Construction Technology and Application of Industrial Control System Security and Trusted Environment

doi:10.3969/j.issn.1671-1122.2019.06.001

Abstract

Abstract:

Aiming at the problem of low information security protection ability of traditional PLC in industrial measurement and control system, this paper presents a method of building a trusted computing environment based on the key technology of embedded equipment security protection in industrial control system. Firstly, this paper introduces the research work and shortcomings of trusted computing in system application, and then gives a detailed design of security technology architecture for industrial embedded equipment, including trusted PLC main control unit based on bus arbitration mechanism, trusted PLC running environment based on virtualization sandbox technology and trusted PLC network security unit based on white list access control. Experiments show that the trusted computing environment construction method proposed in this paper can be used to build a secure and trusted system network for traditional industrial control equipment and realize the equipment built-in security capability.

Key words: industrial control system, trusted computing, trusted PLC, network security unit

CLC Number:

TP309

Wenli SHANG, Long YIN, Xianda LIU, Jianming ZHAO. Construction Technology and Application of Industrial Control System Security and Trusted Environment[J]. Netinfo Security, 2019, 19(6): 1-10.

Figures/Tables 6

测试项	内容
TCP SYN Storm （L1/L2）	TCP SYN风暴测试：生成有效的SYN数据包,检查设备处理大量新连接请求时保持控制的能力
UDP Scan Robustness （L1/L2）	UDP扫描健壮性测试
UDP Unicast Storm（L1/L2）	UDP单播风暴测试
UDP Multicast Storm（L1/L2）	UDP多播风暴测试
UDP Broadcast Storm （L1/L2）	UDP广播风暴测试
UDP Fuzzer （L1/L2）	UDP模糊测试：检查设备对无效、碎片式UDP数据包的处理能力
UDP Grammer （L1/L2）	UDP语法测试：检查处理无效报头数据包时设备保持控制的能力
UDP Data Grammer（L2）	UDP数据语法测试：检查潜在问题数据发送到开放端口时设备保持控制的能力
TCP Closed Receive Window Storm（L2）	TCP关闭接收窗口风暴测试：以特定包速率发送接收窗口大小为0的TCP数据包,检查泛洪攻击时设备保持控制的能力
TCP Segment Reassembly Storm（L2）	TCP片段重组风暴测试：以特定包速率发送具有前置错误序号的数据包,检查泛洪攻击时设备保持控制的能力
TCP Grammer-Contextually Invalid Packets（L2）	TCP上下文语法无效数据包测试：生成语法正确但与TCP连接当前状态不一致的报文,检查处理这种数据包时设备保持控制的能力
TCP Priority Traffic Interleaving（L2）	TCP优先级流量插队测试：生成优先通信级别和正常通信级别混合的数据流量,检查处理交替通信级别流量时设备保持控制的能力
TCP Timestamp Manipulation（L2）	TCP时间戳篡改测试：生成一连串TCP通信,篡改返回的时间戳并发送给待测设备,检查时间戳改变是否影响设备保持会话通信的健壮性
TCP Selective Acknowledgement（L2）	TCP选择性应答测试：生成不正确的TCP确认响应数据包并发送给待测设备,检查处理有选择性确认响应数据包时设备保持控制的能力
TCP Receive Window（L2）	TCP接收窗口测试：生成与设备接收窗口尺寸不一致的或生成包含与设备接收窗口相关的无效序列号的TCP数据包,检查处理这种数据包时设备保持控制的能力
TCP Maximum Concurrent Connections（L2）	TCP最大并发连接数测试：端对端尝试建立多个并发连接时设备保持控制的能力
TCP SYN Storm from Broadcast（L2）	生成具有广播源IP地址的SYN数据包,检查设备处理大量新连接请求时保持控制的能力
TCP/IP LAND Storm（L1/L2）	精心构造源地址和目的地址相同、源端口和目的端口相同的数据包,检测设备处理这种数据包时保持控制的能力
TCP FIN Storm （L2）	TCP FIN风暴测试：以特定速率向待测设备发送设置了FIN标志的TCP数据包,检查泛洪攻击时设备保持控制的能力
TCP RST Strom（L2）	TCP RST风暴测试：以特定速率向待测设备发送设置了RST标志的TCP数据包,检查泛洪攻击时设备保持控制的能力
Ethernet Unicast Storm （L1/L2）	以太网单播风暴测试
Ethernet Multicast Storm （L1/L2）	以太网多播风暴测试
Ethernet Broadcast Storm （L1/L2）	以太网广播风暴测试
ARP Request Storm（L1/L2）	ARP请求风暴测试
ARP Host Reply Storm （L1/L2）	ARP主机应答风暴测试
ARP Cache Saturation Storm （L1/L2）	ARP缓存饱和风暴测试
IP Unicast Storm（L1/L2）	IP单播风暴测试
IP Multicast Storm（L1/L2）	IP多播风暴测试
IP Broadcast Storm（L1/L2）	IP广播风暴测试
ICMP Storm（L1/L2）	ICMP风暴测试

