Industrial Internet Terminal Access Authentication Method and System Based on Zero Trust Architecture

Abstract

This invention discloses an industrial internet terminal access authentication method and system based on a zero-trust architecture, relating to the field of industrial internet security technology. The method establishes a behavioral-level identity identifier and evidence chain model for industrial terminals, combines static device attributes and industrial control behavior feature sequences to generate behavioral-level identity identifiers and binds them to distributed identity identifiers. Simultaneously, it records key operations through an evidence chain, achieving strong binding and traceability between identity and business behavior. Furthermore, through a two-level collaborative trust evaluation architecture of edge trust cerebellum and cloud decision-making brain, real-time protocol parsing and short-cycle trust decisions are achieved at the edge, while global policy orchestration and cross-domain collaboration are realized in the cloud. Finally, cross-domain access is achieved by synchronizing terminal identity mapping relationships, trust policy summaries, and evidence chain hashes across multiple management domains via blockchain. This invention effectively improves the security, real-time performance, and cross-domain collaboration capabilities of industrial terminal access authentication, ensuring industrial production safety.

Description

Technical Field

[0001] This invention relates to the field of industrial internet security technology, specifically to an industrial internet terminal access authentication method and system based on a zero-trust architecture. Background Technology

[0002] As the core carrier of industrial digital transformation, the Industrial Internet connects a large number of industrial terminals (such as PLCs, sensors, and industrial control hosts), realizing the intelligentization and collaboration of the production process. However, with the popularization of the Industrial Internet, terminal access scenarios are becoming increasingly complex, and the demand for cross-domain access and heterogeneous terminal access is constantly increasing, posing a severe challenge to the security and reliability of terminal access authentication.

[0003] Zero-trust architecture, based on the core principles of "default distrust, always verify, and least privilege," provides a new solution for industrial internet terminal access authentication. However, existing industrial terminal access authentication schemes based on zero-trust architecture still have many shortcomings:

[0004] The current methods of identity verification are simplistic and lack sufficient security: Existing solutions largely rely on static identity identifiers such as device certificates and static fingerprints (e.g., MAC addresses, IP addresses) for authentication. These identifiers are easily forged and tampered with, making it difficult to identify cloned devices, counterfeit terminals, and hijacked terminals, thus failing to achieve a strong binding between terminal identity and business behavior, posing serious security vulnerabilities. For example, a power company's SCADA system experienced a regional power outage due to a PLC device infected with malware (logged in with a legitimate account but actually hijacked). In another instance, an attacker in a petrochemical company bypassed MAC-based whitelist protection by tampering with the PLC's MAC address, causing reactor temperature control failure and triggering a small-scale explosion. Even more alarming, Gartner predicts that by 2025, 75% of industrial attacks will utilize device identity forgery techniques to bypass perimeter defenses.

[0005] The existing trust assessment architecture is flawed, resulting in poor real-time performance and reliability. Most solutions employ a centralized cloud-based trust assessment architecture, with the edge only responsible for data collection and forwarding, lacking independent trust decision-making capabilities. This over-reliance on the cloud leads to high authentication latency, failing to meet the demands of high real-time scenarios in industrial production (such as millisecond-level responses). Furthermore, cloud failures can paralyze the entire access authentication system, indicating insufficient reliability. In the Device-Edge-Cloud (DEC) computing framework, scenarios such as multi-hop collaborative task offloading place higher demands on the edge's real-time decision-making capabilities, which the existing architecture struggles to adapt to.

[0006] Weak cross-domain collaboration capabilities and serious resource waste: There are multiple independent management domains in the industrial internet (such as different factories or departments). In the existing solutions, each management domain independently builds its own identity authentication and trust policy system. When the terminal accesses across domains, it needs to repeatedly perform identity authentication and policy configuration, which is inefficient. At the same time, the existing blockchain-based identity solution is only used for token issuance and cannot realize cross-domain synchronization of trust policies and operational evidence, which makes it difficult to transfer trust across domains. This further reduces the efficiency and security of cross-domain access and causes a lot of resource waste. Summary of the Invention

[0007] To address the shortcomings of the aforementioned technologies, this invention provides an industrial internet terminal access authentication method and system based on a zero-trust architecture. This method solves the technical problems of inaccurate identity recognition, weak edge-side decision-making capabilities, and low cross-domain collaboration efficiency in existing technologies, thereby improving the security, real-time performance, and cross-domain collaboration capabilities of industrial terminal access authentication.

[0008] The technical solution adopted by the present invention to achieve the above-mentioned technical effects is as follows:

[0009] The industrial internet terminal access authentication method based on zero-trust architecture includes the following steps:

[0010] Step S1, Terminal Initialization Phase: Collect the static attributes of the industrial terminal and the sequence of industrial control behavior features, generate a behavior-level identity identifier (BID), create a distributed identity identifier (DID), and bind the behavior-level identity identifier (BID) and the distributed identity identifier (DID) to complete the terminal identity registration.

