Unaddressable stealth gateway-based method for trusted access of field devices

Abstract

The application discloses a field equipment trusted access method based on an unaddressable invisible gateway, relates to the technical field of network security access, and comprises four steps: in the manufacturing period and the first access, the device identity and the trusted platform module measurement are bound by a certificate authorization machine, a policy decision point is judged, a policy execution point is implemented and a policy subset is loaded; outward initiation by the device, establishment of an end-to-end trusted channel with the center, inward isolation of the real service in the back end and transparent bearing; online incremental and gray update of the policy, algorithm and key under the control of a unified policy library; and decryption, tracking and backfilling in the authorized lease through a bypass mirror and a special decryption module, so that the method reduces the attack surface, reduces the transformation cost, guarantees non-stop management, makes encrypted traffic observable and auditable, ensures that only trusted devices can reach the center through the trusted channel, and supports event linkage and power reduction and certificate state linkage and management.

Description

Technical Field

[0001] This invention relates to the field of network security access technology, specifically to a trusted access method for field devices based on an unaddressable stealth gateway. Background Technology

[0002] In industries such as IoT, industrial control, and energy, a large number of field devices need to access the central network across the public internet for monitoring. Such access is characterized by numerous points of contact, heterogeneous vendors, diverse protocols, and complex deployments, often constrained by limited network conditions and difficulties in upgrading legacy systems. Current practices often employ VPNs, port mapping, and traditional application gateways, typically requiring the central network to retain detectable entry points and listening ports on the public internet, prioritizing connectivity over governance. This results in the central boundary remaining addressable for extended periods, making it vulnerable to internet mapping and automatic scanning, and hindering attack surface containment.

[0003] In terms of encryption, the widespread adoption of transport layer security protocols has made link encryption commonplace, but it has also brought about the monitoring dilemma of encryption being invisible: some organizations rely on inline decryption for bearer detection, which raises questions about performance and compliance; at the same time, the lack of in-depth auditing of encrypted traffic makes it difficult to identify and trace hidden channels in a timely manner.

[0004] Meanwhile, the distribution and rotation of certificates, algorithms, and keys are often decentralized across geographically dispersed device clusters. Certificate revocation propagation suffers from time lags, and weak algorithms and long-term key remnants are common. Policy changes are difficult to implement with fine-grained precision based on objects and time windows, and there is a lack of standardized procedures for rollback after failed gray-scale deployments. On the other hand, network access control in many cases still relies on identity credentials and network addresses, lacking a mechanism to incorporate device integrity measurements as a prerequisite, and failing to bind the actual state of a device to its access eligibility in real time. Even after being hijacked, a device may still gain access to the network with legitimate credentials and engage in lateral movement and data leakage, threatening both the central and backend business systems. In summary, it is difficult to simultaneously close the central boundary at both the physical exposure surface and semantic trustworthiness levels, encrypted traffic visibility auditing is insufficient, and there is a long-standing conflict between policy and cryptographic governance and business continuity.

[0005] In scenarios where cross-domain field devices access the central network, existing technologies struggle to establish verifiable access boundaries. They cannot ensure that only field devices with trusted identities and states can reach the center and access backend services via auditable, trusted channels. The root causes are: the center consistently exposes addressable entry points; device trust status and access eligibility cannot be linked in real-time; and encrypted communication lacks bypass visual auditing and runtime governance of certificates, algorithms, and keys, making it difficult to simultaneously achieve attack surface convergence, traceable behavior, and minimal business modification for access. Summary of the Invention

[0006] (a) Technical problems to be solved To address the shortcomings of existing technologies, this invention provides a trusted access method for field devices based on an unaddressable stealth gateway. This method establishes an end-to-end trusted channel with the central authority by initiating access from the device, while internally isolating and transparently carrying the real backend services. Under the control of a unified policy library, policies, algorithms, and keys are updated online incrementally and in a canary manner. Decryption, tracing, and re-implementation are performed within the authorized lease through bypass mirroring and a dedicated decryption module. This method reduces the attack surface, lowers modification costs, ensures uninterrupted governance, makes encrypted traffic observable and auditable, and ensures that only trusted devices can reach the central authority via a trusted channel. It also supports event-linked demotion and certificate status-linked governance, resolving the technical problems described in the background section.

[0007] (II) Technical Solution To achieve the above objectives, the present invention provides the following technical solution: The trusted access method for field devices based on unaddressable stealth gateways includes: establishing a private trusted channel between the field device and the certificate authorization machine during the manufacturing period; submitting the trusted platform module measurement for the first access; determining whether to allow, isolate, or deny access by the policy decision point and the policy execution point; and issuing a policy subset to the unified policy library. The center adopts a transparent transmission proxy model without network address. The connection is initiated from the device and an end-to-end trusted channel is established after certificate and metric verification. Inward protection and isolation are implemented for the real backend service, and transparent forwarding and pre-screening are performed based on policy subsets. Within the trusted channel, the unified policy library executes incremental and canary updates of policies, algorithms, and keys, which are linked to the certificate lifecycle. The central trusted access gateway will update and compile these into access control lists and deep packet inspection items and incrementally replace them to take effect. Without changing the path, the bearer port is bypassed and mirrored. A dedicated decryption module authorized by the certificate authority decrypts the session in a controlled manner and performs behavior tracking. Abnormal results are fed back to the policy decision point and policy execution point to adjust or revoke the policy.

[0008] Furthermore, during the manufacturing phase, the firmware digest of the field device and the trusted platform module metric are used to generate a manufacturing phase binding digest and write it into the public key certificate extension field. Upon initial access, the policy decision point makes a decision based on the binding digest and metric evidence comparison, and the policy enforcement point sets up a virtual LAN isolation zone or allows access.

[0009] Furthermore, the unified policy library uses role-based access control and attribute-based access control to jointly model and describe subjects, objects, actions and contexts with structured data. Policies are distributed to devices and the central trusted access gateway after signature verification, breakpoint resume and version identification management, and are associated with the admission status.

[0010] Furthermore, the central trusted access gateway does not register domain names on the public network, does not respond to inbound handshakes, and only initiates outbound communication outside the address range permitted by the device according to the policy subset. After the certificate and manufacturing period binding digest verification is passed, it enters the channel permission state and establishes an end-to-end trusted channel.

[0011] Furthermore, the device and the central trusted access gateway each generate a one-time random variable, which is combined with the manufacturing period binding digest to derive the session key; and the central trusted access gateway maps the virtual destination identifier to the backend real service address according to the policy subset, establishes session persistence and performs transparent forwarding.