References 19

[1]	QIAO Quansheng, XING Shuangyun, SHANG Wenli.Design and Implementation of the Trusted PLC[J]. Process Automation Instrumentation, 2016(12): 76-78.
	乔全胜,邢双云,尚文利,等.可信PLC的设计与实现[J].自动化仪表,2016(12):76-78.
[2]	HU Jipeng, TAN Li, YANG Minghua.A User Behavior Measurement Method Based on Trusted Cryptography Moudle[J]. Computer Engineering, 2017(5): 121-128.
	胡计鹏,谭励,杨明华,等.一种基于可信密码模块的用户行为度量方法[J].计算机工程,2017(5):121-128.
[3]	LI Mengjun, WANG Ledong, XIONG Wei.Research on Trusted Computing Constructing Technology for PLC System[J]. Software Guide, 2017(11): 168-171, 175.
	李孟君,王乐东,熊伟,等.PLC工控系统可信构建技术研究[J].软件导刊,2017(11):168-171,175.
[4]	ZHANG Huanguo, LI Jing, PAN Danling.Trusted Platform Module in Embedded System[J]. Journal of Computer Research and Development, 2011(7): 1269-1278.
	张焕国,李晶,潘丹铃,等.嵌入式系统可信平台模块研究[J].计算机研究与发展,2011(7):1269-1278.
[5]	LI Tao, HU Aiqun.Security Protection Scheme Using Mobile Trusted Module and Mandatory Access Control[J]. Journal of Southeast University: Natural Science Edition, 2011(3): 513-517.
	李涛,胡爱群.可信模块与强制访问控制结合的安全防护方案[J].东南大学学报:自然科学版,2011(3):513-517.
[6]	WU You, LI Guang, LIU Shaofang, et al.Study and Implementation of Embedded TPM and Chain of Trust[J]. Computer Engineering and Design, 2012, 33(6): 2229-2235.
	吴悠,李光,刘绍方,等.嵌入式TPM及信任链的研究与实现[J]. 计算机工程与设计,2012,33(6):2229-2235.
[7]	DIETRICH K, WINTER J. Towards Customizable, Application Specific Mobile Trusted Modules[C]//ACM. The Fifth ACM Workshop on Scalable Trusted Computing, October 4 , 2010, Chicago, Illinois, USA. New York: ACM, 2010: 31-40.
[8]	ZHAO Baohua, ZHANG Hao, GUO Hao, et al. White List Security Management Mechanism based on Trusted Computing Technology[EB/OL]. , 2018-12-20.
[9]	NEPAL S, ZIC J, LIU Dongxi, et al.A Mobile and Portable Trusted Computing Platform[J]. Eurasip Journal on Wireless Communications & Networking, 2011, 2011(1): 75.
[10]	CHERNOV A Y, KONOPLEV A S, RESHETOV D V.The Task of Building a Trusted Computing Environment on the Intel Hardware Platform[J]. Automatic Control & Computer Sciences, 2017, 51(8): 844-847.
[11]	NAGARAJAN A, VARADHARAJAN V.Dynamic Trust Enhanced Security Model for Trusted Platform based Services[J]. Future Generation Computer Systems, 2011, 27(5): 564-573.
[12]	LI Haiwei, FAN Bo, LI Wenfeng.Research and Improvement on Constructing Method of A Trusted Virtualization Platform[J]. Netinfo Security, 2015, 15(1): 1-5.
	李海威,范博,李文锋.一种可信虚拟平台构建方法的研究和改进[J].信息网络安全,2015,15(1):1-5.
[13]	WANG Yong, SHANG Wenli, ZHAO Jianming.Design of Embedded Trusted Computing Platform Based on TPM[J]. Computer Engineering and Applications, 2018, 54(13): 105-110.
	王勇,尚文利,赵剑明,等.基于TPM的嵌入式可信计算平台设计[J].计算机工程与应用,2018,54(13):105-110.
[14]	XU Ri, MAO Ming, GAO Xianwei.Integrity Measurement and Cryptographic Mechanism of Cryptographic Support Platform for Trusted Computing[J]. Communications Technology, 2009(4): 111-113.
	徐日,毛明,高献伟.可信计算密码支撑平台完整性度量和密码机制的研究[J].通信技术,2009(4):111-113.
[15]	XING Bin, LIU Jiqiang, HAN Zhen.A New Model for Measuring the Integrity of Trusted Computing Platforms[J]. Netinfo Security, 2016,16(6): 8-14.
	邢彬,刘吉强,韩臻.一种可信计算平台完整性度量的新模型[J].信息网络安全,2016,16(6):8-14.
[16]	WAN Ming, SHANG Wenli, ZHAO Jianming.Trusted Security Defense Architecture for Industrial Embedded Device[J]. Instrument Standardization & Metrology, 2015(6): 18-21.
	万明,尚文利,赵剑明,等.面向工业嵌入式设备的可信安全防护体系[J].仪器仪表标准化与计量,2015(6):18-21.
[17]	LI Lin.Research on Intrusion Detection Algorithm of Industrial Control Systems Based on OCSVM[D]. Shenyang: Shenyang Ligong University, 2016.
	李琳. 基于OCSVM的工业控制系统入侵检测算法研究[D].沈阳:沈阳理工大学,2016.
[18]	SHANG Wenli, LEI Yanqing, WAN Ming, et al.Self-learning Method for Industrial Firewall Yules Based on Hash Algorithm[J]. Computer Engineering and Design 2016, 37(3): 613-617.
	尚文利,雷艳晴,万明,等.基于哈希算法的工业防火墙规则自学习方法[J].计算机工程与设计,2016,37(3):613-617.
[19]	OUYANG Jinsong, DING Lu, Review on IEC 62443 Industrial Control Network & System Security Standardization[J]. Information Technology & Standardization, 2012(3): 24-27.
	欧阳劲松,丁露.IEC 62443工控网络与系统信息安全标准综述[J].信息技术与标准化,2012(3):24-27.