[0011] Step S2: Terminal access request. The terminal sends an access request to the edge trust cerebellum. The access request carries the bound behavioral identity identifier BID and the distributed identity identifier DID, as well as the current industrial control behavior characteristics.

[0012] Step S3: The edge trust cerebellum performs real-time trust assessment on the terminal, parses the industrial control protocol and extracts the current behavioral features, compares them with the behavioral feature sequence corresponding to the behavioral identity identifier BID, completes short-cycle trust decision, and allows the terminal to temporarily access if the assessment is passed. At the same time, trust assessment evidence is generated and uploaded to the cloud decision brain and blockchain.

[0013] Step S4: The cloud-based decision-making brain receives the trust assessment evidence uploaded by the edge trust cerebellum, combines the global security policy with the historical evidence chain, performs long-term trust assessment and policy optimization, and distributes the optimized trust policy to the corresponding edge trust cerebellum.

[0014] Step S5: Cross-domain access. The blockchain synchronizes the terminal identity mapping relationship, trust policy summary and evidence chain hash between multiple management domains. The terminal achieves cross-domain single sign-on by using its own behavioral identity identifier BID and the distributed identity identifier DID. The edge trust cerebellum completes cross-domain trust assessment according to the strategy synchronized by the blockchain to achieve minimum permission access.

[0015] Step S6: Record key data on terminal access, cross-domain access operations, and trust assessment to form a traceable chain of evidence for subsequent security audits and cross-domain trust transfer.

[0016] Preferably, in the above-mentioned industrial internet terminal access authentication method based on zero-trust architecture, in step S1, the static attributes of the device include at least one of the following: terminal hardware model, firmware version, MAC address, CPU serial number, and memory capacity.

[0017] Preferably, in the above-mentioned industrial internet terminal access authentication method based on zero-trust architecture, in step S1, the industrial control behavior feature sequence includes at least one of the terminal's industrial control protocol interaction frequency, data transmission rate, operation instruction sequence, task execution cycle, and number of abnormal behavior triggers, which is collected and updated in real time through the edge trust cerebellum.

[0018] Preferably, in the above-described industrial internet terminal access authentication method based on zero-trust architecture, step S1, generating the behavioral-level identity identifier (BID), includes the following steps:

[0019] Step S1.1: Perform a hash operation on the collected static attributes of the device to obtain the static attribute hash value;

[0020] Step S1.2: Perform time-series modeling on the industrial control behavior feature sequence, extract feature vectors, and perform normalization processing;

[0021] Step S1.3: Fuse the static attribute hash value with the normalized feature vector, and generate the unique behavior-level identity identifier BID through an encryption algorithm.

[0022] Preferably, in the above-mentioned industrial internet terminal access authentication method based on zero-trust architecture, in step S3, the edge trust cerebellum is equipped with an independent industrial control protocol parsing module, and the response time of short-cycle trust decision does not exceed 10ms.

[0023] Preferably, in the above-mentioned industrial internet terminal access authentication method based on zero-trust architecture, in step S4, the long-term trust assessment of the cloud decision brain includes: based on the trust assessment evidence, historical evidence chain and global security policy uploaded by the edge trust cerebellum, a trust assessment model is constructed using machine learning algorithms to analyze the long-term behavior of the terminal and dynamically adjust the trust threshold and access permissions.

[0024] Preferably, in the above-mentioned industrial internet terminal access authentication method based on zero-trust architecture, in step S5, the terminal identity mapping relationship is a mapping relationship between the terminal behavior-level identity identifier BID and the distributed identity identifier DID of multiple management domains, and the blockchain adopts a consortium blockchain architecture to support the joining and consensus of multiple management domain nodes.

[0025] Preferably, in the above-mentioned industrial internet terminal access authentication method based on zero-trust architecture, in step S6, the evidence chain includes terminal identity information, access time, trust assessment result, operation instructions, data transmission records, and abnormal behavior logs. Each piece of data in the evidence chain is stored after being hashed and encrypted to ensure that it cannot be tampered with, and is used for subsequent security auditing, attack tracing, and cross-domain trust transfer.

[0026] An industrial internet terminal access authentication system based on a zero-trust architecture is used to implement the above methods, including...

[0027] It includes the terminal layer, the edge trust cerebellum layer, the cloud decision-making brain layer, and the blockchain layer;

[0028] The terminal layer includes several industrial terminals, which are used to collect static attributes and industrial control behavior characteristics of their own equipment, send access requests, and execute trust policies issued by the cloud and the edge.

