WO2022213535A1 - 一种基于隧道加解密的工业控制系统通信方法及系统 - Google Patents
一种基于隧道加解密的工业控制系统通信方法及系统 Download PDFInfo
- Publication number
- WO2022213535A1 WO2022213535A1 PCT/CN2021/116128 CN2021116128W WO2022213535A1 WO 2022213535 A1 WO2022213535 A1 WO 2022213535A1 CN 2021116128 W CN2021116128 W CN 2021116128W WO 2022213535 A1 WO2022213535 A1 WO 2022213535A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- key
- encryption
- tunnel
- control device
- decryption
- Prior art date
Links
- 230000006854 communication Effects 0.000 title claims abstract description 235
- 238000004891 communication Methods 0.000 title claims abstract description 231
- 238000000034 method Methods 0.000 title claims abstract description 49
- 238000006243 chemical reaction Methods 0.000 claims description 29
- 230000004044 response Effects 0.000 claims description 24
- 238000012795 verification Methods 0.000 claims description 19
- 230000008569 process Effects 0.000 abstract description 20
- 230000003044 adaptive effect Effects 0.000 abstract description 3
- 238000012986 modification Methods 0.000 abstract description 3
- 230000004048 modification Effects 0.000 abstract description 3
- 238000010586 diagram Methods 0.000 description 7
- 230000008901 benefit Effects 0.000 description 3
- 238000004519 manufacturing process Methods 0.000 description 3
- 238000012544 monitoring process Methods 0.000 description 3
- 230000005540 biological transmission Effects 0.000 description 2
- 238000012545 processing Methods 0.000 description 2
- 230000009466 transformation Effects 0.000 description 2
- 238000013475 authorization Methods 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 230000006872 improvement Effects 0.000 description 1
- 238000012423 maintenance Methods 0.000 description 1
- 238000012067 mathematical method Methods 0.000 description 1
- 230000007246 mechanism Effects 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G05—CONTROLLING; REGULATING
- G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
- G05B19/00—Programme-control systems
- G05B19/02—Programme-control systems electric
- G05B19/418—Total factory control, i.e. centrally controlling a plurality of machines, e.g. direct or distributed numerical control [DNC], flexible manufacturing systems [FMS], integrated manufacturing systems [IMS] or computer integrated manufacturing [CIM]
- G05B19/4185—Total factory control, i.e. centrally controlling a plurality of machines, e.g. direct or distributed numerical control [DNC], flexible manufacturing systems [FMS], integrated manufacturing systems [IMS] or computer integrated manufacturing [CIM] characterised by the network communication
-
- G—PHYSICS
- G05—CONTROLLING; REGULATING
- G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
- G05B2219/00—Program-control systems
- G05B2219/30—Nc systems
- G05B2219/33—Director till display
- G05B2219/33139—Design of industrial communication system with expert system
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
- Y02P—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN THE PRODUCTION OR PROCESSING OF GOODS
- Y02P90/00—Enabling technologies with a potential contribution to greenhouse gas [GHG] emissions mitigation
- Y02P90/02—Total factory control, e.g. smart factories, flexible manufacturing systems [FMS] or integrated manufacturing systems [IMS]
Definitions
- the present application belongs to the technical field of system security, and more specifically, relates to a communication method and system for an industrial control system based on tunnel encryption and decryption.
- the present invention provides an industrial control system communication method and system based on tunnel encryption and decryption that overcomes the above problems or at least partially solves the above problems.
- the technical solutions are as follows:
- a communication method for an industrial control system based on tunnel encryption and decryption comprising:
- the national encryption and decryption tunnel obtains the request data packet sent by the client device, wherein the request data packet carries There is the device identification of the target control device and the target industrial control protocol, and the national encryption and decryption tunnel is transparent to the client device;
- the national encryption and decryption tunnel determines a tunnel encryption policy matching the request data packet according to the device identifier and the target industrial control protocol;
- the national encryption and decryption tunnel queries the target key information matching the target control device in the encrypted communication database according to the tunnel encryption strategy;
- the national encryption and decryption tunnel determines whether there is a first communication key within the validity period in the target key information, wherein the first communication key is determined by the national encryption and decryption tunnel and the target control device. Determined by identity identification and key agreement;
- the request data packet is encrypted and obtained according to the first communication key and the national encryption algorithm. the first encrypted data packet;
- the national encryption and decryption tunnel sends the first encrypted data packet to the target control device
- the target control device decrypts the first encrypted data packet according to the first communication key to obtain the request data packet;
- the target control device responds to the request data packet, and obtains a response data packet
- the target control device encrypts the response data packet according to the first communication key and the national secret algorithm to obtain a second encrypted data packet;
- the target control device sends the second encrypted data packet to the national encryption and decryption tunnel
- the national encryption and decryption tunnel decrypts the second encrypted data packet according to the first communication key, obtains the response data packet, and sends the response data packet to the client device.
- the method further includes:
- the destination information in the request data packet is converted with the protocol in the tunnel encryption policy
- the policy is matched, and if the match is successful, the national encryption and decryption tunnel performs a protocol conversion operation on the request data packet according to the protocol conversion policy.
- the method further includes:
- the national encryption and decryption tunnel and the target control device determine the second communication key through identity identification and key negotiation;
- the national encryption and decryption tunnel adds the second communication key to the target key information.
- determining the second communication key through identity identification and key negotiation between the national encryption and decryption tunnel and the target control device may include:
- the national encryption and decryption tunnel sends the first digital certificate and the first random number encrypted by the first private key to the target control device;
- the target control device verifies the validity of the first digital certificate according to the root certificate of the CA server; if the verification is passed, the target control device uses the first public key carried in the first digital certificate to verify the validity of the first digital certificate.
- the first random number encrypted by the private key is decrypted;
- the target control device generates and obtains a second random number, generates a second communication key according to the decrypted first random number and the second random number, and stores the second communication key;
- the target control device sends the second digital certificate, the decrypted first random number, and the second random number encrypted by the second private key to the national encryption and decryption tunnel;
- the national encryption and decryption tunnel performs validity verification on the second digital certificate and the decrypted first random number according to the root certificate of the CA server. If the verification is passed, the second digital certificate is used.
- the second public key carried decrypts the second random number encrypted by the second private key;
- the national encryption and decryption tunnel generates the second communication key according to the first random number and the decrypted second random number and stores the second communication key;
- the national encryption and decryption tunnel uses the second communication key to encrypt the decrypted second random number, and sends the second random number encrypted by the second communication key to the target controlling device;
- the target control device decrypts the second random number encrypted by the second communication key using the second communication key, and verifies the validity of the decrypted second random number, If the verification is passed, the target control device sends a notification to the national encryption and decryption tunnel that encrypted communication can be performed by using the second communication key.
- the first digital certificate is issued by the CA server to the national encryption and decryption tunnel
- the second digital certificate is issued by the CA server to the target control device.
- the method further includes:
- the national encryption and decryption tunnel detects the key information matched with each control device in the encrypted communication database according to a preset period. When the key information that meets the preset key negotiation conditions is detected, the The national encryption and decryption tunnel and the control device corresponding to the key information determine the communication key through identity identification and key negotiation.
- the preset key negotiation conditions include:
- control device recorded in the key information and the national encryption/decryption tunnel determine through identity identification and key negotiation that the communication key negotiation failure times are within the preset negotiation times.
- the state secret algorithm includes a state secret asymmetric encryption algorithm, a state secret symmetric encryption algorithm, and a state secret password hash algorithm.
- the state secret asymmetric encryption algorithm is an elliptic curve encryption algorithm, and/or the state secret symmetric encryption algorithm is a block cipher algorithm.
- An industrial control system communication system based on tunnel encryption and decryption comprising: a client device, a target control device and a national encryption and decryption tunnel,
- the national encryption and decryption tunnel is used to obtain the request data packet sent by the client device in the initial stage of communication between the client device and the target control device through the national encryption and decryption tunnel , wherein the request data packet carries the device identification of the target control device and the target industrial control protocol, and the national encryption and decryption tunnel is transparent to the client device;
- the national encryption and decryption tunnel is also used to determine a tunnel encryption policy matching the request data packet according to the device identifier and the target industrial control protocol;
- the national encryption and decryption tunnel is also used for querying the target key information matched with the target control device in the encrypted communication database according to the tunnel encryption strategy;
- the national encryption and decryption tunnel is also used to determine whether there is a first communication key within the validity period in the target key information, wherein the first communication key is used by the national encryption and decryption tunnel and the The target control device is determined through identity identification and key negotiation;
- the national encryption and decryption tunnel is also used for, in the case that the first communication key within the validity period exists in the target key information, according to the first communication key and the national encryption algorithm to the request data.
- the packet is encrypted to obtain the first encrypted data packet;
- the national encryption and decryption tunnel is also used to send the first encrypted data packet to the target control device;
- the target control device is used for decrypting the first encrypted data packet according to the first communication key to obtain the request data packet;
- the target control device is further configured to respond to the request data packet and obtain a response data packet;
- the target control device is further configured to encrypt the response data packet according to the first communication key and the national secret algorithm to obtain a second encrypted data packet;
- the target control device is further configured to send the second encrypted data packet to the national encryption and decryption tunnel;
- the national encryption and decryption tunnel is further configured to decrypt the second encrypted data packet according to the first communication key, obtain the response data packet, and send the response data packet to the client device.
- the present disclosure provides a communication method and system for an industrial control system based on tunnel encryption and decryption, which uses the first communication key within the validity period and the
- the national secret algorithm completes the encrypted communication between the client device and the target control device, wherein the first communication key is determined by the national encryption and decryption tunnel and the target control device through identity identification and key negotiation.