[0012] Furthermore, the inbound pre-screening includes: the central trusted access gateway compiles access control lists and deep packet inspection entries based on policy subsets, matches the five-tuples of the device's uplink packets with application layer fields one by one, and does not allow passage if any allowed entry is not matched and generates an audit record associated with the session.

[0013] Furthermore, within the trusted channel, a unified policy library generates a policy version sequence based on a grayscale window. The central trusted access gateway pre-compiles the updates and generates replacement snapshots, incrementally replacing them with the effective rule set according to the policy dependency order, and linking them with certificate revocation and online status verification.

[0014] Furthermore, within the scrolling window, session keys are scrolled forward one by one by session, and the corresponding rule set is issued synchronously. When the certificate authorizing machine indicates that the certificate status is invalid or an abnormal bypass behavior fingerprint is reported, the policy decision point issues a demotion instruction, and the policy execution point shrinks the access scope accordingly.

[0015] Furthermore, the bearer traffic is obtained by bypassing the port mirroring or splitter of the switching device; the dedicated decryption module requests a decryption lease from the certificate authority, the lease limits the time window, session range and accessible fields, and performs controlled decryption on the matched session according to the session key index.

[0016] Furthermore, a fingerprint score is generated based on the decrypted session and matched with the event dictionary to form an event set; the processing engine combines the processing action with the session identifier, relevant rule entries and session key index to form an audit record, which is fed back to the policy decision point and certificate authorization machine for subsequent governance.

[0017] (III) Beneficial Effects This invention provides a trusted access method for field devices based on a non-addressable stealth gateway, which has the following beneficial effects: During the manufacturing phase and initial access, the binding of device identity and trusted platform module measurement is completed on the certificate authorization machine side. The policy decision point decides access and the policy execution point implements it, forming a trusted baseline. This reduces the space for illegal access and credential drift from the source and avoids the risk window caused by allowing access first and then managing it.

[0018] The center adopts an unaddressable stealth gateway, which initiates connections from the outside of the device, establishes an end-to-end trusted channel on the center side, and implements inward mapping and transparent bearing for the real backend services, so that the center has no exposed public network entry point, and business systems can be included in the bearing without modification, and the aggregation and access process is smooth and controllable.

[0019] Above the trusted channel, inbound sessions are pre-screened with fine-grained precision by combining access control lists and deep packet inspection. Corresponding to a subset of policies, only authorized virtual destination identifiers are allowed to map to real services, restricting lateral access and unauthorized application layer requests, and synchronizing audit logs and session persistence tables.

[0020] The unified policy library updates policies, algorithms, and keys online through incremental, canary, and breakpoint resume updates. The central trusted access gateway pre-compiles the rules and applies them incrementally with replacement snapshots. It also links with certificate revocation and online status verification to ensure governance and maintenance of minimum necessary permissions under uninterrupted operation.

[0021] Without changing the bearer path, encrypted traffic is obtained through port mirroring or bypass devices. The dedicated decryption module performs controlled decryption and reassembly within the decryption lease issued by the certificate authority. It combines fingerprint scoring and event dictionary to trigger blocking, isolation or trapping, and integrates evidence backfeeding strategy with certificate governance. Attached Figure Description

[0022] Figure 1 This is a schematic diagram of the trusted access method for field devices based on an unaddressable stealth gateway according to the present invention. Detailed Implementation

[0023] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0024] Please see Figure 1 This invention provides a trusted access method for field devices based on an unaddressable stealth gateway, comprising: Step 1: During the manufacturing and initial access phases, taking the certificate authorization machine as the starting point for governance, the device identity, trusted platform module measurement, and policy loading of the unified policy library are integrated into the same decision chain, outputting verifiable access status and a subset of directly executable policies, and fixing the preconditions for trusted channels.

[0025] Field devices come from diverse sources and come in various forms. If only a single identity credential is used for identification, it will leave room for tampering or forgery. If only measurement results are used for identification, it will be difficult to prevent replacement and impersonation when the identity binding is weak. Therefore, it is necessary to load the device identity characteristics, certificate, measurement evidence, and policy into a single chain during the manufacturing period and complete the one-time closure upon initial access to avoid the window of connecting first and then governing.

[0026] As an example: A substation adds a new field monitoring and control terminal. Before the equipment rolls off the production line, the production workshop writes the equipment serial number, hardware fingerprint digest, and manufacturing batch code into a read-only area and registers this information to the certificate authorization machine via a private channel. After the equipment arrives at the site and is powered on, it automatically initiates an initial registration request to the certificate authorization machine, generates a public key, and applies for a 509 format public key certificate. The equipment simultaneously collects the measurement values ​​of the trusted platform module and packages them into measurement evidence, which is then submitted to the integrity measurement collection component. The integrity measurement verification component and the unified policy library jointly determine the access status. Based on this, the policy decision point places the terminal in a virtual LAN isolation zone and issues a minimum policy subset. At the policy execution point, the switching equipment performs port-level access according to the rules, allowing only the necessary handshake messages required for subsequent stealth link establishment to pass through.

[0027] This involves converting device identity strength into a computable quantity, and then strongly binding this computable quantity to the certificate issuance process to prevent certificates from becoming easily transferable credentials. First, during the manufacturing phase, device identity elements are aggregated from multiple sources and normalized to establish a device identity strength score. Then, during certificate issuance, key metrics of the trusted platform module and firmware digests are written into the certificate's extended field, forming a consistency anchor between the certificate and the metrics.

[0028] Furthermore, using device identity feature vectors Using serial number hashing, hardware fingerprint stability, and manufacturing batch consistency as the core carrier, discrete elements are unified onto the same number axis, and a single score is obtained through weighted combination, which serves as the entry threshold for subsequent actions. Where: Equipment identity strength score : A scalar value that quantifies the trustworthiness of a device's identity, with a value of The closer The more stable the identity representation; Weight vector : Assigning certainty and weight to each identity element, with the sum of components as follows The value range of each component is Used to express the trust assignment of the manufacturing chain; device identity feature vector The element vector obtained according to the same normalization criterion has a component range of... This includes serial number hash consistency, hardware fingerprint stability, and manufacturing batch code consistency; identity trust threshold. : rating The lower bound constraint, the value It is configured at the manufacturing batch level by the certificate authorization machine.

[0029] Device identity strength scoring Generation and threshold The constraints allow for the screening of equipment with weak or easily replaceable identity structures during the manufacturing phase; the scoring serves as a unified data axis, providing reusable judgment and ranking criteria for certificate issuance and subsequent access.

