method of the test platform.

[0112] The technical solutions of the embodiments of the present application can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes one or more instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the method described in the embodiments of the present application. The aforementioned storage medium can be a non-transitory storage medium, including a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various media that can store program codes.

[0113] The technical solutions of the embodiments of the present application can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes one or more instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the method described in the embodiments of the present application. The aforementioned storage medium can be a non-transitory storage medium, including a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various media that can store program codes.

[0114] The above description and the accompanying drawings fully illustrate the embodiments of the present application so that those skilled in the art can practice them. Other embodiments may include structural, logical, electrical, process and other changes. The embodiments represent only possible variations. Unless explicitly required, separate components and functions are optional, and the order of operations may vary. Parts and features of some embodiments may be included in or replace parts and features of other embodiments. Moreover, the words used in this application are only used to describe the embodiments and are not used to limit the claims. As used in the description of the embodiments and claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to also include plural forms. Similarly, the term "and / or" as used in this application refers to any and all possible combinations of one or more associated listings. In addition, when used in this application, the term "comprise" and its variations "comprises" and / or comprising refer to the presence of stated features, wholes, steps, operations, elements, and / or components, but do not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or groups of these. In the absence of further restrictions, an element defined by the sentence "comprising a..." does not exclude the presence of other identical elements in the process, method or device that includes the element. In this article, each embodiment may focus on the differences from other embodiments, and the same and similar parts between the various embodiments can be referenced to each other. For the methods, products, etc. disclosed in the embodiments, if they correspond to the method part disclosed in the embodiments, then the relevant parts can be found in the description of the method part.

[0115] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented with electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software may depend on the specific application and design constraints of the technical solution. The technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the embodiments of the present application. The technicians will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0116] In the embodiments disclosed herein, the disclosed methods, products (including but not limited to apparatuses, devices, etc.), can be implemented in other manners. For example, the apparatus embodiments described above are merely schematic. For example, the division of the units is merely logical function division. There can be other division manners in actual implementation. For example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the displayed or discussed mutual couplings or direct couplings or communication connections can be indirect couplings or communication connections through some interfaces, apparatuses, or units, and can be in electrical, mechanical, or other forms. The units described as separated components can or can not be physically separated, and components displayed as units can or can not be physical units. Some or all of the units can be selected according to actual needs to achieve the embodiments.

[0117] The flowcharts and block diagrams in the drawings show the possible implementation architectures, functions, and operations of the systems, methods, and computer program products according to the embodiments of the present application. In this regard, each block in the flowcharts or block diagrams can represent a module, a program segment, or a part of code that contains one or more executable instructions for implementing the specified logical functions. In some alternative implementations, the functions noted in the blocks can occur in different orders than those noted in the drawings. For example, two consecutive blocks can actually be executed substantially in parallel, and they can sometimes be executed in reverse order, depending on the functions involved. In the descriptions corresponding to the flowcharts and block diagrams in the drawings, the operations or steps corresponding to different blocks can also occur in different orders than those disclosed in the descriptions, and sometimes there is no specific order between different operations or steps. For example, two consecutive operations or steps can actually be executed substantially in parallel, and they can sometimes be executed in reverse order, depending on the functions involved. Each block in the block diagrams and / or flowcharts, and the combination of blocks in the block diagrams and / or flowcharts, can be implemented by a dedicated hardware-based system that performs the specified functions or actions, or can be implemented by a combination of dedicated hardware and computer instructions.

Claims

1. A security authentication method for a test platform, characterized in that: include: Fingerprinting of virtual and real devices to generate unique identifiers, forming an isolated test environment based on dynamic slicing of software-defined networks, and injecting zero-trust access policies associated with the fingerprints; Based on the zero-trust access policy and device fingerprint, minimum permissions are assigned through an attribute-based access control model, device behavior is continuously evaluated to calculate a dynamic trust score, and permissions are adaptively updated based on the trust score.