- the present disclosure completes the encrypted communication between the client device and the target control device based on the transparent national encryption and decryption tunnel, and completes the process of encrypting and decrypting data sent and received by the client device in the form of a proxy service, avoiding the need for the client device to encrypt and decrypt data. It is easy to realize safe communication between various industrial control systems because of the compatibility problem of adaptive transformation of the relevant industrial control software in the system.
- FIG. 1 shows a schematic diagram of an implementation manner of an industrial control system communication method based on tunnel encryption and decryption provided by an embodiment of the present disclosure
- FIG. 2 shows a schematic diagram of a process of determining a second communication key through identity identification and key negotiation between a national encryption and decryption tunnel and a target control device provided by an embodiment of the present disclosure
- FIG. 3 shows a schematic structural diagram of an industrial control system communication system based on tunnel encryption and decryption provided by an embodiment of the present disclosure
- FIG. 4 shows another schematic structural diagram of an industrial control system communication system based on tunnel encryption and decryption provided by an embodiment of the present disclosure.
- the communication method for an industrial control system based on tunnel encryption and decryption may include:
- the national encryption and decryption tunnel obtains a request data packet sent by the client device, wherein the request data packet carries the target control device
- the national encryption and decryption tunnel is transparent to the client device.
- the client device may include an engineer station (ES station) and an operator station (OS station).
- the target control device may include an operator station (OS station) and a controller.
- the engineering station can be a computer device that installs programming configuration software and monitors and operates the configuration software.
- the operator station can be a computer device that installs the monitoring operation configuration software and the corresponding authorization license (License Keys).
- the target control device has a built-in national encryption algorithm encryption and decryption module, which can support national encryption encrypted communication.
- the national encryption and decryption tunnel is a transparent proxy data encryption and decryption tunnel using the national encryption and decryption algorithm.
- the request data packet may include the device identification of the target control device, the target industrial control protocol, request content information, address information, port information, service information, and protocol content information.
- the national encryption and decryption tunnel is transparent to the client device, which means that the national encryption and decryption tunnel is invisible to the client device.
- the national encryption and decryption tunnel can be built in the client device.
- the national encryption and decryption tunnel and the built-in national encryption algorithm encryption and decryption module of the target control device can encrypt and decrypt data according to the relevant communication key and national encryption algorithm, but no matter whether the national encryption and decryption tunnel is built in the client In the device, the national encryption and decryption tunnel is transparent to the client device. It can be understood that the client device does not know the existence of the national encryption and decryption tunnel, which is equivalent to the national encryption and decryption tunnel to implement data encryption and decryption for the client device agent. For the client device, the data sent and received is in clear text. The encryption and decryption module of the national encryption algorithm is visible to the target control device. The target control device actively calls the encryption and decryption module of the national encryption algorithm to perform the encryption and decryption process of the data.
- the national encryption and decryption tunnel determines a tunnel encryption policy matching the request data packet according to the device identification and the target industrial control protocol.
- the national encryption and decryption tunnel integrates tunnel encryption policies that match with each industrial control protocol.
- the embodiment of the present disclosure can find out a tunnel encryption policy matching the request data packet by using the device identifier and the target industrial control protocol in the request data packet.
- the request data packet is directly sent to the target control device.
- the national encryption and decryption tunnel searches the encrypted communication database for the target key information matching the target control device.
- the tunnel encryption policy includes a set of rules for querying target key information matching the target control device in the encrypted communication database.
- the national encryption and decryption tunnel can query the encrypted communication database according to the rule matching items required in the tunnel encryption policy and use the information corresponding to the rule matching items to query the target key information matching the target control device.
- rule matching items can be device ID and target industrial control protocol.
- the target key information may include information such as the communication address of the target control device, the current communication key, the historical communication key, the next communication key, and the relevant certificate of the target control device.
- the current communication key may be a communication key within the validity period.
- the historical communication key can be a communication key that has been used and has expired.
- the next communication key may be a communication key that has not expired and is used in the next communication.
- the embodiment of the present disclosure can use a tunnel encryption strategy to search and query target key information matching the target control device in the encrypted communication database according to the device identifier included in the request data packet.
- the national encryption and decryption tunnel determines whether there is a first communication key within the validity period in the target key information, wherein, the first communication key is identified by the national encryption and decryption tunnel and the target control device through the identification and key Negotiated.
- the national encryption and decryption tunnel and the target control device determine the second communication key through identity identification and key negotiation.
- the national encryption and decryption tunnel adds the second communication key to the target key information.
- FIG. 2 a schematic diagram of the process of determining the second communication key between the national encryption and decryption tunnel and the target control device through identity identification and key negotiation provided by the embodiment of the present disclosure, the national encryption and decryption tunnel and the target control device.
- the process of determining the second communication key by the device through identity identification and key negotiation may specifically include:
- the national encryption and decryption tunnel sends the first digital certificate and the first random number encrypted by the first private key to the target control device.
- the target control device performs validity verification on the first digital certificate according to the root certificate of the CA server; if the verification is passed, step B003 is performed.
- the CA (Certification Authority) server is the server of the certification authority, which can issue, manage and cancel the digital certificate for the applicant of the digital certificate.
- the role of the CA server is to check the legitimacy of the identity of the digital certificate holder and issue a digital certificate (sign the certificate with a mathematical method) to prevent the digital certificate from being forged or tampered with.
- the target control device uses the first public key carried in the first digital certificate to decrypt the first random number encrypted by the first private key.
- the target control device generates a second random number, generates a second communication key according to the decrypted first random number and the second random number, and stores the second communication key.
- the target control device sends the second digital certificate, the decrypted first random number, and the second random number encrypted by the second private key to the national encryption and decryption tunnel.
- step B006 the national encryption and decryption tunnel performs validity verification on the second digital certificate and the decrypted first random number according to the root certificate of the CA server, and if the verification is passed, step B007 is performed.
- connection reset is used to instruct the national encryption and decryption tunnel to re-establish a connection with the target control device.
- the national encryption and decryption tunnel uses the second public key carried by the second digital certificate to decrypt the second random number encrypted by the second private key.
- the national encryption and decryption tunnel generates a second communication key according to the first random number and the decrypted second random number, and stores the second communication key.
- the national encryption and decryption tunnel uses the second communication key to encrypt the decrypted second random number, and sends the second random number encrypted by the second communication key to the target control device.
- step B011 is executed.
- connection reset is used to instruct the national encryption and decryption tunnel to re-establish a connection with the target control device.
- the target control device sends a notification to the national encryption and decryption tunnel that encrypted communication can be performed using the second communication key.
- the first digital certificate is issued by the CA server to the national encryption and decryption tunnel
- the second digital certificate is issued by the CA server to the target control device.
- the national encryption and decryption tunnel sends a connection request and tunnel information Info to the CA server. After receiving the connection request, the CA server verifies and records the tunnel information Info. After the verification is passed, the CA server sends the CA certificate Cer1 to the national encryption and decryption tunnel. The national encryption and decryption tunnel verifies the validity of the CA certificate Cer1 through the root certificate. After the verification is passed, the national encryption and decryption tunnel generates a tunnel key pair SK and a certificate issuance request.
- the national encryption and decryption tunnel sends the certificate issuance request and the public key information PK in the tunnel key pair SK to the CA server.
- the CA server generates and records the first digital certificate according to the certificate issuance request and the public key information PK.
- the CA server sends the first digital certificate to the national encryption and decryption tunnel.
- the national encryption and decryption tunnel verifies the validity of the first digital certificate through the tunnel key pair SK and root certificate. After the verification is passed, the national encryption and decryption tunnel stores the first digital certificate.
- tunnel key pair SK is the communication key obtained by the national encryption and decryption tunnel and the target control device through key negotiation.
- the state secret algorithm includes a state secret asymmetric encryption algorithm, a state secret symmetric encryption algorithm, and a state secret password hash algorithm.
- the national secret asymmetric encryption algorithm is an elliptic curve encryption algorithm, and/or the national secret symmetric encryption algorithm is a block cipher algorithm.
- the embodiment of the present disclosure applies the national secret algorithm to the communication of the industrial control system, and realizes the encrypted communication of the industrial control system based on the national secret algorithm.
- the encrypted communication process keys are all different and cannot be forged, which greatly ensures the safety and effectiveness of the communication process.
- the national encryption and decryption tunnel sends the first encrypted data packet to the target control device.
- the target control device decrypts the first encrypted data packet according to the first communication key to obtain the request data packet.
- the target control device responds to the request data packet, and obtains the response data packet.
- the target control device encrypts the response data packet according to the first communication key and the national secret algorithm to obtain a second encrypted data packet.
- the target control device sends the second encrypted data packet to the national encryption and decryption tunnel.
- the national encryption and decryption tunnel decrypts the second encrypted data packet according to the first communication key, obtains a response data packet, and sends the response data packet to the client device.
- the embodiments of the present disclosure identify the data at the stage of data export of the client device through the encryption and decryption tunnel based on the transparent national encryption, without performing secondary development and compatibility adjustment of the industrial control system software, and pass the encryption through the encryption and decryption tunnel. Key negotiation, maintenance, and management, and encryption and decryption processing are performed with the communication key as the overall encrypted communication certificate.
- the software on the client device processes the decrypted or unencrypted original data, so that the encryption and decryption of the data will not affect the normal business processing of the software.