[0030] On the certificate authorization machine side, the device firmware digest and the trusted platform module metric vector are concatenated and hashed. The result is written into the certificate extension field, establishing an inseparable binding between the certificate and the metric, where: Where: Certificate extended domain metric summary : Write a fixed-length digest of the public key certificate in 509 format, with the value space being the output space of the hash function; hash function Collision-resistant cryptographic hash maps, defined by a domain of any finite bit string and a range of a fixed-length bit string; Firmware integrity digest. The digest obtained from the device firmware image using the same algorithm has a value space that is a hash function. The range of values; the metric vector of the trusted platform module. The bit string obtained by concatenating bits according to a preset register order has components all from the measurement register of the trusted platform module; concatenation operator : An operator that concatenates two bit strings in the high-low direction to form a longer bit string.

[0031] When used, it is solidified in the certificate extension field. A one-to-one correspondence is established between certificates and metric evidence; once the firmware is replaced or the trusted platform module metric changes, the certificate extension field metric digest is updated. The measurement evidence reported on-site will be mismatched, thus accurately identifying and blocking the risk of certificate drift during the first access.

[0032] Furthermore, it is necessary to merge the measurement verification during the initial access with the manufacturing certificate binding information into the same scoring space, then unambiguously map the scoring results to the access status of allow, isolate or deny, and simultaneously trigger the policy loading action.

[0033] First, calculate the remote proof score, combine the current metric with baseline consistency and historical stability, and then generate access decision variables based on it; then, drive the unified policy library according to the decision variables to complete the selection and distribution of policy subsets, and implement specific network and host-side control at the policy execution point.

[0034] Specifically, on the integrity metric verification component side, the matching degree between the current metric and the certificate extension domain metric digest, the deviation from the trusted baseline, and the stability of historical behavior are unified into a single score to balance one-time consistency and stability over time. Where: Remote proof score Scalar score for measuring credibility, with values... Matching consistency index : The degree of matching between the current metric evidence and the certificate extension domain metric digest, with a value of Historical stability indicators The metric is obtained by estimating the stability and behavioral consistency of recent accesses, and its value is [value missing]. Trade-off coefficient A proportional parameter that balances one-time matching with historical stability, with a value of [value missing]. It is jointly set by the certificate authorization machine and the unified policy library.

[0035] When used, remote proof scoring It takes into account both the consistency at present and the stability in the past, avoiding situations where historical changes are ignored based on a single successful match, and also avoiding situations where the history is good but the current situation is tampered with, thus achieving a robust judgment at the first access.

[0036] Furthermore, the device identity strength score and remote authentication score are merged in the same rule to output an unambiguous three-value judgment. Based on this, the unified policy library selects and distributes a subset of policies, and finally implements specific network actions at the policy execution point. Where: Access decision variable A three-valued variable, whose value set is: From top to bottom, these correspond to three states: rejection, isolation, and release; identity trust threshold. : This represents the minimum constraint for identity strength, and its value is [value missing]. ; Measurement confidence threshold : Minimum constraint on the scoring of remote proofs, with a value of Logical AND operator The conjunction operation in Boolean algebra is used to give the truth value when two inequalities are satisfied simultaneously.

[0037] When using it, access the decision variable. The three-value mapping makes the admission decision unique and executable; the linkage with the unified policy library enables actions such as allowing access (loading a complete subset of policies), isolating access (issuing the minimum access policy and placing it in a virtual LAN), and denying access (not opening any business plane) to be directly implemented at the policy execution point.

[0038] Step 2: Under the constraints of outward initiation-non-addressable-transparent bearer, complete the stealth chain establishment and central isolation, so that the end-to-end trusted channel is only open to qualified devices, and carry the real business of the backend in deterministic mapping, while solidifying fine-grained access control into executable rules.

[0039] If the central trusted access gateway exposes its entry point on the public network, it will inevitably be actively scanned and mapped; even if the entry point is only used for handshake, it will become a target for probe and resource consumption. Therefore, it is necessary to ensure that chain establishment is only actively triggered on the field device side, and the center will only silently accept the connection within the existing trust relationship when the admission score of the previous step meets the standard and the manufacturing period binding digest and signature verification are consistent, thereby maintaining the appearance of being unaddressable.

[0040] The specific concept is to use the admission score, manufacturing period binding summary and certificate chain formed in the previous step as a prerequisite for chain establishment. First, the challenge signature is completed locally on the field device side, and then submitted to the center for verification. Only when the verification is successful will the channel permission variable be set to available, and then the session key derivation will be started.

[0041] The channel permission variable is jointly determined by the access scoring threshold and signature verification. Among them, channel permission variables , is a Boolean variable, and its set of values ​​is A value of 1 indicates that session key derivation is allowed; admission score The meaning is the same as the previous step, it is a non-negative real number, and its value is... Threshold , is a fixed real number, taking values The point configuration is determined by the policy; signature value , is the signature result of the combination of challenge and manufacturing period binding digest by the field equipment, and its value range is the output space of the signature algorithm; manufacturing period binding digest The meaning is the same as the previous step, which is a fixed-length digest; public key , is the public verification key for the corresponding device in the certificate chain, and its value range is the elliptic curve public key set; Verification Operator The verification process based on the national cryptographic signature (SM2 signature verification) ， Receives the signature value, manufacturing period binding digest, and public key, and outputs a boolean value; Indicator function The value is 1 if the condition is true, and 0 if the condition is false.

[0042] When in use, the chain establishment trigger does not rely on central inbound listening, but uses the value of the channel permission variable as the only latch; at the same time, the scoring achievement and signature verification are combined into rigid conditions to eliminate passive exposure surfaces.

[0043] As an example: A pitch control terminal in a wind farm needs to connect to the central control center. Following the instructions, the terminal generates a signature value locally, packages it into a manufacturing-period binding digest, and initiates an outbound request to the central trusted access gateway. The central control center does not respond to public network scan packets, but completes signature verification upon receiving a request packet from a registered address range, sets the channel permission variable to available, and then proceeds to key derivation.

[0044] Furthermore, the "available" channel permission variable only indicates that the channel can be established or not; a session key that does not rely on a fixed key is still required to avoid the associated risks from long-term key leakage. To semantically couple the session key with the creation-period binding digest, both parties generate random variables and synthesize key material, which is then used to derive the session key.

[0045] The field equipment and the central trusted access gateway each generate a one-time random quantity, and the two parties exchange random quantities under the permission state; the random quantities on both sides are concatenated with the manufacturing period binding digest in a fixed order and then input into the key derivation operator to obtain the session key, and then enter the channel encryption and integrity protection.

