CN118473749A

CN118473749A - Encryption communication method and system based on TCP and SM4 for industrial control system

Info

Publication number: CN118473749A
Application number: CN202410590950.8A
Authority: CN
Inventors: 王芝芳; 万路; 陈宇; 吴兴鑫; 章海春; 杨绍良; 魏忠巍; 杨波; 舒银丹; 周茜; 徐学英; 付云政; 丁伟
Original assignee: Huaneng Lancang River Hydropower Co Ltd
Current assignee: Huaneng Lancang River Hydropower Co Ltd
Priority date: 2024-05-13
Filing date: 2024-05-13
Publication date: 2024-08-09

Abstract

The invention discloses a communication method and a system based on TCP and SM4 encryption for an industrial control system, wherein the method comprises the following steps: creating TCP connection through an industrial control terminal; sending a registration request of the MAC address and the corresponding password of the industrial control terminal equipment to a server terminal through TCP connection; receiving an encryption confirmation packet returned by the server after the server inquires the original password according to the MAC address registration request; and decrypting the encryption confirmation packet according to the original password, and transmitting the data of the industrial control terminal equipment register after the decryption is successful. The algorithm has simple structure, and can effectively prevent man-in-the-middle attack, replay attack and unauthorized access by encrypting communication data.

Description

Encryption communication method and system based on TCP and SM4 for industrial control system

Technical Field

The invention relates to the technical field of communication encryption, in particular to a communication method and a system based on TCP and SM4 encryption for an industrial control system.

Background

Modbus and IEC104 communication protocols are commonly used in power systems, and both of these communication protocols suffer from lack of authentication and unencrypted data, thereby making both protocols vulnerable to man-in-the-middle and replay attacks and unauthorized access.

Disclosure of Invention

The present invention aims to solve at least one of the technical problems in the related art to some extent.

Therefore, the invention provides a TCP and SM4 encryption communication method for an industrial control system, which can effectively prevent man-in-the-middle attack, replay attack and unauthorized access.

Another object of the present invention is to propose a TCP and SM4 based encryption communication system for an industrial control system.

To achieve the above object, in one aspect, the present invention provides a method for encrypting communication based on TCP and SM4 for an industrial control system, comprising:

Creating TCP connection through an industrial control terminal;

Sending a registration request of an MAC address and a corresponding password of the industrial control equipment to a server through the TCP connection;

Receiving an encryption confirmation packet returned by the server after the server inquires the original password according to the MAC address registration request;

and decrypting the encryption confirmation packet according to the original password, and transmitting data of the industrial control equipment register after the decryption is successful.

In addition, the encryption communication method based on TCP and SM4 for an industrial control system according to the above embodiment of the present invention may further have the following additional technical features:

further, in an embodiment of the present invention, after the decrypting the encrypted acknowledgement packet according to the original password and performing data transmission of the industrial control device register after the decrypting is successful, the method further includes:

configuring a register data pushing rule of industrial control terminal equipment; the register data pushing rule comprises a pushing period, a triggering condition and a register list needing pushing;

and reading the current value of the internal register according to the register data pushing rule and the preset triggering condition, and packaging the current value into a data message conforming to a communication protocol format so as to be sent to the server through a network.

Further, in one embodiment of the present invention, after being sent to the server through the network, the method further includes:

receiving a read request data packet constructed by a server according to a preset communication protocol, identifying operation of reading a register, and reading a current register value from a specified register address to obtain a read result;

After the reading operation is finished, constructing a data packet containing the reading result according to the specification of a communication protocol, and returning the current register value to a server side so as to analyze and verify the returned data packet.

Further, in one embodiment of the present invention, the method further comprises:

Receiving a write request data packet constructed by a server side according to a preset communication protocol through a communication interface;

Analyzing the instruction and the data in the write request data packet to update the corresponding internal register according to the register address and the data value in the data packet;

After the writing operation is finished, a response data packet is sent to the server side according to a mode specified by a communication protocol to verify results.

Further, in an embodiment of the present invention, before the TCP connection is created by the industrial control terminal, the method further includes:

processing the original password by using SM3 to obtain a password abstract with 256-bit length;

extracting the first 128 bits from the 256-bit-length cipher digest as keying material for use in an SM4 encryption algorithm;

and encrypting all data behind the message header transmitted by the industrial control equipment by using the 128-bit key before the SM4 encryption algorithm.