[0029] The edge trust cerebellum layer is deployed at the edge nodes of the industrial site and includes an industrial control protocol parsing module, a short-cycle trust assessment module, an evidence generation module, and a policy execution module. The industrial control protocol parsing module is used to parse industrial control protocols in real time and extract terminal behavior features. The short-cycle trust assessment module is used to make real-time trust decisions on terminal access requests. The evidence generation module is used to generate evidence data of trust assessment and terminal operation. The policy execution module is used to execute the trust policy issued by the cloud and control the terminal access permissions.

[0030] The cloud-based decision-making brain layer is deployed on a cloud server and includes a global policy orchestration module, a long-term trust assessment module, a model training module, and a cross-domain collaboration module. The global policy orchestration module is used to formulate and optimize global security policies. The long-term trust assessment module is used to perform long-term trust assessments by combining historical evidence chains. The model training module is used to train the trust assessment model and optimize the assessment accuracy. The cross-domain collaboration module is used to coordinate the synchronization of policies and identities among multiple management domains.

[0031] The blockchain layer adopts a distributed ledger architecture, including an identity mapping storage module, a policy digest storage module, an evidence chain hash storage module, and a consensus module. The identity mapping storage module is used to store the mapping relationship between the behavioral-level identity identifier (BID) and the distributed identity identifier (DID) of multiple management domain terminals. The policy digest storage module is used to store the digest information of the trust policies of each domain. The evidence chain hash storage module is used to store the hash value of the evidence chain to ensure that the data is tamper-proof. The consensus module is used to achieve consensus among multiple domain nodes and ensure data consistency.

[0032] Preferably, in the above-mentioned industrial internet terminal access authentication system based on zero-trust architecture, the edge trust cerebellum and the cloud decision brain interact with each other through an encrypted communication link, and the TLS 1.3 protocol is used for encryption to ensure data transmission security; the terminal and the edge trust cerebellum communicate with each other using an industrial-grade encryption protocol, supporting local trust assessment and temporary access management when the device is offline.

[0033] The beneficial effects of this invention are as follows: This invention proposes a behavior-level identity identifier and evidence chain model for industrial terminals. It combines the static attributes of the device with the industrial control behavior feature sequence to generate a behavior-level identity identifier (BID) and binds it with a distributed identity identifier (DID). This strongly binds the terminal identity with its business behavior pattern. Compared with traditional static identity identifiers (device certificates, MAC addresses, etc.), it can more effectively identify cloned devices, forged terminals, and abnormal operations, thereby improving the security of identity authentication from the root. At the same time, by recording key operations through the evidence chain, the authentication process can be traced, providing strong support for security auditing and attack tracing. This solves the problems of easy forgery and low security of traditional static identity identifiers. The device identification accuracy can be increased from 78% in traditional solutions to over 99%. The system adopts a two-tier collaborative trust assessment architecture consisting of an "edge trust cerebellum + cloud decision-making brain." The edge side possesses independent protocol parsing and short-cycle trust decision-making capabilities with a response time of no more than 10ms. It can independently handle high real-time industrial control scenarios, solving the latency problems caused by weak edge-side decision-making capabilities and excessive reliance on the cloud in existing solutions. At the same time, the edge and cloud work together, with the cloud responsible for global policy optimization and model training, and the edge responsible for local real-time decision-making. Even if the cloud fails, the edge side can still operate independently, improving system reliability. This is similar to the security mechanism of multi-hop collaborative task offloading in a device-edge-cloud computing framework. This solution achieves cross-domain terminal identity and policy synchronization based on blockchain / distributed ledger. Identity mapping, policy summaries, and evidence chain hashes are uploaded to the blockchain, ensuring identity and policy consistency across multiple management domains. It supports cross-domain single sign-on and least privilege access for terminals, avoiding redundant construction of identity and policy systems in each domain, reducing operational costs, and improving cross-domain access efficiency. Compared to existing blockchain identity solutions used only for token issuance, this solution expands the application scenarios of blockchain, enabling cross-domain synchronization of policies and evidence, further enhancing the security and reliability of cross-domain trust transfer, reducing production interruptions caused by cumbersome cross-domain authentication, and lowering operational costs. Attached Figure Description

[0034] Figure 1 This is an overall flowchart of the method described in this invention;

[0035] Figure 2 This is a schematic diagram of the process for generating a behavior-level identity identifier (BID) as described in this invention.

[0036] Figure 3 This is an architecture diagram of the system described in this invention. Detailed Implementation

[0037] To provide a further understanding of the present invention, the invention will be further described below with reference to the accompanying drawings and specific embodiments:

[0038] In the description of this invention, it should be noted that the terms "vertical," "upper," "lower," and "horizontal," etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are used only for the convenience of describing the invention and for simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on the invention. Furthermore, "first," "second," "third," and "fourth" are used for descriptive purposes only and should not be construed as indicating or implying relative importance.

