Industrial control device security assessment method based on network topology and network path analysis

Abstract

The present application relates to the technical field of industrial internet security, and discloses an industrial control equipment security evaluation method based on network topology and network path analysis. The present application aims to solve the problems of inaccurate risk quantification caused by the existing evaluation method deviating from the real business path, and the problem of easy triggering of large-scale suspension of normal industrial production caused by rough blocking. The present application constructs an initial network topology graph by collecting communication data packets, traces time-continuous data streams to generate real transmission paths, reads the encryption state flag bit and digital certificate of the network nodes on the path, associates the identified unencrypted link with the certificate unauthenticated node with the real transmission path, calculates the path risk value in combination with the above risk factors, and comprehensively obtains the security evaluation score of the industrial control equipment; if the score is over the limit, an instruction is sent to cut off the unencrypted link.

Description

Technical Field

[0001] This invention relates to the field of industrial internet security technology, and more specifically, to a security assessment method for industrial control equipment based on network topology and network path analysis. Background Technology

[0002] With the rapid evolution of Industrial Internet technology, industrial control systems are gradually breaking down traditional physical isolation, and interconnection with external networks is becoming increasingly frequent. As the central nervous system of industrial production, the confidentiality and security of the underlying communication of industrial control networks are directly related to the stable operation of production lines and even critical national infrastructure. In the current field of security assessment and protection of industrial control equipment, existing technical means usually focus on static vulnerability scanning of single network nodes, or deploying security devices at the network boundary for passive traffic anomaly alarms and coarse-grained access control.

[0003] However, due to the complex topology and numerous underlying terminal devices of industrial control networks, existing security assessment methods face a prominent and substantial technical problem. On the one hand, traditional assessment methods often detach themselves from the actual flow of business data, viewing the risks of single devices in isolation, making it difficult to accurately quantify the true threat posed by plaintext leakage or identity spoofing on communication links to the overall control system. On the other hand, industrial control systems have extremely stringent requirements for business continuity. After identifying high-risk security risks, existing technologies, lacking fine-grained control capabilities deeply integrated with business paths, often resort to coarse physical network disconnection or global isolation strategies. This lack of targeted blocking can easily lead to indiscriminate large-scale shutdowns of normal industrial production, making it difficult to achieve an effective balance between preventing network threats and maintaining continuous industrial production. Summary of the Invention

[0004] In view of the aforementioned existing problems, the present invention is proposed.

[0005] Therefore, this invention provides a security assessment method for industrial control equipment based on network topology and network path analysis, which solves the problems of inaccurate risk quantification caused by existing assessment methods being divorced from real business paths, and the problem that crude blocking can easily cause large-scale shutdowns of normal industrial production.

[0006] To solve the above-mentioned technical problems, the present invention provides the following technical solution: This invention provides a security assessment method for industrial control equipment based on network topology and network path analysis, executed by a computer device, and includes the following steps: S1. Collect communication data packets, parse the application layer service payload of the communication data packets to obtain network addresses, and construct an initial network topology map reflecting the connection relationship of industrial control equipment based on the network addresses; S2. Combine the time-continuous communication data packets into a data stream, trace the network nodes through which the data stream passes, and connect them to form the actual transmission path on the initial network topology map; S3. Read the encryption status flag and digital certificate of the network node on the real transmission path, identify the unencrypted link and the unauthenticated certificate node respectively, and associate the unencrypted link, the unauthenticated certificate node and the real transmission path; S4. Calculate the path risk value based on the basic risk score of the actual transmission path, the number of unencrypted links, and the number of unauthenticated certificate nodes. Combine the path risk values ​​associated with the industrial control equipment to obtain a security assessment score. If the security assessment score exceeds the limit, send an instruction to disconnect the unencrypted link.

[0007] As a preferred embodiment of the industrial control equipment security assessment method based on network topology and network path analysis described in this invention, step S1 specifically includes: A traffic mirroring device is bypassed and connected to the core switch of the industrial control network. The traffic mirroring device is used to copy the communication data packets transmitted in the network, and a caching mechanism is configured for the traffic mirroring device to cope with sudden fluctuations in data traffic. Strip the data link layer frame header and network layer protocol header of the communication data packet to extract the application layer service payload containing control instructions; Read the content of the application layer service payload, identify the source node of the sending instruction and the destination node of the receiving instruction, and extract the corresponding sending end network address and receiving end network address; Using the sending end network address and the receiving end network address as nodes, and the communication connection behavior between the source node and the destination node as lines, an initial network topology diagram reflecting the physical and logical connection status of the industrial control equipment is constructed.

[0008] As a preferred embodiment of the industrial control equipment security assessment method based on network topology and network path analysis described in this invention, step S2 specifically includes: Extract the timestamp information attached to the communication data packet. If the network address of the sending end and the network address of the receiving end are the same, and the time interval between the data packets is less than the set fault tolerance time threshold, then combine the corresponding communication data packets into a continuous data stream. The fault tolerance time threshold is calculated by dynamic time compensation based on a preset basic communication interval threshold and combined with the average transmission delay and out-of-order jitter rate of the network line. Extract the routing check-in records and node location information generated by the network routing nodes and boundary protection nodes when the data stream is transmitted in the network; According to the chronological order of the timestamp information, the route check-in records and the node location information are sequentially concatenated to generate a real transmission path representing the data flow direction on the initial network topology map.