To achieve the above object, another aspect of the present invention provides a TCP and SM4 based encryption communication system for an industrial control system, comprising:

The TCP connection creation module is used for creating TCP connection through the industrial control terminal;

The registration request sending module is used for sending the registration request of the MAC address and the corresponding password of the industrial control equipment to the server through the TCP connection;

The encryption confirmation receiving module is used for receiving an encryption confirmation packet returned by the server after the server inquires the original password according to the MAC address registration request;

And the decryption data transmission module is used for decrypting the encryption confirmation packet according to the original password and transmitting the data of the industrial control equipment register after the decryption is successful.

The TCP and SM 4-based encryption communication method and system for the industrial control system can effectively prevent man-in-the-middle attack, replay attack and unauthorized access compared with IEC104 and modbus.

Additional aspects and advantages of the invention will be set forth in part in the description which follows and, in part, will be obvious from the description, or may be learned by practice of the invention.

Drawings

The foregoing and/or additional aspects and advantages of the invention will become apparent and readily appreciated from the following description of the embodiments, taken in conjunction with the accompanying drawings, in which:

fig. 1 is a flowchart of a TCP and SM4 based encryption communication method for an industrial control system according to an embodiment of the present invention;

FIG. 2 is a flow chart of another TCP and SM4 encryption based communication method for an industrial control system according to an embodiment of the invention;

fig. 3 is a schematic structural diagram of a TCP and SM4 based encryption communication system for an industrial control system according to an embodiment of the present invention.

Detailed Description

It should be noted that, without conflict, the embodiments of the present invention and features of the embodiments may be combined with each other. The invention will be described in detail below with reference to the drawings in connection with embodiments.

In order that those skilled in the art will better understand the present invention, a technical solution in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in which it is apparent that the described embodiments are only some embodiments of the present invention, not all embodiments. All other embodiments, which can be made by those skilled in the art based on the embodiments of the present invention without making any inventive effort, shall fall within the scope of the present invention.

The following describes a communication method and system based on TCP and SM4 encryption for an industrial control system according to an embodiment of the present invention with reference to the accompanying drawings.

Fig. 1 is a flowchart of a method for encrypting communication based on TCP and SM4 for an industrial control system according to an embodiment of the present invention, as shown in fig. 1, including:

s1, creating TCP connection through an industrial control terminal;

s2, sending a registration request of an MAC address and a corresponding password of the industrial control equipment to a server through TCP connection;

s3, receiving an encryption confirmation packet returned by the server after the server inquires the original password according to the MAC address registration request;

S4, decrypting the encryption confirmation packet according to the original password, and transmitting data of the industrial control equipment register after the decryption is successful.

The encryption communication method is based on TCP, the whole data can be divided into 8 parts, 21+n bytes can be provided, the length is variable, the data head is a plaintext, the next round of passwords, a read-write flag, a data type, a register address, a read/write data length, the data and an end flag are ciphertext, and all the data are stored by adopting a small end.

Illustratively, byte 1 of the data of the present invention is a data header flag, which is defined as shown in Table 1:

TABLE 1

Mark head	Description of the invention
		0x55	Registration apparatus
0xEE	Password error
		0xAA	Ciphertext communication

The 2 nd byte and the 17 th byte of data are SM4 passwords for the next communication, the industrial control equipment randomly generates a new password after each time of sending the data, when the data acquisition and monitoring control System (SCADA) sends an instruction, the latest password is required to be adopted to encrypt a data area by using an SM4 algorithm and then the data area is sent to the industrial control equipment, and if the industrial control equipment cannot decrypt the correct data, the industrial control equipment refuses to execute the instruction.

Illustratively, the 18 th byte of data is used to represent the data's registers for the read/write industrial control device, which are defined as shown in Table 2:

TABLE 2

Read-write mark	Description of the invention
		0x00	Reading registers
0x01	Write register
		0x02	Registration apparatus
0x55	Confirmation bag
		0x66	Heartbeat bag

Illustratively, the 19 th byte of data is used to represent the data type of the subsequent data, which is defined as shown in Table 3:

TABLE 3 Table 3

Illustratively, the 20 th and 22 th bytes of data are used for the address where the first data is located, and the subsequent data address is added with one on the basis, which can represent 65535 bit registers at maximum, and the address field is enough to be used considering that the number of registers to be read by a single device of the industrial control device is generally within 4 bits.

