Cryptographic security management method applied to industrial security

Abstract

The application is a password security management method applied to industrial safety, and relates to the technical field of industrial control system safety, which comprises: deploying password strategies in batches in a laid controlled simulation environment, triggering test case execution according to priority, monitoring system response data to obtain test results; wherein the execution success rate obtained in the test case execution process needs to be judged whether correct or not by analyzing the verification error coefficient obtained. In the application, an isolated simulation test platform highly consistent with the real production environment is built, the HMI / operator station, PLC / DCS controller and industrial network structure are accurately copied by combining with the digital twin technology, the test process is completely isolated from the production environment, and the serious consequences such as the interruption of the automation process and the shutdown of the production line caused by the password strategy change test are avoided from the root.

Description

Technical Field

[0001] This invention relates to the field of industrial control system security technology, and in particular to a cryptographic security management method applied to industrial security. Background Technology

[0002] As the core infrastructure of industrial production, industrial control systems need to operate continuously 24 hours a day, and their stability is directly related to production safety and efficiency.

[0003] In industrial control systems, in addition to operator accounts, a large number of service accounts and machine accounts support key automated processes such as data acquisition, instruction transmission, and report generation. Updating and iterating password policies is a necessary means to ensure system security. However, deploying new policies directly in the production environment may lead to the interruption of automated processes that have not been updated in time, resulting in serious consequences such as production line stoppages, data loss, and quality accidents. Therefore, industrial systems have an extremely low tolerance for trial and error in password policy changes.

[0004] Existing testing methods are mostly designed for general IT environments and are not fully adapted to the special characteristics of industrial systems. They are difficult to replicate the device interaction logic and automated process dependencies of industrial control networks, resulting in test results that cannot be effectively transferred to the production environment.

[0005] Meanwhile, the effectiveness of test cases lacks a scientific verification mechanism, making it difficult to ensure the comprehensiveness of test coverage and the authenticity of results. Furthermore, it is impossible to accurately locate compatibility issues and the scope of impact caused by changes in cryptographic policies, and there is a lack of targeted remediation guidance, ultimately leading to uncontrollable risks in policy deployment.

[0006] Therefore, a cryptographic security management method for industrial security is proposed to address the above problems. Summary of the Invention

[0007] The purpose of this invention is to propose a cryptographic security management method for industrial security in order to solve the above-mentioned problems.

[0008] To achieve the above objectives, the present invention adopts the following technical solution:

[0009] Cryptographic security management methods applied to industrial security include:

[0010] Build an isolated simulation testing platform that corresponds to the real production environment;

[0011] Deploy the password policy to be tested, and generate test cases covering real-world scenarios through traffic mirroring, script recording, and template library;

[0012] In a controlled simulation environment, cryptographic strategies are deployed in batches, test cases are triggered according to priority, and system response data is monitored to obtain test results. During the execution of test cases, the success rate is determined by analyzing the obtained verification error coefficient to verify its accuracy.

[0013] Analyze test data to determine compliance and compatibility, pinpoint the root cause of problems, assess the scope of impact, and automatically generate targeted remediation suggestions and comprehensive test reports.

[0014] Preferably, the construction of the isolation simulation test platform corresponding to the real production environment specifically includes:

[0015] By configuring the target IP network segment and subnet mask, the scanning range is limited to industrial control networks;

[0016] The scan results are matched against the fields of the data imported from the asset management system and CMDB.

[0017] Create a virtual machine and restore the system based on snapshot files from the production environment HMI to restore disk partition structure, registry configuration, and driver versions;

[0018] Use a hash verification tool to verify the consistency of critical files in the cloned system with the production environment.

[0019] Manually configure the virtual machine IP address, subnet mask, gateway, and DNS to ensure consistency with the production environment HMI network parameters; replicate the VLAN ID, VLAN name, and trunk link configuration of the production network, and configure static routes or OSPF routing protocol.

[0020] Import the security policies of the production environment into the simulated firewall, including source and destination addresses, service ports, actions, and logging status;

[0021] Simulate the latency and packet loss rate of an industrial network;

[0022] Scan the authentication port of the simulated component; verify that the port is open. Write a test tool to send standard protocol requests to the authentication port.

[0023] Preferably, the deployment of the password policy to be tested, and the generation of test cases covering real-world scenarios through traffic mirroring, script recording, and template libraries, specifically includes:

[0024] The graphical interface provides a web-based management interface;

[0025] The configuration policy also includes support for custom password complexity settings, password management settings, and account security management settings;

[0026] The system has a built-in policy conflict rule library. When the configured policy items conflict with each other, the system will automatically pop up a window to indicate the conflict points and provide modification suggestions.

[0027] Preferably, the method further includes the generation and recording of automated test cases:

[0028] Configure port mirroring on the core switches of the production network to mirror authentication-related traffic to the collection server; retain authentication protocol traffic, store it as a pcap format file, and name it by timestamp;

[0029] Replay the pcap file in the simulation environment, and configure the playback rate and number of replays;

[0030] The administrator logs into the policy management platform, enters the script recording module, inputs the recording name, target device IP, and recording duration, and clicks start recording;

[0031] Capture all network requests, system calls, and process start / termination events when administrators execute automated processes in a production environment;

[0032] After recording is complete, convert the captured behavior into a Python or Shell script;

[0033] The recorded script is executed in the simulation environment to verify that the script can completely reproduce the original process. The execution success rate must reach the preset standard, and the obtained execution success rate also completes self-verification. That is, the execution success rate is judged by analyzing the obtained verification error coefficient. Otherwise, the failure node is prompted and re-recording is allowed.