[0039] In the description of this invention, it should also be noted that, unless otherwise explicitly specified and limited, the terms "set," "install," "connect," and "link" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or a connection through an intermediate medium; and they can refer to the internal communication between two components. Those skilled in the art can understand the specific meaning of the above terms in this invention according to the specific circumstances.

[0040] Please see Figure 1 As shown in the figure, an embodiment of the present invention proposes an industrial internet terminal access authentication method based on a zero-trust architecture, including the following steps:

[0041] Step S1, Terminal Initialization Phase: Collect the static attributes of the industrial terminal and the sequence of industrial control behavior features, generate a behavior-level identity identifier (BID), create a distributed identity identifier (DID), and bind the behavior-level identity identifier (BID) and the distributed identity identifier (DID) to complete the terminal identity registration.

[0042] Step S2: Terminal access request. The terminal sends an access request to the edge trust cerebellum. The access request carries the bound behavioral identity identifier BID and the distributed identity identifier DID, as well as the current industrial control behavior characteristics.

[0043] Step S3: The edge trust cerebellum performs real-time trust assessment on the terminal, parses the industrial control protocol and extracts the current behavioral features, compares them with the behavioral feature sequence corresponding to the behavioral identity identifier BID, completes short-cycle trust decision, and allows the terminal to temporarily access if the assessment is passed. At the same time, trust assessment evidence is generated and uploaded to the cloud decision brain and blockchain.

[0044] Step S4: The cloud-based decision-making brain receives the trust assessment evidence uploaded by the edge trust cerebellum, combines the global security policy with the historical evidence chain, performs long-term trust assessment and policy optimization, and distributes the optimized trust policy to the corresponding edge trust cerebellum.

[0045] Step S5: Cross-domain access. The blockchain synchronizes the terminal identity mapping relationship, trust policy summary and evidence chain hash between multiple management domains. The terminal achieves cross-domain single sign-on by using its own behavioral identity identifier BID and the distributed identity identifier DID. The edge trust cerebellum completes cross-domain trust assessment according to the strategy synchronized by the blockchain to achieve minimum permission access.

[0046] Step S6: Record key data on terminal access, cross-domain access operations, and trust assessment to form a traceable chain of evidence for subsequent security audits and cross-domain trust transfer.

[0047] Specifically, in the embodiments of the present invention, the static attributes of the device in step S1 are inherent attributes of the terminal, including but not limited to the terminal hardware model, firmware version, MAC address, CPU serial number, memory capacity, etc. These attributes are stable and can serve as the basis for identity recognition. The industrial control behavior feature sequence is dynamic behavioral data of the terminal during industrial production, including but not limited to the terminal's industrial control protocol interaction frequency, data transmission rate, operation command sequence, task execution cycle, and number of abnormal behavior triggers. These features can reflect the terminal's business behavior patterns and are collected and dynamically updated in real time through edge trust cerebellum to ensure the timeliness of the behavioral features.

[0048] Furthermore, in embodiments of the present invention, such as Figure 2 As shown, the generation of the behavioral-level identity identifier (BID) includes the following steps:

[0049] Step S1.1: Perform a hash operation on the collected static attributes of the device to obtain the static attribute hash value;

[0050] Step S1.2: Perform time-series modeling on the industrial control behavior feature sequence, extract feature vectors, and perform normalization processing;

[0051] Step S1.3: Fuse the static attribute hash value with the normalized feature vector, and generate the unique behavior-level identity identifier BID through an encryption algorithm.

[0052] The hash operation is preferably performed using the SHA-256 encrypted hash algorithm, ensuring the immutability of the static attribute hash value. Time-series modeling of the industrial control behavior feature sequence can be performed using an LSTM model, and normalization of the extracted feature vectors can eliminate the influence of different feature dimensions. The encryption algorithm in step S1.3 can be either SM4 or AES. A unique behavior-level identifier (BID) is generated through the encryption algorithm, enabling deep binding between static attributes and dynamic behaviors.

[0053] In a preferred embodiment of the present invention, the distributed identity identifier (DID) adopts a decentralized architecture, is autonomously controlled by the terminal, and does not rely on third-party institutions. After binding the behavioral identity identifier (BID) with the distributed identity identifier (DID), decentralized management of the terminal identity is realized, while ensuring the uniqueness and traceability of the identity identifier, laying the foundation for cross-domain trust transfer.

[0054] Furthermore, in a preferred embodiment of the present invention, in step S2, when the terminal initiates the access process, the current industrial control behavior characteristics (such as real-time protocol interaction data, operation instructions, etc.) are automatically collected, and the bound behavior-level identity identifier BID, distributed identity identifier DID and the current behavior characteristics are encapsulated into an access request, which is then sent to the edge trust cerebellum deployed in the industrial site through an industrial-grade encrypted communication link to ensure the data security of the access request and prevent it from being eavesdropped on or tampered with.