- the present disclosure can effectively avoid the software compatibility problem under the condition of industrial control systems with multiple types, functions and multiple suppliers, and ensure the safety and effectiveness of the communication process.
- the national encryption and decryption tunnel combines the characteristics of the national encryption algorithm and digital certificate, and realizes the encryption, decryption and identity authentication of the communication between the client device and the target control device.
- the national encryption and decryption tunnel effectively utilizes the non-repudiation and non-forgery characteristics of digital certificates, restricts unauthorized operations, and ensures the security of communication identity authentication between devices.
- the national secret encryption and decryption tunnel is based on the national secret algorithm, and makes full use of the characteristics of strong attack resistance, fast encryption speed, low system resource occupation and strong security of the national secret algorithm, which improves the communication security performance between industrial control systems.
- the present disclosure provides an industrial control system communication method based on tunnel encryption and decryption.
- a national encryption and decryption tunnel that is transparent to the client device, the first communication key within the validity period and the national encryption algorithm are used to complete the communication between the client device and the national encryption algorithm.
- Encrypted communication between target control devices wherein the first communication key is determined by the national encryption and decryption tunnel and the target control device through identity identification and key negotiation.
- the present disclosure completes the encrypted communication between the client device and the target control device based on the transparent national encryption and decryption tunnel, and completes the process of encrypting and decrypting data sent and received by the client device in the form of a proxy service, avoiding the need for the client device to encrypt and decrypt data. It is easy to realize safe communication between various industrial control systems because of the compatibility problem of adaptive transformation of the relevant industrial control software in the system.
- the national encryption and decryption tunnel can also support protocol conversion.
- protocol conversion is to convert the original protocol with poor security of the request data packet into a protocol with high security for transmission. For example: convert the original UDP protocol to the TCP protocol.
- the specific conditions and process for the conversion of the national encryption and decryption tunnel protocol may be: in the case that the national encryption and decryption tunnel has a first communication key within the validity period in the target key information, the request data packet The destination information is matched with the protocol conversion policy in the tunnel encryption policy. If the match is successful, the national encryption and decryption tunnel performs the protocol conversion operation on the request data packet according to the protocol conversion policy.
- the engineer station sends a request data packet to the operator station through the national encryption and decryption tunnel, and the tunnel encryption policy is successfully matched and the target matched by the engineer station is queried in the encrypted communication database.
- the national encryption and decryption tunnel can compare and match the target industrial control protocol, port information and address information in the request data packet with the protocol conversion policy in the tunnel encryption policy.
- the content of the protocol conversion strategy may include: target conversion port information, target conversion industrial control protocol, original port information, original industrial control protocol and operator station address information. If the match is successful, the protocol conversion is performed according to the protocol conversion policy.
- the national encryption and decryption tunnel can actively initiate a TCP connection to the target conversion port of the operator station according to the address information of the engineer station ask.
- the national encryption and decryption tunnel enables monitoring of the target conversion port.
- the operator station receives the TCP request to the target conversion port initiated by the engineer station, it will establish a TCP connection with the engineer station.
- the national encryption and decryption tunnel between the engineer station and the operator station performs encrypted communication and key negotiation based on the TCP connection.
- the national encryption and decryption tunnel can encrypt the request data packet under the original industrial control protocol UDP as a whole according to the tunnel key, and copy it to the data area of the TCP. connection to send.
- the operator station receives the TCP-based encrypted data packet sent by the engineer station through the national encryption and decryption tunnel, uses the tunnel key to decrypt the SK-based encrypted data packet, and converts the encrypted UDP-based request according to the protocol conversion strategy.
- the data in the data package is processed by the software in the operator station.
- the national encryption and decryption tunnel enables the monitoring of the target conversion port.
- the national encryption and decryption tunnel can also manage each key information stored in the encrypted communication database. Specifically, the national encryption and decryption tunnel can detect the key information matching each control device in the encrypted communication database according to a preset period. When the key information that meets the preset key negotiation conditions is detected, the national encryption The encryption/decryption tunnel and the control device corresponding to the key information determine the communication key through identity identification and key negotiation.
- the process of determining the communication key between the national encryption and decryption tunnel and the control device corresponding to the key information can refer to the national encryption and decryption tunnel and the target control device shown in FIG. The process of two communication keys will not be repeated here.
- the preset key negotiation conditions may include: there is no communication key within the validity period in the key information; and/or, there is a communication key within the validity period in the key information and the remaining communication key
- the validity period is less than the second preset duration; and/or, the number of times of negotiation failure of the communication key determined by the control device recorded in the key information and the national encryption/decryption tunnel through identity identification and key negotiation is within the preset number of negotiation times.
- the communication key after the re-key negotiation can be set as the next communication key.
- the current communication key is set as the historical communication key
- the next communication key is set as the current communication key.
- the re-key negotiation fails, wait for the current communication key to expire before re-key negotiation.
- the national encryption and decryption tunnel may mark the control device as an offline state, and suspend regular key negotiation with the control device.
- the national encryption and decryption tunnel gradually reduces the frequency of key negotiation with the control device as the number of key negotiation failures increases.
- the industrial control system communication system based on tunnel encryption and decryption may include: The client device 100 , the target control device 200 and the national encryption and decryption tunnel 300 .
- the national encryption and decryption tunnel 300 is used to obtain the request data packet sent by the client device 100 in the initial stage of communication between the client device 100 and the target control device 200 through the national encryption and decryption tunnel 300, wherein the request data
- the packet carries the device identification of the target control device 200 and the target industrial control protocol, and the national encryption and decryption tunnel 300 is transparent to the client device 100 .
- the national encryption and decryption tunnel 300 is also used for determining a tunnel encryption policy matching the request data packet according to the device identification and the target industrial control protocol.
- the national encryption and decryption tunnel 300 is further configured to query the target key information matching the target control device 200 in the encrypted communication database according to the tunnel encryption policy.
- the national encryption and decryption tunnel 300 is also used to determine whether there is a first communication key within the validity period in the target key information, wherein the first communication key is passed through the national encryption and decryption tunnel 300 and the target control device 200 Identity and key agreement are determined.
- the national encryption and decryption tunnel 300 is also used to encrypt the request data packet according to the first communication key and the national encryption algorithm under the condition that the first communication key within the validity period exists in the target key information to obtain the first communication key. An encrypted packet.
- the national encryption and decryption tunnel 300 is also used to send the first encrypted data packet to the target control device 200 .
- the target control device 200 is configured to decrypt the first encrypted data packet according to the first communication key to obtain the request data packet.
- the target control device 200 is further configured to respond to the request data packet and obtain the response data packet.
- the target control device 200 is further configured to encrypt the response data packet according to the first communication key and the national secret algorithm to obtain a second encrypted data packet.
- the target control device 200 is further configured to send the second encrypted data packet to the national encryption and decryption tunnel 300 .
- the national encryption and decryption tunnel 300 is further configured to decrypt the second encrypted data packet according to the first communication key, obtain a response data packet, and send the response data packet to the client device 100 .
- the structure of the tunnel encryption and decryption-based industrial control system communication system provided by the embodiment of the present disclosure may also be as shown in FIG. 4 .
- the national encryption and decryption tunnel 300 is also used to compare the destination information in the request data packet with the protocol in the tunnel encryption policy when there is a first communication key within the validity period in the target key information.
- the conversion policy is matched, and if the match is successful, the national encryption and decryption tunnel 300 performs a protocol conversion operation on the request data packet according to the protocol conversion policy.
- the national encryption and decryption tunnel 300 is further configured to determine the second communication key through identity identification and key negotiation with the target control device 200, and add the second communication key to the target key information.
- the national encryption and decryption tunnel 300 is further configured to send the first digital certificate and the first random number encrypted by the first private key to the target control device 200 .
- the target control device 200 is further configured to verify the validity of the first digital certificate according to the root certificate of the CA server; if the verification is passed, the target control device 200 uses the first public key carried in the first digital certificate to verify the validity of the first digital certificate through the first private key.
- the encrypted first random number is decrypted.
- the target control device 200 generates a second random number, generates a second communication key according to the decrypted first random number and the second random number, and stores the second communication key.
- the target control device 200 is further configured to send the second digital certificate, the decrypted first random number, and the second random number encrypted by the second private key to the national encryption and decryption tunnel 300 .
- the national encryption and decryption tunnel 300 is also used to verify the validity of the second digital certificate and the decrypted first random number according to the root certificate of the CA server.
- the key decrypts the second random number encrypted by the second private key.
- the national encryption and decryption tunnel 300 is further configured to generate a second communication key according to the first random number and the decrypted second random number and store the second communication key.
- the national encryption and decryption tunnel 300 is also used for encrypting the decrypted second random number using the second communication key, and sending the second random number encrypted by the second communication key to the target control device 200 .
- the target control device 200 is further configured to use the second communication key to decrypt the second random number encrypted by the second communication key, and to verify the validity of the decrypted second random number.
- the target control device 200 sends a notification to the national encryption and decryption tunnel 300 that encrypted communication can be performed using the second communication key.
- the first digital certificate is issued to the national encryption and decryption tunnel 300 by the CA server
- the second digital certificate is issued to the target control device 200 by the CA server.
- the national encryption and decryption tunnel 300 is further configured to detect the key information matched with each control device in the encrypted communication database according to a preset period, and when the key information that meets the preset key negotiation conditions is detected. In this case, the national encryption and decryption tunnel 300 and the control device corresponding to the key information determine the communication key through identity identification and key negotiation.