[0009] As a preferred embodiment of the industrial control equipment security assessment method based on network topology and network path analysis described in this invention, step S3 specifically includes: The encryption status flag of the packet header of each network node on the actual transmission path is checked one by one. If the encryption status flag is determined to be inactive, the corresponding network communication link is marked as the unencrypted link. Send an identity verification request message to the network node on the real transmission path, and receive the digital certificate returned by the network node within the set response time period; The received digital certificate is compared with the system's pre-set list of trusted certificates. Network nodes that do not provide a digital certificate, network nodes whose digital certificates have expired, and network nodes whose certificate signature verification has failed are all marked as uncertified nodes. The network location information of the unencrypted link and the network address information of the unauthenticated node are recorded and saved in the attribute tag of the real transmission path to complete the logical association.

[0010] As a preferred embodiment of the industrial control equipment security assessment method based on network topology and network path analysis described in this invention, step S4 specifically includes: The service control type carried by the actual transmission path is analyzed to determine the basic risk score. If the service control type carried is a mechanical low-level action control instruction, a high-level basic risk score is assigned; if the service control type carried is a normal data reading instruction, a low-level basic risk score is assigned. Extract the number of unencrypted links and the number of unauthenticated certificate nodes to construct a risk amplification coefficient. Use the risk amplification coefficient to calculate the numerical gain of the basic risk score to obtain the corresponding path risk value. Identify all real transmission paths associated with the target industrial control equipment, summarize all associated path risk values ​​and superimpose them to obtain the security assessment score of the target industrial control equipment. The security assessment score is compared with a preset security tolerance threshold. If the security assessment score exceeds the security tolerance threshold, a network blocking command is generated and sent to the firewall device in the network, triggering the firewall device to cut off the unencrypted link to the target industrial control device.

[0011] As a preferred embodiment of the industrial control equipment security assessment method based on network topology and network path analysis described in this invention, after the firewall device is triggered to block the network connection, in order to ensure the business continuity of industrial production, a communication protocol reset command is sent to a trusted network node located in the network topology neighborhood of the target industrial control equipment and verified by a digital certificate, triggering the trusted network node to enable cryptographic encryption algorithm and establish an encrypted data transmission channel.

[0012] As a preferred embodiment of the industrial control equipment security assessment method based on network topology and network path analysis described in this invention, if there are communication delay limitations and computing power constraints, the step of sending a communication protocol reset command and establishing an encrypted data transmission channel includes: The communication protocol reset instruction specifies that the trusted network node uses a lightweight symmetric encryption mechanism; The system uniformly generates a symmetric encryption key and distributes it to the two nodes in the communication interaction, enabling the trusted network nodes to perform fast encryption and decryption operations on the data based on the symmetric encryption key, and establishing a low-latency encrypted data transmission channel.

[0013] As a preferred embodiment of the industrial control equipment security assessment method based on network topology and network path analysis described in this invention, if there are security requirements for network transmission anti-tampering and anti-forgery, the step of sending a communication protocol reset command and establishing an encrypted data transmission channel includes: The communication protocol reset instruction specifies that the trusted network node uses an asymmetric encryption mechanism. The sending network node uses its private key to calculate and generate a digital signature anti-counterfeiting seal on the sent business data. The receiving network node uses the corresponding public key to verify the digital signature anti-counterfeiting seal, verify the integrity of the data and the authenticity of its source, and establish an encrypted data transmission channel with non-repudiation characteristics.

[0014] As a preferred embodiment of the industrial control equipment security assessment method based on network topology and network path analysis described in this invention, if there are security isolation requirements for cross-network segment communication, the step of sending a communication protocol reset command to establish an encrypted data transmission channel includes: The communication protocol reset instruction specifies that the trusted network node located in the network boundary area performs two-way authentication before establishing encrypted communication; The system controls the exchange and verification of electronic identity certificates containing the signatures of certification authorities between the two communicating parties. By verifying the certificate validity period, the certificate issuing authority, and the certificate revocation list, and after confirming the legitimacy of the identities of both nodes, it triggers the establishment of an encrypted data transmission channel across network regions.

[0015] As a preferred embodiment of the industrial control equipment security assessment method based on network topology and network path analysis described in this invention, if the terminal node cannot independently execute the cryptographic algorithm due to hardware limitations, the step of sending a communication protocol reset command and establishing an encrypted data transmission channel includes: The communication protocol reset command is sent to the bypass cryptographic gateway device that is physically directly connected to the terminal node; The control bypass cryptographic gateway device intercepts the plaintext service data sent by the terminal node, converts it into ciphertext data, and then sends it to the target receiver in the network, establishing an encrypted data transmission channel in transparent proxy mode.

[0016] The beneficial effects of this invention are as follows: By extracting communication data packets and tracing time-continuous data streams to reconstruct the actual transmission path, this invention effectively reduces assessment errors caused by deviations from the actual business flow. This invention directly associates unencrypted links and unauthenticated nodes with the actual transmission path, and comprehensively calculates path risk values ​​and device security assessment scores based on the aforementioned indicators. This overcomes the limitations of traditional methods that isolate and detect single-point risks, achieving linked analysis of risks and dynamic business paths. Furthermore, when a high-risk state with excessive scores is identified, the system only sends a disconnect command to the unencrypted link, avoiding production shutdowns caused by indiscriminate physical network outages. This invention constructs a closed-loop security defense system from accurate risk assessment to targeted blocking of dangerous links, effectively ensuring business continuity in industrial production while eliminating underlying communication vulnerabilities. Attached Figure Description