Illustratively, word 23 represents the data length of the data segment to be read/written, assuming that the value is n and the actual number of bytes of the data segment for which the data type is int16 (2 bytes) is equal to 2 times n.

Illustratively, the segment of data that is written to or needs to be written to is zero in length if a segment of register data is to be read.

Illustratively, the data employs a fixed end, and after decryption of the data, a cryptographic error is indicated if the end data does not match. The value was fixed at 0x55555555. As shown in table 4:

TABLE 4 Table 4

The embodiment of the invention discloses a TCP and SM4 encryption communication method for an industrial control system, which comprises the following specific processes as shown in figure 2:

In one embodiment of the invention, the original password is processed by SM3 to obtain a 256-bit digest, and the first 128 bits of the digest are used for key of SM4 encryption algorithm to encrypt all data behind the header. And after the industrial control equipment is successfully registered, the key is randomly generated after data is transmitted each time and is used for encrypting the next communication.

Specifically, in an industrial control system, in order to ensure the security of data, the invention adopts a hybrid encryption strategy. The method comprises the following specific steps: first, the original password is processed using SM3 (one of the national commercial cryptographic algorithm standards, a hash function similar to SHA-256), resulting in a fixed digest output of 256 bits in length. This digest can uniquely and irreversibly represent the information of the original password, enhancing security. The first 128 bits are taken from the 256-bit digest generated by SM3 as keying material, which will be used in the SM4 encryption algorithm. SM4 is a block cipher algorithm that typically requires a key length of 128 bits, so the digest portion extracted here meets exactly this requirement. All payload data transmitted by the device (i.e., all data following the header) is encrypted using the SM4 encryption algorithm with the 128-bit key described above. This ensures that the data, if intercepted during transmission, cannot be easily interpreted. After the industrial control equipment is successfully registered and establishes a secure communication connection with the server, a new key is randomly generated again each time the equipment transmits data, so that different encryption keys are ensured for each communication.

The dynamic key mechanism of the embodiment of the invention greatly enhances the safety of the communication link, so that the safety of the subsequent communication is not affected even if a certain key is cracked. By the method, the system can realize highly-safe data encryption and transmission, and the freshness and communication safety of the secret key are always kept in the frequent communication process.

In one embodiment of the invention, the IP and password configuration of the server is completed at the industrial control end, and the MAC and corresponding password configuration of the device is completed at the server end.

Specifically, a server IP and a password are configured at an industrial control terminal (client): the IP address of the target server needs to be known and filled into the network setting of the industrial control system so that the industrial control terminal can be accurately connected to the server. Next, a login password required for communication with the server is set. This typically involves authentication information of the SSH, telnet, or other remote access protocol, ensuring that only authorized users or devices can access the server through the industrial control side.

Specifically, a device MAC address and a corresponding password are configured at a server side: the device MAC address is a unique identifier of the physical layer, and the device with a specific MAC address may be authorized or managed at the server according to actual requirements. For some advanced rights operations, it may be necessary to set device-level access control based on the MAC address, i.e., assign a unique password or key to each device to achieve device-level security authentication. In addition, if the device is in the local area network environment, the access of illegal devices can be prevented by binding the MAC address and the IP address, namely, the MAC-IP binding rule is set in the DHCP service of the server side. The two steps are used for realizing effective communication and safety management between network devices and avoiding unauthorized access and data leakage risks. Meanwhile, please ensure that all password settings conform to the security policy, periodically replace and use passwords with higher complexity.

In one embodiment of the present invention, the industrial control terminal creates a TCP connection, sends a MAC address registration connection through a TCP connection server, and the data structure is shown in table 5:

TABLE 5

Further, after receiving the registration information, the server queries the password according to the MAC address, and returns an encrypted acknowledgement packet with a read-write flag of 0x55 and a data length of 0.

Further, the industrial control terminal decrypts the data according to the initial password after receiving the data, and starts data transmission after the decryption is successful. Returning 0xEE+MAC after decryption error indicates that the cipher error is simultaneously disconnected from TCP.

Further, the industrial control terminal periodically transmits an encrypted heartbeat packet with a read-write mark of 0x66 and a data length of 0.