[0034] Preferably, the process of obtaining the verification error coefficient includes:

[0035] Extract the timestamp sequence of script execution, including the start and end times of each step, and record them as the single-step start time and single-step end time, respectively;

[0036] And the actual start time and actual end time corresponding to the production environment;

[0037] Calculate the time difference between the start time of a single step and the start time of the actual step to obtain the start deviation duration; calculate the time difference between the end time of a single step and the end time of the actual step to obtain the end deviation duration.

[0038] The total duration of a single-step deviation is obtained by summing the start deviation duration and the end deviation duration.

[0039] Get the duration between the start time and end time of a single step, and record it as the duration of the single step process; get the duration between the start time and end time of a real step, and record it as the duration of the real step process.

[0040] The time difference between the duration of a single step process and the actual duration of the process step is recorded as the process time deviation.

[0041] The total duration of the single-step deviation and the process time deviation are respectively used as the base and the height perpendicular to the base of the triangle. After constructing the triangle, the area of ​​the triangle is calculated and recorded as the initial error coefficient.

[0042] Obtain the initial error coefficients corresponding to each step during script execution, and sort them in descending order of their values ​​to obtain a descending set of initial error coefficients;

[0043] The three largest initial error coefficients are extracted from the set, and the mean is calculated to obtain the verification error coefficients.

[0044] The verification error coefficient is matched with the corresponding decay rate. The obtained execution success rate is subtracted from the decay rate. If the obtained execution success rate still meets the preset execution success rate requirement, then the execution success rate is self-verified.

[0045] Preferably, the step of deploying cryptographic strategies in batches within a controlled simulation environment, triggering test cases according to priority, and monitoring system response data to obtain test results specifically includes:

[0046] In the policy management server simulation version, create a test domain and add all simulated devices and virtual machines in the simulation environment to the test domain, ensuring that the devices are connected to the domain controller network.

[0047] Deploy in batches according to equipment type, prioritizing non-core equipment, and then deploying core control equipment;

[0048] After deployment, the system automatically logs into each device, verifies whether the policy has been successfully applied via command line, generates a deployment verification report, and marks devices that failed to apply the policy and the reasons therefor.

[0049] Preferably, the method further includes triggering the test execution:

[0050] Test case scheduling configuration: Supports prioritizing test cases, with higher priority cases executed first; supports parallel execution;

[0051] Execution triggering methods: Supports manual triggering, timed triggering, and event triggering;

[0052] When a test case fails to execute, the system automatically analyzes the reason for the failure. If it is a temporary problem, it automatically retryes the execution; if it is a permanent problem, it stops retrying and marks the failure status.

[0053] It displays the execution status of test cases in real time, showing the number of executed test cases, the number of remaining test cases, and the success rate. It also supports manually pausing / resumpting test execution.

[0054] Preferably, the method also includes comprehensive monitoring and data acquisition:

[0055] Logs were collected and key fields were extracted.

[0056] Configure packet capture ports on the core routers and switches of the simulated network, set packet capture filtering rules, and split the packet capture files by hour;

[0057] Parse the packet capture file to extract the protocol type, source port, destination port, sequence number, acknowledgment number, username, password encryption method, authentication result, and response time;

[0058] Performance monitoring includes monitoring response time, error rate, and resource utilization;

[0059] Install a monitoring agent on the simulation equipment to collect performance metrics in real time.

[0060] Preferably, the analysis of test data is used to determine compliance and compatibility, locate the root cause of problems, assess the scope of impact, and automatically generate targeted remediation suggestions and a comprehensive test report with visualization elements, specifically including:

[0061] Built-in compliance checklist; supports custom compliance rules, and administrators can add internal enterprise password management standards;

[0062] For each account, verify whether it meets all compliance rules one by one. If all rules are met, it is deemed compliant; otherwise, it is deemed non-compliant, and the specific non-compliant items are marked.

[0063] Set compatibility grading standards; conduct correlation analysis on root cause localization and impact scope assessment from time, account, device, and protocol dimensions; classify failure root causes, with each category containing specific sub-causes;

[0064] The quantitative assessment of the scope of impact analyzes the impact on business, equipment, and accounts.

[0065] Dependency relationships are generated by using nodes to represent devices / systems and lines to represent dependencies in a topology graph. Problematic nodes and their dependency paths are highlighted, and the scope of impact is marked.

[0066] Preferably, the method further includes:

[0067] Based on the root cause analysis results and the built-in remediation solution knowledge base, corresponding remediation suggestions are matched to ensure that the suggestions are targeted and actionable.

[0068] The remediation recommendations are analyzed from the perspectives of account, device, software, and policy:

[0069] Sorted by urgency of repair, with high-priority items displayed first, and the time, resources, and technical difficulty required for repair noted.

[0070] For each suggestion, predict its effects after implementation to help administrators make decisions; and generate a comprehensive test report.

[0071] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are:

[0072] 1. This invention establishes an isolated simulation test platform that is highly consistent with the real production environment. By combining digital twin technology, it accurately replicates the HMI / operator station, PLC / DCS controller and industrial network structure, completely isolating the test process from the production environment. This fundamentally avoids serious consequences such as automation process interruption and production line stoppage that may be caused by password policy change testing.