- the preset key negotiation conditions include: there is no communication key within the validity period in the key information; and/or, there is a communication key within the validity period in the key information and the remaining validity period of the communication key is is less than the second preset duration; and/or, the control device recorded in the key information and the national encryption/decryption tunnel 300 determine through identity identification and key negotiation that the communication key negotiation failure times are within the preset negotiation times.
- the state secret algorithm includes a state secret asymmetric encryption algorithm, a state secret symmetric encryption algorithm, and a state secret password hash algorithm.
- the national secret asymmetric encryption algorithm is an elliptic curve encryption algorithm, and/or the national secret symmetric encryption algorithm is a block cipher algorithm.
- the present disclosure provides an industrial control system communication system based on tunnel encryption and decryption.
- the national encryption and decryption tunnel 300 transparent to the client device 100, the first communication key within the validity period and the national encryption algorithm are used to complete the client
- the first communication key is determined by the national encryption and decryption tunnel 300 and the target control device 200 through identity identification and key negotiation.
- the present disclosure completes the encrypted communication between the client device 100 and the target control device 200 based on the transparent national encryption and decryption tunnel 300, and completes the process of encrypting and decrypting the data sent and received by the client device 100 in the form of a proxy service, avoiding the need for
- the compatibility problem of adapting the relevant industrial control software in the client device 100 makes it easy to realize secure communication among various industrial control systems.
Landscapes
- Engineering & Computer Science (AREA)
- General Engineering & Computer Science (AREA)
- Manufacturing & Machinery (AREA)
- Quality & Reliability (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Automation & Control Theory (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
本公开提供的一种基于隧道加解密的工业控制系统通信方法及系统，通过对客户端设备透明的国密加解密隧道，使用处于有效期之内的第一通讯密钥和国密算法完成客户端设备和目标控制设备之间的加密通信，其中，第一通讯密钥由国密加解密隧道与目标控制设备通过身份识别和密钥协商确定。本公开基于透明的国密加解密隧道完成客户端设备与目标控制设备的加密通信，以代理服务的形式完成对客户端设备发送和接收的数据的加密解密的过程，规避了需要对客户端设备中的相关工控软件进行适应性改造的兼容性问题，容易在多样化的工业控制系统之间实现安全的通信。
Description
本申请要求于2021年04月06日提交中国专利局、申请号为202110365552.2、发明名称为“一种基于隧道加解密的工业控制系统通信方法及系统”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
本申请属于系统安全技术领域，更具体的说，尤其涉及一种基于隧道加解密的工业控制系统通信方法及系统。
随着工业4.0与数字工厂进程的不断推进，对工业控制系统中的通信安全防护不容忽视。现有工业控制系统由于缺乏有效的安全传输手段，通信数据容易被劫持与伪造，存在巨大的安全风险。
同时，由于不同的工业控制系统在实际生产应用中的通信内容和实现机制存在差异，因此，如何在多样化的工业控制系统之间实现通信过程的安全，成为本领域技术人员急需解决的技术问题。
发明内容
鉴于上述问题，本发明提供一种克服上述问题或者至少部分地解决上述问题的一种基于隧道加解密的工业控制系统通信方法及系统，技术方案如下：
一种基于隧道加解密的工业控制系统通信方法，包括：
在客户端设备与目标控制设备之间通过国密加解密隧道进行通信的起始阶段，所述国密加解密隧道获得所述客户端设备发送的请求数据包，其中，所述请求数据包携带有所述目标控制设备的设备标识和目标工控协议，所述国密加解密隧道对所述客户端设备透明；
所述国密加解密隧道根据所述设备标识和所述目标工控协议，确定与所述请求数据包匹配的隧道加密策略；
所述国密加解密隧道根据所述隧道加密策略，在加密通讯数据库中查询与所述目标控制设备匹配的目标密钥信息；
所述国密加解密隧道确定所述目标密钥信息中是否存在处于有效期之内 的第一通讯密钥，其中，该第一通讯密钥由所述国密加解密隧道与所述目标控制设备通过身份识别和密钥协商确定；
所述国密加解密隧道在所述目标密钥信息中存在处于有效期之内的第一通讯密钥的情况下，根据该第一通讯密钥和国密算法对所述请求数据包进行加密获得第一加密数据包；
所述国密加解密隧道将所述第一加密数据包发送至所述目标控制设备；
所述目标控制设备根据该第一通讯密钥对所述第一加密数据包进行解密获得所述请求数据包；
所述目标控制设备对所述请求数据包作出响应，获得响应数据包；
所述目标控制设备根据该第一通讯密钥和所述国密算法对所述响应数据包进行加密获得第二加密数据包；
所述目标控制设备将所述第二加密数据包发送至所述国密加解密隧道；
所述国密加解密隧道根据该第一通讯密钥对所述第二加密数据包进行解密，获得所述响应数据包并将所述响应数据包发送至所述客户端设备。
可选的，所述方法还包括：
所述国密加解密隧道在所述目标密钥信息中存在处于有效期之内的第一通讯密钥的情况下，将所述请求数据包中的目的信息与所述隧道加密策略中的协议转换策略进行匹配，若匹配成功，则所述国密加解密隧道根据所述协议转换策略对所述请求数据包进行协议转换操作。
可选的，所述方法还包括：
在所述目标密钥信息中不存在有效期之内的通讯密钥，或，所述目标密钥信息中处于有效期之内的第一通讯密钥的剩余有效期小于第一预设时长的情况下，所述国密加解密隧道与所述目标控制设备通过身份识别和密钥协商确定第二通讯密钥；
所述国密加解密隧道将所述第二通讯密钥添加至所述目标密钥信息中。
可选的，所述国密加解密隧道与所述目标控制设备通过身份识别和密钥协商确定第二通讯密钥可以包括：
所述国密加解密隧道将第一数字证书和经第一私钥加密后的第一随机数 发送至所述目标控制设备；
所述目标控制设备根据CA服务器的根证书，对所述第一数字证书进行有效性验证；若验证通过，所述目标控制设备使用所述第一数字证书携带的第一公钥对经第一私钥加密后的所述第一随机数进行解密；
所述目标控制设备生成获得第二随机数，并根据解密后的所述第一随机数和所述第二随机数生成第二通讯密钥并存储所述第二通讯密钥；
所述目标控制设备将第二数字证书、解密后的所述第一随机数以及经第二私钥加密后的所述第二随机数发送至所述国密加解密隧道；
所述国密加解密隧道根据所述CA服务器的根证书，对所述第二数字证书和解密后的所述第一随机数进行有效性验证，若验证通过，则使用所述第二数字证书携带的第二公钥对第二私钥加密后的所述第二随机数进行解密；
所述国密加解密隧道根据所述第一随机数和解密后的所述第二随机数生成所述第二通讯密钥并存储所述第二通讯密钥；
所述国密加解密隧道使用所述第二通讯密钥对解密后的所述第二随机数进行加密，并将经所述第二通讯密钥加密后的第二随机数发送至所述目标控制设备；
所述目标控制设备使用所述第二通讯密钥对经所述第二通讯密钥加密后的所述第二随机数进行解密，并对解密后的所述第二随机数进行有效性验证，若验证通过，则所述目标控制设备向国密加解密隧道发送可使用所述第二通讯密钥进行加密通信的通知。
可选的，所述第一数字证书由所述CA服务器向所述国密加解密隧道签发，所述第二数字证书由所述CA服务器向所述目标控制设备签发。