[0055] In embodiments of this invention, the edge trust cerebellum, acting as a "trust cerebellum" in the industrial field, possesses independent industrial control protocol parsing capabilities. It supports real-time parsing of commonly used industrial protocols such as Modbus, Profibus, and EtherCAT, and can quickly extract current industrial control behavior features from access requests. Simultaneously, the edge trust cerebellum pre-stores the behavioral-level identity identifier (BID) and corresponding behavioral feature sequence during terminal registration. By calculating the similarity between the current behavioral features and the pre-stored feature sequence (e.g., using a cosine similarity algorithm), and setting a reasonable similarity threshold (e.g., 90%), if the similarity is greater than or equal to the threshold, the terminal is deemed legitimate and its behavior normal, the trust assessment is passed, and the terminal is allowed temporary access to the industrial internet, with temporary access granted. If the similarity is less than the threshold, an anomaly detection mechanism is triggered, recording abnormal behavior (e.g., sudden changes in behavioral features, abnormal protocol interactions, etc.) and reporting it to the cloud-based decision-making brain. Simultaneously, terminal access is denied to prevent malicious terminal intrusion.

[0056] To ensure the traceability of trust assessments, the edge trust cerebellum generates trust assessment evidence after completing a trust decision. Specifically, this assessment evidence includes key data such as the terminal behavior-level identity identifier (BID), distributed identity identifier (DID), access time, assessment result, and current behavioral characteristics. After hashing and encrypting the evidence data, it is uploaded to both the cloud-based decision-making brain (for long-term assessments) and the blockchain (for evidence storage) to ensure the immutability of the evidence.

[0057] Furthermore, the edge trust cerebellum's short-cycle trust decision response time is no more than 10ms, which can meet the needs of high real-time scenarios in industrial production and solve the latency problem caused by excessive reliance on the cloud in existing solutions. At the same time, the edge trust cerebellum can operate independently, and even if it is disconnected from the cloud, it can still complete the access authentication of local terminals, improving the reliability of the system, similar to the local independent operation capability of the edge smart box in the edge intelligence layer.

[0058] Furthermore, in a preferred embodiment of the present invention, in step S4, the cloud-based decision-making brain, acting as the "decision-making brain" of the entire system, is responsible for the orchestration and optimization of global security policies. It receives trust assessment evidence uploaded by all edge trust cerebellar units, combines it with historical evidence chains (stored in the cloud database and blockchain), and constructs a trust assessment model using machine learning algorithms (such as random forest, LSTM, SVM, etc.). This model analyzes the long-term behavior of the terminal and dynamically adjusts the trust threshold and access permissions. For example, if the terminal's long-term behavior is stable and its trust assessment score is high, the trust threshold can be appropriately increased to simplify the access authentication process and improve access efficiency. If the terminal exhibits multiple minor abnormal behaviors, the trust threshold is lowered, behavior monitoring is strengthened, and access permissions are restricted if necessary. If the terminal exhibits serious abnormal behavior, an alarm mechanism is immediately triggered to notify the administrator for processing, and the terminal's behavioral-level identity identifier (BID) and distributed identity identifier (DID) are added to a blacklist, prohibiting its subsequent access.

[0059] Furthermore, the cloud-based decision-making brain is also responsible for training and optimizing the trust assessment model. By collecting a large amount of terminal behavioral data and trust assessment results, it continuously optimizes model parameters to improve the accuracy and precision of trust assessment. Simultaneously, it dynamically adjusts the global security strategy based on changes in industrial production needs to ensure the adaptability of the authentication scheme. The optimized trust strategy is distributed to the corresponding edge trust cerebellum via an encrypted communication link. The edge trust cerebellum updates its local assessment rules according to the new strategy, achieving synergy between the global strategy and local execution.

[0060] Since there are multiple independent management domains in the Industrial Internet (such as Plant A, Plant B, and Headquarters Management Domain), independent edge trust cerebellum and cloud decision-making brain nodes are deployed in each management domain. The blockchain adopts a consortium blockchain architecture, allowing nodes from each management domain to join and participate in consensus. The consensus mechanism adopts efficient and secure consensus algorithms such as PBFT and PoS to ensure data consistency.

[0061] In step S5, the blockchain stores the following: a mapping relationship between terminal behavior-level identity identifiers (BIDs) and distributed identity identifiers (DIDs) across multiple management domains; trust policy summaries for each domain; and the hash value of the evidence chain for terminal access and operation. This mapping relationship ensures consistent identity recognition of the same terminal across different domains. The trust policy summaries for each domain prevent redundant policy development and enable policy sharing. The hash value of the evidence chain for terminal access and operation ensures the traceability of cross-domain evidence.

