基于国产密码算法的数控网络的认证与验证模型研究及安全评估

夏晓峰; 向宏; 肖震宇; 蔡挺

doi:10.11999/JEIT190893

基于国产密码算法的数控网络的认证与验证模型研究及安全评估

doi: 10.11999/JEIT190893

夏晓峰¹,
向宏^1, ,,
肖震宇²,
蔡挺²

1.
信息物理社会可信服务计算教育部重点实验室重庆 400044
2.
重庆大学大数据与软件学院重庆 400044

基金项目: 国家重点研发计划(2017YFB0802400)，国家十三五密码发展基金(MMJJ20180211)，重庆市研究生导师团队建设项目，重庆市研究生教育教学改革研究项目(yjg192003)

详细信息

作者简介:
夏晓峰：男，1980年生，副教授，研究方向为信息安全

向宏：男，1964年生，教授，研究方向为信息安全

通讯作者:
向宏　xianghong@cqu.edu.cn

中图分类号: TN918; TP309.2
计量
- 文章访问数: 1738
- HTML全文浏览量: 491
- PDF下载量: 109
- 被引次数: 0
出版历程
- 收稿日期: 2019-11-07
- 修回日期: 2020-05-31
- 网络出版日期: 2020-06-23
- 刊出日期: 2020-08-18

Research and Security Evaluation of AUTH-VRF Model for NCS Network Based on Domestic Cryptographic Algorithms

1.
Key Laboratory of Dependable Service Computing in Cyber Physical Society, Ministry of Education, Chongqing 400044, China
2.
School of Bigdata and Software Engineering, Chongqing University, Chongqing 400044, China

Funds: The National Key Research and Development Project (2017YFB0802400), The National 13th Five Year Code Development Fund (MMJJ20180211), Chongqing Postgraduate Tutor Team Construction Project, Chongqing Graduate Education and Teaching Reform Research Project (yjg192003)

摘要

摘要: 该文针对工业控制系统安全，提出面向数控系统(NCS)网络安全保护技术框架，选用国产密码系列算法中的SM2, SM3, SM4算法，设计并建立了数控网络(CNC)认证与验证模型(AUTH-VRF)，分内外两层为数控网络提供安全防护。外层为数控网络设备间通信与传输进行安全认证实现网段隔离，内层验证通信协议完整性以确保现场设备接收运行程序的正确性与有效性；通过基于SM2, SM3, SM4算法设计和部署的外层防护装置，为分布式数控(DNC)设备与数控系统之间的通信提供身份认证与文件加密传输；同时针对工业控制网络的S7Comm工业通信协议数据，通过SM3算法验证专有工业协议数据完整性。通过网络攻击实验证明，AUTH-VRF模型可以为数控网络中工业生产数据提供有效的安全认证和资源完整性保护，为满足我国关键基础设施“国内、国外工业控制系统产品共同安全可控”和“安全技术深入工业控制系统各个层级”的需求提供了实际可行的技术参考方案。
- 国产密码算法 /
- 数控网络 /
- 安全认证 /
- 完整性验证
Abstract: For the security of industrial control system, a framework for Numerical Control System(NCS) network security protection technology is proposed. The SM2, SM3 and SM4 algorithms in the domestic cryptographic algorithms are used to design and establish the AUTHentication and VRFfication (AUTH-VRF) model of the Computerized Numerical Control(CNC) network, which provides security protection for both internal and external sides. The external side conducts the security authentication for communication and transmission between CNC network devices to achieve network segment isolation. The internal side verifies communication protocol integrity to ensure that the operating procedures received by the field devices are correct and valid. The external protection device designed and deployed based on the SM2, SM3 and SM4 algorithms provides identity authentication and file encryption transmission for communication between the Distributed Numerical Control(DNC) device and the CNC system. At the same time, for the proprietary industrial communication protocol data in the CNC network, the SM3 algorithm is used to verify its integrity. The network attack experiments prove that the AUTH-VRF model can provide effective security certification and integrity protection for industrial production data in CNC networks. It also provides a practical technical approach to meet the requirements of ‘secure and controllable both for domestic and foreign products’, as well as ‘applying security technique to all layers of Industrial Control Systems’ for protecting the critical infrastructure.
- Domestic cryptographic algorithm /
- Computerized Numerical Control(CNC) network /
- Security certificate /
- Integrity verification