Specifically, the industrial control device sends a registration information request containing the own MAC address and the corresponding password to the server. After receiving the request, the server searches the corresponding password record in the database according to the MAC address. Once a match is found, the server will generate a confirmation response packet containing header information with a read/write flag of 0x55, indicating that this is a special encrypted confirmation packet, and the data length field is set to 0, possibly because the server does not need to return specific data content at this time, only as a signal that authentication is successful. The server encrypts the confirmation packet and sends the encrypted confirmation packet to the industrial control terminal, wherein the encryption may be based on a pre-shared initial password or other security mechanism. And after receiving the encryption confirmation packet returned by the server, the industrial control terminal decrypts by using the same initial password. If the decryption is successful, the identity of the industrial control terminal is effectively verified by the server terminal, and subsequent communication and data interaction tasks can be continued. The flow design ensures the safety of communication and also realizes the accurate verification of the identity of the equipment.

Further, the industrial control terminal actively pushes the register to the server terminal and the transmitting register to the server terminal.

It will be appreciated that in the industrial control (Industrial Control) scenario, the industrial control side device (such as PLC, DCS, or intelligent meter) will actively push the total amount of data in the internal register to the server (such as SCADA system, cloud server, database, etc.) periodically or when the status changes. In order to realize real-time monitoring and remote data acquisition, the server side can conveniently perform functions such as data analysis, alarm processing, optimizing control strategies and the like.

Specifically, a register data pushing rule is configured on the industrial control terminal device, and the register data pushing rule comprises a pushing period, a triggering condition (such as timing pushing, event triggering and the like) and a register list needing pushing. Establishing a communication connection: a stable communication link is established between the industrial control terminal and the server terminal, and common industrial control protocols such as Modbus TCP, OPCUA, MQTT and the like ensure that data can be transmitted smoothly. The industrial control terminal reads the current value of the internal register periodically or under the triggering condition according to the preset rule, packages the current value into a data message conforming to the communication protocol format, and sends the data message to the server through the network. After receiving the data pushed by the industrial control terminal, the server analyzes the content of the data message, stores the register data into a database or a cache, and further performs operations such as data analysis, report generation, alarm prompt, control instruction issuing and the like according to service requirements. If an abnormality occurs in the data pushing process, such as network failure, data loss and the like, the industrial control terminal and/or the server terminal should have a corresponding retransmission mechanism and an abnormality handling mechanism, and give confirmation feedback after the data is successfully received, so as to ensure the consistency and the integrity of the data.

Further, the server sends a data packet (the read-write flag is 0X 00) for reading the register of the industrial control equipment, the industrial control equipment receives and sends the data to the server, and other address data are returned to indicate the write failure.

Specifically, the server constructs a data packet of a read command according to a predefined communication protocol, where the data packet includes an address of an industrial control device register to be read and a read-write flag (in this case, setting to 0x00 represents a read operation). After receiving the read request data packet sent by the server, the industrial control device recognizes that the read request data packet is a register reading operation, and then reads the current register value from the designated register address. After the reading operation is finished, the industrial control equipment constructs a data packet containing a reading result according to the specification of a communication protocol, and returns the value of the current register to the server. If the read is successful, the returned data should be the true value of the requested register. After receiving the data packet returned by the industrial control equipment, the server analyzes and verifies the data content in the data packet. In a normal response, the returned data should correspond to the register address requested to be read.

Further, the server sends a data packet for writing the register of the industrial control equipment (the read-write mark is 0X 01), the industrial control equipment receives and modifies the register, and after the completion, the modified data is sent to the server for judging whether the read-write is successful or not by the server, and other address data are returned to indicate the write failure.

Specifically, the server constructs a data packet containing a write command according to a predefined communication protocol, where the data packet generally specifies a register address of the target industrial control device, a new data value to be written, and a read-write flag (in this case, set to 0x01 represents a write operation), and the industrial control device receives the write request data packet from the server through the communication interface, parses the command and the data therein, and verifies that the read-write flag identifies that the write operation is a write operation. And the industrial control equipment updates the corresponding internal register according to the register address and the data value in the data packet. After the writing operation is completed, the industrial control device generally sends a response data packet according to a protocol specified mode in order to inform whether the operation of the server is successful. In addition to possibly including some status codes, the response packet may also directly send back the current value of the register that has just been written to for verification at the server side. After receiving the response of the industrial control equipment, the server verifies the state information or compares whether the newly written data value is consistent with the expected value. If the write operation is successful, the register data should have been updated to the desired value; if the write fails, the industrial control device may return a specific error code or unexpected data as a flag, such as data returned to other addresses to indicate that the write operation was not completed correctly.