[0073] 2. This invention automates test case generation through traffic mirroring, script recording, and a template library. Combined with a self-verification mechanism for execution success rate, it ensures the comprehensiveness, authenticity, and effectiveness of test cases, significantly reducing the cost of manual writing and verification. Priority scheduling, parallel execution, and failure retry mechanisms during the test execution phase further improve testing efficiency. In the results analysis stage, multi-dimensional correlation analysis enables precise location of the root cause of problems, and hierarchical and categorized remediation suggestions and visualized comprehensive reports provide clear guidance for rectification and reduce the difficulty of problem solving. Attached Figure Description

[0074] Further details, features, and advantages of this application are disclosed in the following description of exemplary embodiments in conjunction with the accompanying drawings, in which:

[0075] Figure 1 This is a flowchart of the method of the present invention. Detailed Implementation

[0076] Several embodiments of this application will now be described in more detail with reference to the accompanying drawings to enable those skilled in the art to implement this application. This application may be embodied in many different forms and for various purposes and should not be limited to the embodiments set forth herein. These embodiments are provided to make this application thorough and complete, and to fully convey the scope of this application to those skilled in the art. The embodiments described do not limit this application.

[0077] Unless otherwise defined, all terms used herein (including technical and scientific terms) shall have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains. It will be further understood that terms such as those defined in commonly used dictionaries shall be interpreted as having a meaning consistent with their meaning in the relevant field and / or the context of this specification, and shall not be interpreted in an idealized or overly formal sense unless expressly defined herein. Example

[0078] Its specific implementation method is combined with the appendix Figure 1 Please provide a detailed explanation.

[0079] Appendix Figure 1 The flowchart of the cryptographic security management method for industrial security provided in this embodiment of the invention illustrates the complete steps from building an isolated simulation test platform corresponding to the real production environment to automatically generating targeted repair suggestions and comprehensive test reports.

[0080] In this embodiment, it includes:

[0081] Build an isolated simulation test platform that corresponds to the real production environment to provide real-world scenario support for subsequent testing and ensure the validity and transferability of test results;

[0082] Specifically, it includes:

[0083] By configuring the target IP network segment and subnet mask, the scanning scope is limited to industrial control networks, avoiding scanning of unrelated office networks;

[0084] Scanning methods include active probing using ICMPping and TCPSYN scanning (to avoid full-connection scanning from interfering with production equipment), and passive listening by capturing device communication packets through mirroring industrial switch ports.

[0085] The scan results are matched with the data imported from the asset management system and CMDB (using the device IP and hostname as unique identifiers), and duplicate entries are automatically removed and missing fields are added (such as the production line to which the device belongs and the contact information of the person in charge).

[0086] CMDB stands for Configuration Management Database. Its core function is to store detailed information about IT assets (such as devices, software, and network components) and the dependencies between assets, providing unified data support for IT management and decision-making.

[0087] The manifest export supports multiple formats such as CSV, JSON, and Excel. Fields include device IP address, hostname, MAC address, device type, model, firmware version, operating system version, installed software list, network partition, authentication protocol type, and responsible person information.

[0088] Legacy device identification rules: The built-in industrial equipment compatibility database contains authentication capability parameters for common industrial equipment models. By comparing the device model and firmware version, legacy devices that do not support SHA-256 encryption, have password length restrictions of ≤8 bits, etc., are marked.

[0089] Scan access control: Scanning operations are performed using read-only accounts, and the scanning frequency is configurable (once a week by default) to avoid high-frequency scanning consuming network bandwidth.

[0090] The process of establishing a digital twin model includes:

[0091] HMI / Operator Station Modeling:

[0092] Create virtual machines using VMware vSphere or Hyper-V, restore the system based on snapshot files from the production environment HMI, and restore disk partition structure, registry configuration, and driver versions;

[0093] Use a hash verification tool to verify the consistency of critical files (such as configuration software executable files and project configuration files) of the cloned system with the production environment. The verification pass rate must reach the preset standard.

[0094] Manually configure the virtual machine's IP address, subnet mask, gateway, and DNS to ensure they match the production environment HMI network parameters, and disable unnecessary network services;

[0095] PLC / DCS controller modeling:

[0096] Hardware simulator configuration: For Siemens S7 series PLCs, use S7-PLCSIMAdvanced to create a virtual controller that matches the production PLC model, import the PLC program (.awl format) from the production environment, and configure parameters such as CPU model, memory size, and number of I / O modules.

[0097] Stub module development standard: For older PLCs that cannot be simulated, stub modules are developed using C++. Based on the TCP / IP protocol, the PLC authentication interface is simulated, supporting the receipt of login requests, parsing of usernames and passwords, and returning preset responses (success / failure). The response delay is controlled to be consistent with that of a real PLC.

[0098] Program logic consistency: Virtual controllers or stub modules must replicate the authentication logic of the production PLC, including password storage encryption methods (such as AES-256) and login permission verification rules (such as administrator / operator permission differentiation).

