A semantic-based ics zero trust method and platform

Abstract

The application discloses a kind of ICS zero trust method and platform based on semantics.The application provides the automation interface of different protocol adaptation by analyzing multiple PLC communication protocols, converting and mapping PLC point to memory address in communication data packet.Adopt three-layer permission allocation method, fine permission allocation is carried out to memory address and host-PLC pair from three dimensions of read / write permission, space area and time stage, and quantization permission generates bitmap.When communication data packet accesses PLC memory address, the legality and security of access are ensured by comparing the bit-by-bit and operation result of permission bitmap to verify access permission.The platform includes memory address acquisition, permission allocation module and permission verification module, supports multiple PLC communication protocols, can be deployed on FPGA, ASIC and other hardware platforms, realizes efficient trust verification, meets the real-time and reliability requirements of industrial control system, has the advantages of fine-grained permission control, protocol independence, strong adaptability and the like.

Description

Technical Field

[0001] This invention relates to the field of industrial control system security, and more particularly to a semantic-based zero-trust method and platform for industrial control systems that takes into account real industrial control environments. Background Technology

[0002] In the era of Industry 4.0, Industrial Control Systems (ICS) networks are experiencing a growing trend of IT / OT convergence. Driven by advancements in next-generation ICS technologies, such as OpenPLC and the Industrial Internet of Things (IIoT), ICS is becoming increasingly intertwined with internet infrastructure. ICS networks expose previously "barren" local area networks (LANs) to more complex and dangerous network environments. This open network environment further amplifies ICS vulnerabilities, making them more vulnerable to cyberattacks. While some defense systems have been implemented in industrial applications, they are insufficient for modern production ICS. Traditional industrial firewalls implement rule-based trust verification, but their granularity is too coarse to detect hidden attacks like Stuxnet. Intrusion detection systems offer finer granularity but rely more heavily on post-incident detection and recovery. ICS networks require trust verification mechanisms to eliminate all implicit prior trust and prevent untrusted requests from attackers. In other words, a granular zero-trust policy—"never trust, always verify"—is needed in ICS. Every message in ICS requires verification and protection.

[0003] However, implementing a zero-trust approach for ICS networks remains challenging. Attacks against ICS networks are often semantic, more covert than those against IT networks. Semantic-level information includes sensor / actuator values, intermediate system variables, and more. Some attacks can be accomplished by modifying just one core variable. Once an attacker gains unauthorized access to a core semantic variable, it can cause fatal damage to an industrial environment. A single programmable logic controller (PLC) may involve hundreds of semantic variables, while large plants may involve managing tens of thousands. For example, a small facility at the scale of a large utility may have millions of process sensors. Managing such a large number of semantic variables during operation is a significant challenge. Furthermore, access permissions for semantic data are often dynamically adjusted to align with industrial workflows. The actuators and sensors accessible to a particular device may vary over time at different operational phases, thus requiring context-aware access control.

[0004] In summary, it is necessary to design a semantic-based zero-trust method that takes into account the characteristics of ICS networks. Summary of the Invention

[0005] The purpose of this invention is to address the shortcomings of existing zero-trust methods in the field of industrial control system security by designing a semantic-based, dynamic zero-trust method that is tailored to the characteristics of ICS networks.

[0006] The objective of this invention is achieved through the following technical solution:

[0007] This invention provides a semantic-based zero-trust method for ICS, comprising the following steps:

[0008] S1: Converts the control variables of the industrial process into memory addresses in the PLC communication protocol.

[0009] Furthermore, control variables in industrial processes are represented as points (e.g., Q0.1) in the PLC program, while corresponding to specific memory addresses in the communication data packets. Due to the potential for multiple protocols or the mixing of PLCs from different manufacturers, the same control variable may correspond to different memory addresses in different systems. Therefore, this invention provides a protocol adaptation interface with built-in mapping rules for different protocols, capable of automatically mapping points to memory addresses and ensuring consistent semantic recognition.

[0010] S2: Assign permissions to the memory address mentioned in S1, i.e., the permissions required to access that memory address. This invention proposes an innovative three-layer permission allocation method, which performs fine-grained permission allocation for each memory address from three dimensions: read / write permissions, spatial regions, and temporal phases.