[0046] The certificate authorizing machine does not directly distribute session keys, but only issues certificates and key indexes, and authorizes the materials and scope required for derivation; the actual session key is jointly derived by the central trusted access gateway and field devices based on random quantities and manufacturing period binding digests, and the certificate authorizing machine provides indexes and leases for auditing and revocation.

[0047] Specifically, a key derivation operator is used to perform calculations on the ternary material, outputting a session key: Among them, session key Fixed-length key material, used for encryption and integrity verification; manufacturing-period binding digest. Used to inject manufacturing-period binding semantics into the session key.

[0048] Key derivation operator The proposed approach employs a two-stage extraction-expansion method, using deterministic and collision-resistant derived functions. The domain is any finite bit string, and the range is a fixed-length bit string. The requirement is to produce statistically independent outputs for different inputs. A two-stage extraction-expansion approach is suggested: the extraction stage uses salt as input material. Expanding stage tag count ; Among them, the salt extraction manufacturing period is bound to the summary Input materials The label is taken as the channel identifier, and the count is taken as a fixed constant.

[0049] Device-side random quantity The random numbers generated locally by the field equipment are in a high-entropy random number space; the random numbers on the central side... The one-time random number generated by the central trusted access gateway has the same value range as... ; The session key is strongly coupled with the manufacturing-time binding digest, so the key cannot be reconstructed even if the random quantity is intercepted; the two-sided random quantity eliminates the bias of the single-point random source, reducing the sensitivity of the derived result to weak one-sided randomness; the key material is used only once, reducing the window for replay and long-term leakage.

[0050] As an example, both the terminal and the central server of the same wind farm generate a one-time random quantity. After the central server sends the random quantity back, both parties concatenate the random quantity with the manufacturing period binding digest in a fixed order and call the key derivation operator to obtain the session key. The terminal then uses this session key to calculate the integrity flag for subsequent handshake fields and heartbeat messages. The central server checks the flags one by one, and the channel is then switched to stable bearer mode.

[0051] If the field device establishes a session directly with the backend real address, the real address and port of the center will be exposed. In order to keep the service without modification and hide the real address, an integrated mechanism of inward mapping and transparent forwarding needs to be established on the trusted access gateway side of the center, so that the field device always faces the virtual addressing plane and the real service is only visible inside the gateway.

[0052] Based on a subset of the device policy, determine the set of services and session directions that the device is allowed to access; map the virtual destination identifier of the field device to the internal real address and port, and perform session persistence and transparent forwarding internally; all return traffic is carried using existing channels, and no inbound listening is opened on the public network side.

[0053] Furthermore, an inward mapping operator is used to map the virtual destination identifier to the real service address: Among them, the actual service address The service address and port pair in the internal network are taken from the central internal address space; Inward mapping operator A deterministic mapping function, with virtual destination identifier as input. The output is the actual service address. It requires that the same input remain unchanged throughout the policy's effective period; and that the virtual destination identifier be... Mapped to the real service address ; It belongs to the set of identifiers defined in the strategy library. It belongs to the internal address space of the center; the identifier-address static bi-target table is issued by the unified policy library, and the trusted access gateway of the center queries and maintains the table entries.

[0054] Virtual destination identifier The service alias used by the field devices is a set of identifiers defined in the unified policy library. The central trusted access gateway does not register domain names with the public network, does not respond to address resolution and probes, and does not accept inbound handshakes; it only reuses the reverse bearer initiated by the field devices within existing trust relationships, using keep-alive and reconnection timings to maintain channel survival; it only accesses backend real services through inward mapping (see operator). (Definition) The real address does not appear on the outside. In use, field devices only perceive the virtual destination identifier and do not access the internal addressing details; all mappings are completed within the central trusted access gateway, and the real address is not leaked; transparent bearer ensures that the business system does not need to modify the protocol stack and address configuration.

[0055] As an example: After the substation acquisition terminal stabilizes the channel, it initiates a session with the virtual identifier telemetry service number one. The central trusted access gateway retrieves the corresponding real service address and port based on a subset of the device policies, establishes a hold-up entry internally, and then transparently forwards the field session to the real service. The returned data is multiplexed back to the terminal via the same channel, and the terminal remains unaware of the real address throughout the entire process.

[0056] Furthermore, even if inbound mapping is completed, unauthorized access, lateral movement, and hidden channels may still occur if fine-grained constraints on inbound sessions are lacking. It is necessary to jointly determine the 5-tuple with application-layer features and a subset of device policies to form executable single-packet and session-level rules.

[0057] The five-tuple elements of the field equipment and the application layer features are used as message feature vectors. The rules are matched against the allowed items in the subset of the device policy; packets that match successfully enter the transparent bearer process, while packets that fail to match are discarded or transferred to the trapping process; the rule matching takes into account the session direction, rate and destination set at the same time to ensure that only the sub-paths authorized by the policy are allowed.

[0058] Among them, the rule-based decision function is used to evaluate the message feature vector. The rule list and a subset of device policies are jointly calculated, and the output is whether to allow the pass: Among them, release judgment Boolean variable, with a set of possible values. When the value is Indicates permission to proceed; message feature vector An ordered vector containing source address, destination address, source port, destination port, protocol, and application layer fields; a resolvable field for network packets; rule list. An ordered set of access control lists and deep packet inspection entries, where the value is a subset of the entire rule set; a subset of device policies. The meaning is the same as the previous step, which refers to the set of policies that take effect on this device;

[0059] Rule-based decision function A deterministic function that requires publicizing its matching order and conflict resolution strategy to ensure unique output under the same input; output is a Boolean value. Input: Message feature vector. (Source address, destination address, source port, destination port, protocol, and application layer fields are all collected and normalized by the packet parser), rule list Device strategy subset First based on filter When candidates are obtained, matching follows the order of explicit rejection first → most specific match first (exact match > prefix match > wildcard match; application layer exact field > pattern match) → for the same priority, the order of loading.

[0060] In use, whether a message is allowed or not is determined solely by the rule-based decision function, and the central trusted access gateway completes pre-screening before transparent bearer operation; lateral probing and unauthorized application layer behaviors are neutralized at the entry point; rules are derived from a subset of device policies to avoid differences in manual configuration.

[0061] As an example, when a data acquisition terminal in the same substation initiates a session with the real service corresponding to the virtual identifier, the request is parsed into a message feature vector containing the source address, destination address, port, and application layer header. The rule determination function matches a subset of the device policy with the rule list, allowing requests that fall within the specified range. If the terminal subsequently attempts to access an unauthorized destination address, the rule determination function rejects the request, discards it, and generates an audit log.