[0062] When a terminal needs to access a cross-domain environment, it does not need to repeat identity registration and authentication. It only needs to send its own behavioral identity identifier (BID) and distributed identity identifier (DID) to the edge trust daemon of the target domain. The edge trust daemon queries the identity mapping relationship and corresponding trust policy summary of the terminal through the blockchain, and combines it with local real-time behavior assessment to complete the cross-domain trust decision and grant the terminal the least privilege access. That is, it only allows the terminal to access the resources required for its business and restricts access to irrelevant resources, thereby reducing security risks.

[0063] Compared to existing blockchain identity solutions that are only used for token issuance, this solution extends the application of blockchain to cross-domain synchronization of identity mapping, policy digests, and evidence chain hashes. It achieves trust collaboration between multiple management domains, avoids the duplication of identity and policy systems in each domain, improves cross-domain access efficiency, and ensures the security and reliability of cross-domain trust transmission, similar to the collaborative role of the contract consensus layer and the blockchain infrastructure layer in a "cloud-edge-chain" three-in-one collaborative system.

[0064] Furthermore, in step S6, the evidence chain runs through the entire terminal access authentication process, including key data such as terminal identity information (behavioral identity identifier BID and distributed identity identifier DID), access time, access domain, trust assessment results, operation instructions, data transmission records, and abnormal behavior logs. Each piece of evidence data is hashed and encrypted before being stored in the blockchain and cloud database to ensure the immutability and traceability of the evidence. During subsequent security audits, administrators can use the evidence chain to query the terminal's access and operation records, trace the source of abnormal behavior, and provide a basis for attack tracing and responsibility determination. In the process of cross-domain trust transfer, the evidence chain can serve as proof of the terminal's trust status, enabling mutual recognition of trust between different management domains without the need for repeated trust assessments, thus improving cross-domain collaboration efficiency.

[0065] On the other hand, such as Figure 3 As shown, this invention also proposes an industrial internet terminal access authentication system based on a zero-trust architecture, which is used to implement the above-described method. This system includes a terminal layer, an edge trust cerebellum layer, a cloud decision-making brain layer, and a blockchain layer.

[0066] The terminal layer comprises several industrial terminals used to collect their own static attributes and industrial control behavior characteristics, send access requests, and execute trust policies issued by the cloud and edge. Specifically, industrial terminals can be PLCs, sensors, industrial control hosts, robots, etc. Each terminal has a built-in identity acquisition module and communication module, used to collect its own static attributes and industrial control behavior characteristics, send access requests, execute trust policies issued by the cloud-based decision-making system and the edge trust system, and simultaneously receive and respond to trust assessment instructions. The terminal layer supports heterogeneous terminal access, adapting to different types and protocols of industrial terminals to meet the diverse terminal access needs of the Industrial Internet.

[0067] The edge trust cerebellum layer is deployed at edge nodes in industrial settings and includes an industrial control protocol parsing module, a short-cycle trust assessment module, an evidence generation module, and a policy execution module. The industrial control protocol parsing module is used to parse industrial control protocol data sent by the terminal in real time, extracting the terminal's current industrial control behavior characteristics to provide data support for trust assessment. Specifically, the extraction of industrial control behavior characteristics can be achieved using the libpcap library based on Linux to capture data packets and extract key behavioral features through a dedicated algorithm. The extraction of industrial control behavior characteristics is an existing technology that can be accomplished using statistical analysis methods, machine learning models, deep learning, time series analysis, and other related methods; as existing technologies, they will not be elaborated upon here.

[0068] The short-cycle trust assessment module is used to make real-time trust decisions on terminal access requests. It pre-stores the behavioral-level identity identifier (BID) and corresponding behavioral feature sequence of the terminal during registration, calculates the similarity between the current behavioral features and the pre-stored feature sequence, completes the real-time trust decision, and determines whether the terminal is allowed to access. It also has an anomaly detection function to identify cloned devices, fake terminals, and abnormal operations.

[0069] The evidence generation module generates evidence data during terminal access, trust assessment, and operation. It hashes and encrypts the evidence data to ensure its integrity and immutability, and uploads it to the cloud-based decision-making system and the blockchain. The policy execution module receives global trust policies from the cloud-based decision-making system, updates local assessment rules, executes terminal access control, and feeds back local trust assessment results and evidence data to the cloud.

[0070] The cloud-based decision-making brain layer is deployed on cloud servers, possessing powerful computing and storage capabilities. It includes a global policy orchestration module, a long-term trust assessment module, a model training module, and a cross-domain collaboration module. The global policy orchestration module formulates global security policies based on the security requirements of industrial production. These policies include trust thresholds, access permission rules, and anomaly handling mechanisms. Simultaneously, it dynamically optimizes the policy content based on the long-term trust assessment results of the terminals, ensuring the adaptability and security of the policies, similar to the task scheduling and resource pooling functions in a cloud-edge collaboration platform.

