Summary of the invention
For the deficiencies in the prior art; the object of this invention is to provide a kind of method that strengthens communications security in industrial control system; the method be unidirectional, only for important communication message; adopt a series of method for security protection targetedly such as Elliptic Curve Cryptosystem, the design of employing suffix formula, employing important traffic enrollment mechanism and timestamp mechanism of depth optimization; realized the necessary safety function such as authentication, integrity protection, can not affect the work of this industrial control system simultaneously.
The object of the invention is to adopt following technical proposals to realize:
In a kind of industrial control system, strengthen the method for communications security, its improvements are, described method is applied in industrial control system, and described industrial control system comprises main website side and the end side of intercommunication mutually, and described method is implemented by following three phases:
(1) preparatory stage before communication;
(2) main website side transmission phase;
(3) end side reception, processing and recovery stage.
Further, before the communication of described (1), the preparatory stage comprises the steps:
Step 102: main website lateral root generates elliptic curve cryptography key pair according to the disclosed SM2 ellipse curve public key cipher algorithm of national Password Management No. 21 bulletins of office (issue on December 17th, 2010), comprises private key PriK and PKI PubK;
Step 104: the key pair of the preset elliptic curve cryptography of main website side, comprises private key PriK and PKI PubK; Private key PriK wherein will deposit preset by encrypted card, encryption chip or encryption equipment; Storage should guarantee fail safe, can not leak;
Step 106: the PKI PubK of the preset main website of end side side.
Further, the main website side transmission phase of described (2) comprises the steps:
Step 202: main website adnation becomes to be protected, original important traffic message, described important traffic message is original message M;
Step 204: main website side is filled local time stamp M||timestamp after original message M;
Step 206: main website side after timestamp, fill by the preset private key PriK of main website side to original message M the signed data signature=Sign (M||timestamp, PriK) to this segment data of timestamp;
Step 208: main website side is filled safe packet end mark byte end after signed data, the composite safe message SM of formation, described SM=Signature||end;
Step 210: main website side is sent composite safe message SM to end side.
Further, in described step 202, important traffic message refers to the control message in industrial control system communication protocol; In described step 206, the signature verification that the original message M in communication is carried out is unidirectional signature authentication.
Further, end side reception, processing and the recovery stage of described (3) comprise the steps:
Step 302: end side receives composite safe message SM;
Step 304: end side extracts original important traffic message timestamp timestamp and signed data signature according to composite safe message SM;
Step 306: end side is extracted local time stamp localtime;
Step 308: relatively time tolerance whether in reasonable time window W, i.e. (localtime-timestamp) <W? if in rational time window W, carry out step 310; Otherwise, carry out step 309; The value of reasonable time window W is determined according to concrete application scenarios, in industrial control system example, is set as 30 seconds.
Step 309: abandon described composite safe message SM, do not return to any data;
Step 310: relatively whether important traffic message timestamp timestamp is in the registered timestamp list in this locality L; If so, carry out step 311; Otherwise, carry out step 312;
Step 311: abandon described composite safe message SM, do not return to any data;
Step 312: whether the PKI PubK certifying signature data preset according to end side effective, i.e. ret=verify (signature, PubK), ret=0? if so, carry out step 314; Otherwise, carry out step 313;
Step 313: abandon described composite safe message SM, do not return to any data;
Step 314: end side is processed original message M, whether observation result is normal; If normal, carry out step 316, otherwise, carry out step 315;
Step 315: return to processing exception message;
Step 316: end side registers to important traffic message timestamp timestamp in timestamp list L;
Step 317: return to processing normal message.
Compared with the prior art, the beneficial effect that the present invention reaches is:
1-the present invention, according to the particularity of communication system, has analysed in depth the general and special various attacks form that may run into, and has designed safety measure targetedly, can effectively ensure communication safety and resist attack.
The safe enhanced scheme that 2-the present invention designs on the basis of particularity of analysing in depth former communication system, not only can effectively strengthen communication security, has guaranteed that communication efficiency is influenced hardly simultaneously.
3-the present invention has compatible strong feature at the same time, and being applicable to very much, in large area terminal protocol transformation process, needs the situation of compatible the old and new's agreement, the old and new's terminal.