[0099] Network structure modeling:

[0100] VLAN and routing configuration: In Cisco IOS or Huawei VRP systems, replicate the VLAN ID, VLAN name, and trunk link configuration of the production network, and configure static routes or OSPF routing protocols to ensure that the network topology of the simulation environment is consistent with that of the production environment;

[0101] Firewall and ACL rules: Import the security policies of the production environment into the simulated firewall, including source and destination addresses, service ports, actions (allow / deny), and logging status, to ensure that network access control during testing is consistent with the production environment;

[0102] Network latency simulation: Using the NetEm tool, the latency and packet loss rate of industrial networks are simulated to reproduce the real transmission characteristics of production networks;

[0103] Interface status detection: Use the Nmap tool to scan the authentication port of the simulated component to verify that the port is open, and rule out the possibility that the port is blocked by the firewall or the service is not started;

[0104] Interface compatibility verification: Write a test tool using Socket programming to send standard protocol requests to the authentication port and verify that the interface can correctly return response messages;

[0105] Multi-protocol support: Supports common authentication interfaces in industrial scenarios, including RDP (port 3389), SSH (port 22), Telnet (port 23), database ports (MySQL 3306, SQL Server 1433), PLC dedicated ports (Siemens 102 port, Modbus 502 port), and OPCUA ports (4840 / 4841).

[0106] Deploy the password policy to be tested, and generate test cases covering real-world scenarios through traffic mirroring, script recording, and template libraries to ensure the comprehensiveness, relevance, and repeatability of the tests. During the execution of the test cases, the success rate obtained needs to be analyzed to determine whether the success rate is correct.

[0107] Specifically, it includes:

[0108] The graphical interface provides a web-based management interface that supports drag-and-drop configuration of policies and real-time preview of policy effects. It includes fields such as policy name, scope of application, effective time, configuration items, and remarks.

[0109] The configuration policy also includes support for custom password complexity settings, password management settings, and account security management settings;

[0110] Password complexity: Supports custom character sets, prohibits consecutive repeated characters, and prohibits keyboard sequences;

[0111] Password management: Supports minimum password expiration time (e.g., 1 day to prevent frequent password changes), password reset reminders (7 days before expiration via email / SMS), and a limit on the number of password history records (configurable from 1 to 20).

[0112] Account security: Supports account lockout time (configurable from 1 to 1440 minutes), unlocking method after lockout (manual unlock / automatic unlock), and dormancy of idle accounts (such as automatic dormancy after 90 days of inactivity).

[0113] The system has a built-in policy conflict rule library. When the configured policy items contradict each other (such as setting the maximum password validity period to 90 days and the password to be permanently valid at the same time), the system will automatically pop up a window to indicate the conflict point and provide modification suggestions.

[0114] It also includes the generation and recording of automated test cases:

[0115] Configure port mirroring (SPAN) on the core switch of the production network to mirror authentication-related traffic (such as TCP 3389 and 1433 port traffic) to the data collection server;

[0116] Use Wireshark to filter out irrelevant traffic, keeping only authentication protocol traffic such as Kerberos, LDAP, RDP, and SQL Server, and store it as a pcap file named by timestamp;

[0117] Use the Tcpreplay tool to replay pcap files in a simulation environment. Configure the replay rate (default 1:1 to restore the real traffic rate) and the number of replays (configurable from 1 to 10). Supports replaying a portion of the traffic by time range.

[0118] The administrator logs into the strategy management platform, enters the script recording module, inputs the recording name (such as the database acquisition process for production line B), the target device IP, the recording duration, and clicks start recording;

[0119] Capture all network requests (including TCP connections, UDP packets, and application layer protocol interactions), system calls, and process start / termination events when administrators execute automated processes in a production environment;

[0120] After recording is complete, the system automatically converts the captured behavior into Python or Shell scripts, removes redundant operations (such as repeated mouse clicks), replaces fixed parameters (such as IP address and username) with variables, and supports manual editing of the script to adjust the logic;

[0121] Execute the recorded script in the simulation environment to verify that the script can completely reproduce the original process. The execution success rate must reach the preset standard (the success rate must reach more than 95%). The obtained execution success rate also completes self-verification, that is, the execution success rate is judged by analyzing the obtained verification error coefficient. Otherwise, the failure node is prompted and re-recording is allowed.

[0122] Templated script library:

[0123] Scenario Coverage: Built-in 20+ common industrial automation scenario templates, including OPCDA / UA data acquisition, MES system and PLC communication, scheduled database backup, HMI screen switching, automatic report generation, remote equipment maintenance, etc.

[0124] Template parameter configuration: Each template provides a visual parameter configuration interface. The key parameters that need to be filled in include the target device IP, port number, username, password, operation frequency, data transmission format, expected results, etc.

[0125] Custom script extensions: Allow users to modify script logic based on templates, add custom assertions (such as checking whether the returned data meets the expected format), loop structures, and exception handling mechanisms (such as retrying connection timeout).

[0126] The process of obtaining the verification error coefficients includes:

[0127] Extract the timestamp sequence of script execution, including the start and end times of each step, and record them as the single-step start time and single-step end time, respectively;

[0128] Extract the historical timestamp sequence of the same process as in the production environment, and record the start and end times of each step as the actual step start time and actual step end time;

[0129] The difference between the start time of a single step and the start time of the actual step is calculated, and the absolute value is taken to obtain the start deviation duration.

[0130] The difference between the end time of a single step and the end time of the actual step is calculated, and the absolute value is taken to obtain the end deviation duration.

[0131] The total duration of a single-step deviation is obtained by summing the start deviation duration and the end deviation duration.

[0132] Get the duration between the start time and end time of a single step, and record it as the duration of the single step process;

[0133] Obtain the duration between the start time and end time of the actual step, and record it as the duration of the actual step process;

[0134] The time difference between the duration of a single step process and the actual duration of the process step is recorded as the process time deviation.

