Research on key technologies of industrial terminal security protection based on zero trust
Sun Guofeng1，Zeng Bin2，Tang Ning1
1. CNNC 272 Uranium Industry Co., Ltd.; 2. Changsha University
Abstract： The industrial system involves a wide variety of equipment and products, and the security boundary of industrial information systems is gradually blurring. External attacks and internal threats are becoming increasingly serious. This paper focuses on solving the security risks existing in the edge management of the industrial Internet, studies the unified identity authentication, continuous trust assessment, and dynamic access control technologies that are suitable for different types of terminals, different access and interaction methods, and builds a zero-trust security protection architecture for industrial information security. It can avoid security risks such as illegal imitation access, security vulnerability exploitation, and data monitoring and theft, monitor the communication behavior characteristics of industrial devices connected to the network, and achieve the protection goals of trusted access, protocol security, and continuous assessment, thereby improving the active defense capability of the industrial control network boundary.
Key words : zero trust；industrial control network; access control；security protection
引言
目前，工業(yè)控制系統(tǒng)(Industrial Control System，ICS)的建設(shè)規(guī)模不斷擴(kuò)大，復(fù)雜程度不斷提高，導(dǎo)致其面臨的安全風(fēng)險(xiǎn)激增，例如誤操作、數(shù)據(jù)篡改、未授權(quán)訪問，以及惡意代碼、拒絕服務(wù)、違規(guī)外聯(lián)、異常進(jìn)程活動(dòng)等外部威脅［1］?；趯?duì)系統(tǒng)內(nèi)設(shè)備、應(yīng)用和用戶的信任，傳統(tǒng)工控網(wǎng)絡(luò)安全架構(gòu)在一定程度上已不能完全滿足目前工業(yè)信息系統(tǒng)日益復(fù)雜的安全防護(hù)要求。零信任機(jī)制適用于工業(yè)互聯(lián)網(wǎng)中設(shè)備多樣性和網(wǎng)絡(luò)邊界模糊的特點(diǎn)，通過身份驗(yàn)證、持續(xù)信任評(píng)估與動(dòng)態(tài)調(diào)整訪問控制等策略，為工業(yè)互聯(lián)網(wǎng)安全提供了重要解決方案［2］。為了解決傳統(tǒng)安全防護(hù)體系在新型工業(yè)終端接入管控方面逐漸失效的問題，本文緊密圍繞新型工業(yè)終端接入安全管控需求，深入研究以工業(yè)主機(jī)、控制設(shè)備、非受控終端等為代表的終端統(tǒng)一身份認(rèn)證、持續(xù)信任評(píng)估、動(dòng)態(tài)訪問控制等技術(shù)，進(jìn)而研制面向新型業(yè)務(wù)終端接入的威脅智能防控系統(tǒng)原型，實(shí)現(xiàn)工控網(wǎng)內(nèi)終端設(shè)備的有效識(shí)別、行為監(jiān)測(cè)與異常管控，提高工業(yè)互聯(lián)網(wǎng)的邊界智能安全管控能力，構(gòu)建面向異構(gòu)工業(yè)終端的多層次邊界接入防護(hù)體系。