[0017] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 is the main flowchart of the industrial control equipment security assessment method based on network topology and network path analysis provided in the embodiment of the present invention; Figure 2 is a schematic diagram of the industrial control network system architecture and the topology of bypass traffic mirroring access in an embodiment of the present invention; Figure 3 is a schematic diagram of continuity determination and real transmission path generation based on dynamic fault tolerance time threshold in an embodiment of the present invention; Figure 4 is a logical diagram illustrating the full superposition of path risk weighted calculation and security assessment score in an embodiment of the present invention; Figure 5 is a graph showing the time decay and closed-loop self-healing curves of the safety assessment score of the target industrial control equipment in an embodiment of the present invention. Figure 6 is a schematic diagram of the policy tree in which the intelligent policy scheduling center issues communication protocol reset instructions for different node types in an embodiment of the present invention. Detailed Implementation

[0019] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0020] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0021] Secondly, the term "one embodiment" or "example" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the invention. The appearance of an embodiment in different places in this specification does not necessarily refer to the same embodiment, nor is it a single or selective embodiment that mutually excludes other embodiments. Example 1

[0022] Reference Figures 1-5 This is the first embodiment of the present invention, which provides a method for security assessment of industrial control equipment based on network topology and network path analysis, including the following steps: S1. Collect communication data packets, parse the application layer service payload of the communication data packets to obtain network addresses, and construct an initial network topology map reflecting the connection relationship of industrial control equipment based on the network addresses; A traffic mirroring device is bypassed at the core switch of the industrial control network. The traffic mirroring device is used to copy the communication data packets transmitted in the network, and a caching mechanism is configured for the traffic mirroring device to cope with sudden fluctuations in data traffic. Strip the data link layer frame header and network layer protocol header of the communication data packet to extract the application layer service payload containing control instructions; Read the content of the application layer service payload, identify the source node of the sending command and the destination node of the receiving command, and extract the corresponding sending end network address and receiving end network address; By using the network addresses of the sending and receiving ends as nodes and the communication connections between the source and destination nodes as lines, an initial network topology diagram reflecting the physical and logical connection status of industrial control equipment is constructed.

[0023] In a real industrial control network environment, ensuring continuous machine operation is paramount. Therefore, the system is not directly connected to the main communication backbone but instead uses a bypass access method. The traffic mirroring device copies all data flowing through the core switch for analysis. Considering the potential for data surges during specific periods, such as early morning machine startups, the system equips the traffic mirroring device with a sufficiently large buffer to maximize the complete capture of data packets. After acquiring the data packets, the system needs to parse their structure to extract the payload. The system sequentially disassembles the data link layer frame header, used for physical addressing within the local area network, and the network layer protocol header, used for cross-segment routing, to accurately extract the inner application layer service payload. These payloads contain low-level industrial production commands such as starting motors and reading liquid levels. Subsequently, the system extracts the network addresses of both the issuing and receiving parties of the commands, treats these addresses as entity coordinate systems in cyberspace, and reconstructs the actual physical and logical connections between all control devices, sensors, and operating terminals in the entire workshop by connecting them. This allows the system to draw a comprehensive and accurate initial network topology map, providing a basic spatial environment reference for subsequent safety assessments.

[0024] S2. Combine time-continuous communication data packets into a data stream, trace the network nodes through which the data stream passes, and connect them to form the actual transmission path on the initial network topology map; Extract the timestamp information attached to the communication data packets. If the network address of the sending end and the network address of the receiving end are the same, and the time interval between the data packets is less than the set fault tolerance time threshold, then combine the corresponding communication data packets into a continuous data stream. The fault tolerance time threshold is calculated by dynamic time compensation based on the preset basic communication interval threshold and the average transmission delay and out-of-order jitter rate of the network line. Extract routing check-in records and node location information generated by network routing nodes and border protection nodes when the data stream is transmitted in the network; Based on the chronological order of the timestamp information, the routing check-in records and node location information are sequentially concatenated to generate a real transmission path representing the data flow on the initial network topology map.

[0025] A static topology map alone cannot accurately identify potential security risks in the network, because physical connections do not necessarily mean that business data will pass through them. To reconstruct the true movement trajectory of data, the system examines data packets with the same sender and receiver over time. In industrial environments, older network cables often suffer from signal attenuation and transmission congestion; therefore, the system abandons static, fixed time comparisons and instead introduces a dynamically set fault-tolerance time threshold. To facilitate a clear understanding of how this fault-tolerance time threshold dynamically changes based on real-world network conditions, the fault-tolerance time threshold... The dynamic calculation can be achieved using the following formula:

[0026] In the formula: This represents the fault tolerance time threshold calculated by the system at its final stage. This represents the system's preset basic communication interval threshold; This represents the average transmission delay measured in real time on the current network line. This represents the out-of-order jitter rate measured in real time from the current network. and These represent the weighting adjustment coefficients set by the system for network latency and network jitter, respectively.

[0027] The system does not use a fixed static time difference to determine the continuity of data packets. During calculation, the system first extracts the baseline buffer time under ideal network conditions. Subsequently, based on the current real-time network latency... The delay compensation time is calculated by multiplying by the corresponding coefficient; then, it is determined based on the degree of disorder in the packet queuing in the network. The out-of-order compensation time is calculated by multiplying by the corresponding coefficient. The system adds the basic backup time, the delay compensation time, and the out-of-order compensation time to obtain a dynamically relaxed total time limit. As long as the time difference between the arrival of two data packets is less than this relaxed total time limit, the system determines that they have business continuity and packages and splices them into a continuous data stream. For example, as a specific numerical calculation example, assume that the system presets a basic communication interval threshold. The latency weighting factor is set at 20ms for legacy networks. The jitter weighting coefficient is 1.5. The value is 1.2. If the current system measures the average network latency of this road segment to be 10ms and the jitter rate to be 5ms in real time, then the fault tolerance time threshold dynamically calculated by substituting these values ​​into the formula will be relaxed to 41ms. This means that as long as the arrival time difference between the two data packets in the conversation does not exceed 41ms, the system can effectively reduce misjudgments caused by network lag.