4-design of the present invention is due to this asymmetric scheme that obtains of the unilateral authentication adopting, and main website side need to increase the password related hardwares such as encrypted card, encryption chip and encryption equipment, and terminal can realize by pure software.Because main website quantity is few and password product price is inexpensive, and if terminal transformation with software, to realize cost lower, so enforcement economic benefit of the present invention is outstanding, cost is low and high efficiency can be described as inexpensive.
Embodiment
Below in conjunction with accompanying drawing, the specific embodiment of the present invention is described in further detail.
Be defined as follows term:
Ellipse curve signature function Sign (tosign, Prik)->signature is ellipse curve signature function, and input tosign is data to be signed, and PriK is private key, and output signature is signature;
Elliptic curve sign test function verify (sign, Pubk)->0/err is elliptic curve sign test function, and input sign is signature, and PubK is PKI key, and it is correct that output 0 is expressed as signature, and other represent mistake;
A||b: character string b is spliced after character string a.
The technical problem that the present invention will solve is to provide a kind of method that strengthens communications security in industrial control system, and the communication in this industrial control system has that end side computing capability is weak, the time of end side derives from main website end, communication channel is unreliable, important traffic frequency is lower but requires the features such as real-time and high security.For these features; the present invention designed a kind of unidirectional, only for important communication message; adopt a series of method for security protection targetedly such as Elliptic Curve Cryptosystem, the design of employing suffix formula, employing important traffic enrollment mechanism and timestamp mechanism of depth optimization; realized the necessary safety function such as authentication, integrity protection, can not affect the work of this industrial control system simultaneously.
Below in conjunction with the communication characteristic of this Special industrial control system, illustrate that the present invention strengthens the method for communications security, proves its fail safe simultaneously.
First, consider the weak computing capability of end side and the requirement of real-time of important traffic and high security requirement.The present invention for the communication both sides of this Special industrial control system, i.e. main website and terminal, their computing capability is widely different, main website side configuration is higher, and end side configuration is lower, the MCU dominant frequency of the employing of low side model wherein may only have tens, and internal memory only has tens K.Because application program also will take most of resource, leave the resource that enhancing function is used safely for very limited.Simultaneously the important traffic due to this Special industrial control system also has requirement of real-time and high security requirement, and the fail safe here, most importantly will prevent that terminal from accepting the important traffic message of illegal main website end.For not affecting to greatest extent the application function of end side, the design does not protect all communication, and only important traffic is wherein protected, and is unidirectional protection.This unidirectional and only for the design of crucial message, cause the safety problem of a series of uniquenesses, follow-up design focal point is placed on and solves in these safety problems.
Before further analyzing the safety problem that the design faces, unidirectional and only for the concrete meaning of crucial message, to explain follow-up safety problem and solution under detailed explanation here.
So-called unidirectional, refer to the only message of the direction from main website to terminal and sign.
So-called important traffic, refers to the control message in this Special industrial control system communication protocol, and the frequency of controlling message use is lower, but operating result directly affects productive life and personal safety, extremely important.Control message all higher to real-time and security requirement.
Unidirectional and only for the design of crucial message, refer to the message except controlling message in the communication of this Special industrial control system, still press original realization, do not make and change.And to controlling message, by main website, message is signed, then mailing to end side, terminal is made sign test after receiving message, if sign test deciphering does not all have mistake, accepts this message, and carries out the work of next step application.And the reply message of terminal does not change, still with former plaintext form, reply main website side.
Only no problem in most of agreement for the design of crucial message, but can cause some problems or hidden danger in the communication protocol of this Special industrial control system.The two ends of the communication protocol of this Special industrial control system; be main website side and end side, main website side has correct time source, and the time of end side derives from main website side; time synchronized message by communication is realized, and this time synchronized message is not protected as crucial message.Because the communication channel of this Special industrial control system is dangerous, so assailant can pass through control time sync message, reach the control terminal time, thereby control the poor of the timestamp of crucial message and end side time, this may cause the design that utilizes the end side time to do function of safety protection to have serious leak.
Above-mentionedly explained for Special industrial control system communication protocol in detail, unique time synchronized message aggression, in addition also has other general protocol attack forms, for the communication protocol that has adopted authentication and encryption mechanism, is mainly Replay Attack.
