Semantic-based ICS zero-trust method and platform

Abstract

The invention discloses an ICS zero-trust method and platform based on semantics. According to the invention, by analyzing a plurality of PLC communication protocols and converting and mapping the PLC point locations into the memory addresses in the communication data packets, automatic interfaces adaptive to different protocols are provided. A three-layer permission allocation method is adopted, fine permission allocation is performed on a memory address and a host-PLC pair from three dimensions of read / write permission, a space region and a time stage, and permission is quantified to generate a bitmap. And when the communication data packet accesses the PLC memory address, the access permission is verified by comparing the bitwise of the permission bitmap and the operation result, so that the legality and security of the access are ensured. The platform comprises a memory address acquisition module, a permission allocation module and a permission verification module, supports various PLC communication protocols, can be deployed on hardware platforms such as an FPGA and an ASIC, realizes efficient trust verification, meets the requirements of real-time performance and reliability of an industrial control system, and has the advantages of fine-grained permission control, protocol independence, high adaptability and the like.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of industrial control safety, and in particular to a semantic-based ICS zero-trust method and platform considering real industrial control environment. BACKGROUND

[0002] In the era of Industry 4.0, the ICS network is experiencing an increasing trend of IT / OT convergence. Driven by next-generation ICS technology advancements such as OpenPLC and Industrial Internet of Things, ICS is closely intertwined with Internet infrastructure. ICS networks expose "barren" LANs to a more complex and dangerous network environment. The open network environment further amplifies ICS vulnerabilities, making them more vulnerable to cyber attacks. Some defense systems have been implemented in industrial applications, but they are not sufficient for modern production ICS. Traditional industrial firewalls implement rule-based trust verification, but the granularity is too coarse to identify hidden attacks like Stuxnet. Intrusion detection systems have finer granularity, but they rely more on post-event detection and recovery. ICS networks need a trust verification mechanism to eliminate all implicit prior trust to prevent untrusted requests from attackers. In other words, a detailed zero-trust policy is needed in ICS to follow the "never trust, always verify" principle. Each message of ICS needs to be verified and protected.

[0003] However, it is still challenging to implement a zero-trust method suitable for ICS networks. Attacks on ICS networks are usually semantic, more hidden than attacks on IT networks. Semantic-level information includes sensor / actuator values, intermediate system variables, etc. Some attacks can be implemented by modifying only one core variable. Once an attacker gains illegal access to a core semantic variable, it will cause fatal damage to the industrial environment. A single programmable logic controller (PLC) can involve hundreds of semantic variables, and a large factory can involve the management of tens of thousands of semantic variables. For example, a small facility of a large utility scale can have millions of process sensors. It is a major challenge to manage such a large number of semantic variables during operation. In addition, access permissions for semantic data are often dynamically adjusted in line with industrial workflows. At different stages of operation, the actuators and sensors accessible to a particular device can vary over time, so context-aware permission management is needed.

[0004] In summary, it is necessary to design a semantic-based zero-trust method that takes into account the characteristics of ICS networks. SUMMARY

[0005] The purpose of the present application is to design a semantic-based, dynamic zero-trust method for ICS network characteristics to address the shortcomings of existing zero-trust methods in the field of industrial control safety.

[0006] The purpose of the present application is achieved by the following technical solutions:

[0007] In one aspect, the present application provides a semantic-based ICS zero-trust method, comprising the following steps:

[0008] S1: Convert the control variables of the industrial process into memory addresses in the PLC communication protocol.

[0009] Further, the control variables in the industrial process are represented as point positions (such as Q0.1) in the PLC program, and correspond to specific memory addresses in the communication data packet. Due to the possible mixing of multiple protocols or different manufacturers' PLCs, the same control variable may correspond to different memory addresses in different systems. Therefore, the present application provides a protocol adaptation interface, which internally stores the mapping rules of different protocols, and can automatically complete the mapping of point positions to memory addresses, ensuring unified semantic recognition.

[0010] S2: Assign permissions to the memory addresses mentioned in S1, i.e., the permissions required to access the memory addresses. The present application proposes an innovative three-layer permission assignment method, which finely assigns permissions to each memory address from three dimensions of read / write permissions, spatial regions, and time stages.