2. The method according to claim 1, characterized in that Fingerprint collection of virtual and real devices, including: The hardware features of physical devices and the virtual features of virtual devices are collected through the multimodal perception layer; The collected features are processed based on the hash algorithm to generate a unique fingerprint for the device; Collect unique runtime attributes of industrial control devices to associate fingerprints with industrial control scenario characteristics.

3. The method according to claim 2, characterized in that The hardware characteristics include hardware serial number, firmware hash and / or physical address; and / or, The virtual characteristics include image identification, virtual machine monitor signature and / or virtual trusted platform module measurement value; and / or, The runtime attributes are used to construct industrial control protocol-aware access policy rules.

4. The method according to claim 1, wherein Dynamic slicing based on software-defined networking, including: Use software-defined network controllers to divide production test slices and vulnerability reproduction slices; Set up independent flow tables for each slice to isolate broadcast traffic; wherein the flow table rules are generated based on the control requirements of the industrial control protocol; Associate the slice with the secure partition corresponding to the device's unique fingerprint.

5. The method according to claim 4, characterized in that The industrial control protocol includes a dedicated industrial control communication protocol; and / or, The flow table rules are used to control protocol ports and instructions.

6. The method according to claim 1, characterized in that Inject the Zero Trust Access policy associated with the fingerprint, including: Compile access rules into micro-segmentation policies based on device fingerprints through the policy engine; Send policies to the software-defined network controller and terminal agent for execution in the slice; Preset dynamic policy trigger conditions based on the initial trust score corresponding to the device fingerprint.

7. The method according to claim 1, characterized in that Assign least privilege through an attribute-based access control model, including: Calculate real-time permissions based on subject and environment attributes associated with device fingerprints; Generate a temporary token corresponding to the slice environment to authorize the device; For industrial control equipment, token permissions are limited based on security partitioning strategies and access policies.

8. The method according to claim 7, characterized in that The subject attributes include device role and / or historical behavior score; and / or, The environmental attributes include network load and / or threat intelligence level; and / or, The validity period of the temporary token is adaptively adjusted based on the dynamic trust score.

9. The method according to claim 1, characterized in that Continuously evaluates device behavior to calculate a dynamic trust score, including: Collect behavioral indicators related to permission allocation results from the network layer, host layer, protocol layer and / or user layer; Calculate dynamic trust scores based on behavioral indicators and / or access policy compliance requirements; For industrial scenarios, set evaluation rules based on the device type corresponding to the device fingerprint.

10. The method according to claim 9, characterized in that The network layer indicator includes a traffic mutation detection result; and / or, The host layer indicators include system call sequence analysis results; and / or, The protocol layer indicators include industrial control instruction compliance test results; and / or, The user layer indicator includes a matching test result between the operation sequence and the authority allocation result.

11. The method according to claim 1, characterized in that Adaptively updating permissions based on the trust points, including: Adjust authentication strength and the validity period of temporary tokens based on dynamic trust scores; Immediately revoke permissions for high-risk devices and initiate forensics; Real-time synchronization of policies and trust points is achieved through the software-defined network fast path update mechanism.

12. The method according to any one of claims 1 to 11, characterized in that Also includes: Key events including device fingerprints, access policies, permission allocation results and / or trust scores are stored on the chain to generate compliance audit reports.

13. The method according to claim 12, characterized in that Key events including device fingerprints, access policies, permission allocation results and / or trust scores are stored on the chain and a compliance audit report is generated, including: Store permission change records including device fingerprints and policy violation events including access policies on the chain; Generate industrial control compliance reports with dynamic trust scores through smart contracts; The national secret algorithm is used to sign the blockchain data containing device fingerprints and trust points.

14. A security authentication device for a test platform, comprising a processor and a memory storing program instructions, characterized in that: The processor is configured to execute the security authentication method for the test platform according to any one of claims 1 to 13 when running the program instructions.

15. A security authentication system, characterized in that: include: Security authentication system ontology; The safety authentication device of the test platform as described in claim 14 is installed in the safety authentication system body.

16. A computer-readable storage medium storing program instructions, characterized in that: When the program instructions are executed, the computer is configured to execute the security authentication method for the test platform according to any one of claims 1 to 13.

Images