[0062] Step 3: Without interrupting business sessions, enable policies, algorithms, and keys to be orchestrated online and establish a defined linkage with certificate status, session evidence, and bearer rules to ultimately maintain runtime control with minimum necessary permissions.

[0063] As an example: In a field switching window at an oil and gas station, maintenance personnel switch the access policy version of the process monitoring service from the old version to the new version in the unified policy library, and set the gray-scale window from midnight to 1 a.m. on that day.

[0064] Upon receiving the policy update, the central trusted access gateway did not interrupt any established sessions. Instead, it marked the matched sessions as pending negotiation in the session persistence table. After midnight, the gateway first requested a new set of key materials from the certificate authority, and then performed key rolling, rule replacement, and evidence recording for each matched session. The replacement status was visible on the screen as each item was completed without any interruption prompts. If any session's application-layer fingerprint did not match the policy, the system immediately issued a demotion command, retaining only necessary one-way up transmission, blocking management plane access, and writing the corresponding record to the audit.

[0065] The direct whole-package replacement strategy is prone to causing instantaneous rule oscillations and cross-item dependency misordering on the carrier surface. It is necessary to compress the differences between the old and new versions into an executable minimum difference set, and project them onto the carrier surface in a defined order within the grayscale window to ensure that dependencies take priority and are mutually exclusive and not parallel.

[0066] The unified policy library first generates the old policy selection vector and the new policy selection vector, and then performs interpolation under the control of grayscale weights; subsequently, it projects the effective policy selection vector at the current moment into the dependency and mutual exclusion constraint domain; the central trusted access gateway compiles the effective policy selection vector into a rule set based on the session mapping relationship, and distributes it to the bearer plane in an incremental replacement manner.

[0067] To avoid dependency on out-of-order execution, the two policy selection vectors are first interpolated on a unified number axis according to the gray-scale progression ratio. Then, the result is projected onto the feasible region using a constrained projection operator, so that the policy subset at any gray-scale time satisfies the execution order of basic first, then upper layer.

[0068] The unified policy library generates old and new policy selection vectors, performs linear interpolation under grayscale weight control, and then projects them into the dependency domain to obtain the policy selection vector in effect at the current moment. The central trusted access gateway uses this as input to initiate subsequent rule compilation and incremental replacement. Effective strategy selection vector : Values ​​are binary or piecewise binary vectors used to indicate the subset of strategies that should take effect at this moment; constraint projection operator The domain is a vector space, and the range is a feasible set that satisfies dependency and mutual exclusion relationships. Its function is to map the interpolation result to the executable domain and project the interpolated vector onto the feasible set. ; The public approach is as follows: Dependencies are represented by directed acyclic graphs (DAGs) consisting of policy dependencies, and mutual exclusions are represented by mutual exclusion families. The dependency graph is topologically sorted, with positions assigned from bottom to top, and single components are retained based on priority when encountering mutual exclusion families. The execution flow is: topological sorting of the dependency graph → assigning positions from bottom to top to satisfy dependencies → retaining single components based on priority when encountering mutual exclusion families (priority is given by a unified policy library) → producing feasible results. ; Constraint domain : A set of strategies to satisfy the conditions of dependency activation and mutual exclusion without parallelism; grayscale weighting : Range of values This is used to control the proportion of the transition from the old version to the new version; the old version and new version strategy selection vector. , The value is a binary vector, which serves as the anchor points at both ends of the interpolation.

[0069] When in use, the constraint projection ensures that the policy subset at any grayscale moment must satisfy the dependency relationship, avoiding the violation of the order of opening sub-policies before opening the basic policy; through interpolation-projection joint, the large-scale policy replacement is decomposed into stable fine-grained increments, and the bearing surface rules do not fluctuate significantly.

[0070] Furthermore, the strategy spans multiple stages from generation to activation, including transmission, verification, and replacement. Transmission interruptions and replacement failures require recoverability and rollback capabilities.

[0071] The unified policy library maintains a subscription pointer and policy version number for each managed object, with increments organized in the form of version number minus segment offset. The central trusted access gateway and field devices each record subscription pointers, and once the link is interrupted, transmission is restored according to the most recently confirmed segment offset. Pre-compilation and replacement are performed on the bearer plane, and replacement snapshots are generated for rollback in case of anomalies. All replacement actions are associated with and stored as evidence of the policy version number.

[0072] When used, the combination of subscription pointer and segment offset reduces retransmission overhead and improves the stability of cross-regional distribution; pre-compilation and replacement snapshots make the replacement action reversible, the abnormal rollback path is clear, and the impact of human misconfiguration is avoided.

[0073] Furthermore, keys and rules need to be coupled and advanced in time to avoid time-series holes where keys have rolled over while rules remain unchanged. Simultaneously, when certificate status or behavioral evidence is abnormal, a demotion should be triggered immediately, and the session should be placed in a safe window to reduce potential activity. Within the rolling window, the current session key is used as the base point, combined with a rolling random variable to roll forward to the next session key. The rule set is then recompiled using the effective policy selection vector and session mapping matrix to achieve synchronous key-rule replacement. If the certificate status expires or an abnormal fingerprint score is reported by bypass detection, a demotion indicator variable is immediately calculated, and the rules are shrunk according to the minimum set, while the session key is rolled forward to a temporary key.

[0074] Specifically, session key rolling does not change the underlying trust of the handshake layer, but it changes the subsequent encryption and integrity material; the rule set should be recompiled synchronously with the currently effective policy selection vector and session mapping relationship to ensure that the access path is consistent with the key state.

[0075] Within a rolling window, the central trusted access gateway uses a rolling operator to map the current session key and rolling random variable to the key for the next time step for each session. Simultaneously, it feeds the effective policy selection vector and session mapping matrix into the rule compilation operator to generate a new rule set, which is then distributed incrementally on the bearer plane. ; Next moment session key A fixed-length bit string used for encryption and integrity at this moment; Session scroll operator The input consists of the current session key and a rolling random variable; the output is the key for the next time step. Determinism and collision resistance are required. Optionally, the output can be a channel identifier. Among them, rolling random number Collected by a hardware random number generator; the channel identifier is a fixed byte string. Current session key. : Fixed-length bit string, used as input to the rolling chain; rolling random variable High-entropy bit strings are used to eliminate predictability; the effective strategy is to select vectors. The meaning is the same as Formula 1; rule set : The set of entries bound to the new key and ready for distribution. Session mapping matrix A two-dimensional matrix describing the mapping relationship between policy entries and the actual backend services; Rule compilation operator Translate the policy selection-mapping relationship into a deterministic process of access control lists and deep packet inspection entries; Input: Effective policy selection vector Session mapping matrix (Rows correspond to policy entries, columns correspond to actual services, and elements are...) )right Expand the template item by item in the center position, and press... The column selects the real service address, generates an access control list and deep packet inspection entries, and performs conflict resolution; the process is as follows: Expand rule template → Combine with session mapping matrix Select the real service → Generate access control and deep packet inspection entries → Perform conflict resolution consistent with item 8.