[0011] Further, assigning read / write permissions means explicitly specifying which memory addresses can only be read (such as sensor data) and which can be read / written (such as actuator control signals) according to the sensitivity of the data and the use scenario.

[0012] Further, the classification according to the spatial region means that the memory addresses are grouped and assigned permissions according to the physical location or component where the control point position corresponding to the memory address is located. From the spatial region, a complete industrial process can usually be divided into multiple components. Taking the distillation process as an example, it includes four key components in the spatial region: feeding, heating, condensing, and discharging. These components are relatively independent and have weak interdependence. In a large factory, these different components may be managed by different departments. Therefore, it is crucial to ensure the isolation of the spatial region.

[0013] Further, the classification according to the time stage means that the memory addresses are grouped and assigned permissions according to whether the control point position corresponding to the memory address participates in the operation at different times. From the time stage, a complete industrial process can usually be divided into multiple states. The operations performed in each state may be very different over time. For example, in the distillation process, the system only starts distillation after the preheating stage reaches the specified temperature threshold. And in different states, the actuators and sensors that play a key role in the industrial process differ greatly. For example, in the preheating stage, the temperature of the reboiler is the main concern, while in the subsequent distillation stage, the liquid level in the tower becomes a more critical parameter. Therefore, it is crucial to ensure the isolation of the time stage.

[0014] S3: According to the permission allocation mode of the memory address, the application also allocates corresponding access permissions for each pair of host-PLC in the ICS.

[0015] Further, according to the role and function of the host in the system (such as a monitoring host, an operating host), the read / write permission range of the host to the target PLC is determined.

[0016] Further, according to the industrial process components involved by the host, the host is allocated spatial access permissions to ensure that it can only access the points in the spatial region it is responsible for.

[0017] Further, in combination with the time characteristics of the industrial process, the host is configured with time access permissions to ensure that it only performs corresponding operations within the specified process phase.

[0018] S4: When a communication data packet accesses a certain memory address in a certain PLC, the application performs real-time permission verification in the communication traffic, that is, the permissions of the host-PLC pair are compared with the permissions required to access the memory address. If the host permissions completely cover the permissions required by the target memory address, access is allowed; otherwise, the access request is denied. In this way, only authorized hosts can perform correct operations on specified memory addresses within the correct time and space range, thereby effectively preventing unauthorized access and external semantic-level attacks.

[0019] Another aspect of the application provides a semantic-based ICS zero-trust platform, comprising the following modules:

[0020] Memory address acquisition module: used to map the points in the PLC into the memory addresses in the communication data packet according to the rules defined by the PLC communication protocol. The memory address serves as the unique identifier of the points in ICS network communication.

[0021] Permission allocation module: provides an automation interface for engineers, and allocates permissions to each PLC memory address and host-PLC pair from three dimensions of read / write permissions, spatial regions, and time phases using a three-layer permission allocation method, to generate a memory address permission bitmap and a host-PLC pair permission bitmap, respectively.

[0022] Permission verification module: real-time monitoring of access requests of communication data packets in the ICS to memory addresses, parsing the communication data packets to extract the five-tuple and target memory address, obtaining the memory address permission bitmap and the host-PLC pair permission bitmap and performing a bitwise AND operation, if the result is equal to the memory address permission bitmap, it is determined that the access to the memory address is trusted, when all target memory addresses are determined to be trusted, it is determined that the communication data packet is trusted, and the communication data packet is allowed to pass, otherwise it is rejected, to ensure the legality and security of access.

[0023] Further, the three-layer permission allocation method provided by the present application has high flexibility and scalability, and can be adjusted or extended according to the specific needs of different industrial scenarios to adapt to diversified security policies.

[0024] Further, the zero-trust platform can be deployed on programmable hardware platforms such as FPGAs and ASICs, and by utilizing the parallel processing capability and low-latency characteristics of hardware, efficient trust verification can be realized to meet the strict requirements of industrial control systems on real-time performance and reliability.