HTML全文

图 1 NCS网络AUTH-VRF模型安全认证流程

下载: 全尺寸图片幻灯片

图 2 NCS网络AUTH-VRF模型安全验证流程

下载: 全尺寸图片幻灯片

图 3 AUTH-VRF模型实现场景部署

下载: 全尺寸图片幻灯片

图 4 外层防护装置部署概况

下载: 全尺寸图片幻灯片

图 5 内层防护装置部署概况

下载: 全尺寸图片幻灯片

图 6 利用ettercap攻击嗅探NCS网络并劫持未保护的G代码文件

下载: 全尺寸图片幻灯片

参考文献(20)

陈清明, 朱少辉. 关于工业控制系统网络安全审查工作的思考[J]. 信息安全与通信保密, 2018(6): 59–67. doi: 10.3969/j.issn.1009-8054.2018.06.011

CHEN Qingming and ZHU Shaohui. Considerations on the network security censor of industrial control systems[J]. Information Security and Communications Privacy, 2018(6): 59–67. doi: 10.3969/j.issn.1009-8054.2018.06.011

赖英旭, 刘增辉, 蔡晓田, 等. 工业控制系统入侵检测研究综述[J]. 通信学报, 2017, 38(2): 143–156. doi: 10.11959/j.issn.1000-436x.2017036

LAI Yingxu, LIU Zenghui, CAI Xiaotian, et al. Research on intrusion detection of industrial control system[J]. Journal on Communications, 2017, 38(2): 143–156. doi: 10.11959/j.issn.1000-436x.2017036

尚文利, 安攀峰, 万明, 等. 工业控制系统入侵检测技术的研究及发展综述[J]. 计算机应用研究, 2017, 34(2): 328–333, 342. doi: 10.3969/j.issn.1001-3695.2017.02.002

SHANG Wenli, AN Panfeng, WAN Ming, et al. Research and development overview of intrusion detection technology in industrial control system[J]. Application Research of Computers, 2017, 34(2): 328–333, 342. doi: 10.3969/j.issn.1001-3695.2017.02.002

YANG Dayu, USYNIN A, and HINES W. Anomaly-based Intrusion Detection for SCADA Systems[C]. The 5th International Topical Meeting on Nuclear Plant Instrumentation Controls, and Human Machine Interface Technology, Albuquerque, 2006: 797–802.

黄海, 冯新新, 刘红雨, 等. 基于随机加法链的高级加密标准抗侧信道攻击对策[J]. 电子与信息学报, 2019, 41(2): 348–354. doi: 10.11999/JEIT171211

HUANG Hai, FENG Xinxin, LIU Hongyu, et al. Random addition-chain based countermeasure against side-channel attack for advanced encryption standard[J]. Journal of Electronics &Information Technology, 2019, 41(2): 348–354. doi: 10.11999/JEIT171211

屠袁飞, 苏清健, 杨庚. 一种适用于工业控制系统的加密传输方案[J]. 电子与信息学报, 2020, 42(2): 348–354. doi: 10.11999/JEIT190187

TU Yuanfei, SU Qingjian, and YANG Geng. An encryption transmission scheme for industrial control system[J]. Journal of Electronics &Information Technology, 2020, 42(2): 348–354. doi: 10.11999/JEIT190187

冯登国. 国内外密码学研究现状及发展趋势[J]. 通信学报, 2002, 23(5): 18–26. doi: 10.3321/j.issn:1000-436X.2002.05.005

FENG Dengguo. Status quo and trend of cryptography[J]. Journal of China Institute of Communications, 2002, 23(5): 18–26. doi: 10.3321/j.issn:1000-436X.2002.05.005

国家密码管理局. GM/T 0003.1-2012 SM2椭圆曲线公钥密码算法第1部分: 总则[S]. 北京: 中国标准出版社, 2012.