可选的，所述方法还包括：
所述国密加解密隧道按照预设周期对所述加密通讯数据库中与各控制设备匹配的密钥信息进行检测，当检测出满足预设密钥协商条件的密钥信息的情况下，所述国密加解密隧道与该密钥信息对应的控制设备通过身份识别和密钥协商确定通讯密钥。
可选的，所述预设密钥协商条件包括：
密钥信息中不存在处于有效期内的通讯密钥；
和/或，密钥信息中存在处于有效期内的通讯密钥且该通讯密钥的剩余有效期小于第二预设时长；
和/或，密钥信息中记录的控制设备与所述国密加解密隧道通过身份识别和密钥协商确定通讯密钥的协商失败次数在预设协商次数以内。
可选的，所述国密算法包括国密非对称加密算法、国密对称加密算法和国密密码杂凑算法。
可选的，所述国密非对称加密算法为椭圆曲线加密算法，和/或，所述国密对称加密算法为分组密码算法。
一种基于隧道加解密的工业控制系统通信系统，包括：客户端设备、目标控制设备以及国密加解密隧道，
所述国密加解密隧道，用于在所述客户端设备与所述目标控制设备之间通过所述国密加解密隧道进行通信的起始阶段，获得所述客户端设备发送的请求数据包，其中，所述请求数据包携带有所述目标控制设备的设备标识和目标工控协议，所述国密加解密隧道对所述客户端设备透明；
所述国密加解密隧道，还用于根据所述设备标识和所述目标工控协议，确定与所述请求数据包匹配的隧道加密策略；
所述国密加解密隧道，还用于根据所述隧道加密策略，在加密通讯数据库中查询与所述目标控制设备匹配的目标密钥信息；
所述国密加解密隧道，还用于确定所述目标密钥信息中是否存在处于有效期之内的第一通讯密钥，其中，该第一通讯密钥由所述国密加解密隧道与所述目标控制设备通过身份识别和密钥协商确定；
所述国密加解密隧道，还用于在所述目标密钥信息中存在处于有效期之内的第一通讯密钥的情况下，根据该第一通讯密钥和国密算法对所述请求数据包进行加密获得第一加密数据包；
所述国密加解密隧道，还用于将所述第一加密数据包发送至所述目标控制设备；
所述目标控制设备，用于根据该第一通讯密钥对所述第一加密数据包进行 解密获得所述请求数据包；
所述目标控制设备，还用于对所述请求数据包作出响应，获得响应数据包；
所述目标控制设备，还用于根据该第一通讯密钥和所述国密算法对所述响应数据包进行加密获得第二加密数据包；
所述目标控制设备，还用于将所述第二加密数据包发送至所述国密加解密隧道；
所述国密加解密隧道，还用于根据该第一通讯密钥对所述第二加密数据包进行解密，获得所述响应数据包并将所述响应数据包发送至所述客户端设备。
借由上述技术方案，本公开提供的一种基于隧道加解密的工业控制系统通信方法及系统，通过对客户端设备透明的国密加解密隧道，使用处于有效期之内的第一通讯密钥和国密算法完成客户端设备和目标控制设备之间的加密通信，其中，第一通讯密钥由国密加解密隧道与目标控制设备通过身份识别和密钥协商确定。本公开基于透明的国密加解密隧道完成客户端设备与目标控制设备的加密通信，以代理服务的形式完成对客户端设备发送和接收的数据的加密解密的过程，规避了需要对客户端设备中的相关工控软件进行适应性改造的兼容性问题，容易在多样化的工业控制系统之间实现安全的通信。
上述说明仅是本发明技术方案的概述，为了能够更清楚了解本发明的技术手段，而可依照说明书的内容予以实施，并且为了让本发明的上述和其它目的、特征和优点能够更明显易懂，以下特举本发明的具体实施方式。
通过阅读下文优选实施方式的详细描述，各种其他的优点和益处对于本领域普通技术人员将变得清楚明了。附图仅用于示出优选实施方式的目的，而并不认为是对本发明的限制。而且在整个附图中，用相同的参考符号表示相同的部件。在附图中：
图1示出了本公开实施例提供的基于隧道加解密的工业控制系统通信方法的一种实施方式的示意图；
图2示出了本公开实施例提供的国密加解密隧道与目标控制设备通过身份标识和密钥协商确定第二通讯密钥的过程示意图；
图3示出了本公开实施例提供的基于隧道加解密的工业控制系统通信系统的一种结构示意图；
图4示出了本公开实施例提供的基于隧道加解密的工业控制系统通信系统的另一种结构示意图。
下面将参照附图更详细地描述本公开的示例性实施例。虽然附图中显示了本公开的示例性实施例，然而应当理解，可以以各种形式实现本公开而不应被这里阐述的实施例所限制。相反，提供这些实施例是为了能够更透彻地理解本公开，并且能够将本公开的范围完整的传达给本领域的技术人员。
如图1所示，本公开实施例提供的基于隧道加解密的工业控制系统通信方法的一种实施方式的示意图，该基于隧道加解密的工业控制系统通信方法可以包括：
A001、在客户端设备与目标控制设备之间通过国密加解密隧道进行通信的起始阶段，国密加解密隧道获得客户端设备发送的请求数据包，其中，请求数据包携带有目标控制设备的设备标识和目标工控协议，国密加解密隧道对客户端设备透明。
其中，客户端设备可以包括工程师站(ES站)以及操作员站(OS站)。目标控制设备可以包括操作员站(OS站)以及控制器。工程师站可以是安装了编程组态软件以及监控操作组态软件的计算机设备。操作员站可以是安装监控操作组态软件以及相应的授权许可证(License Keys)的计算机设备。其中，目标控制设备内置有国密算法加解密模块，可支持国密加密通信。
其中，国密加解密隧道为应用国密加解密算法的透明代理式数据加解密隧道。请求数据包可以包括目标控制设备的设备标识、目标工控协议、请求内容信息、地址信息、端口信息、服务信息以及协议内容信息。
在本领域中，国密加解密隧道对客户端设备透明，指的是国密加解密隧道对客户端设备不可见。
可选的，国密加解密隧道可以内置在客户端设备中。
需要注意的是，国密加解密隧道与目标控制设备内置的国密算法加解密模 块都可以根据相关通讯密钥和国密算法进行数据加解密，但是无论国密加解密隧道是否内置在客户端设备中，国密加解密隧道对客户端设备都是透明的。可以理解为客户端设备不知道国密加解密隧道的存在，相当于国密加解密隧道为客户端设备代理实现数据的加解密。对于客户端设备而言，发送和接收的数据都是以明文形式存在。而国密算法加解密模块对目标控制设备是可见的。目标控制设备是主动调用国密算法加解密模块进行数据的加解密过程。
A002、国密加解密隧道根据设备标识和目标工控协议，确定与请求数据包匹配的隧道加密策略。
其中，国密加解密隧道集成有分别与各个工控协议匹配的隧道加密策略。本公开实施例可以通过请求数据包中的设备标识和目标工控协议，查找出与该请求数据包匹配的隧道加密策略。可选的，当未查找出与该请求数据包匹配的隧道加密策略的情况下，直接将请求数据包发送至目标控制设备。
A003、国密加解密隧道根据隧道加密策略，在加密通讯数据库中查询与目标控制设备匹配的目标密钥信息。
可以理解的是，隧道加密策略包括实现在加密通讯数据库中查询与目标控制设备匹配的目标密钥信息的规则集合。国密加解密隧道可以依照隧道加密策略中要求的规则匹配项，使用与该规则匹配项对应的信息按照规则在加密通讯数据库中进行查询，以查询到与目标控制设备匹配的目标密钥信息。例如：规则匹配项可以是设备标识和目标工控协议。
其中，目标密钥信息可以包括目标控制设备的通讯地址、当前通讯密钥、历史通讯密钥、下一次通讯密钥以及目标控制设备的相关证书等信息。
其中，当前通讯密钥可以为处于有效期之内的通讯密钥。历史通讯密钥可以为曾经使用过且已过期的通讯密钥。下一次通讯密钥可以是未到有效期且在下一次通信时使用的通讯密钥。
具体的，本公开实施例可以使用隧道加密策略，依据请求数据包中包括的设备标识在加密通讯数据库中检索查询与目标控制设备匹配的目标密钥信息。
A004、国密加解密隧道确定目标密钥信息中是否存在处于有效期之内的第一通讯密钥，其中，该第一通讯密钥由国密加解密隧道与目标控制设备通过 身份识别和密钥协商确定。
可选的，在目标密钥信息中不存在有效期之内的通讯密钥，或，目标密钥信息中处于有效期之内的第一通讯密钥的剩余有效期小于第一预设时长的情况下，国密加解密隧道与目标控制设备通过身份识别和密钥协商确定第二通讯密钥。国密加解密隧道将第二通讯密钥添加至目标密钥信息中。
可选的，如图2所示，本公开实施例提供的国密加解密隧道与目标控制设备通过身份标识和密钥协商确定第二通讯密钥的过程示意图，国密加解密隧道与目标控制设备通过身份标识和密钥协商确定第二通讯密钥的过程可以具体包括：
B001、国密加解密隧道将第一数字证书和经第一私钥加密后的第一随机数发送至目标控制设备。
B002、目标控制设备根据CA服务器的根证书，对第一数字证书进行有效性验证；若验证通过，则执行步骤B003。
其中，CA(Certification Authority)服务器是认证机构的服务器，可以对数字证书的申请者发放、管理、取消数字证书。CA服务器的作用是检查数字证书持有者身份的合法性，并签发数字证书(用数学方法在证书上签字)，以防数字证书被伪造或篡改。
B003、目标控制设备使用第一数字证书携带的第一公钥对经第一私钥加密后的第一随机数进行解密。
B004、目标控制设备生成第二随机数，并根据解密后的第一随机数和第二随机数生成第二通讯密钥并存储第二通讯密钥。
B005、目标控制设备将第二数字证书、解密后的第一随机数以及经第二私钥加密后的第二随机数发送至国密加解密隧道。
B006、国密加解密隧道根据CA服务器的根证书，对第二数字证书和解密后的第一随机数进行有效性验证，若验证通过，则执行步骤B007。
可选的，若验证失败，则丢弃报文，连接重置。其中连接重置用于指示国密加解密隧道重新与目标控制设备建立连接。
B007、国密加解密隧道使用第二数字证书携带的第二公钥对第二私钥加 密后的第二随机数进行解密。
B008、国密加解密隧道根据第一随机数和解密后的第二随机数生成第二通讯密钥并存储第二通讯密钥。
B009、国密加解密隧道使用第二通讯密钥对解密后的第二随机数进行加密，并将经第二通讯密钥加密后的第二随机数发送至目标控制设备。
B010、目标控制设备使用第二通讯密钥对经第二通讯密钥加密后的第二随机数进行解密，并对解密后的第二随机数进行有效性验证，若验证通过，则执行步骤B011。
可选的，若验证失败，则丢弃报文，连接重置。其中连接重置用于指示国密加解密隧道重新与目标控制设备建立连接。
B011、目标控制设备向国密加解密隧道发送可使用第二通讯密钥进行加密通信的通知。
可选的，第一数字证书由CA服务器向国密加解密隧道签发，第二数字证书由CA服务器向目标控制设备签发。
为了便于理解CA服务器签发数字证书的具体过程，此处特举CA服务器向国密加解密隧道签发第一数字证书的过程的例子进行说明：国密加解密隧道发送连接请求和隧道信息Info至CA服务器。CA服务器在接收到该连接请求之后，对该隧道信息Info进行验证并记录。在验证通过后，CA服务器发送CA证书Cer1至国密加解密隧道。国密加解密隧道通过根证书验证CA证书Cer1的有效性。在验证通过之后，国密加解密隧道生成隧道密钥对SK和证书签发请求。国密加解密隧道将该证书签发请求和隧道密钥对SK中的公钥信息PK发送至CA服务器。CA服务器根据该证书签发请求和公钥信息PK生成第一数字证书并记录。CA服务器将该第一数字证书发送至国密加解密隧道。国密加解密隧道通过隧道密钥对SK和根证书验证第一数字证书的有效性。在验证通过之后，国密加解密隧道存储该第一数字证书。