[0028] As this data stream travels through the network, intermediate devices such as routers, gateways, and firewalls along the way leave routing records in the header of the data packets. The system then concatenates these node location information collected along the way in strict chronological order, thus clearly outlining a dynamic transmission path from the source to the destination on the static initial network topology map, reflecting the actual flow of business data.

[0029] S3. Read the encryption status flag and digital certificate of the network node on the real transmission path, identify the unencrypted link and the unauthenticated certificate node respectively, and associate the unencrypted link and the unauthenticated certificate node with the real transmission path. The encryption status flag of the message header of each network node on the actual transmission path is checked one by one. If the encryption status flag is determined to be inactive, the corresponding network communication link is marked as an unencrypted link. Send an identity verification request message to the network node on the actual transmission path, and receive the digital certificate returned by the network node within the set response time limit; The received digital certificate is compared with the system's pre-set list of trusted certificates. Network nodes that do not provide a digital certificate, network nodes whose digital certificates have expired, and network nodes whose certificate signature verification has failed are all marked as uncertified nodes. The network location information of the unencrypted link and the network address information of the uncertified node are recorded and saved in the attribute tag of the actual transmission path to complete the logical association.

[0030] This step is crucial for uncovering underlying cryptographic security vulnerabilities in the Industrial Internet. Instead of performing a blind global scan, the system conducts a precise investigation along the previously identified real transmission path. The system first checks the encryption status flag in the packet header. If the flag is found to be inactive, it means that the data transmitted in that link is unencrypted plaintext, and the system immediately marks that segment as a high-risk unencrypted link. As a preferred underlying detection optimization mechanism, to prevent advanced attackers from maliciously forging the encryption status flag and causing system misses, after reading the encryption status flag, the system can further extract the binary byte stream of the application layer payload and calculate its Shannon information entropy value. To facilitate an intuitive understanding of this verification logic, as an example, the information entropy of the application layer payload... The calculation can be performed using the following formula:

[0031] In the formula: This represents the final information entropy value of the extracted application layer business payload. The total number of different types of byte data blocks in the binary byte stream representing the application layer business payload; Representing the The probability (i.e. frequency) of a certain type of byte data block appearing in the service load segment. This represents the summation of the information entropy components of all types of byte data blocks; It represents logarithmic operations with base 2.

[0032] The system first extracts the payload of the intercepted message and then counts the frequency distribution of various byte characteristics within it. Because the actual ciphertext data undergoes obfuscation and diffusion processing using cryptographic algorithms, its byte distribution exhibits a high degree of uniformity and randomness. Therefore, the information entropy value calculated by substituting it into the logarithmic summation formula is... It will approach the theoretical maximum; conversely, if the encryption status flag is active, but the system calculates the information entropy value of the payload, it will approach the theoretical maximum. If the message still falls below the preset security anti-counterfeiting threshold, it is mathematically proven from a probabilistic perspective that the payload contains a large number of repetitive communication protocol control words or plaintext patterns. Based on this, the system determines that the message is actually a forged plaintext command in an encrypted state and marks it as an unencrypted link for risk penalty. Through this deep information entropy cross-verification, the system effectively eliminates the interference of forged messages on the detection mechanism.

[0033] Simultaneously, the system sends identity verification messages to all industrial control devices along the path, requiring them to provide digital certificates for identity verification. Considering the slow response time of industrial equipment operating at full capacity, the system provides a lenient response timeframe. Upon receiving the digital certificate, the system performs multi-dimensional comparisons. If any of the following three conditions are found: the device cannot provide a certificate, the certificate has expired, or the signature has been forged or tampered with, the device's trusted identity is revoked, and it is marked as a certificate-unauthenticated node at risk of unauthorized replacement. Most importantly, the system directly writes the location coordinates of all identified unencrypted links and certificate-unauthenticated nodes into the underlying attribute tags of the corresponding actual transmission path. This deep logical correlation operation overcomes the shortcomings of traditional security assessments that isolate device risk detection, achieving linked analysis of risk and business paths.

[0034] S4. The path risk value is calculated based on the basic risk score of the actual transmission path, the number of unencrypted links, and the number of uncertified nodes. The security assessment score is obtained by combining the path risk values ​​associated with the industrial control equipment. If the security assessment score exceeds the limit, an instruction is sent to cut off the unencrypted link.

[0035] The service control type carried by the actual transmission path is analyzed to determine the basic risk score. If the service control type carried is a mechanical low-level action control command, a high level of basic risk score is assigned; if the service control type carried is a normal data reading command, a low level of basic risk score is assigned. The risk amplification coefficient is constructed by extracting the number of unencrypted links and the number of uncertified nodes. The risk amplification coefficient is then used to calculate the numerical gain of the basic risk score to obtain the corresponding path risk value. All real transmission paths associated with the target industrial control equipment are identified, and the risk values ​​of all associated paths are summed up to obtain the security assessment score of the target industrial control equipment. The security assessment score is compared with a preset security tolerance threshold. If the security assessment score exceeds the security tolerance threshold, a network blocking command is generated and sent to the firewall device in the network, triggering the firewall device to cut off the unencrypted link to the target industrial control device.

[0036] After the firewall device blocks the network connection, in order to ensure the business continuity of industrial production, a communication protocol reset command is sent to a trusted network node that is in the network topology neighborhood of the target industrial control equipment and has been verified by a digital certificate. This triggers the trusted network node to enable the cryptographic encryption algorithm and establish an encrypted data transmission channel.