[0076] When in use, the synchronous advancement of keys and rules eliminates the inconsistency between new keys and old rules; deterministic rolling and compilation ensure that the results are unique under the same input, and can be audited and verified.

[0077] Furthermore, certificate expiration, fingerprint anomalies, or specific events reported by bypass may indicate that the session has deviated from the trusted path, requiring immediate triggering of demotion and shrinking of bearer rules.

[0078] The central trusted access gateway continuously reads the certificate status indication from the certificate authorizing machine and simultaneously receives abnormal events from bypass controlled decryption. When any triggering condition is met, it calculates the demotion indicator variable and selects a preset demotion strategy and minimum rule set accordingly. It then executes key roll-forwarding to a temporary key and reduces the rule set session by session. Where: weighted indicator variable : Values This is the trigger switch for the downgrade action; certificate status indicator. : Values , This indicates that the license is invalid or has been revoked. Indicates validity; fingerprint scoring : interval This indicates the degree of matching between the inbound message fingerprint and the expected fingerprint; fingerprint cutoff boundary. : interval This represents the minimum acceptable match; anomaly event identifier. : A set of tags derived from bypass-controlled decryption and behavior tracking; a set of anomalous events. : A set of abnormal events that trigger a weight reduction; logical AND operator : Boolean or operator, indicating that the condition is triggered immediately upon its fulfillment.

[0079] When in use, invalid credentials, abnormal content, and abnormal behavior are listed as trigger sources to cover typical risk areas; the session activity space is quickly reduced by using the minimum rule set and temporary keys to reduce the propagation path of anomalies.

[0080] Step 4: Transform the encrypted, invisible production chain into a resolvable, auditable, and disposable governance chain, while ensuring that all decryption and disposal actions are performed within the authorized boundaries of the certificate authority domain, and use structured evidence to drive the convergence of constraints on policies and keys during runtime.

[0081] As an example: At a municipal pumping station renovation site, the network administrator enables port mirroring on the aggregation switching equipment, mirroring the traffic from the field to the central trusted access gateway to a dedicated bypass collector. The collector sends the captured packets to a dedicated decryption module. The dedicated decryption module requests a decryption lease from the certificate authority for the pumping station A-central trusted access gateway. The lease time window is from midnight to 1 a.m., covering only sessions for process monitoring services. After the lease is approved, the dedicated decryption module obtains the session key index from the certificate authority and decrypts the hit session, parsing the application layer fields and session sequence. The behavior tracking unit marks the Internet control message covert transmission event accordingly. The processing engine downgrades the involved field device to an upload-only state and sends the evidence back to the policy decision point. The policy decision point then issues isolation rules at the policy execution point. The isolation action is displayed on the screen as destination set shrinking and management plane access closed.

[0082] Intra-link decryption in the production link changes the path and latency, and introduces a single point of failure. The bypass method can recover the message sequence without changing the path, but recovery alone is not enough to form traceable evidence. Controlled decryption and trusted session reassembly are also required. Therefore, the collection-reassembly-authorization-decryption chain must be linked into a single chain, and the authorization boundary must be anchored in the Certificate Authority domain.

[0083] The packet transport interface is mirrored on the switching or splitter equipment to the bypass collector; the bypass collector marks each packet with a timestamp and direction, and reassembles it into a session set according to the five-tuple and handshake characteristics; the dedicated decryption module performs controlled decryption of the session according to the decryption lease; after decryption, the session sequence and application layer fields are output, providing input for subsequent behavior tracking and event generation. The authorized session set, authorized time period, accessible field set, and revocation conditions are included; the certificate authorizing machine returns a key index set and signature ticket, which the dedicated decryption module uses to retrieve and decrypt the key material within the authorization window according to the index. This boundary is consistent with the linkage between step three (demotion trigger - certificate status change).

[0084] A message sequence is constructed using the message-time-direction-five-tuple as the smallest observation unit, and discrete messages are aggregated into a set of resolvable sessions using a session reassembly operator. To avoid erroneous reassembly caused by out-of-order messages across links, the reassembly process is constrained by the synchronization order of timestamp, sequence number, and handshake flag.

[0085] On the bypass collector, each packet stream from the mirror ingress is labeled with its timestamp and direction. Primary buckets are then created based on the five-tuple elements: source address, destination address, source port, destination port, and protocol. Subsequently, within each bucket, packets are reassembled into a session set according to handshake flags and sequence numbers. The output of this set serves as the input for controlled decryption. Where: Session set : An ordered set of sessions to be decrypted and analyzed, where each element is a single session; Session reorganization operator The input is a sequence of message, timestamp, and direction triples; the output is a set of sessions. The requirement is that the reassembled result is unique under the same input. Also, mirror the message triple sequence. Reassemble into a session set, bucket it according to the five-tuple, use timestamps and handshake flags for sequence alignment, and output a unique session sequence; the rules are as follows: primary bucketing by five-tuples → alignment within the bucket based on timestamp monotonicity, handshake flags and sequence numbers → close the session with window timeout, support retransmission and deduplication, and output the session sequence.

[0086] Feature Field Set : No. A message's characteristic field set includes at least the source address, destination address, source port, destination port, and protocol number, used to distinguish different connections; among which the subscript... The message sequence number ranges from 1 to the total number of messages collected so far; the timestamp is also included. : No. The timestamp of each message takes a monotonically increasing value in the time domain; direction marker. : No. The direction marker of the message has a set of values. , respectively representing the connection from the field device to the central trusted access gateway and the connection from the central trusted access gateway to the field device.

[0087] When in use, the message sequence is transformed into a session set by an explicit session reassembly operator, ensuring that all subsequent analysis is performed at the session granularity; the combined constraints of timestamp and direction reduce the errors and omissions caused by out-of-order processing, making the controlled decryption input stable and reliable.

