Research on key technologies of industrial terminal security protection based on zero trust
Sun Guofeng1，Zeng Bin2，Tang Ning1
1. CNNC 272 Uranium Industry Co., Ltd.; 2. Changsha University
Abstract： The industrial system involves a wide variety of equipment and products, and the security boundary of industrial information systems is gradually blurring. External attacks and internal threats are becoming increasingly serious. This paper focuses on solving the security risks existing in the edge management of the industrial Internet, studies the unified identity authentication, continuous trust assessment, and dynamic access control technologies that are suitable for different types of terminals, different access and interaction methods, and builds a zero-trust security protection architecture for industrial information security. It can avoid security risks such as illegal imitation access, security vulnerability exploitation, and data monitoring and theft, monitor the communication behavior characteristics of industrial devices connected to the network, and achieve the protection goals of trusted access, protocol security, and continuous assessment, thereby improving the active defense capability of the industrial control network boundary.
Key words : zero trust；industrial control network; access control；security protection
引言
目前，工業(yè)控制系統(tǒng)(Industrial Control System，ICS)的建設規(guī)模不斷擴大，復雜程度不斷提高，導致其面臨的安全風險激增，例如誤操作、數(shù)據(jù)篡改、未授權訪問，以及惡意代碼、拒絕服務、違規(guī)外聯(lián)、異常進程活動等外部威脅［1］。基于對系統(tǒng)內(nèi)設備、應用和用戶的信任，傳統(tǒng)工控網(wǎng)絡安全架構在一定程度上已不能完全滿足目前工業(yè)信息系統(tǒng)日益復雜的安全防護要求。零信任機制適用于工業(yè)互聯(lián)網(wǎng)中設備多樣性和網(wǎng)絡邊界模糊的特點，通過身份驗證、持續(xù)信任評估與動態(tài)調(diào)整訪問控制等策略，為工業(yè)互聯(lián)網(wǎng)安全提供了重要解決方案［2］。為了解決傳統(tǒng)安全防護體系在新型工業(yè)終端接入管控方面逐漸失效的問題，本文緊密圍繞新型工業(yè)終端接入安全管控需求，深入研究以工業(yè)主機、控制設備、非受控終端等為代表的終端統(tǒng)一身份認證、持續(xù)信任評估、動態(tài)訪問控制等技術，進而研制面向新型業(yè)務終端接入的威脅智能防控系統(tǒng)原型，實現(xiàn)工控網(wǎng)內(nèi)終端設備的有效識別、行為監(jiān)測與異常管控，提高工業(yè)互聯(lián)網(wǎng)的邊界智能安全管控能力，構建面向異構工業(yè)終端的多層次邊界接入防護體系。
