摘要
针对目前工业测控系统中传统PLC自身信息安全防护能力低下的问题,文章提出一种基于工业控制系统嵌入式设备安全防护关键技术的可信计算环境构建方法。文章首先介绍了现有可信计算在系统应用中的研究工作和不足;然后详细给出了面向工业嵌入式设备的安全技术架构设计,包括基于总线仲裁机制的可信PLC主控单元、基于虚拟化沙盒技术的可信PLC运行环境和基于白名单访问控制的可信PLC网络安全单元。实验证明,文章提出的可信计算环境构建方法能够用于为传统工控设备组建安全可信的系统网络,实现设备的内建安全能力。
Aiming at the problem of low information security protection ability of traditional PLC in industrial measurement and control system, this paper presents a method of building a trusted computing environment based on the key technology of embedded equipment security protection in industrial control system. Firstly, this paper introduces the research work and shortcomings of trusted computing in system application, and then gives a detailed design of security technology architecture for industrial embedded equipment, including trusted PLC main control unit based on bus arbitration mechanism, trusted PLC running environment based on virtualization sandbox technology and trusted PLC network security unit based on white list access control. Experiments show that the trusted computing environment construction method proposed in this paper can be used to build a secure and trusted system network for traditional industrial control equipment and realize the equipment built-in security capability.
作者
尚文利
尹隆
刘贤达
赵剑明
SHANG Wenli;YIN Long;LIU Xianda;ZHAO Jianming(Shenyang Institute of Automation,Chinese Academy of Sciences,Shenyang Liaoning 110016,China;Institutes for Robotics and Intelligent Manufacturing,Chinese Academy of Sciences,Shenyang Liaoning 110016,China;University of Chinese Academy of Sciences,Beijing 100049,China;Key Laboratory of Networked Control Systems,Chinese Academy of Sciences,Shenyang Liaoning 110016,China)
出处
《信息网络安全》
CSCD
北大核心
2019年第6期1-10,共10页
Netinfo Security
基金
国家重点研发计划[2018YFB2004200]
中国科学院战略性先导科技专项[XDC02020200]
国家自然科学基金[61773368]
关键词
工业控制系统
可信计算
可信PLC
网络安全单元
industrial control system
trusted computing
trusted PLC
network security unit