[0088] Decryption permission is granted by combining three conditions: lease time window, key index set, and policy consistency, to prevent session keys from being used without authorization at any time and within any scope.

[0089] The dedicated decryption module first submits a lease request to the certificate authority, which includes a time window, session identifier range, and policy consistency proof. After verification by the certificate authority, it returns a key index set. The dedicated decryption module calculates the lease permission variable for each reconstructed session; if the permission is true, it retrieves the session key from the certificate authority by index and performs decryption. Where: Lease date indication variable : in timestamp The lease license variable at the location has a set of values. This is the determination of whether decryption is allowed; lease start time, lease end time. The lease start and end times are taken as the two endpoints on the timeline, satisfying the following conditions: Session key index corresponding to the time point : in timestamp The corresponding session key index takes the value of the key index space; the set of allowed key indices. The certificate authorizing machine returns a set of allowed key indices, which are subsets of the key index space; the effective policy selection vector. : Effective policy selection vector, with the same meaning as before, is a set of effective policy selection results determined by the unified policy library at the current moment after grayscale and constraint projection, which determines which access control rules and audit rules are currently enabled; Effective rule set The rule set, derived from the access control list and deep packet inspection entries compiled by the effective policy selection vector at the central trusted access gateway, represents the specific set of rules actually implemented; the policy and rule consistency indicator function. : Determine whether there is a consistent relationship between the current effective policy selection vector and the current effective rule set, that is, whether the executed rule matches the authorized policy version. If they match, set it to 1; otherwise, set it to 0.

[0090] When in use, decryption permission is determined by three conditions, ensuring consistency in time, scope, and policy before decryption can proceed; session keys are accessed in a controlled manner by index, and the decryption boundary is uniformly governed by the certificate authority domain, reducing the risk of key proliferation.

[0091] The decrypted session needs to be mapped to a judgment dimension of whether it exceeds authority, is abnormal, or has a hidden channel, and the judgment should be coupled with the rule set and the selection vector of the effective strategy. To avoid instability caused by subjective thresholds, the consistency of time sequence, field, and path needs to be compressed into a single fingerprint score, and an event set should be generated based on the score and the event dictionary, thereby solidifying the handling action and the backfeed path into a deterministic mapping.

[0092] For each session, a fingerprint score is calculated and compared with a threshold. At the same time, an abnormal event set is generated by matching the event dictionary. The handling engine selects a set of handling actions based on the abnormal event set and the effective policy selection vector. After the handling is completed, the evidence, actions and related state variables are packaged into audit records and fed back into the unified policy library and certificate authorization machine.

[0093] The session's timing consistency, application layer field consistency, and path consistency are compressed into [a specific value] using an activation function. The fingerprint score for each interval is compared with a threshold; then, the score, features, and rule hits are mapped to a set of anomalous events using an event dictionary.

[0094] Within the fingerprint analyzer, session sequences are mapped to three types of consistency indicators, then weighted fusion and activation function compression are used to generate fingerprint scores. Finally, a set of anomalous events is generated based on the scores and the event dictionary. ; ; Normalized fingerprint components Examples include request method sequence stability, header field length distribution consistency, round-trip ratio, and response code trajectory stability, within a given range. , by conversation Obtained through analysis; weight parameters Versioned storage for a unified policy library; Fingerprint scoring : interval is , indicating consistency with the desired pattern; activation function The domain is the field of real numbers, and the range is... Using exponential monotonicity Shape mapping, parameters Versioned storage is performed in a unified policy repository; Weighting coefficient : interval is This is used to express the relative importance of the three types of consistency, satisfying... Time series consistency index : Values It is constructed from the time interval and the increasing sequence of session messages; : Values Constructed from the matching degree between application layer fields and rule sets; path consistency index : Values It is constructed by the consistency between the session path and the session mapping matrix.

[0095] When in use, multidimensional consistency is compressed into a single score, which facilitates joint decision-making with thresholds and event dictionaries; the score space is consistent with the rule set and the effective strategy selection vector to reduce false positives and false negatives.

[0096] The abnormal event set and the effective policy selection vector are projected into a set of handling actions, and the evidence is packaged and fed back to the policy decision point and certificate authorization machine to form a second layer of constraints at the policy and certificate lifecycle level.

[0097] The handling engine reads the set of abnormal events and the selection vector of effective policies, and selects the set of handling actions (such as blocking, isolation, trapping and demotion) in the order of explicit denial priority and most specific match priority. After the handling is executed, an audit record is generated, which includes session identifier, handling action, relevant rule entries and session key index, and the record and abnormal event set are fed back to the unified policy library and certificate authorization machine.

[0098] When in use, the actions are derived from both event and policy constraints, eliminating arbitrariness and ensuring verifiability; the audit records and backfeed paths are fixed, the evidence chain is complete, and it is easy for subsequent gray-scale and key rolling to converge synchronously at the policy and certificate layers.

[0099] Timing consistency metrics are used to characterize whether the arrangement of messages within the same session on the timeline conforms to an expected pattern. Specifically, after a session is reconstructed through bypassing, it is first sorted by timestamp, and the chronological order of handshake messages, request messages, and response messages, as well as the time interval sequence between adjacent messages, is calculated. This time interval sequence is then compared with a reference time interval distribution pre-extracted for this type of service, for example, checking for abnormally dense bursts of intervals, long pauses, or order reversals. Based on the order accuracy and the proportion of time intervals falling within the reference range, the results are normalized to a range of 0 to 1: the closer to 1, the closer the message timing rhythm and order are to normal samples; the closer to 0, the more likely there are out-of-order messages, replays, or abnormal pauses.

[0100] The field consistency metric focuses on whether the application-layer fields of each message within the same session are consistent with the rule set and business semantics. During calculation, key fields are first parsed based on the protocol type. For example, in Hypertext Transfer Protocol (HTTP), this includes extracting the method, path, hostname, header field set, and partial payload digest; in Industrial Control Protocol (ICP), it includes extracting the function code, register address range, and collection point number. These fields are then compared item by item with predefined field templates for this type of session in the unified policy library. This checks for missing fields, values ​​outside the authorized range, and abnormal combinations (e.g., low-privilege terminals accessing high-sensitivity paths, mismatches between status and command fields). Finally, the results are mapped to a 0-1 range based on the proportion of matching fields to the total number of checked fields, or a weighted proportion. Higher values ​​indicate that the field content and combinations are more consistent with the allowed form for the terminal and service under the current policy.