可以理解的是，CA服务器向目标控制设备签发第二数字证书的过程可参照上述CA服务器向国密加解密隧道签发第一数字证书的过程的例子，此处不再赘述。
需要注意的是，隧道密钥对SK即为国密加解密隧道与目标控制设备通过密钥协商获得的通讯密钥。
A005、国密加解密隧道在目标密钥信息中存在处于有效期之内的第一通讯密钥的情况下，根据该第一通讯密钥和国密算法对请求数据包进行加密获得第一加密数据包。
可选的，国密算法包括国密非对称加密算法、国密对称加密算法和国密密码杂凑算法。
可选的，国密非对称加密算法为椭圆曲线加密算法，和/或，国密对称加密算法为分组密码算法。
本公开实施例将国密算法应用到工业控制系统的通信中，实现了基于国密算法的工业控制系统加密通信。使得加密通信过程密钥均不相同且不可伪造，极大保证了通信过程的安全有效。
A006、国密加解密隧道将第一加密数据包发送至目标控制设备。
A007、目标控制设备根据该第一通讯密钥对第一加密数据包进行解密获得请求数据包。
A008、目标控制设备对请求数据包作出响应，获得响应数据包。
A009、目标控制设备根据该第一通讯密钥和国密算法对响应数据包进行加密获得第二加密数据包。
A010、目标控制设备将第二加密数据包发送至国密加解密隧道。
A011、国密加解密隧道根据该第一通讯密钥对第二加密数据包进行解密，获得响应数据包并将响应数据包发送至客户端设备。
本公开实施例通过基于透明式的国密加解密隧道，在不对工业控制系统软件进行二次开发与兼容性调整的情况下，在客户端设备数据出口的阶段就对数据进行识别，并通过密钥协商、维护以及管理，凭借通讯密钥最为整体加密通信凭证进行加解密处理。客户端设备上软件处理的都是解密完成或未加密的原始数据，使得对数据进行加解密不会影响软件的正常业务处理。本公开通过国密加解密隧道，能够实现在多种类、多功能、多供应商类型的工业控制系统的条件下，有效规避软件兼容性问题，保证通信过程安全、有效。
国密加解密隧道结合了国密算法与数字证书的特点，实现了对客户端设备以及目标控制设备之间的通信加解密以及身份认证。国密加解密隧道有效利用了数字证书的不可抵赖以及不可伪造的特点，限制非授权操作行为，保证设备间通信身份认证的安全性。国密加解密隧道以国密算法为基础，充分利用国密算法抗攻击性强、加密速度快、系统资源占用低、安全性强的特点，提升了工业控制系统之间的通信安全性能。
本公开提供的一种基于隧道加解密的工业控制系统通信方法，通过对客户端设备透明的国密加解密隧道，使用处于有效期之内的第一通讯密钥和国密算法完成客户端设备和目标控制设备之间的加密通信，其中，第一通讯密钥由国密加解密隧道与目标控制设备通过身份识别和密钥协商确定。本公开基于透明的国密加解密隧道完成客户端设备与目标控制设备的加密通信，以代理服务的形式完成对客户端设备发送和接收的数据的加密解密的过程，规避了需要对客户端设备中的相关工控软件进行适应性改造的兼容性问题，容易在多样化的工业控制系统之间实现安全的通信。
可选的，国密加解密隧道还可以支持协议转换。协议转换的目的是将请求数据包原有安全性较差的协议转换为安全性较高的协议进行传输。例如：将原有的UDP协议转换为TCP协议。
可选的，国密加解密隧道协议转换的具体条件和过程可以为：国密加解密隧道在目标密钥信息中存在处于有效期之内的第一通讯密钥的情况下，将请求数据包中的目的信息与隧道加密策略中的协议转换策略进行匹配，若匹配成功，则国密加解密隧道根据协议转换策略对请求数据包进行协议转换操作。
为了便于理解协议转换操作，此处通过举例进行说明：工程师站通过国密加解密隧道向操作员站发送请求数据包，在隧道加密策略匹配成功以及在加密通讯数据库中查询到工程师站匹配的目标密钥信息的情况下，国密加解密隧道可以根据该请求数据包中目标工控协议、端口信息以及地址信息与隧道加密策略中的协议转换策略进行对比匹配。协议转换策略的内容可以包括：目标转换端口信息，目标转换工控协议，原始端口信息、原始工控协议以及操作员站地址信息。若匹配成功，则根据协议转换策略进行协议转换。例如：以目标转换 端口信息Port2，目标转换工控协议TCP，原始端口信息Port以及原始工控协议UDP为例，国密加解密隧道可以根据工程师站地址信息主动发起对操作员站目标转换端口的TCP连接请求。国密加解密隧道根据目标转换工控协议中的配置信息，开启对目标转换端口的监听。当操作员站接收到工程师站发起对目标转换端口的TCP请求时，将与工程师站建立TCP连接。在该TCP连接建立成功的情况下，工程师站和操作员站之间的国密加解密隧道基于该TCP连接进行加密通信以及密钥协商。需要注意的是，在密钥协商结束后，国密加解密隧道可以根据隧道密钥对SK对原始工控协议UDP下的请求数据包进行整体加密，并复制到TCP的数据区，以此基于TCP连接进行发送。操作员站在接收到工程师站通过国密加解密隧道发送的基于TCP的加密数据包，使用隧道密钥对SK对加密数据包进行解密，并根据协议转换策略，将加密后的基于UDP的请求数据包中的数据交由操作员站中的软件进行处理。可以理解的是，若工程师站和操作员站在一定时间内不进行通讯或者隧道密钥对SK超出有效期，则基于TCP连接将会释放，下一次通讯时，需要重新建立TCP连接，即重新执行国密加解密隧道根据目标转换工控协议中的配置信息，开启对目标转换端口的监听的步骤。
可选的，国密加解密隧道还可以对加密通讯数据库中保存的各密钥信息进行管理。具体的，国密加解密隧道可以按照预设周期对加密通讯数据库中与各控制设备匹配的密钥信息进行检测，当检测出满足预设密钥协商条件的密钥信息的情况下，国密加解密隧道与该密钥信息对应的控制设备通过身份识别和密钥协商确定通讯密钥。
可以理解的是，国密加解密隧道与该密钥信息对应的控制设备确定通讯密钥的过程可以参考图2所示的国密加解密隧道与目标控制设备通过身份标识和密钥协商确定第二通讯密钥的过程，此处不再赘述。
可选的，预设密钥协商条件可以包括：密钥信息中不存在处于有效期内的通讯密钥；和/或，密钥信息中存在处于有效期内的通讯密钥且该通讯密钥的剩余有效期小于第二预设时长；和/或，密钥信息中记录的控制设备与国密加解密隧道通过身份识别和密钥协商确定通讯密钥的协商失败次数在预设协商 次数以内。
可以理解的是，对于重新密钥协商已完成且当前通讯密钥即将超出有效期的通讯，将从当前通讯密钥无缝切换至该重新密钥协商后的通讯密钥进行通讯。具体的，可以将该重新密钥协商后的通讯密钥设置为下一次通讯密钥。在下一次通讯时，将该当前通讯密钥设置为历史通讯密钥，将该下一次通讯密钥设置为当前通讯密钥。可选的，当重新密钥协商失败，则等待该当前通讯密钥超出有效期后再重新进行密钥协商。
可选的，国密加解密隧道对于密钥协商失败次数超过预设协商次数的控制设备，可以将该控制设备标记为离线状态，暂停定期与该控制设备进行密钥协商。可选的，对于密钥协商失败次数未超过预设协商次数的控制设备，国密加解密隧道随着密钥协商失败次数的增加，逐渐降低与该控制设备进行密钥协商的频率。
与上述方法实施例相对应，如图3所示，本公开实施例提供的基于隧道加解密的工业控制系统通信系统的一种结构示意图，该基于隧道加解密的工业控制系统通信系统可以包括：客户端设备100、目标控制设备200以及国密加解密隧道300。
国密加解密隧道300，用于在客户端设备100与目标控制设备200之间通过国密加解密隧道300进行通信的起始阶段，获得客户端设备100发送的请求数据包，其中，请求数据包携带有目标控制设备200的设备标识和目标工控协议，所述国密加解密隧道300对所述客户端设备100透明。
国密加解密隧道300，还用于根据设备标识和目标工控协议，确定与请求数据包匹配的隧道加密策略。
国密加解密隧道300，还用于根据隧道加密策略，在加密通讯数据库中查询与目标控制设备200匹配的目标密钥信息。
国密加解密隧道300，还用于确定目标密钥信息中是否存在处于有效期之内的第一通讯密钥，其中，该第一通讯密钥由国密加解密隧道300与目标控制设备200通过身份识别和密钥协商确定。
国密加解密隧道300，还用于在目标密钥信息中存在处于有效期之内的第 一通讯密钥的情况下，根据该第一通讯密钥和国密算法对请求数据包进行加密获得第一加密数据包。
国密加解密隧道300，还用于将第一加密数据包发送至目标控制设备200。
目标控制设备200，用于根据该第一通讯密钥对第一加密数据包进行解密获得请求数据包。
目标控制设备200，还用于对请求数据包作出响应，获得响应数据包。
目标控制设备200，还用于根据该第一通讯密钥和国密算法对响应数据包进行加密获得第二加密数据包。
目标控制设备200，还用于将第二加密数据包发送至国密加解密隧道300。
国密加解密隧道300，还用于根据该第一通讯密钥对第二加密数据包进行解密，获得响应数据包并将响应数据包发送至客户端设备100。
可以理解的是，在国密加解密隧道300内置在客户端设备100中的情况下，本公开实施例提供的基于隧道加解密的工业控制系统通信系统的结构还可以如图4所示。
可选的，国密加解密隧道300，还用于在目标密钥信息中存在处于有效期之内的第一通讯密钥的情况下，将请求数据包中的目的信息与隧道加密策略中的协议转换策略进行匹配，若匹配成功，则国密加解密隧道300根据协议转换策略对请求数据包进行协议转换操作。
可选的，在目标密钥信息中不存在有效期之内的通讯密钥，或，目标密钥信息中处于有效期之内的第一通讯密钥的剩余有效期小于第一预设时长的情况下，国密加解密隧道300，还用于与目标控制设备200通过身份识别和密钥协商确定第二通讯密钥，将第二通讯密钥添加至目标密钥信息中。
可选的，国密加解密隧道300，还用于将第一数字证书和经第一私钥加密后的第一随机数发送至目标控制设备200。
目标控制设备200，还用于根据CA服务器的根证书，对第一数字证书进行有效性验证；若验证通过，目标控制设备200使用第一数字证书携带的第一公钥对经第一私钥加密后的第一随机数进行解密。
目标控制设备200生成第二随机数，并根据解密后的第一随机数和第二随 机数生成第二通讯密钥并存储第二通讯密钥。
目标控制设备200，还用于将第二数字证书、解密后的第一随机数以及经第二私钥加密后的第二随机数发送至国密加解密隧道300。
国密加解密隧道300，还用于根据CA服务器的根证书，对第二数字证书和解密后的第一随机数进行有效性验证，若验证通过，则使用第二数字证书携带的第二公钥对第二私钥加密后的第二随机数进行解密。
国密加解密隧道300，还用于根据第一随机数和解密后的第二随机数生成第二通讯密钥并存储第二通讯密钥。