[0037] To arrive at a scientifically sound safety score that aligns with the factory's actual capacity, the system employs a multi-dimensional weighted calculation model. The system first assesses the safety importance level of operational controls. If the transmission path involves direct control commands for opening and closing high-pressure valves or swinging heavy robotic arms, a high base risk score is assigned; conversely, if it merely involves reading data from a water temperature gauge, a low score is given.

[0038] To visually demonstrate how path risk is amplified by various hazard factors during calculation, path risk values ​​are used. The weighted calculation process can be performed using the following formula:

[0039] In the formula: The path risk value represents the actual transmission path; Represents the basic risk score; Represents the number of unencrypted links; This represents the number of nodes whose certificates have not been authenticated. and This represents the preset risk penalty weighting coefficient for unencrypted and uncertified scenarios.

[0040] The system first categorizes the basic risks inherent in the business itself. The formula uses a base value for calculation. The part within parentheses essentially constitutes a dynamic risk amplification factor. If the current transmission path is flawless (i.e., the number of unencrypted links and uncertified nodes is 0), the amplification factor within parentheses is 1, and the total risk value of the path equals the base hazard score. Once an unencrypted link or uncertified node is found on the path, the system will multiply its quantity by the corresponding penalty coefficient and add it as a penalty increment to the amplification factor. The more security vulnerabilities found, the larger the risk amplification factor becomes. Finally, multiplying the base hazard score by this amplification factor yields a significantly amplified total path risk score, thus intuitively quantifying the multiplier-level destructive effect of vulnerabilities on business security. For example, in a real industrial scenario, for a high-level command path that directly controls the opening and closing of a high-pressure valve, the system assigns it a base risk score. The score is 100. Assume the system has a preset penalty weight for unencrypted links. The penalty weight for uncertified nodes is 0.5. The score is 0.8. If the investigation reveals two unencrypted links and one unlicensed node on this advanced command path, substituting them into the weighted formula will instantly amplify the path risk score to 280 points. .

[0041] In complex industrial control networks, a core target industrial control device often serves as a communication hub node for multiple real transmission paths. The failure of any of these converging paths can threaten the device. Therefore, the system performs comprehensive numerical aggregation and accumulation to derive a security assessment score that reflects the device's true security situation. The specific mathematical expression of this formula is as follows:

[0042] In the formula: The safety assessment score representing the target industrial control equipment; This represents a cumulative summation operation; This represents the total number of actual transmission paths that are physically or logically connected to the target industrial control device; Representing the The path risk value of the actual transmission paths that intersect.

[0043] The system takes the target industrial control equipment as its central perspective and accurately identifies all business data paths that converge and connect to the equipment in the physical and logical networks. Subsequently, the system extracts the risk values ​​of the first and second intersecting paths calculated using the aforementioned weighted formula, and so on, until the... The risk values ​​of each intersecting path are comprehensively summed. The sum represents the overall risk pressure currently faced by the target industrial control equipment, and the system uses this as the final safety assessment score. For example, suppose a target industrial control equipment (hub node) intersects with both a high-level instruction path rated 280 points and a regular data path used only for reading ambient temperature, rated 20 points. After the comprehensive summation, the target industrial control equipment's overall safety assessment score reaches 300 points. If the factory administrator's preset safety tolerance threshold in the system is 200 points, since the equipment's current situation of 300 points has significantly exceeded the limit, the system will immediately trigger a series of defensive actions such as firewall blocking and communication protocol reset.

[0044] When the security assessment score exceeds the factory's pre-set security tolerance threshold, the system avoids employing a global isolation strategy that would trigger a network-wide blockade. Instead, the system automatically generates highly targeted network blocking commands and precisely sends them to firewall devices deployed on the network backbone. This controls the firewall to completely sever only the risky links connected to the target industrial control device that have been confirmed to be leaking plaintext. At the specific blocking execution level, to ensure microsecond-level precision and avoid indiscriminate interruption of normal business communication, the system automatically extracts the five-tuple characteristics of the network packets from the risky link: source IP address, destination IP address, source port, destination port, and transport layer protocol type. Based on these five-tuple characteristics, the system dynamically compiles and generates a refined network access control list (ACL) rule and injects this ACL rule directly into the hardware forwarding table of the core firewall via a standard network configuration protocol (such as NETCONF). This achieves precise business-level isolation, rather than a crude physical port disconnection.

[0045] In the event of a crisis, to maintain the continuous operation of industrial production, the system immediately activates a remedial mechanism. It proactively sends communication protocol reset commands to trusted network nodes located near the target industrial control equipment that have undergone rigorous digital certificate verification. This commands control these nodes to cease using plaintext communication, triggering them to fully implement cryptographic algorithms to hide communication content. This lays the groundwork for subsequently rebuilding a secure, confidential, and compliant encrypted data transmission channel.

[0046] Building upon this foundation, to achieve closed-loop management and self-repair of the industrial control network's network security status, the system incorporates a security status heartbeat monitoring and risk value time decay mechanism. After triggering blocking and protocol reset actions, the system continuously scans the reconstructed transmission path according to a set heartbeat cycle. If, within multiple consecutive cycles, it is detected that the data on this path has been restored to a compliant encrypted state and all nodes have passed certificate authentication, the system will trigger a decay function, causing the originally calculated security assessment score of the target industrial control equipment to gradually and smoothly decay over time. As a non-limiting technical reference, the smooth decay process of the security assessment score can adopt the following exponential decay example formula:

[0047] In the formula: Representative process The current security assessment score monitored by the system in real time after each recovery cycle; This represents the initial peak performance score achieved by the target industrial control equipment before the blocking action was implemented. Represents the natural constant (irrational number); This represents the system's preset decay constant (used to dynamically control the smooth rate of score decline, with a value greater than 0). This represents the number of consecutive secure heartbeat cycles that occurred after the network returned to a compliant encrypted state.