[0011] Furthermore, allocating read / write permissions means, based on the sensitivity of the data and the usage scenario, specifying which memory addresses can only be read (such as sensor data) and which can be read / written (such as actuator control signals).

[0012] Furthermore, spatial region classification refers to grouping and allocating permissions to memory addresses based on the physical location or component division of the control points corresponding to those addresses. From a spatial region perspective, a complete industrial process can typically be divided into multiple components. Taking a distillation process as an example, it includes four key components in terms of spatial region: feeding, heating, condensation, and discharging. These components are relatively independent and have weak interdependence. In large factories, these different components may be managed by different departments. Therefore, ensuring spatial region isolation is crucial.

[0013] Furthermore, classification by time phase refers to grouping and allocating permissions to memory addresses based on whether the control points corresponding to those addresses participate in the operation at different times. From a time phase perspective, a complete industrial process can typically be divided into multiple states. Over time, the operations performed in each state can differ significantly. For example, in a distillation process, the system only initiates distillation after reaching a specified temperature threshold during the preheating phase. Moreover, the actuators and sensors that play a crucial role in the industrial process vary considerably across different states. For instance, during the preheating phase, the reboiler temperature is of primary concern, while in the subsequent distillation phase, the liquid level within the column becomes a more critical parameter. Therefore, ensuring isolation between time phases is essential.

[0014] S3: Referring to the permission allocation method for memory addresses, this invention also assigns corresponding access permissions to each pair of host-PLC in the ICS.

[0015] Furthermore, based on the host's role and function in the system (such as monitoring host, operation host), determine its read / write permission range for the target PLC.

[0016] Furthermore, based on the industrial process components involved in the host, spatial access permissions are assigned to ensure that it can only access points within the spatial area it is responsible for.

[0017] Furthermore, considering the time characteristics of industrial processes, time-based access permissions are configured for the host to ensure that it performs corresponding operations only within the specified process phases.

[0018] S4: When a communication data packet accesses a memory address in a PLC, this invention performs real-time permission verification within the communication traffic, comparing the permissions of the host-PLC pair with the permissions required to access the memory address. If the host's permissions completely cover the permissions required for the target memory address, access is allowed; otherwise, the access request is denied. This ensures that only authorized hosts can perform correct operations on the specified memory address within the correct time and space, effectively preventing unauthorized access and external semantic-level attacks.

[0019] Another aspect of the present invention provides a semantic-based ICS zero-trust platform, comprising the following modules:

[0020] Memory address acquisition module: This module maps points in the PLC to memory addresses in communication data packets according to the rules defined in the PLC communication protocol. This memory address serves as a unique identifier for the point in the ICS network communication.

[0021] Permission allocation module: Provides an automated interface for engineers, adopts a three-layer permission allocation method, and allocates permissions to each PLC memory address and host-PLC pair from three dimensions: read / write permissions, spatial area and time stage, generating memory address permission bitmap and host-PLC pair permission bitmap respectively.

[0022] The access verification module monitors communication data packets in the ICS for access requests to memory addresses in real time. It parses the communication data packets to extract the quintuple and the target memory address, obtains the memory address access permission bitmap and the host-PLC access permission bitmap, and performs a bitwise AND operation. If the result is equal to the memory address access permission bitmap, the access to that memory address is deemed trustworthy. When all accesses to the target memory addresses are deemed trustworthy, the communication data packet is deemed trustworthy and allowed to pass; otherwise, it is rejected to ensure the legality and security of access.

[0023] Furthermore, the three-tier permission allocation method proposed in this invention has high flexibility and scalability, and can be adjusted or expanded according to the specific needs of different industrial scenarios to adapt to diverse security strategies.

[0024] Furthermore, this zero-trust platform can be deployed on programmable hardware platforms such as FPGA and ASIC, leveraging the parallel processing capabilities and low latency of the hardware to achieve efficient trust verification and meet the stringent requirements of industrial control systems for real-time performance and reliability.