[0025] Compared with the prior art, the present application has the following advantages:

[0026] First, fine-grained permission control is realized. By allocating permissions to the memory address level and skillfully combining read / write permissions, spatial regions, and three-layer permission allocation methods, memory-level semantic control is implemented for data access in ICS;

[0027] Second, it has protocol adaptability. The present application extends to multiple mainstream PLC communication protocols and has universality and practicality in different industrial environments;

[0028] Third, it is highly adaptable. Considering the diversity and complexity of industrial production, the permission allocation strategy can be flexibly adjusted according to the specific needs of different industrial processes and scenarios;

[0029] Fourth, it is easy to deploy. The present application can be deployed on programmable hardware platforms such as FPGAs and ASICs, and by utilizing the parallel processing capability and ultra-low latency characteristics of hardware, efficient trust verification is realized. While ensuring security, the real-time performance of the industrial control system is not affected at all. BRIEF DESCRIPTION OF DRAWINGS

[0030] Figure 1 is a semantic-based ICS zero-trust method flowchart provided by an embodiment of the present application;

[0031] Figure 2 is a distillation column equipment and space / time classification diagram provided by an embodiment of the present application, which shows the spatial relationship of four key spatial components (feed, heating, condensation, and discharge) of the distillation column, as well as the time sequence of three main time stages (preheating, distillation, and reflux);

[0032] Figure 3 is a permission verification process diagram provided by an embodiment of the present application;

[0033] Figure 4 is a semantic-based ICS zero-trust platform structure diagram provided by an embodiment of the present application. DETAILED DESCRIPTION

[0034] In order to make the above objectives, characteristics and advantages of the present application more obvious and easy to understand, the specific embodiments of the present application are described in detail below in combination with the drawings and in combination with a specific industrial scene (rectifying column).

[0035] In the following description, a large number of specific details are set forth in order to facilitate a thorough understanding of the present application, but the present application can also be implemented in other ways different from those described herein, and those skilled in the art can make similar generalizations without departing from the connotation of the present application, therefore the present application is not limited by the specific embodiments disclosed below.

[0036] An ICS zero trust method based on semantics proposed by the embodiments of the present application is as shown in Figure 1 The specific implementation can be divided into four steps.

[0037] (1) First, analyze multiple PLC communication protocols (including S7COMM, UMAS, PCCC, etc.), and master the mapping rules of the points and memory addresses of the PLCs supported by different protocols. According to the mapping rules specified by different PLC communication protocols, provide an automation interface to map the variable table exported from the upper computer software into the memory address in the communication data packet.

[0038] (2) According to the experience of engineers, classify the industrial process in space and time. For example, in space, the rectifying process is composed of four independent key components (as shown in Figure 2 ), including feed, heating, condensation and discharge. The rectifying process first preheats to the boiling point of the material, then is a circulating distillation stage, and finally recovers the impure product back to the reflux until the purity requirement is met. Therefore, the rectifying process can be divided into three main states: preheating, distillation and reflux, and can be modeled by a finite state machine (as shown in Figure 2 ). The trust permissions are borrowed from the above introduction: in the read / write permissions, the variables corresponding to the sensors are readable, and the variables and intermediate variables (such as registers, timers, etc.) corresponding to the actuators are readable / writable; in space, the memory addresses are classified according to the corresponding positions (feed, heating, condensation, and discharge); in time, the memory addresses are classified according to the different stages (preheating, distillation, and reflux).

[0039] After the classification is clear, the memory addresses in step (1) need to be assigned permissions. According to the actual device type (sensor or actuator) corresponding to it and its position and role in the industrial process, determine its permissions in the three dimensions of read / write permissions, space and time.

[0040] Further, the permissions need to be quantified. The present application uses a high-efficiency storage bitmap to realize the quantification of permissions. The number of bits of the memory address permission bitmap is the same as the total number of classifications in the three dimensions. For example, in the above rectification process, the number of bits of the memory address permission bitmap is 2 bits (read, write) for read / write permissions + 4 bits (feed, heater, condenser, discharge) for spatial regions + 3 bits (preheating, distillation, reflux) for time stages, a total of 9 bits. If the permissions of a certain memory address correspond to several of the nine states, the bits at the corresponding positions are set to 1, and the remaining bits are set to 0. For example, the temperature sensor in the rectification tower corresponds to the permissions (read only, heating region, distillation stage), and the quantized memory address permission bitmap is represented as (1, 0, 0, 1, 0, 0, 0, 1, 0).