[0071] The long-term trust assessment module receives trust assessment evidence uploaded by the edge trust cerebellum, combines it with historical evidence chains, and uses machine learning algorithms to construct a trust assessment model. This model analyzes the long-term behavior of terminals and dynamically adjusts their trust levels and access permissions. The model training module collects a large amount of terminal behavior data and trust assessment results to train and optimize the trust assessment model, improving its accuracy and efficiency. It also supports online updates and deployment of the trust assessment model. The cross-domain collaboration module coordinates identity mapping, policy synchronization, and evidence sharing across multiple management domains. It interacts with the blockchain layer to achieve cross-domain trust transfer and collaborative authentication, improving cross-domain access efficiency.

[0072] The blockchain layer adopts a distributed ledger architecture, including an identity mapping storage module, a policy digest storage module, an evidence chain hash storage module, and a consensus module. The identity mapping storage module stores the mapping relationship between behavioral-level identity identifiers (BIDs) and distributed identity identifiers (DIDs) of terminals across multiple management domains, ensuring consistent identity recognition of the same terminal across different management domains and supporting cross-domain identity authentication. It adheres to the W3C DID standard, achieving decentralized management of terminal identities. The policy digest storage module stores the summary information of trust policies for each domain, avoiding redundant policy system construction across domains, enabling policy sharing and synchronization, and reducing operational costs. The evidence chain hash storage module stores the evidence chain hash values ​​of terminal access, operation, and trust assessment, ensuring the immutability and traceability of evidence, providing a basis for security auditing and attack tracing. Specifically, it can be combined with distributed storage (such as IPFS) to achieve full storage of evidence data. The consensus module uses consensus algorithms such as PBFT and PoS to achieve consensus among nodes across multiple management domains, ensuring the consistency and security of data in the blockchain and preventing data tampering or forgery.

[0073] Furthermore, in a preferred embodiment of the present invention, the edge trust cerebellum and the cloud-based decision-making brain interact via an encrypted communication link, specifically using the TLS 1.3 protocol for encryption to ensure the security of data transmission. The terminal and the edge trust cerebellum communicate using an industrial-grade encryption protocol, supporting local trust assessment and temporary access management in offline device states, thus improving system reliability and adaptability. Specifically, the OPC UA Security encryption protocol can be used.

[0074] This invention is highly adaptable and scalable, supports heterogeneous industrial terminal access, and is compatible with various commonly used industrial protocols, meeting the needs of different industrial internet scenarios. Simultaneously, the strategies and models of the cloud-based decision-making system can be dynamically optimized, the blockchain layer supports the flexible addition of multiple management domain nodes, and the system can flexibly adjust its architecture and functions according to the scale of industrial production and changes in demand, exhibiting excellent scalability and adaptability.

[0075] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the claims. The scope of protection claimed by the appended claims and their equivalents is defined.

Claims

1. An industrial internet terminal access authentication method based on a zero-trust architecture, characterized in that, Includes the following steps: Step S1, Terminal Initialization Phase: Collect the static attributes of the industrial terminal and the sequence of industrial control behavior features, generate a behavior-level identity identifier (BID), create a distributed identity identifier (DID), and bind the behavior-level identity identifier (BID) and the distributed identity identifier (DID) to complete the terminal identity registration. Step S2: Terminal access request. The terminal sends an access request to the edge trust cerebellum. The access request carries the bound behavioral identity identifier BID and the distributed identity identifier DID, as well as the current industrial control behavior characteristics. Step S3: The edge trust cerebellum performs real-time trust assessment on the terminal, parses the industrial control protocol and extracts the current behavioral features, compares them with the behavioral feature sequence corresponding to the behavioral identity identifier BID, completes short-cycle trust decision, and allows the terminal to temporarily access if the assessment is passed. At the same time, trust assessment evidence is generated and uploaded to the cloud decision brain and blockchain. Step S4: The cloud-based decision-making brain receives the trust assessment evidence uploaded by the edge trust cerebellum, combines the global security policy with the historical evidence chain, performs long-term trust assessment and policy optimization, and distributes the optimized trust policy to the corresponding edge trust cerebellum. Step S5: Cross-domain access. The blockchain synchronizes the terminal identity mapping relationship, trust policy summary and evidence chain hash between multiple management domains. The terminal achieves cross-domain single sign-on by using its own behavioral identity identifier BID and the distributed identity identifier DID. The edge trust cerebellum completes cross-domain trust assessment according to the strategy synchronized by the blockchain to achieve minimum permission access. Step S6: Record key data on terminal access, cross-domain access operations, and trust assessment to form a traceable chain of evidence for subsequent security audits and cross-domain trust transfer.

2. The industrial internet terminal access authentication method based on zero-trust architecture according to claim 1, characterized in that, In step S1, the static attributes of the device include at least one of the following: terminal hardware model, firmware version, MAC address, CPU serial number, and memory capacity.