[0025] Compared with the prior art, the present invention has the following advantages:

[0026] First, it achieves fine-grained access control. By allocating permissions at the memory address level and cleverly combining three-layer permission allocation methods—read / write permissions, spatial regions, and time phases—it implements memory-level semantic control over data access in ICS.

[0027] Second, it is protocol-adaptable. This invention is extended to multiple mainstream PLC communication protocols, making it universal and practical in different industrial environments;

[0028] Third, it is highly adaptable. Considering the diversity and complexity of industrial production, the permission allocation strategy can be flexibly adjusted according to the specific needs of different industrial processes and scenarios;

[0029] Fourth, it is easy to deploy. This invention can be deployed on programmable hardware platforms such as FPGAs and ASICs, leveraging the parallel processing capabilities and ultra-low latency of the hardware to achieve efficient trust verification. While ensuring security, it does not affect the real-time performance of the industrial control system at all. Attached Figure Description

[0030] Figure 1 This is a flowchart of the semantic-based ICS zero-trust method provided in an embodiment of the present invention;

[0031] Figure 2 This is a diagram of the distillation column equipment and its spatial and temporal classification provided in the embodiments of the present invention. It shows the spatial relationship of the four key spatial components of the distillation column (feed, heating, condensation and discharge) and the temporal sequence of the three main time stages (preheating, distillation and reflux).

[0032] Figure 3 This is a diagram illustrating the permission verification process provided in an embodiment of the present invention;

[0033] Figure 4 This is a semantic-based ICS zero-trust platform architecture diagram provided in an embodiment of the present invention. Detailed Implementation

[0034] To make the above-mentioned objectives, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings and specific industrial scenarios (distillation columns).

[0035] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0036] This application proposes a semantic-based ICS zero-trust method, such as... Figure 1 As shown, the specific implementation can be divided into four steps.

[0037] (1) First, analyze multiple PLC communication protocols (including S7COMM, UMAS, PCCC, etc.) to understand the mapping rules between PLC points and memory addresses supported by different protocols. Based on the mapping rules specified by different PLC communication protocols, provide an automation interface to map the variable table exported from the host computer software to the memory address in the communication data packet.

[0038] (2) Based on engineers' experience, industrial processes are categorized spatially and temporally. For example, spatially, a distillation process consists of four independent key components (such as...). Figure 2 As shown in the diagram, the process includes feeding, heating, condensation, and discharging. Distillation first requires preheating the material to its boiling point, followed by a cyclic distillation stage, and finally, the impurities are recovered and refluxed until the required purity is met. Therefore, the distillation process can be divided into three main states: preheating, distillation, and reflux, and can be modeled using a finite state machine (e.g., [example missing]). Figure 2 (As shown). Trust permissions are based on the above introduction: In read / write permissions, the variables corresponding to sensors are readable, and the variables corresponding to actuators and intermediate variables (such as registers, timers, etc.) are readable / writable; spatially, memory addresses are classified according to their corresponding locations (feeding, heating, condensing, discharging); temporally, memory addresses are classified according to their different stages (preheating, distillation, and reflux).

[0039] After clearly classifying the memory addresses, permissions need to be assigned to them in step (1). Based on the actual device type (sensor or actuator) and its position and role in the industrial process, the permissions for reading / writing, space, and time are determined.

[0040] Furthermore, permissions need to be quantified. This invention uses a highly efficient storage bitmap to quantify permissions. The number of bits in the memory address permission bitmap is the same as the sum of the number of categories in the three dimensions. For example, in the above distillation process, the number of bits in the memory address permission bitmap is 2 bits for read / write permissions (read, write) + 4 bits for spatial regions (feed, heating, condensation, discharge) + 3 bits for time stages (preheating, distillation, reflux), for a total of 9 bits. If the permission of a certain memory address corresponds to several of these nine states, then the corresponding bit is set to 1, and the remaining bits are set to 0. For example, the permissions corresponding to the temperature sensor in the distillation column are (read-only, heating area, distillation stage), and the quantized memory address permission bitmap is represented as (1, 0, 0, 1, 0, 0, 1, 0).