[0041] (3) With reference to the method of assigning permissions to memory addresses and quantification, the present application also assigns corresponding permissions to each host-PLC pair. For example, the monitoring host has lower permissions and can only monitor the feed inlet of the distillation, so the corresponding permissions are (read only, feed, distillation), and the quantized host-PLC pair permission bitmap is (1, 0, 1, 0, 0, 0, 0, 1, 0); the engineer station has higher permissions and can read and modify related parameters of multiple spatial regions and time stages, such as monitoring and adjusting the parameters of the heater region in the preheating, distillation, and reflux stages, and the corresponding permissions are (read / write, heater, preheating, distillation, reflux), and the quantized host-PLC pair permission bitmap is (1, 1, 0, 1, 0, 0, 1, 1, 1).

[0042] (4) Real-time monitoring and analysis of communication data packets in ICS, when a certain data packet attempts to access a memory address in a PLC, the permissions of the corresponding host-PLC pair are compared with the permissions required to access the memory address. Here, the permission bitmap of the host-PLC pair and the permission bitmap of the memory address need to be compared bit by bit. Specifically, the host-PLC pair permission bitmap and the memory address permission bitmap are subjected to a bitwise AND operation (as shown in Figure 3 ). If the operation result is equal to the memory address permission bitmap, it means that the permissions of the host-PLC pair cover all the permissions required to access the memory address, and this access is trusted; otherwise, the access is not trusted. Because an ICS data packet can request access to multiple memory addresses, only when the access to each memory address is trusted, the data packet is determined to be trusted.

[0043] As shown in Figure 4 , an ICS zero-trust platform based on semantics proposed by the present application includes the following modules:

[0044] Memory address obtaining module: export the variable table of the PLC control program from the upper computer software, and map the variables into memory addresses. According to the mapping rules of different PLC communication protocols, the variables are accurately mapped into the memory addresses in the communication data packet, providing basic data support for subsequent permission allocation and verification.

[0045] Permission allocation module: provides an automation interface for engineers, and allocates permissions for each memory address and host-PLC pair based on a three-layer architecture (read / write permissions, spatial regions, and time stages). The engineers can manage the permissions in batches through an intuitive configuration file. Once the permission allocation is completed, the module will automatically generate a memory address permission bitmap and a host-PLC pair permission bitmap, and store them as a memory table and a flow table in the form of key-value pairs, where the key of the memory address permission bitmap is the memory address, and the value is the corresponding permission bitmap, and the key of the host-PLC pair permission bitmap is the corresponding five-tuple (including source IP, destination IP, source port, destination port, and protocol type), and the value is the corresponding permission bitmap, so as to facilitate subsequent quick query and comparison.

[0046] Permission verification module: real-time monitoring of host access requests to memory addresses. When a certain communication data packet accesses certain memory addresses, the module parses the data packet, extracts the five-tuple and all target memory addresses. Then, using the extracted five-tuple and memory addresses as indexes, the corresponding host-PLC pair permission bitmap and memory address permission bitmap are quickly located in the flow table and memory table generated by the permission allocation module, and a bitwise AND operation is performed for comparison (as shown in Figure 3 Permission verification module: real-time monitoring of host access requests to memory addresses. When a certain communication data packet accesses certain memory addresses, the module parses the data packet, extracts the five-tuple and all target memory addresses. Then, using the extracted five-tuple and memory addresses as indexes, the corresponding host-PLC pair permission bitmap and memory address permission bitmap are quickly located in the flow table and memory table generated by the permission allocation module, and a bitwise AND operation is performed for comparison (as shown in

[0047] The embodiment of the application realizes a prototype system on an FPGA platform, and verifies the effect of the method. In addition, according to different hardware devices used by the network forwarding platform, the embodiment of the application can also be deployed on programmable hardware platforms such as ASIC.