The interaction process of the invention ensures that the server can grasp the control effect on the industrial control equipment in real time and make corresponding processing based on the response. In practice, this process is often accompanied by a strict security and error handling mechanism to ensure stable operation of the system.

Compared with the traditional modbus and IEC104, the communication method based on TCP and SM4 encryption for the industrial control system is simple in structure, communication data are encrypted, and man-in-the-middle attacks, replay attacks and unauthorized access can be effectively prevented.

In order to implement the above embodiment, as shown in fig. 3, there is further provided a TCP and SM4 based encryption communication system 10 for an industrial control system, including:

A TCP connection creation module 100, configured to create a TCP connection through an industrial control terminal;

The registration request sending module 200 is configured to send a registration request of an MAC address and a corresponding password of the industrial control device to the server through a TCP connection;

The encryption confirmation receiving module 300 is configured to receive an encryption confirmation packet returned by the server after the server queries the original password according to the MAC address registration request;

and the decryption data transmission module 400 is used for decrypting the encryption confirmation packet according to the original password and transmitting the data of the industrial control equipment register after the decryption is successful.

Further, after decrypting the data transmission module 400, it further includes: the register data pushing module is used for:

And reading the current value of the internal register according to the register data pushing rule and the preset triggering condition, and packaging the current value into a data message conforming to the communication protocol format so as to be sent to a server side through a network.

Further, after the register data pushing module, the method further includes: the industrial control equipment register reading module is used for:

Further, after the industrial control device register reading module, the device further comprises an industrial control device register writing module, configured to:

Further, before the TCP connection creation module 100, it further includes: the password encryption module is used for:

And encrypting all data behind the message header transmitted by the industrial control terminal equipment by using the 128-bit key before an SM4 encryption algorithm.

Compared with the traditional modbus and IEC104, the communication method of the encryption communication system based on TCP and SM4 for the industrial control system is simple in structure, and communication data are encrypted, so that man-in-the-middle attacks, replay attacks and unauthorized access can be effectively prevented.

In the description of the present specification, a description referring to terms "one embodiment," "some embodiments," "examples," "specific examples," or "some examples," etc., means that a particular feature, structure, material, or characteristic described in connection with the embodiment or example is included in at least one embodiment or example of the present invention. In this specification, schematic representations of the above terms are not necessarily directed to the same embodiment or example. Furthermore, the particular features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples. Furthermore, the different embodiments or examples described in this specification and the features of the different embodiments or examples may be combined and combined by those skilled in the art without contradiction.

Furthermore, the terms "first," "second," and the like, are used for descriptive purposes only and are not to be construed as indicating or implying a relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defining "a first" or "a second" may explicitly or implicitly include at least one such feature. In the description of the present invention, the meaning of "plurality" means at least two, for example, two, three, etc., unless specifically defined otherwise.

Claims

1. A TCP and SM4 based encryption communication method for an industrial control system, the method comprising:

Creating TCP connection through an industrial control terminal;

2. The method of claim 1, wherein after decrypting the encrypted confirmation packet according to the original password and performing data transmission of the industrial control device register after the decryption is successful, the method further comprises:

3. The method of claim 2, wherein after being transmitted to the server side over a network, the method further comprises:

4. A method according to claim 3, characterized in that the method further comprises:

5. The method of claim 4, wherein prior to said creating a TCP connection by an industrial control terminal, the method further comprises:

6. A TCP and SM4 based encryption communication system for an industrial control system, comprising:

7. The system of claim 6, further comprising, after the decrypted data transfer module: the register data pushing module is used for:

8. The system of claim 7, further comprising, after the register data push module: the industrial control equipment register reading module is used for:

9. The system of claim 8, further comprising an industrial control device register write module, after the industrial control device register read module, for:

10. The system of claim 9, further comprising, prior to the TCP connection creation module: the password encryption module is used for:

and encrypting all data behind the message header transmitted by the industrial control terminal equipment by utilizing the 128-bit key before the SM4 encryption algorithm.