[0048] The system monitors the effectiveness of network remediation through continuous heartbeat backscans. Once it is confirmed that the threat has been eliminated and the encrypted channel has been successfully rebuilt, the number of secure heartbeat cycles is recorded. It begins to accumulate and increase over time. At this point, the decay factor... It will show a smooth downward curve, which, when compared with previous historical high scores, indicates a potential danger. Multiplication causes the system's real-time security score to no longer remain consistently high, but instead dynamically decline based on the duration of compliance. When this real-time score... When the network environment of the industrial control device naturally decays and falls back below the preset security tolerance threshold, the system determines that the network environment has been restored to a safe state and automatically cancels the network access control list blocking command issued to the core firewall, thereby completing the security self-healing and closed-loop recovery of the entire industrial control network topology. Example 2

[0049] Reference Figure 6This is the second embodiment of the present invention. This embodiment provides a security assessment method for industrial control equipment based on network topology and network path analysis. Building upon Embodiment 1, this embodiment further refines the specific implementation of the system sending communication protocol reset commands to rebuild the encrypted data transmission channel. Addressing the differences in hardware computing power, latency requirements, and boundary attributes among nodes in the industrial control network, the system adaptively determines the environmental characteristics of the target node through its built-in intelligent policy scheduling center and issues different types of reconstruction commands accordingly. If there are communication latency restrictions and computing power constraints, the steps to send a communication protocol reset command and establish an encrypted data transmission channel include: The communication protocol reset command specifies that trusted network nodes should use a lightweight symmetric encryption mechanism; The system generates a symmetric encryption key and distributes it to the two nodes in the communication interaction, enabling trusted network nodes to perform fast encryption and decryption operations on data based on the symmetric encryption key, and establishing a low-latency encrypted data transmission channel.

[0050] In industrial settings, devices such as CNC machine tools and high-speed robotic arms face stringent millisecond-level latency limitations when performing motion control. Furthermore, the CPUs of these lower-level nodes typically have limited computing power, insufficient to support complex mathematical operations. Forcing the application of conventional high-strength asymmetric cryptographic handshake protocols would cause delays in command delivery, leading to operational pauses or misalignments in industrial production. Therefore, when the system assesses that the communication link involves underlying real-time control operations, it adaptively issues a lightweight symmetric encryption strategy. The system, acting as a trusted third party, directly generates a unified symmetric encryption key and synchronously distributes it to both the sender and receiver. The two parties do not need to engage in time-consuming key negotiation; they can directly use this single key to encrypt and decrypt business data. This strategy ensures data communication confidentiality while minimizing the computational overhead of cryptographic algorithms and network transmission latency, meeting the stringent requirements of underlying production control scenarios.

[0051] If there are security requirements for network transmission to resist tampering and forgery, the steps for sending a communication protocol reset command and establishing an encrypted data transmission channel include: The communication protocol reset command specifies that trusted network nodes use an asymmetric encryption mechanism. The sending network node uses its private key to calculate and generate a digital signature anti-counterfeiting seal for the sent business data. The receiving network node uses the corresponding public key to verify the digital signature anti-counterfeiting seal, verify the integrity of the data and the authenticity of its source, and establish an encrypted data transmission channel with non-repudiation characteristics.

[0052] In particular, considering that remote data acquisition nodes distributed in field pipelines or remote physical areas are vulnerable to wiretapping and eavesdropping, and face the risk of external attackers maliciously forging sensor readings and transmitting them back, simple confidentiality is insufficient to address the threat; the authenticity of the data source and its tamper-proof nature are crucial. Therefore, when the system determines that a node is in a high-risk exposure area, it adaptively issues an asymmetric encryption and digital signature strategy. The system controls the sending node to use a pre-allocated private key to perform hashing and asymmetric encryption calculations on the collected business payload, generating a unique digital signature anti-counterfeiting seal, which is then sent along with the business ciphertext. To intuitively demonstrate how this anti-tampering and non-repudiation feature is implemented through mathematical logic at the underlying level, as an optional specific cryptographic implementation example, and without limiting the type of asymmetric algorithm protected by this invention, the digital signature anti-counterfeiting seal... The generation and verification process can be expressed mathematically as follows:

[0053] In the formula: This represents the original service data payload actually collected by the sending end; Represents a cryptographic one-way hash function (such as the SHA-256 algorithm), used to extract a fixed-length digital fingerprint of data; This represents a private key that is unique to the sender and is kept strictly confidential. This represents the public key that is paired with the private key and is publicly available across the entire network; and These represent the encryption and decryption functions in asymmetric encryption algorithms, respectively. This means that a strict consistency check is performed on both sides of the equation.

[0054] At the sending end, the system first sends the large volume of raw business data. Input one-way hash function The system extracts a unique digital fingerprint; subsequently, it uses a private key known only to the sender. Perform encryption operation on the fingerprint The result is the digital signature anti-counterfeiting seal sent with the message. When the message arrives at the target receiver, the receiver executes two parallel computational logics: on the one hand, the receiver uses the same hash function to hash the received message. The digital fingerprint is recalculated; on the other hand, the receiving end calls the public key published by the sending end. Regarding the received signatures and seals Perform decryption operation This process reconstructs the fingerprint originally generated by the sender. Finally, the receiver compares the two fingerprints to see if they are identical. If the equation holds true, it not only mathematically proves that the data has not been tampered with during transmission (ensuring data integrity), but also verifies, through the unique pairing of public and private keys, that the data originated from the designated sender holding the private key (ensuring authenticity of the source and non-repudiation). Upon receiving the message, the receiving end must use the public key published by the sender to perform mathematical and logical verification on the signature. By verifying the digital signature, the system can accurately identify whether the data has been tampered with during transmission and confirm the true sender of the message, thereby constructing a high-security transmission channel with anti-forgery and non-repudiation characteristics.