国密加解密隧道300，还用于使用第二通讯密钥对解密后的第二随机数进行加密，并将经第二通讯密钥加密后的第二随机数发送至目标控制设备200。
目标控制设备200，还用于使用第二通讯密钥对经第二通讯密钥加密后的第二随机数进行解密，并对解密后的第二随机数进行有效性验证，若验证通过，则目标控制设备200向国密加解密隧道300发送可使用第二通讯密钥进行加密通信的通知。
可选的，第一数字证书由CA服务器向国密加解密隧道300签发，第二数字证书由CA服务器向目标控制设备200签发。
可选的，国密加解密隧道300，还用于按照预设周期对加密通讯数据库中与各控制设备匹配的密钥信息进行检测，当检测出满足预设密钥协商条件的密钥信息的情况下，国密加解密隧道300与该密钥信息对应的控制设备通过身份识别和密钥协商确定通讯密钥。
可选的，预设密钥协商条件包括：密钥信息中不存在处于有效期内的通讯密钥；和/或，密钥信息中存在处于有效期内的通讯密钥且该通讯密钥的剩余有效期小于第二预设时长；和/或，密钥信息中记录的控制设备与国密加解密隧道300通过身份识别和密钥协商确定通讯密钥的协商失败次数在预设协商次数以内。
可选的，国密算法包括国密非对称加密算法、国密对称加密算法和国密密码杂凑算法。
可选的，国密非对称加密算法为椭圆曲线加密算法，和/或，国密对称加 密算法为分组密码算法。
本公开提供的一种基于隧道加解密的工业控制系统通信系统，通过对客户端设备100透明的国密加解密隧道300，使用处于有效期之内的第一通讯密钥和国密算法完成客户端设备100和目标控制设备200之间的加密通信，其中，第一通讯密钥由国密加解密隧道300与目标控制设备200通过身份识别和密钥协商确定。本公开基于透明的国密加解密隧道300完成客户端设备100与目标控制设备200的加密通信，以代理服务的形式完成对客户端设备100发送和接收的数据的加密解密的过程，规避了需要对客户端设备100中的相关工控软件进行适应性改造的兼容性问题，容易在多样化的工业控制系统之间实现安全的通信。
关于上述实施例中的系统，其中各个设备和国密加解密隧道执行操作的具体方式已经在有关该方法的实施例中进行了详细描述，此处将不做详细阐述说明。
还需要说明的是，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、商品或者设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、商品或者设备所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括要素的过程、方法、商品或者设备中还存在另外的相同要素。
以上仅为本申请的实施例而已，并不用于限制本申请。对于本领域技术人员来说，本申请可以有各种更改和变化。凡在本申请的精神和原理之内所作的任何修改、等同替换、改进等，均应包含在本申请的权利要求范围之内。
Claims (10)
- 一种基于隧道加解密的工业控制系统通信方法，其特征在于，包括：在客户端设备与目标控制设备之间通过国密加解密隧道进行通信的起始阶段，所述国密加解密隧道获得所述客户端设备发送的请求数据包，其中，所述请求数据包携带有所述目标控制设备的设备标识和目标工控协议，所述国密加解密隧道对所述客户端设备透明；所述国密加解密隧道根据所述设备标识和所述目标工控协议，确定与所述请求数据包匹配的隧道加密策略；所述国密加解密隧道根据所述隧道加密策略，在加密通讯数据库中查询与所述目标控制设备匹配的目标密钥信息；所述国密加解密隧道确定所述目标密钥信息中是否存在处于有效期之内的第一通讯密钥，其中，该第一通讯密钥由所述国密加解密隧道与所述目标控制设备通过身份识别和密钥协商确定；所述国密加解密隧道在所述目标密钥信息中存在处于有效期之内的第一通讯密钥的情况下，根据该第一通讯密钥和国密算法对所述请求数据包进行加密获得第一加密数据包；所述国密加解密隧道将所述第一加密数据包发送至所述目标控制设备；所述目标控制设备根据该第一通讯密钥对所述第一加密数据包进行解密获得所述请求数据包；所述目标控制设备对所述请求数据包作出响应，获得响应数据包；所述目标控制设备根据该第一通讯密钥和所述国密算法对所述响应数据包进行加密获得第二加密数据包；所述目标控制设备将所述第二加密数据包发送至所述国密加解密隧道；所述国密加解密隧道根据该第一通讯密钥对所述第二加密数据包进行解密，获得所述响应数据包并将所述响应数据包发送至所述客户端设备。
- 根据权利要求1所述的方法，其特征在于，还包括：所述国密加解密隧道在所述目标密钥信息中存在处于有效期之内的第一通讯密钥的情况下，将所述请求数据包中的目的信息与所述隧道加密策略中的 协议转换策略进行匹配，若匹配成功，则所述国密加解密隧道根据所述协议转换策略对所述请求数据包进行协议转换操作。
- 根据权利要求1所述的方法，其特征在于，还包括：在所述目标密钥信息中不存在有效期之内的通讯密钥，或，所述目标密钥信息中处于有效期之内的第一通讯密钥的剩余有效期小于第一预设时长的情况下，所述国密加解密隧道与所述目标控制设备通过身份识别和密钥协商确定第二通讯密钥；所述国密加解密隧道将所述第二通讯密钥添加至所述目标密钥信息中。
- 根据权利要求3所述的方法，其特征在于，所述国密加解密隧道与所述目标控制设备通过身份识别和密钥协商确定第二通讯密钥可以包括：所述国密加解密隧道将第一数字证书和经第一私钥加密后的第一随机数发送至所述目标控制设备；所述目标控制设备根据CA服务器的根证书，对所述第一数字证书进行有效性验证；若验证通过，所述目标控制设备使用所述第一数字证书携带的第一公钥对经第一私钥加密后的所述第一随机数进行解密；所述目标控制设备生成第二随机数，并根据解密后的所述第一随机数和所述第二随机数生成第二通讯密钥并存储所述第二通讯密钥；所述目标控制设备将第二数字证书、解密后的所述第一随机数以及经第二私钥加密后的所述第二随机数发送至所述国密加解密隧道；所述国密加解密隧道根据所述CA服务器的根证书，对所述第二数字证书和解密后的所述第一随机数进行有效性验证，若验证通过，则使用所述第二数字证书携带的第二公钥对第二私钥加密后的所述第二随机数进行解密；所述国密加解密隧道根据所述第一随机数和解密后的所述第二随机数生成所述第二通讯密钥并存储所述第二通讯密钥；所述国密加解密隧道使用所述第二通讯密钥对解密后的所述第二随机数进行加密，并将经所述第二通讯密钥加密后的所述第二随机数发送至所述目标控制设备；所述目标控制设备使用所述第二通讯密钥对经所述第二通讯密钥加密后 的所述第二随机数进行解密，并对解密后的所述第二随机数进行有效性验证，若验证通过，则所述目标控制设备向国密加解密隧道发送可使用所述第二通讯密钥进行加密通信的通知。
- 根据权利要求4所述的方法，其特征在于，所述第一数字证书由所述CA服务器向所述国密加解密隧道签发，所述第二数字证书由所述CA服务器向所述目标控制设备签发。
- 根据权利要求1所述的方法，其特征在于，还包括：所述国密加解密隧道按照预设周期对所述加密通讯数据库中与各控制设备匹配的密钥信息进行检测，当检测出满足预设密钥协商条件的密钥信息的情况下，所述国密加解密隧道与该密钥信息对应的控制设备通过身份识别和密钥协商确定通讯密钥。
- 根据权利要求6所述的方法，其特征在于，所述预设密钥协商条件包括：密钥信息中不存在处于有效期内的通讯密钥；和/或，密钥信息中存在处于有效期内的通讯密钥且该通讯密钥的剩余有效期小于第二预设时长；和/或，密钥信息中记录的控制设备与所述国密加解密隧道通过身份识别和密钥协商确定通讯密钥的协商失败次数在预设协商次数以内。
- 根据权利要求1至7所述的任一项所述的方法，其特征在于，所述国密算法包括国密非对称加密算法、国密对称加密算法和国密密码杂凑算法。
- 根据权利要求8所述的方法，其特征在于，所述国密非对称加密算法为椭圆曲线加密算法，和/或，所述国密对称加密算法为分组密码算法。
- 一种基于隧道加解密的工业控制系统通信系统，其特征在于，包括：客户端设备、目标控制设备以及国密加解密隧道，所述国密加解密隧道，用于在所述客户端设备与所述目标控制设备之间通过所述国密加解密隧道进行通信的起始阶段，获得所述客户端设备发送的请求数据包，其中，所述请求数据包携带有所述目标控制设备的设备标识和目标工控协议，所述国密加解密隧道对所述客户端设备透明；所述国密加解密隧道，还用于根据所述设备标识和所述目标工控协议，确定与所述请求数据包匹配的隧道加密策略；所述国密加解密隧道，还用于根据所述隧道加密策略，在加密通讯数据库中查询与所述目标控制设备匹配的目标密钥信息；所述国密加解密隧道，还用于确定所述目标密钥信息中是否存在处于有效期之内的第一通讯密钥，其中，该第一通讯密钥由所述国密加解密隧道与所述目标控制设备通过身份识别和密钥协商确定；所述国密加解密隧道，还用于在所述目标密钥信息中存在处于有效期之内的第一通讯密钥的情况下，根据该第一通讯密钥和国密算法对所述请求数据包进行加密获得第一加密数据包；所述国密加解密隧道，还用于将所述第一加密数据包发送至所述目标控制设备；所述目标控制设备，用于根据该第一通讯密钥对所述第一加密数据包进行解密获得所述请求数据包；所述目标控制设备，还用于对所述请求数据包作出响应，获得响应数据包；所述目标控制设备，还用于根据该第一通讯密钥和所述国密算法对所述响应数据包进行加密获得第二加密数据包；所述目标控制设备，还用于将所述第二加密数据包发送至所述国密加解密隧道；所述国密加解密隧道，还用于根据该第一通讯密钥对所述第二加密数据包进行解密，获得所述响应数据包并将所述响应数据包发送至所述客户端设备。
Applications Claiming Priority (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110365552.2 | 2021-04-06 | ||
| CN202110365552.2A CN112731897B (zh) | 2021-04-06 | 2021-04-06 | 一种基于隧道加解密的工业控制系统通信方法及系统 |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| WO2022213535A1 true WO2022213535A1 (zh) | 2022-10-13 |
Family
ID=75596506
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| PCT/CN2021/116128 WO2022213535A1 (zh) | 2021-04-06 | 2021-09-02 | 一种基于隧道加解密的工业控制系统通信方法及系统 |
Country Status (2)
| Country | Link |
|---|---|