[0135] The total duration of the single-step deviation and the process time deviation are respectively used as the base and the height perpendicular to the base of the triangle. After constructing the triangle, the area of ​​the triangle is calculated and recorded as the initial error coefficient.

[0136] Obtain the initial error coefficients corresponding to each step during script execution, and sort them in descending order of their values ​​to obtain a descending set of initial error coefficients;

[0137] Extract the three largest initial error coefficients from the set, calculate their average, and record them as the verification error coefficients;

[0138] The verification error coefficient is matched with the corresponding decay rate. The obtained execution success rate is subtracted from the decay rate. If the obtained execution success rate still meets the preset execution success rate requirement, then the execution success rate is self-verified.

[0139] Matching the verification error coefficients to the corresponding attenuation rates involves the following process:

[0140] Three threshold ranges are preset, and each threshold range corresponds to an attenuation rate. The verification error coefficient is matched with the three threshold ranges to obtain the attenuation rate corresponding to the verification error coefficient.

[0141] The verification logic can comprehensively capture the timing risks of industrial script execution. By simultaneously considering the deviation of step time points (start deviation, end deviation) and the deviation of execution time (process time deviation), and quantifying the combined effect of the two in the form of triangle area, the severity of timing deviation is made more intuitive and perceptible.

[0142] Meanwhile, the average of the three largest initial error coefficients is selected as the verification error coefficient, which not only highlights the deviation weight of key steps, but also avoids the interference of a single extreme value on the overall judgment, so that the error quantification results can better reflect the real time sequence of the industrial process.

[0143] Its constructed verification error coefficient-attenuation rate-success rate standard-reaching process deeply binds the timing consistency performance with the execution success rate, ensuring that the final success rate not only meets the surface numerical standard, but also has adaptability to the production environment.

[0144] It can accurately select effective test cases that conform to the actual industrial production at the time level, providing a reliable premise for the compliance and compatibility testing of subsequent cryptographic strategies, and fully meeting the core requirements of industrial security scenarios for process stability and result authenticity.

[0145] In a controlled simulation environment, cryptographic policies are deployed in batches, test cases are triggered according to priority (including retries on failure), and system response data is monitored to obtain test results.

[0146] Specifically, it includes:

[0147] Create a test domain (e.g., test.industrial.com) in the policy management server simulation version, add all simulated devices and virtual machines in the simulation environment to the test domain, and ensure that the devices are connected to the domain controller network.

[0148] It supports two push modes: manual push (triggered by the administrator clicking "Deploy Now") and scheduled push (configure the deployment time, such as 2 a.m., to avoid peak testing times).

[0149] Deploy in batches according to equipment type, prioritizing non-core equipment (such as report servers) and then core control equipment (such as PLCs and HMIs), with a 30-minute interval between each batch to facilitate monitoring of deployment effectiveness;

[0150] After deployment, the system automatically logs into each device and verifies whether the policy has been successfully applied via command line (such as the gpresult command in Windows or the pam-config command in Linux), generates a deployment verification report, and marks the devices that failed to apply the policy and the reasons (such as network failure or insufficient permissions).

[0151] If a device is detected to be offline during deployment, the system will record the offline time and automatically retry the deployment after the device comes back online. The maximum number of retries is 3. If it still fails, an alarm will be sent to notify the administrator.

[0152] It also includes the triggering of test execution:

[0153] Test case scheduling configuration: Supports sorting test cases by priority (high / medium / low), with high-priority test cases (such as PLC control process testing) being executed first; supports parallel execution (the default maximum is 10 test cases executed simultaneously), and the number of parallel executions can be configured to avoid excessive resource consumption;

[0154] Triggering methods: Supports manual triggering (administrator clicks "Start Test"), scheduled triggering (configure test time), and event triggering (such as automatic triggering after policy deployment).

[0155] When a test case fails to execute, the system automatically analyzes the reason for the failure. If it is a temporary problem such as network fluctuation or service not starting temporarily, it will automatically retry the execution (up to 3 times); if it is a permanent problem such as authentication failure or script error, it will stop retrying and mark the failure status.

[0156] It displays the execution status of test cases in real time (waiting to execute / in execution / success / failure), showing the number of executed test cases, the number of remaining test cases, and the success rate. It also supports manually pausing / resuming test execution.

[0157] It also includes comprehensive monitoring and data collection:

[0158] System log monitoring:

[0159] Log collection tools: Use ELKStack (Elasticsearch, Logstash, Kibana) or Fluentd to collect logs, supporting formats such as Windows EventLog, Linux Syslog, and application-custom logs;

[0160] Log field extraction: Extract key fields from logs, including event time, event ID, event type, username, source IP, destination IP, event description, error code, etc. Standardized log format facilitates analysis;

[0161] Log storage period: 90 days of logs are stored by default, but the storage period can be configured and log files can be exported for backup.

[0162] Network packet capture:

[0163] Packet capture configuration: Configure packet capture ports on the core routers and switches of the simulated network, set packet capture filtering rules (only capture authentication protocol related traffic), and split the packet capture files by hour;

[0164] Packet analysis fields: Use Wireshark to parse the packet capture file and extract fields such as protocol type, source port, destination port, sequence number, acknowledgment number, username, password encryption method, authentication result, and response time;

[0165] Performance monitoring includes:

[0166] Monitoring metric definition:

[0167] Response time: The total time from sending the authentication request to receiving the response, in milliseconds;

[0168] Error rate: The percentage of times an error occurs during test case execution out of the total number of executions;

[0169] Resource utilization: CPU utilization, memory utilization, disk I / O, network bandwidth utilization;

[0170] Install a monitoring agent (such as PrometheusNodeExporter) on the simulation device to collect performance metrics in real time; the collection frequency is configurable.