Replay Attack is a kind of attack type, and assailant first utilizes network monitoring or other modes to obtain effective transmission data, again it is issued to destination host again afterwards.Encryption and authentication can prevent the various attacks forms such as Session Hijack effectively, but do not prevent Replay Attack.
In order to prevent Replay Attack, generally can adopt timestamp, sequence number and 3 kinds of mechanism of challenge question and answer.
The basic thought of timestamp mechanism is: main frame is accepted a message, and and if only if, and its timestamp comprising is enough near apart from current time.It requires the clock of communicating pair to keep synchronous, and this basis does not have in this Special industrial control system.Assailant can utilize the time of time synchronized message aggression change terminal, to reach the object that expired crucial message still can be accepted by end side.So timestamp mechanism strengthens inapplicable for the communications security of this Special industrial control system.
Adopt the communication of sequence number mechanism to need initial sequence number of as offered and increment method, then according to the sequence number in message, judge the freshness of message.Why sequence number mechanism strengthen inapplicable for the communications security of this Special industrial control system is because the process of negotiation sequence number itself needs two-way encrypting and authenticating, and this method need to be changed too much former protocols having.
The Basic practice of enquirement and acknowledgement mechanism is: expectation obtains careful A from B, issues in advance random value N of B, and in the message that requires B to reply, comprises N or F (N), and F is A, the simple function that B makes an appointment.And A judges what whether this carefully retransmitted by judging consistent that whether N in the reply of B or F (N) send with oneself.Because the reason equally similar with sequence number mechanism, puts question to and the communications security of same inapplicable the Special industrial control system of acknowledgement mechanism strengthens.
Based on above, to preventing the analysis of Replay Attack, can see, conventional anti-replay mechanism to the present invention for scene be inapplicable.In this Special industrial control system, the safety enhancing design of communication protocol has adopted timestamp mechanism and important traffic enrollment mechanism in conjunction with preventing Replay Attack.Whether timestamp mechanism wherein surpasses the reasonable time window of setting and is used for preventing that single message from resetting by stabbing detection time, important traffic enrollment mechanism requires the each successfully timestamp of important traffic of end side record, and the important traffic repeating by refusal timestamp prevents from combining the Replay Attack of time synchronized message aggression.Adopt enrollment mechanism to exist in theory and because important traffic frequency is too high, cause the long problem of registration list, but because important traffic frequency in the actual use of this Special industrial control system is lower, this problem does not exist.
Above-mentioned by analysis the communications security of industrial control system strengthen the main contents of design.Except foregoing, the communications security enhancing of industrial control system is designed to further improve the processing speed of end side to encrypting and authenticating message, adopted in ripe public key algorithm that fail safe is higher, the better elliptic curve of calculated performance, and algorithm has been done to depth optimization.
The main advantage of elliptic curve cryptography is that it uses less key---such as RSA cryptographic algorithms---that suitable or more high-grade safety is provided than other method in some cases.Therefore can be very useful in the connection very tight to bandwidth requirement, be just applicable to the communication scenes of this Special industrial control system.
In addition, the communications security enhancing of this Special industrial control system is designed to guarantee not applying the compatibility of the design's terminal in this Special industrial control system, adopted the design of suffix formula safe packet, be that the original of important traffic do not changed, thereafter, increase safe packet, comprise timestamp, signed data and checking data etc., form composite safe message.The whole composite safe message of terminal processes of application this method, does not adopt the design's terminal only to process original message in running status.
The flow chart of the method for enhancing communications security provided by the invention as shown in Figure 4, implement by following three phases by the method:
(1) preparatory stage before communication, flow chart as shown in Figure 1, comprises the steps:
Step 102: main website lateral root generates elliptic curve cryptography key pair according to the disclosed SM2 ellipse curve public key cipher algorithm of national Password Management No. 21 bulletins of office (issue on December 17th, 2010), comprises private key PriK and PKI PubK.The elliptic curve cryptography here refers in particular to the present invention's use, through the elliptic curve cryptography of depth optimization.The generating algorithm key pair here, should adopt by hard-wired encrypted card, encryption chip, encryption equipment and realize, with the fail safe that guarantees that private key is deposited.
Step 104: the key pair of the preset elliptic curve cryptography of main website side, comprises private key PriK and PKI PubK.