[0055] If there are security isolation requirements for cross-network segment communication, the steps to send a communication protocol reset command to establish an encrypted data transmission channel include: The communication protocol reset command specifies that trusted network nodes located in the network boundary area must perform two-way authentication before establishing encrypted communication; The system controls the exchange and verification of electronic identity certificates containing the signatures of certification authorities between the two communicating parties. By verifying the certificate validity period, the certificate issuing authority, and the certificate revocation list, and after confirming the legitimacy of the identities of both nodes, it triggers the establishment of an encrypted data transmission channel across network regions.

[0056] In modern industrial internet architectures, business data often needs to traverse different physical workshop networks and even penetrate the boundary isolation areas between office IT networks and industrial OT networks. The primary threats in cross-network segment communication scenarios are identity impersonation and man-in-the-middle attacks. Therefore, when the system detects that a business path crosses different network segments, it adaptively issues a two-way authentication policy to the gateway node located in the network boundary area. Before formally establishing a cross-network segment data transmission tunnel, the system controls the boundary nodes of both communicating parties to suspend business data interaction, forcing both parties to exchange electronic identity certificates issued by a Certificate Authority (CA). The system automatically calls and verifies the Certificate Revocation List (CRL) to rigorously examine the validity period of both certificates, the legitimacy of the issuing authority, and whether they are on the blacklist. Only after confirming that the identities of both communicating nodes are completely legitimate is the subsequent key exchange and tunnel establishment process triggered, thus constructing a robust logical identity defense line at the physically isolated network boundary.

[0057] If a terminal node is unable to execute a cryptographic algorithm independently due to hardware limitations, the steps for sending a communication protocol reset command and establishing an encrypted data transmission channel include: Send the communication protocol reset command to the bypass cryptographic gateway device that is physically directly connected to the terminal node; The control bypass cryptographic gateway device intercepts plaintext service data sent by terminal nodes, converts it into ciphertext data, and then sends it to the target receiver in the network, establishing an encrypted data transmission channel in transparent proxy mode.

[0058] In particular, considering the large number of older programmable logic controllers (PLCs) or terminal devices commonly found in industrial control systems, these older devices, limited by their early hardware design architecture, cannot install modern cryptographic software or have the memory space to perform encryption operations, making them vulnerable nodes that cannot be directly modified in terms of protocol. To avoid program crashes or freezes caused by forcibly issuing encryption commands, the system performs a compatibility check before sending commands and adaptively adopts a transparent proxy strategy. The system no longer issues communication protocol reset commands to the older terminal nodes themselves, but instead intelligently switches the control target to a bypass cryptographic gateway device directly connected to the older terminal via a physical network cable. This bypass cryptographic gateway device remains completely hidden from the older terminal at the network layer, and the older terminal continues to send business data in its original plaintext format. The bypass cryptographic gateway device intercepts the plaintext data the moment it leaves the terminal interface, uses its own hardware computing power to convert it into ciphertext, and then forwards it on behalf of the older terminal. This transparent proxy mode does not require modification of the older device's IP configuration or network parameters, and achieves a seamless cryptographic upgrade of older industrial control nodes through a transparent takeover proxy forwarding mechanism.

[0059] In summary, this invention effectively reduces assessment errors caused by deviating from the actual business flow by extracting communication data packets and tracing time-continuous data streams to reconstruct the true transmission path. This invention directly associates unencrypted links and unauthenticated nodes with the true transmission path, and comprehensively calculates path risk values ​​and device security assessment scores based on the aforementioned indicators. This overcomes the limitations of traditional methods that isolate and detect single-point risks, achieving linked analysis of risks and dynamic business paths. Furthermore, when a high-risk state with excessive scores is identified, the system only sends a disconnect command to the unencrypted link, avoiding production shutdowns caused by indiscriminate physical network outages. This invention constructs a closed-loop security defense system from accurate risk assessment to targeted blocking of dangerous links, effectively ensuring business continuity in industrial production while eliminating underlying communication vulnerabilities.

[0060] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A method for security assessment of industrial control equipment based on network topology and network path analysis, characterized in that, Performed by a computer device, including the following steps: S1. Collect communication data packets, parse the application layer service payload of the communication data packets to obtain network addresses, and construct an initial network topology map reflecting the connection relationship of industrial control equipment based on the network addresses; S2. Combine the time-continuous communication data packets into a data stream, trace the network nodes through which the data stream passes, and connect them to form the actual transmission path on the initial network topology map; S3. Read the encryption status flag and digital certificate of the network node on the real transmission path, identify the unencrypted link and the unauthenticated certificate node respectively, and associate the unencrypted link, the unauthenticated certificate node and the real transmission path; S4. Calculate the path risk value based on the basic risk score of the actual transmission path, the number of unencrypted links, and the number of unauthenticated certificate nodes. Combine the path risk values ​​associated with the industrial control equipment to obtain a security assessment score. If the security assessment score exceeds the limit, send an instruction to disconnect the unencrypted link.

2. The industrial control equipment security assessment method based on network topology and network path analysis according to claim 1, characterized in that, S1 specifically includes: A traffic mirroring device is bypassed and connected to the core switch of the industrial control network. The traffic mirroring device is used to copy the communication data packets transmitted in the network, and a caching mechanism is configured for the traffic mirroring device to cope with sudden fluctuations in data traffic. Strip the data link layer frame header and network layer protocol header of the communication data packet to extract the application layer service payload containing control instructions; Read the content of the application layer service payload, identify the source node of the sending instruction and the destination node of the receiving instruction, and extract the corresponding sending end network address and receiving end network address; Using the sending end network address and the receiving end network address as nodes, and the communication connection behavior between the source node and the destination node as lines, an initial network topology diagram reflecting the physical and logical connection status of the industrial control equipment is constructed.