[0101] Path consistency metrics primarily describe whether the session's path at the network and service levels aligns with the paths defined by the unified policy library and session mapping matrix. Firstly, at the network level, based on session persistence information recorded by the central trusted access gateway and the internal forwarding table, it checks whether the session consistently forwards between allowed ingress and egress interfaces, whether it flows within authorized virtual LANs and address ranges, and whether abnormal paths such as cross-network segment jumps or gateway bypasses occur. Secondly, at the service level, combining the mapping relationship between virtual destination identifiers and real services in the session mapping matrix, it checks whether the session's destination identifier, real service address, and port remain consistent, and whether it is forwarded to a service instance that does not match the terminal's role or is inconsistent with the policy subset. Based on the above checks, the proportion of hops conforming to the expected path and the proportion of session segments without abnormal jumps are normalized to a range of 0 to 1. Higher values ​​indicate a closer alignment between the session's network and service paths and the pre-authorized mapping relationship.

[0102] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0103] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0104] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0105] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0106] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A trusted access method for field devices based on a non-addressable stealth gateway, characterized in that, include: During the manufacturing phase, a private trusted channel is established between the field equipment and the certificate authorization machine, and the equipment identity elements of the field equipment are registered to the certificate authorization machine through the private trusted channel. When an external device first connects, it submits a measurement to the trusted platform module. The policy decision point determines the access status of the external device as allow, isolate, or deny. The policy execution point implements the access status and selects and issues a subset of policies for the external device based on the determination result from the unified policy library. The central trusted access gateway located at the center adopts a network address-free transparent transmission proxy mode. The external device initiates a connection to the central trusted access gateway and submits a challenge signature completed locally by the external device. The central trusted access gateway uses the public key corresponding to the external device in the certificate chain to verify the challenge signature and determines whether the admission score formed by the trusted platform module metric when the external device first accesses the network reaches the threshold configured by the policy decision point. After the challenge signature is verified and the admission score reaches the threshold, an end-to-end trusted channel is established with the external device. The central trusted access gateway implements inward protection and isolation for the real backend services, and performs transparent forwarding and inbound pre-screening based on the aforementioned policy subset; Within the end-to-end trusted channel, the unified policy library performs incremental and canary updates on policies, algorithms, and keys, and these updates are linked to the certificate lifecycle. The central trusted access gateway compiles the updates into access control list entries and deep packet inspection entries, and without interrupting established sessions, it only replaces the entries in the current set of effective rules executed by the central trusted access gateway that correspond to the differences between the policy versions before and after the update with the corresponding compiled entries, thus making the updates effective. Without changing the bearer path between the field equipment and the central trusted access gateway, the traffic on the bearer port through which the bearer path passes is bypassed and mirrored to obtain the bearer port traffic; A dedicated decryption module authorized by a certificate authority performs controlled decryption of the sessions in the bearer traffic, and performs behavior tracking on the decrypted sessions. The abnormal results obtained from the behavior tracking are fed back to the policy decision point and the policy execution point to adjust or revoke the policy.

2. The trusted access method for field devices based on an unaddressable stealth gateway according to claim 1, characterized in that: During the manufacturing phase, the certificate authorization machine connects the firmware digest of the field device with the trusted platform module metric and performs a hash operation on the connection result to generate a manufacturing phase binding digest, which is then written into the public key certificate extension field of the field device. Upon initial access, the policy decision point makes a decision based on the comparison between the manufacturing phase binding digest and the metric evidence reported by the field device, and the policy enforcement point places the field device in a virtual LAN isolation zone or allows it to pass based on the decision result.

3. The trusted access method for field devices based on an unaddressable stealth gateway according to claim 2, characterized in that: The unified policy library uses role-based access control and attribute-based access control to jointly model and describe subjects, objects, actions and contexts with structured data. Policies are distributed to field devices and central trusted access gateways through signature verification, breakpoint resume and version identification management, and are associated with the access status.

4. The trusted access method for field devices based on an unaddressable stealth gateway according to claim 3, characterized in that: The central trusted access gateway does not register domain names on the public network and does not respond to inbound handshakes; the challenge signature is a signature made by the field device on the combination of the challenge and the manufacturing period binding digest, and the central trusted access gateway verifies the challenge signature based on the public key and the manufacturing period binding digest; the central trusted access gateway enters the channel permission state and establishes an end-to-end trusted channel only when the field device initiates an outbound connection to the address range permitted by the policy subset, and the challenge signature is verified and the admission score reaches the threshold.

5. The trusted access method for field devices based on an unaddressable stealth gateway according to claim 4, characterized in that: The field equipment and the central trusted access gateway each generate a one-time random quantity, and combine it with the manufacturing period binding digest to derive the session key; then the central trusted access gateway maps the virtual destination identifier to the backend real service address according to the policy subset, establishes session persistence and performs transparent forwarding.

6. The trusted access method for field devices based on an unaddressable stealth gateway according to claim 5, characterized in that: Inbound pre-screening includes: the central trusted access gateway compiles access control lists and deep packet inspection entries based on policy subsets, matches the five-tuples and application layer fields of the uplink packets of external field devices one by one, and does not allow passage if any allowed entry is not matched and generates an audit record associated with the session.

7. The trusted access method for field devices based on an unaddressable stealth gateway according to claim 6, characterized in that: Within the end-to-end trusted channel, a unified policy library generates a policy version sequence based on a grayscale window. The central trusted access gateway pre-compiles the updates and generates replacement snapshots. The replacements are executed on the corresponding entries in the set of effective rules according to the policy dependency order, and this is linked with certificate revocation and online status verification.

8. The trusted access method for field devices based on an unaddressable stealth gateway according to claim 7, characterized in that: Within the scrolling window, each session key is scrolled forward sequentially and the corresponding rule set is issued synchronously. When the certificate authority indicates that the certificate status is invalid or an abnormal bypass behavior fingerprint is reported, the policy decision point issues a demotion instruction, and the policy execution point shrinks the access scope accordingly.

9. The trusted access method for field devices based on a non-addressable stealth gateway according to claim 8, characterized in that: The traffic on the bearer port is obtained in a bypass manner through port mirroring of the switching equipment or through a splitter; the dedicated decryption module requests a decryption lease from the certificate authority, the lease limits the time window, session range and accessible fields, and performs controlled decryption on the matched session according to the session key index.

10. The trusted access method for field devices based on a non-addressable stealth gateway according to claim 9, characterized in that: The fingerprint score is generated based on the decrypted session and matched with the event dictionary to form an event set; the processing engine combines the processing action with the session identifier, relevant rule entries and session key index to form an audit record, which is fed back to the policy decision point and certificate authorization machine for subsequent governance.

Images