State Password Administration. GM/T 0003.1-2012 Public key cryptographic algorithm SM2 based on elliptic curves-Part 1: General[S]. Beijing: China Standard Press, 2012.

国家密码管理局. GM/T 0003.2-2012 SM2椭圆曲线公钥密码算法第2部分: 数字签名算法[S]. 北京: 中国标准出版社, 2012.

State Password Administration. GM/T 0003.2-2012 Public key cryptographic algorithm SM2 based on elliptic curves-Part 2: Digital signature algorithm[S]. Beijing: China Standard Press, 2012.

国家密码管理局. GM/T 0003.3-2012 SM2椭圆曲线公钥密码算法第3部分: 密钥交换协议[S]. 北京: 中国标准出版社, 2012.

State Password Administration. GM/T 0003.3-2012 Public key cryptographic algorithm SM2 based on elliptic curves-Part 3: Key exchange protocol[S]. Beijing: China Standard Press, 2012.

国家密码管理局. GM/T 0003.4-2012 SM2椭圆曲线公钥密码算法第4部分: 公钥加密算法[S]. 北京: 中国标准出版社, 2012.

State Password Administration. GM/T 0003.4-2012 Public key cryptographic algorithm SM2 based on elliptic curves-Part 4: Public key encryption algorithm[S]. Beijing: China Standard Press, 2012.

国家密码管理局. GM/T 0003.5-2012 SM2椭圆曲线公钥密码算法第5部分: 参数定义[S]. 北京: 中国标准出版社, 2012.

State Password Administration. GM/T 0003.5-2012 Public key cryptographic algorithm SM2 based on elliptic curves-Part 5: Parameter definition[S]. Beijing: China Standard Press, 2012.

STINSON D R, 冯登国, 译. 密码学原理与实践[M]. 2版. 北京: 电子工业出版社, 2003: 131–142.

STINSON D R, FENG D G, translation. Cryptography Theory and Practice[M]. 2nd ed. Beijing: Publishing House of Electronics Industry, 2003: 131–142.

赵军, 曾学文, 郭志川. 支持国产密码算法的高速PCIe密码卡的设计与实现[J]. 电子与信息学报, 2019, 41(10): 2402–2408. doi: 10.11999/JEIT190003

ZHAO Jun, ZENG Xuewen, and GUO Zhichuan. Design and implementation of high speed PCIe cipher card supporting GM algorithms[J]. Journal of Electronics &Information Technology, 2019, 41(10): 2402–2408. doi: 10.11999/JEIT190003

国家密码管理局. GM/T 0004-2012 SM3密码杂凑算法[S]. 北京: 中国标准出版社, 2012.

State Password Administration. GM/T 0004-2012 SM3 cryptographic hash algorithm[S]. Beijing: China Standard Press, 2012.

国家密码管理局. GM/T 0002-2012 SM4分组密码算法[S]. 北京: 中国标准出版社, 2012.

State Password Administration. GM/T 0002-2012 SM4 block cipher algorithm[S]. Beijing: China Standard Press, 2012.

ZIMMERMANN P R. The Official PGP User’s Guide[M]. Cambridge: MIT Press, 1995: 152–188.

KURNIAWAN Y, ALBONE A, and RAHYUWIBOWO H. The design of mini PGP security[C]. 2011 International Conference on Electrical Engineering and Informatics, Bandung, Indonesia, 2011: 6021726.

李强, 冯登国, 张立武, 等. 标准模型下增强的基于属性的认证密钥协商协议[J]. 计算机学报, 2013, 36(10): 2156–2167.

LI Qiang, FENG Dengguo, ZHANG Liwu, et al. Enhanced attribute-based authenticated key agreement protocol in the standard model[J]. Chinese Journal of Computers, 2013, 36(10): 2156–2167.

LI Yong, SHA Xuejun, and WANG Kun. Hybrid carrier communication with partial FFT demodulation over underwater acoustic channels[J]. IEEE Communications Letters, 2013, 17(12): 2260–2263. doi: 10.1109/LCOMM.2013.102613.131651

施引文献

资源附件(0)

访问统计