[0041] (3) Referring to the method of allocating permissions and quantization for memory addresses, this invention also assigns corresponding permissions to each host-PLC pair. For example, the monitoring host has lower permissions and can only monitor the feed inlet of distillation, so the corresponding permissions are (read-only, feed, distillation), and the quantized host-PLC pair permission bitmap is (1, 0, 1, 0, 0, 0, 1, 0); the engineer station has higher permissions and can both read and modify relevant parameters of multiple spatial areas and time stages, such as monitoring and adjusting the parameters of the heater area in the preheating, distillation and reflux stages, so the corresponding permissions are (read-write, heater, preheating, distillation, reflux), and the quantized host-PLC pair permission bitmap is (1, 1, 0, 1, 0, 0, 1, 1, 1).

[0042] (4) Real-time monitoring and parsing of communication data packets in the ICS. When a data packet is detected attempting to access a memory address in a PLC, the permissions of the corresponding host-PLC pair are compared with the permissions required to access that memory address. This requires a bitwise comparison between the host-PLC pair's permission bitmap and the memory address's permission bitmap. Specifically, a bitwise AND operation is performed between the host-PLC pair's permission bitmap and the memory address's permission bitmap (e.g., ...). Figure 3 (As shown). If the operation result equals the memory address permission bitmap, it means that the host-PLC pair's permissions cover all the permissions required to access that memory address, and the access is trustworthy; otherwise, the access is untrustworthy. Because an ICS data packet can request access to multiple memory addresses, the data packet is only considered trustworthy if the access to each memory address is trustworthy.

[0043] like Figure 4 As shown in the embodiments of this application, a semantic-based ICS zero-trust platform includes the following modules:

[0044] Memory Address Acquisition Module: Exports the variable table of the PLC control program from the host computer software and maps the variables to memory addresses. Based on the mapping rules of different PLC communication protocols, it accurately maps the variables to memory addresses in the communication data packets, providing basic data support for subsequent permission allocation and verification.

[0045] The permission allocation module provides engineers with an automated interface, assigning permissions to each memory address and host-PLC pair based on a three-tier architecture (read / write permissions, spatial regions, and time phases). Engineers can manage permissions in batches through intuitive configuration files. Once permission allocation is complete, the module automatically generates a memory address permission bitmap and a host-PLC pair permission bitmap, storing them as key-value pairs in memory tables and flow tables. The key in the memory address permission bitmap is the memory address, and the value is the corresponding permission bitmap. The key in the host-PLC pair permission bitmap is the corresponding 5-tuple (including source IP, destination IP, source port, destination port, and protocol type), and the value is the corresponding permission bitmap, facilitating subsequent quick lookups and comparisons.

[0046] The access verification module monitors the host's access requests to memory addresses in real time. When a communication data packet accesses certain memory addresses, this module parses the packet, extracting the quintuple and all target memory addresses. Then, using the extracted quintuple and memory addresses as indices, it quickly locates the corresponding host-PLC access bitmap and memory address access bitmap in the flow table and memory table generated by the access allocation module, and performs a bitwise AND operation for comparison (e.g., ...). Figure 3 (As shown). If the comparison results show that the permissions of the host-PLC pair completely cover the permissions required for all target memory addresses, the access is deemed trustworthy, and the data packet is allowed to pass; otherwise, it is deemed untrustworthy access, the data packet is immediately intercepted, and an alarm is sent to the safety management system to ensure the safe and stable operation of the industrial control system.

[0047] This application's embodiments implemented a prototype system on an FPGA platform and verified the method's effectiveness. Furthermore, depending on the hardware devices used in the network forwarding platform, this application's embodiments can also be extended to programmable hardware platforms such as ASICs.

[0048] The above description is merely a preferred embodiment of the present invention. Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make many possible variations and modifications to the technical solutions of the present invention using the methods and techniques disclosed above, or modify them into equivalent embodiments with equivalent changes, without departing from the scope of the technical solutions of the present invention. Therefore, any simple modifications, equivalent changes, and modifications made to the above embodiments based on the technical essence of the present invention without departing from the content of the technical solutions of the present invention shall still fall within the protection scope of the technical solutions of the present invention.