[0048] The above is only the preferred embodiment of the present application, although the present application has been disclosed as above with the preferred embodiment, however, it is not intended to limit the present application. Any skilled person in the art, without departing from the scope of the technical solution of the present application, can make many possible changes and modifications to the technical solution of the present application by using the disclosed method and technical content, or modify it as an equivalent embodiment. Therefore, any simple modification, equivalent change and modification made to the above embodiments according to the technical essence of the present application, without departing from the content of the technical solution of the present application, all still belong to the protection scope of the technical solution of the present application.

Claims

1. A semantic-based ICS zero trust method, characterized in that, The method comprises the following steps: S1: analyzing a PLC communication protocol, converting a point in the PLC into a memory address in a communication data packet, and providing an automation interface to adapt the point and the memory address mapping rule under different PLC communication protocols; S2: adopting a three-layer permission allocation method to allocate fine-grained permissions to each PLC memory address from three dimensions of read / write permissions, space regions, and time stages, quantifying the permissions by using a bitmap to obtain a memory address permission bitmap; S3: allocating the same three-layer permissions as the memory address to each host-PLC pair in the ICS to obtain a host-PLC pair permission bitmap; S4: when the communication data packet accesses the memory address in the PLC, calculating the bitwise AND operation result of the host-PLC pair permission bitmap and the memory address permission bitmap, if the result is equal to the memory address permission bitmap, it indicates that the permissions of the host-PLC pair completely cover the permissions required for accessing the memory address, and at this time, it is determined that the access to the memory address is trusted; when all the memory addresses in the communication data packet are determined to be trusted, it is determined that the communication data packet is trusted and allowed to pass, otherwise, it is rejected, so as to ensure the legality and security of the access.

2. The semantic-based ICS zero trust method of claim 1, wherein, The PLC communication protocol comprises an S7COMM protocol, a UMAS protocol, and a PCCC protocol.

3. The semantic-based ICS zero trust method of claim 1, wherein, In the three-layer permission allocation method, the read / write permissions are divided into read-only and read-write, the space regions are divided according to the physical layout of the industrial process, and the time stages are divided according to the time characteristics of the industrial process.

4. The semantic-based ICS zero trust method of claim 1, wherein, The number of bits of the memory address permission bitmap is the same as that of the host-PLC pair permission bitmap, which is the sum of the number of read / write permission bits, the number of space region bits, and the number of time stage bits.

5. A semantic-based ICS zero trust platform, characterized in that, It comprises: a memory address acquisition module configured to map a point in a PLC into a memory address in a communication data packet according to a rule defined by a PLC communication protocol; a permission allocation module configured to provide an automation interface for engineers, adopt a three-layer permission allocation method, and allocate permissions to each PLC memory address and host-PLC pair from three dimensions of read / write permissions, space regions, and time stages to generate a memory address permission bitmap and a host-PLC pair permission bitmap, respectively; a permission verification module configured to monitor access requests of a communication data packet in an ICS to a memory address in real time, parse the communication data packet to extract a five-tuple and a target memory address, the five-tuple comprising a source IP, a destination IP, a source port, a destination port, and a protocol type, obtain the memory address permission bitmap and the host-PLC pair permission bitmap, and perform a bitwise AND operation, if the result is equal to the memory address permission bitmap, it is determined that the access to the memory address is trusted, and when the accesses to all the target memory addresses are determined to be trusted, it is determined that the communication data packet is trusted.

6. The semantic-based ICS zero trust platform of claim 5, wherein, In the permission allocation module, the engineers can set permissions through a configuration file.

7. The semantic-based ICS zero trust platform of claim 5, wherein, In the permission assignment module, the engineer automatically generates a memory address permission bitmap and a host-PLC pair permission bitmap after completing permission assignment, and stores them as a memory table and a flow table in the form of a key-value pair, the key of the memory address permission bitmap is a memory address, and the value is a corresponding permission bitmap, the key of the host-PLC pair permission bitmap is a corresponding five tuple, and the value is a corresponding permission bitmap.

8. The semantic-based ICS zero trust platform of claim 5, wherein, The permission verification module intercepts untrusted communication data packets and issues an alarm.

9. The semantic-based ICS zero trust platform of claim 5, wherein, The platform can be deployed on an FPGA or ASIC programmable hardware platform.

Images