[0171] Set thresholds for performance metrics (such as a response time threshold of 500ms and a CPU utilization threshold of 80%). When the threshold is exceeded, trigger an alarm and notify the administrator via email or SMS.

[0172] Each test execution is assigned a unique test ID, and all monitoring data (logs, packet capture files, performance metrics) are associated with this test ID, making it easy to query complete data by test ID later.

[0173] All original monitoring data is retained, and the original log files and packet capture files can be downloaded for administrators to perform secondary analysis.

[0174] Analyze test data to determine compliance and compatibility, pinpoint the root cause of problems, assess the scope of impact, and automatically generate targeted remediation suggestions and comprehensive test reports with visualization elements to provide decision-making basis for strategy deployment;

[0175] Specifically, it includes:

[0176] It has a built-in compliance checklist that meets the requirements of standards such as NISTSP800-63B, ISO / IEC27001, and GB / T22239. The checklist includes password length, complexity, validity period, history, and account lockout.

[0177] It supports custom compliance rules, and administrators can add internal password management rules for the enterprise (such as prohibiting the use of the enterprise name or device model as a password).

[0178] For each account, check whether it meets all compliance rules. If all rules are met, it is considered compliant; otherwise, it is considered non-compliant, and the specific non-compliant item is marked (e.g., the password length is only 8 characters, which does not meet the minimum requirement of 12 characters).

[0179] Compatibility analysis dimensions:

[0180] Device hardware compatibility: Check whether the device firmware version supports new password policies (such as whether it supports long passwords and strong encryption algorithms).

[0181] Software compatibility: Check whether the operating system, configuration software, database, etc. can correctly parse and execute the new password policy.

[0182] Protocol compatibility: Check whether the authentication protocol (such as Kerberos, LDAP) is compatible with the new password policy and whether there are any protocol versions that are not supported.

[0183] Compatibility grading standards:

[0184] Level 1 Incompatibility: The device is completely unable to support the new strategy, causing the authentication function to fail (e.g., older PLCs do not support password lengths greater than 8 bits).

[0185] Level 2 Incompatibility: Some devices support the new policy but have functional abnormalities (e.g., support for long passwords but significantly increased response time).

[0186] Level 3 incompatibility: The device supports the new policy, but requires configuration modification or component upgrades (e.g., the operating system needs to be patched).

[0187] Root cause analysis and impact assessment, including correlation analysis from the perspectives of time, account, device, and protocol.

[0188] Time dimension: By correlating logs, packet capture data, and performance metrics within the same time period, we can pinpoint authentication failure issues that occur frequently at a specific moment.

[0189] Account dimension: Analyze the authentication status of the same account on different devices and at different times to determine whether the problem is with the account itself (such as an incorrect password).

[0190] Device dimension: Analyze the authentication results of all accounts on the same device to determine if the issue is a device configuration or compatibility problem.

[0191] Protocol dimension: Analyze all interaction data of the same authentication protocol to determine whether it is due to protocol incompatibility or configuration error.

[0192] Common failure root causes are divided into 6 categories, including non-compliant password, account lockout, device incompatibility, protocol incompatibility, network failure, and software failure. Each category includes specific sub-reasons (such as non-compliant password including insufficient length, insufficient complexity, failure to change expired password, etc.).

[0193] The quantitative assessment of the scope of impact analyzes the impact on business, equipment, and accounts.

[0194] Business impact: Count the number of affected business systems and critical business processes, and assess the level of business interruption risk (high / medium / low).

[0195] Equipment impact: Statistically determine the number and type of equipment affected, and assess the cost of equipment rectification.

[0196] Account impact: Analyze the number of affected accounts, the distribution of account types (operator accounts / service accounts), and assess the workload of account remediation.

[0197] Dependency relationships are generated by using nodes to represent devices / systems and lines to represent dependencies in a topology graph. Problematic nodes and their dependency paths are highlighted, and the scope of impact is marked.

[0198] Automatic generation of repair suggestions:

[0199] Based on the root cause analysis results and the built-in remediation solution knowledge base, corresponding remediation suggestions are matched to ensure that the suggestions are targeted and actionable.

[0200] The remediation recommendations are analyzed from the perspectives of account, device, software, and policy:

[0201] At the account level: such as changing the password for the svc_data account, ensure that the length is ≥12 characters and includes uppercase and lowercase letters, numbers and special characters, convert the service account to a group-hosted service account (gMSA), and automatically manage the password.

[0202] At the device level: such as upgrading the PLC-01 firmware to version V4.5 to support long password function, and deploying an authentication proxy gateway for Old_PLC_01 to handle authentication requests on behalf of others.

[0203] On the software level: For example, installing the KB2992611 patch on a Windows Server 2012 server to support SHA-256 encryption, refactoring the backup.bat script, and retrieving passwords from the HashiCorpVault security vault.

[0204] At the strategy level: such as adjusting the maximum password usage period to 180 days, reducing the frequency of changing service account passwords, configuring a loose password policy for legacy devices separately, and applying a strong password policy for other devices.