Claims

1. A semantic-based ICS zero trust method, characterized in that, The method comprises the following steps: S1: analyzing the PLC communication protocol, converting the point in the PLC into a memory address in the communication data packet, and providing an automation interface to adapt to the point and memory address mapping rules under different PLC communication protocols; S2: using a three-layer permission allocation method to allocate fine-grained permissions to each PLC memory address from three dimensions of read / write permissions, space regions, and time stages, quantifying the permissions using a bitmap to obtain a memory address permission bitmap; In the three-layer permission allocation method, read / write permissions are divided into read-only and read-write, space regions are divided according to the physical layout of the industrial process, and time stages are divided according to the time characteristics of the industrial process; the number of bits of the memory address permission bitmap is the sum of the number of read / write permission bits, the number of space region bits, and the number of time stage bits; S3: allocating the same three-layer permissions as the memory address to each host-PLC pair in the ICS to obtain a host-PLC pair permission bitmap; The number of bits of the host-PLC pair permission bitmap is the sum of the number of read / write permission bits, the number of space region bits, and the number of time stage bits; S4: When a communication data packet accesses a memory address in the PLC, calculate the bitwise AND operation result of the host-PLC pair permission bitmap and the memory address permission bitmap, if it is equal to the memory address permission bitmap, it means that the permission of the host-PLC pair completely covers the permission required to access the memory address, at this time, it is determined that the access to the memory address is trusted; when all memory addresses in the communication data packet are determined to be trusted, it is determined that the communication data packet is trusted and allowed to pass, otherwise it is rejected, to ensure the legality and security of access.

2. The semantic-based ICS zero trust method of claim 1, wherein, The PLC communication protocol includes S7COMM protocol, UMAS protocol, and PCCC protocol.

3. A semantic-based ICS zero trust platform, characterized in that, It comprises: a memory address acquisition module for mapping the point in the PLC into a memory address in the communication data packet according to the rules defined by the PLC communication protocol; a permission allocation module for providing an automation interface for engineers, using a three-layer permission allocation method to allocate permissions to each PLC memory address and host-PLC pair from three dimensions of read / write permissions, space regions, and time stages, and generating a memory address permission bitmap and a host-PLC pair permission bitmap respectively; in the three-layer permission allocation method, read / write permissions are divided into read-only and read-write, space regions are divided according to the physical layout of the industrial process, and time stages are divided according to the time characteristics of the industrial process; the number of bits of the memory address permission bitmap is the same as that of the host-PLC pair permission bitmap, which is the sum of the number of read / write permission bits, the number of space region bits, and the number of time stage bits; a permission verification module for monitoring the access request of the communication data packet to the memory address in the ICS in real time, parsing the communication data packet to extract a five-tuple and a target memory address, the five-tuple comprising a source IP, a destination IP, a source port, a destination port, and a protocol type, obtaining the memory address permission bitmap and the host-PLC pair permission bitmap and performing a bitwise AND operation, if the result is equal to the memory address permission bitmap, it is determined that the access to the memory address is trusted, and when the access of all target memory addresses is determined to be trusted, it is determined that the communication data packet is trusted.

4. The semantic-based ICS zero trust platform of claim 3, wherein, In the permission assignment module, an engineer can set permissions through a configuration file.

5. The semantic-based ICS zero trust platform of claim 3, wherein, In the permission assignment module, after an engineer completes permission assignment, a memory address permission bitmap and a host-PLC pair permission bitmap are automatically generated, and they are stored as a memory table and a flow table in the form of key-value pairs, the key of the memory address permission bitmap is a memory address, and the value is a corresponding permission bitmap, the key of the host-PLC pair permission bitmap is a corresponding five-tuple, and the value is a corresponding permission bitmap.

6. The semantic-based ICS zero trust platform of claim 3, wherein, The permission verification module intercepts untrusted communication data packets and issues an alarm.

7. The semantic-based ICS zero trust platform of claim 3, wherein, The platform can be deployed on an FPGA or ASIC programmable hardware platform.

Images