Step 106: the PKI PubK of the preset main website of end side side.
(2) main website side transmission phase, flow chart as shown in Figure 2, comprises the steps:
Step 202: main website adnation becomes to be protected, original important traffic message, and this message is called original message M here.
Step 204: main website side is filled local time stamp M||timestamp after original message.
Step 206: main website side after timestamp, fill by the preset private key in this locality to original message the signed data signature=Sign (M||timestamp, PriK) to this segment data of timestamp.
Step 208: main website side is filled safe packet end mark byte end after signed data, the composite safe message SM of formation; Be SM=Signature||end;
Step 210: main website side is sent composite safe message.
(3) end side reception, processing and recovery stage, flow chart as shown in Figure 3, comprises the steps:
Step 302: end side receives composite safe message SM;
Step 304: end side extracts original important traffic message timestamp timestamp and signed data signature according to composite safe message SM;
Step 306: end side is extracted local time stamp localtime;
Step 308: relatively time tolerance whether in reasonable time window W, i.e. (localtime-timestamp) <W? if in rational time window W, carry out step 310; Otherwise, carry out step 309; The value of reasonable time window W is determined according to concrete application scenarios, in industrial control system example, is set as 30 seconds.
Step 309: abandon described composite safe message SM, do not return to any data;
Step 310: relatively whether important traffic message timestamp timestamp is in the registered timestamp list in this locality L; If so, carry out step 311; Otherwise, carry out step 312;
Step 311: abandon described composite safe message SM, do not return to any data;
Step 312: whether the PKI PubK certifying signature data preset according to end side effective, i.e. ret=verify (signature, PubK), ret=0? if so, carry out step 314; Otherwise, carry out step 313;
Step 313: abandon described composite safe message SM, do not return to any data;
Step 314: end side is processed original message M, whether observation result is normal; If normal, carry out step 316, otherwise, carry out step 315;
Step 315: return to processing exception message;
Step 316: end side registers to important traffic message timestamp timestamp in timestamp list L;
Step 317: return to processing normal message.
For the existing old terminal (substation) in running status, receive after compound control message M, can normally read the original load m part in frame according to legacy data form, ignore the processing to completeness check code.For example, in the 1-ISO/IEC8802-3 frame format of the power industry standard IEC61850-8-1 of the People's Republic of China (PRC), comprised length item, length that can recorded message.In " IEC60870-5-101/104 is applied to electrical power distribution automatization system ", in " the variable frame length form of 4.2101 stipulations ", by " length L " item, can list the length of message.The length of integrity verification code/signature can preset, or determines according to algorithm, security parameter.
In above-described embodiment, main website side is signed to the summary info of message, and receiving terminal carries out data source authentication and integrity verification according to signature, has guaranteed the fail safe of information exchange; By signature be placed on original after, the compatible existing industrial control system communication protocol of can trying one's best; End side is verified processing, and old terminal can be omitted the processing of completeness check code, thereby can be as far as possible compatible with existing system, avoids the significant cost to all devices transformation.
When industrial control system control centre or controlled terminal send and control or during the message such as measurement, add completeness check code or signature after message as transmitting terminal; Receiving terminal is received after message, and label are verified or separated to completeness check code or signature, after success, message is processed again.Adopt the technical scheme of the embodiment of the present invention, industrial control system control centre (main website side) and controlled terminal (substation side) can verify the identity of message transmitting party, prevents that malicious persons from pretending to be control centre's (main website side) or controlled terminal (substation side) that industrial control system is controlled and destroyed; Measurement, control, parameter are arranged etc. to message simultaneously and protect, prevent malicious persons distorting message content.The present invention is supporting, under the prerequisite of existing industry control communication protocol functions, can to realize data source authentication, integrity protection and preventing playback attack function between control centre's (main website side) and controlled terminal (substation side).
Finally should be noted that: above embodiment is only in order to illustrate that technical scheme of the present invention is not intended to limit, although the present invention is had been described in detail with reference to above-described embodiment, those of ordinary skill in the field are to be understood that: still can modify or be equal to replacement the specific embodiment of the present invention, and do not depart from any modification of spirit and scope of the invention or be equal to replacement, it all should be encompassed in the middle of claim scope of the present invention.