[0205] Sort by repair urgency (high / medium / low), with high-priority recommendations (such as repairing core PLC certification failure) displayed first, and the time, resources and technical difficulty required for repair marked;

[0206] For each suggestion, predict the effect after implementation (e.g., after implementation, account svc_dat' will comply with the password policy, and the data collection process can run normally) to help administrators make decisions;

[0207] And generate a comprehensive test report:

[0208] Report structure and content:

[0209] Executive Summary: Test objective, test scope, test time, total number of test cases, success rate, core conclusions (e.g., the new password strategy has 3 high-risk points and needs to be rectified before going live).

[0210] Detailed findings: All issues are listed in categories according to risk level (high, medium, low), and each issue includes an issue description, affected entities, root cause analysis, and risk statement.

[0211] Risk level definition:

[0212] High risk: Problems that could lead to disruption of core business operations or production line stoppages (such as PLC certification failure).

[0213] Medium risk: Issues that will affect non-core business operations and cause functional abnormalities (such as report generation failure).

[0214] Low risk: Issues that have a minor impact on business and can be optimized later (such as some account passwords having a complexity close to the threshold).

[0215] List of affected business systems: List the name of the affected business system, the department to which it belongs, the business type, the degree of impact, and the recommended recovery time.

[0216] Repair Operation Guide: Provides detailed repair steps categorized by problem type, including the main body of the operation, operation steps, verification methods, precautions, and download links for relevant tools and command examples.

[0217] Appendix: Test case list, screenshots of raw monitoring data, topology diagram, and compliance checklist.

[0218] The report includes visualization elements such as a pie chart of test success rate, a bar chart of risk level distribution, a statistical chart of affected device types, and a radar chart of repair priority, which visually display the test results.

[0219] Report export formats: Supports exporting in PDF, Word, and HTML formats. PDF format supports encryption protection (set an opening password) to prevent report leakage.

[0220] The above formulas are all dimensionless calculations. The formulas are derived from software simulations based on a large amount of collected data to obtain the most recent real-world results. The preset parameters in the formulas are set by those skilled in the art according to the actual situation.

[0221] The foregoing has only described certain exemplary embodiments of the present invention by way of illustration. Undoubtedly, those skilled in the art can modify the described embodiments in various ways without departing from the spirit and scope of the present invention. Therefore, the foregoing drawings and descriptions are illustrative in nature and should not be construed as limiting the scope of protection of the claims of the present invention.

[0222] It should be noted that, in this document, the use of relational terms such as "first" and "second" is merely for distinguishing one entity or operation from another, and does not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes the element.

[0223] It should be understood that in the various embodiments of this application, the order of the above-mentioned processes does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0224] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0225] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0226] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0227] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0228] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0229] The foregoing has only described certain exemplary embodiments of the present invention by way of illustration. Undoubtedly, those skilled in the art can modify the described embodiments in various ways without departing from the spirit and scope of the present invention. Therefore, the foregoing drawings and descriptions are illustrative in nature and should not be construed as limiting the scope of protection of the claims of the present invention.

Claims

1. A cryptographic security management method applied to industrial security, characterized in that, include: Build an isolated simulation testing platform that corresponds to the real production environment; Deploy the password policy to be tested, and generate test cases covering real-world scenarios through traffic mirroring, script recording, and template library; In a controlled simulation environment, cryptographic policies are deployed in batches, test cases are triggered according to priority, and system response data is monitored to obtain test results. During the execution of test cases, the success rate obtained needs to be analyzed to determine whether the success rate is correct. Analyze test data to determine compliance and compatibility, pinpoint the root cause of problems, assess the scope of impact, and automatically generate targeted remediation suggestions and comprehensive test reports.

2. The cryptographic security management method for industrial security according to claim 1, characterized in that, Establish an isolated simulation test platform that corresponds to the real production environment, specifically including: By configuring the target IP network segment and subnet mask, the scanning range is limited to industrial control networks; The scan results are matched against the fields of the data imported from the asset management system and CMDB. Create a virtual machine and restore the system based on snapshot files from the production environment HMI to restore disk partition structure, registry configuration, and driver versions; Use a hash verification tool to verify the consistency of critical files in the cloned system with the production environment. Manually configure the virtual machine IP address, subnet mask, gateway, and DNS to ensure consistency with the production environment HMI network parameters; replicate the VLAN ID, VLAN name, and trunk link configuration of the production network, and configure static routes or OSPF routing protocol. Import the security policies of the production environment into the simulated firewall, including source and destination addresses, service ports, actions, and logging status; Simulate the latency and packet loss rate of an industrial network; Scan the authentication port of the simulated component; verify that the port is open. Write a test tool to send standard protocol requests to the authentication port.

3. The cryptographic security management method for industrial security according to claim 1, characterized in that, Deploy the password policy to be tested, and generate test cases covering real-world scenarios using traffic mirroring, script recording, and template libraries. Specifically, this includes: The graphical interface provides a web-based management interface; The configuration policy also includes support for custom password complexity settings, password management settings, and account security management settings; The system has a built-in policy conflict rule library. When the configured policy items conflict with each other, the system will automatically pop up a window to indicate the conflict points and provide modification suggestions.