3. The industrial control equipment security assessment method based on network topology and network path analysis according to claim 1, characterized in that, S2 specifically includes: Extract the timestamp information attached to the communication data packet. If the network address of the sending end and the network address of the receiving end are the same, and the time interval between the data packets is less than the set fault tolerance time threshold, then combine the corresponding communication data packets into a continuous data stream. The fault tolerance time threshold is calculated by dynamic time compensation based on a preset basic communication interval threshold and combined with the average transmission delay and out-of-order jitter rate of the network line. Extract the routing check-in records and node location information generated by the network routing nodes and boundary protection nodes when the data stream is transmitted in the network; According to the chronological order of the timestamp information, the route check-in records and the node location information are sequentially concatenated to generate a real transmission path representing the data flow direction on the initial network topology map.

4. The industrial control equipment security assessment method based on network topology and network path analysis according to claim 1, characterized in that, S3 specifically includes: The encryption status flag of the packet header of each network node on the actual transmission path is checked one by one. If the encryption status flag is determined to be inactive, the corresponding network communication link is marked as the unencrypted link. Send an identity verification request message to the network node on the real transmission path, and receive the digital certificate returned by the network node within the set response time period; The received digital certificate is compared with the system's pre-set list of trusted certificates. Network nodes that do not provide a digital certificate, network nodes whose digital certificates have expired, and network nodes whose certificate signature verification has failed are all marked as uncertified nodes. The network location information of the unencrypted link and the network address information of the unauthenticated node are recorded and saved in the attribute tag of the real transmission path to complete the logical association.

5. The industrial control equipment security assessment method based on network topology and network path analysis according to claim 1, characterized in that, S4 specifically includes: The service control type carried by the actual transmission path is analyzed to determine the basic risk score. If the service control type carried is a mechanical low-level action control command, a high-level basic risk score is assigned; if the service control type carried is a normal data reading command, a low-level basic risk score is assigned. Extract the number of unencrypted links and the number of unauthenticated certificate nodes to construct a risk amplification coefficient. Use the risk amplification coefficient to calculate the numerical gain of the basic risk score to obtain the corresponding path risk value. Identify all real transmission paths associated with the target industrial control equipment, summarize all associated path risk values ​​and superimpose them to obtain the security assessment score of the target industrial control equipment. The security assessment score is compared with a preset security tolerance threshold. If the security assessment score exceeds the security tolerance threshold, a network blocking command is generated and sent to the firewall device in the network, triggering the firewall device to cut off the unencrypted link to the target industrial control device.

6. The industrial control equipment security assessment method based on network topology and network path analysis according to claim 5, characterized in that, After the firewall device blocks the network connection, in order to ensure the business continuity of industrial production, a communication protocol reset command is sent to a trusted network node located in the network topology neighborhood of the target industrial control equipment and verified by a digital certificate, triggering the trusted network node to enable cryptographic encryption algorithm and establish an encrypted data transmission channel.

7. The industrial control equipment security assessment method based on network topology and network path analysis according to claim 6, characterized in that, If there are communication latency restrictions and computing power constraints, the step of sending a communication protocol reset command and establishing an encrypted data transmission channel includes: The communication protocol reset instruction specifies that the trusted network node uses a lightweight symmetric encryption mechanism; The system generates a symmetric encryption key and distributes it to the two nodes in the communication interaction, enabling the trusted network nodes to perform fast encryption and decryption operations on the data based on the symmetric encryption key, and establishing a low-latency encrypted data transmission channel.

8. The industrial control equipment security assessment method based on network topology and network path analysis according to claim 6, characterized in that, If there are security requirements for network transmission to resist tampering and forgery, the step of sending a communication protocol reset command and establishing an encrypted data transmission channel includes: The communication protocol reset instruction specifies that the trusted network node uses an asymmetric encryption mechanism. The sending network node uses its private key to calculate and generate a digital signature anti-counterfeiting seal on the sent business data. The receiving network node uses the corresponding public key to verify the digital signature anti-counterfeiting seal, verify the data integrity and authenticity of the source, and establish an encrypted data transmission channel with non-repudiation characteristics.

9. The industrial control equipment security assessment method based on network topology and network path analysis according to claim 6, characterized in that, If there are security isolation requirements for cross-network segment communication, the step of sending a communication protocol reset command to establish an encrypted data transmission channel includes: The communication protocol reset instruction specifies that the trusted network node located in the network boundary area performs two-way authentication before establishing encrypted communication; The system controls the exchange and verification of electronic identity certificates containing the signatures of certification authorities between the two communicating parties. By verifying the certificate validity period, the certificate issuing authority, and the certificate revocation list, and after confirming the legitimacy of the identities of both nodes, it triggers the establishment of an encrypted data transmission channel across network regions.

10. The industrial control equipment security assessment method based on network topology and network path analysis according to claim 6, characterized in that, If a terminal node is unable to independently execute a cryptographic algorithm due to hardware limitations, the step of sending a communication protocol reset command and establishing an encrypted data transmission channel includes: The communication protocol reset command is sent to the bypass cryptographic gateway device that is physically directly connected to the terminal node; The control bypass cryptographic gateway device intercepts the plaintext service data sent by the terminal node, converts it into ciphertext data, and then sends it to the target receiver in the network, establishing an encrypted data transmission channel in transparent proxy mode.

Images