| CN (1) | CN112731897B (zh) |
| WO (1) | WO2022213535A1 (zh) |
Families Citing this family (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112731897B (zh) * | 2021-04-06 | 2021-06-22 | 浙江中控技术股份有限公司 | 一种基于隧道加解密的工业控制系统通信方法及系统 |
| CN114024780B (zh) * | 2022-01-06 | 2022-03-18 | 北京交研智慧科技有限公司 | 一种基于物联网设备的节点信息处理方法及装置 |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106100836A (zh) * | 2016-08-09 | 2016-11-09 | 中京天裕科技（北京）有限公司 | 一种工业用户身份认证和加密的方法及系统 |
| US20170338964A1 (en) * | 2015-01-22 | 2017-11-23 | Visa International Service Association | Method and system for establishing a secure communication tunnel |
| CN110401532A (zh) * | 2019-08-08 | 2019-11-01 | 昆高新芯微电子(江苏)有限公司 | 一种基于国密算法的以太网数据加解密处理方法 |
| CN112350826A (zh) * | 2021-01-08 | 2021-02-09 | 浙江中控技术股份有限公司 | 一种工业控制系统数字证书签发管理方法和加密通信方法 |
| CN112731897A (zh) * | 2021-04-06 | 2021-04-30 | 浙江中控技术股份有限公司 | 一种基于隧道加解密的工业控制系统通信方法及系统 |
Family Cites Families (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102098317B (zh) * | 2011-03-22 | 2013-12-18 | 浙江中控技术股份有限公司 | 一种应用于云系统的数据传输方法及系统 |
| CN102932141B (zh) * | 2012-09-27 | 2016-01-06 | 汉柏科技有限公司 | 多加解密芯片并行处理报文加解密的保序方法及系统 |
| CN103490895B (zh) * | 2013-09-12 | 2016-09-14 | 电小虎能源科技（北京）有限公司 | 一种应用国密算法的工业控制身份认证方法及装置 |
| US9864864B2 (en) * | 2014-09-23 | 2018-01-09 | Accenture Global Services Limited | Industrial security agent platform |
| CN106254231A (zh) * | 2016-08-18 | 2016-12-21 | 中京天裕科技（北京）有限公司 | 一种基于状态的工业安全加密网关及其实现方法 |
-
2021
- 2021-04-06 CN CN202110365552.2A patent/CN112731897B/zh active Active
- 2021-09-02 WO PCT/CN2021/116128 patent/WO2022213535A1/zh active Application Filing
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20170338964A1 (en) * | 2015-01-22 | 2017-11-23 | Visa International Service Association | Method and system for establishing a secure communication tunnel |
| CN106100836A (zh) * | 2016-08-09 | 2016-11-09 | 中京天裕科技（北京）有限公司 | 一种工业用户身份认证和加密的方法及系统 |
| CN110401532A (zh) * | 2019-08-08 | 2019-11-01 | 昆高新芯微电子(江苏)有限公司 | 一种基于国密算法的以太网数据加解密处理方法 |
| CN112350826A (zh) * | 2021-01-08 | 2021-02-09 | 浙江中控技术股份有限公司 | 一种工业控制系统数字证书签发管理方法和加密通信方法 |
| CN112731897A (zh) * | 2021-04-06 | 2021-04-30 | 浙江中控技术股份有限公司 | 一种基于隧道加解密的工业控制系统通信方法及系统 |
Also Published As
| Publication number | Publication date |
|---|---|
| CN112731897A (zh) | 2021-04-30 |
| CN112731897B (zh) | 2021-06-22 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US11403402B2 (en) | System and method for recording device lifecycle transactions as versioned blocks in a blockchain network using a transaction connector and broker service | |
| US10979419B2 (en) | System and method of device identification for enrollment and registration of a connected endpoint device, and blockchain service | |
| WO2020143470A1 (zh) | 发放数字证书的方法、数字证书颁发中心和介质 | |
| CN111010410A (zh) | 一种基于证书身份认证的拟态防御系统及证书签发方法 | |
| WO2022213535A1 (zh) | 一种基于隧道加解密的工业控制系统通信方法及系统 | |
| KR20190034324A (ko) | 네트워크 트래픽의 보안 통신 | |
| KR102325725B1 (ko) | 디지털 인증서 관리 방법 및 장치 | |
| US11372986B1 (en) | Systems and methods for encrypted content management | |
| EP1517514B1 (en) | Method for installing and updating certificates used for device authentication. | |
| US11838409B2 (en) | Method and apparatus for transferring data in a publish-subscribe system | |
| AU2014265058A1 (en) | Policy-Based Secure Communication with Automatic Key Management for Industrial Control and Automation Systems | |
| CN103856473A (zh) | 主要管理装置、代理管理装置、电子装置及密钥管理方法 | |
| CN111275440A (zh) | 远程密钥下载方法及系统 | |
| EP1515518B1 (en) | Method of setting digital certificate to authenticate communication apparatus | |
| EP3624394B1 (en) | Establishing a protected communication channel through a ttp | |
| KR20180041840A (ko) | 암호화 통신 시스템 및 방법, 이를 위한 가드 시스템 및 사용자 단말기 | |
| JP2020136717A (ja) | 機器制御システム及び機器制御方法 | |
| US12008110B2 (en) | System and method for recording device lifecycle transactions as versioned blocks in a blockchain network using a transaction connector and broker service | |
| US12003634B2 (en) | Systems and methods for encrypted content management | |
| CN117978411A (zh) | 一种基于区块链的工业物联网数据安全传输的方法 | |
| CA2871392A1 (en) | Policy- based secure communication with automatic key management for industrial control and automation systems |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| 121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 21935754 Country of ref document: EP Kind code of ref document: A1 |
|
| NENP | Non-entry into the national phase |
Ref country code: DE |
|
| 122 | Ep: pct application non-entry in european phase |
Ref document number: 21935754 Country of ref document: EP Kind code of ref document: A1 |