4. The cryptographic security management method for industrial security according to claim 3, characterized in that, It also includes the generation and recording of automated test cases: Configure port mirroring on the core switches of the production network to mirror authentication-related traffic to the collection server; Preserve authentication protocol traffic and store it as a pcap file, named according to timestamps; Replay the pcap file in the simulation environment, and configure the playback rate and number of replays; The administrator logs into the policy management platform, enters the script recording module, inputs the recording name, target device IP, and recording duration, and clicks start recording; Capture all network requests, system calls, and process start / termination events when administrators execute automated processes in a production environment; After recording is complete, convert the captured behavior into a Python or Shell script; The recorded script is executed in the simulation environment to verify that the script can completely reproduce the original process. The execution success rate must reach the preset standard, and the obtained execution success rate also completes self-verification. That is, the execution success rate is judged by analyzing the obtained verification error coefficient. If the execution success rate is incorrect, the failure node is prompted and re-recording is allowed.

5. The cryptographic security management method for industrial security according to claim 4, characterized in that, The process of obtaining the verification error coefficients includes: Extract the timestamp sequence of script execution, including the start and end times of each step, and record them as the single-step start time and single-step end time, respectively; And the actual start time and actual end time corresponding to the production environment; Calculate the time difference between the start time of a single step and the start time of the actual step to obtain the start deviation duration; calculate the time difference between the end time of a single step and the end time of the actual step to obtain the end deviation duration. The total duration of a single-step deviation is obtained by summing the start deviation duration and the end deviation duration. Get the duration between the start time and end time of a single step, and record it as the duration of the single step process; get the duration between the start time and end time of a real step, and record it as the duration of the real step process. The time difference between the duration of a single step process and the actual duration of the process step is recorded as the process time deviation. The total duration of the single-step deviation and the process time deviation are respectively used as the base and the height perpendicular to the base of the triangle. After constructing the triangle, the area of ​​the triangle is calculated and recorded as the initial error coefficient. Obtain the initial error coefficients corresponding to each step during script execution, and sort them in descending order of their values ​​to obtain a descending set of initial error coefficients; The three largest initial error coefficients are extracted from the set, and the mean is calculated to obtain the verification error coefficients. The verification error coefficient is matched with the corresponding decay rate. The obtained execution success rate is subtracted from the decay rate. If the obtained execution success rate still meets the preset execution success rate requirement, then the execution success rate is self-verified.

6. The cryptographic security management method for industrial security according to claim 1, characterized in that, In a controlled simulation environment, cryptographic policies are deployed in batches, test cases are triggered according to priority, and system response data is monitored to obtain test results. Specifically, this includes: In the policy management server simulation version, create a test domain and add all simulated devices and virtual machines in the simulation environment to the test domain, ensuring that the devices are connected to the domain controller network. Deploy in batches according to equipment type, prioritizing non-core equipment, and then deploying core control equipment; After deployment, the system automatically logs into each device, verifies whether the policy has been successfully applied via command line, generates a deployment verification report, and marks devices that failed to apply the policy and the reasons therefor.

7. The cryptographic security management method for industrial security according to claim 6, characterized in that, It also includes the triggering of test execution: Test case scheduling configuration: Supports prioritizing test cases, with higher priority cases executed first; supports parallel execution; Execution triggering methods: Supports manual triggering, timed triggering, and event triggering; When a test case fails to execute, the system automatically analyzes the reason for the failure. If it is a temporary problem, it automatically retryes the execution; if it is a permanent problem, it stops retrying and marks the failure status. It displays the execution status of test cases in real time, showing the number of executed test cases, the number of remaining test cases, and the success rate. It also supports manually pausing / resumpting test execution.

8. The cryptographic security management method for industrial security according to claim 7, characterized in that, It also includes comprehensive monitoring and data collection: Logs were collected and key fields were extracted. Configure packet capture ports on the core routers and switches of the simulated network, set packet capture filtering rules, and split the packet capture files by hour; Parse the packet capture file to extract the protocol type, source port, destination port, sequence number, acknowledgment number, username, password encryption method, authentication result, and response time; Performance monitoring includes monitoring response time, error rate, and resource utilization; Install a monitoring agent on the simulation equipment to collect performance metrics in real time.

9. The cryptographic security management method for industrial security according to claim 1, characterized in that, Analyze test data to determine compliance and compatibility, pinpoint root causes of issues, assess the scope of impact, and automatically generate targeted remediation suggestions and a comprehensive test report with visualization elements, specifically including: Built-in compliance checklist; supports custom compliance rules, and administrators can add internal enterprise password management standards; For each account, verify whether it meets all compliance rules one by one. If all rules are met, it is deemed compliant; otherwise, it is deemed non-compliant, and the specific non-compliant items are marked. Set compatibility grading standards; conduct correlation analysis on root cause localization and impact scope assessment from time, account, device, and protocol dimensions; classify failure root causes, with each category containing specific sub-causes; The quantitative assessment of the scope of impact analyzes the impact on business, equipment, and accounts. Dependency relationships are generated by using nodes to represent devices / systems and lines to represent dependencies in a topology graph. Problematic nodes and their dependency paths are highlighted, and the scope of impact is marked.

10. The cryptographic security management method for industrial security according to claim 9, characterized in that, Also includes: Based on the root cause analysis results and the built-in remediation solution knowledge base, corresponding remediation suggestions are matched to ensure that the suggestions are targeted and actionable. The remediation recommendations are analyzed from the perspectives of account, device, software, and policy: Sorted by urgency of repair, with high-priority items displayed first, and the time, resources, and technical difficulty required for repair noted. For each suggestion, predict its effects after implementation to help administrators make decisions; and generate a comprehensive test report.

Images