3. The industrial internet terminal access authentication method based on zero-trust architecture according to claim 1, characterized in that, In step S1, the industrial control behavior feature sequence includes at least one of the following: the terminal's industrial control protocol interaction frequency, data transmission rate, operation instruction sequence, task execution cycle, and number of abnormal behavior triggers, which is collected and updated in real time through the edge trust cerebellum.

4. The industrial internet terminal access authentication method based on zero-trust architecture according to claim 1, characterized in that, In step S1, generating the behavior-level identity identifier (BID) includes the following steps: Step S1.1: Perform a hash operation on the collected static attributes of the device to obtain the static attribute hash value; Step S1.2: Perform time-series modeling on the industrial control behavior feature sequence, extract feature vectors, and perform normalization processing; Step S1.3: Fuse the static attribute hash value with the normalized feature vector, and generate the unique behavior-level identity identifier BID through an encryption algorithm.

5. The industrial internet terminal access authentication method based on zero-trust architecture according to claim 1, characterized in that, In step S3, the edge trust cerebellum is equipped with an independent industrial control protocol parsing module, and the response time of short-cycle trust decision does not exceed 10ms.

6. The industrial internet terminal access authentication method based on zero-trust architecture according to claim 1, characterized in that, In step S4, the long-term trust assessment of the cloud-based decision-making brain includes: based on the trust assessment evidence, historical evidence chain and global security policy uploaded by the edge trust cerebellum, a trust assessment model is constructed using machine learning algorithms to analyze the long-term behavior of the terminal and dynamically adjust the trust threshold and access permissions.

7. The industrial internet terminal access authentication method based on zero-trust architecture according to claim 1, characterized in that, In step S5, the terminal identity mapping relationship is the mapping relationship between the terminal behavior-level identity identifier BID and the distributed identity identifier DID of the multi-management domain. The blockchain adopts a consortium blockchain architecture and supports the joining and consensus of nodes from multiple management domains.

8. The industrial internet terminal access authentication method based on zero-trust architecture according to claim 1, characterized in that, In step S6, the evidence chain includes terminal identity information, access time, trust assessment results, operation instructions, data transmission records, and abnormal behavior logs. Each piece of data in the evidence chain is stored after being hashed and encrypted to ensure that it cannot be tampered with, and is used for subsequent security audits, attack tracing, and cross-domain trust transfer.

9. An industrial internet terminal access authentication system based on a zero-trust architecture, characterized in that, The method for implementing the method as described in any one of claims 1 to 8 includes a terminal layer, an edge trust cerebellum layer, a cloud decision brain layer, and a blockchain layer; The terminal layer includes several industrial terminals, which are used to collect static attributes and industrial control behavior characteristics of their own equipment, send access requests, and execute trust policies issued by the cloud and the edge. The edge trust cerebellum layer is deployed at the edge nodes of the industrial site and includes an industrial control protocol parsing module, a short-cycle trust assessment module, an evidence generation module, and a policy execution module. The industrial control protocol parsing module is used to parse industrial control protocols in real time and extract terminal behavior features. The short-cycle trust assessment module is used to make real-time trust decisions on terminal access requests. The evidence generation module is used to generate evidence data of trust assessment and terminal operation. The policy execution module is used to execute the trust policy issued by the cloud and control the terminal access permissions. The cloud-based decision-making brain layer is deployed on a cloud server and includes a global policy orchestration module, a long-term trust assessment module, a model training module, and a cross-domain collaboration module. The global policy orchestration module is used to formulate and optimize global security policies. The long-term trust assessment module is used to perform long-term trust assessments by combining historical evidence chains. The model training module is used to train the trust assessment model and optimize the assessment accuracy. The cross-domain collaboration module is used to coordinate the synchronization of policies and identities among multiple management domains. The blockchain layer adopts a distributed ledger architecture, including an identity mapping storage module, a policy digest storage module, an evidence chain hash storage module, and a consensus module. The identity mapping storage module is used to store the mapping relationship between the behavioral-level identity identifier (BID) and the distributed identity identifier (DID) of multiple management domain terminals. The policy digest storage module is used to store the digest information of the trust policies of each domain. The evidence chain hash storage module is used to store the hash value of the evidence chain to ensure that the data is tamper-proof. The consensus module is used to achieve consensus among multiple domain nodes and ensure data consistency.

10. The industrial internet terminal access authentication system based on zero-trust architecture according to claim 9, characterized in that, The edge trust cerebellum and the cloud decision-making brain interact with each other via an encrypted communication link, using the TLS 1.3 protocol for encryption to ensure data transmission security; the terminal communicates with the edge trust cerebellum using an industrial-grade encryption protocol, supporting local trust assessment and temporary access management when the device is offline.

Images