基于CPN模型的工控网络应用层脆弱性研究
Application Layer Vulnerability Study of Industrial Control Network Based on CPN Model
洪超 1刘媛 2杨祎巍 1陆力瑜 2梁志宏 1曹扬 3莫蓓蓓 2陈文迪2
作者信息
- 1. 南方电网科学研究院有限责任公司,广东 广州 510663
- 2. 广西电网有限责任公司,广西 南宁 450100
- 3. 中国南方电网有限公司,广东 广州 510663
- 折叠
摘要
随着工业控制系统的网络安全问题越发严重,从机理上对工控网络安全脆弱性进行研究变得更加迫切.针对工控网络应用层基于加密安全通信机制的网络安全问题,将着色Petri网(CPN)理论引入工控网络应用层的脆弱性分析.对基于加密通信机制的过程进行标准状态和不安全状态的建模,通过引入模型的状态方程,将脆弱性分析的问题转化为对线性方程的求解问题.通过一个加入中间人攻击的案例验证了不安全状态的可达性,并得到了一个CPN模型的变迁执行(攻击)序列.通过一个中间人攻击算例进行了试验验证.试验结果表明,在掌握工控网络通信机制和工控协议规范的条件下,对于基于加密通信机制的工控网络,攻击者可以达成攻击效果.这意味着相应的工控网络存在可被利用的漏洞.
Abstract
The security problem of industrial control network is more and more serious,making it urgent on the mechanism of the vulnerability study of industrial control network security.Addressed on the cyber security problem of the application layer of industrial control network,which is based on the encrypted seurity communication mechanism,the theory of colored Petri net (CPN) is introduced into the vulnerability analysis for the application layer of industrial control network.The standard states and unsafe states based on the process of encrypted communication mechanism are modeling,and the problem of vulnerability analysis is transformed into the problem of solving the linear equation,by introducing the state equation of the model.A case with a man-in-the-middle attack is introduced to verify the accessibility of unsafe states,and a transition execution (attack) sequence of CPN model is obtained.An experiment validation is conducted through a man-in-the-middle attack case.The result of the experiment shows that under the communication mechanism of the industrial control network,and the industrial control protocol specification are mastered,the attack effect can be achieved by attackers on the industrial control network based on the encrypted communication mechanism.It means that there are exploitable vulnerabilities in the corresponding industrial control network.
关键词
工控网络/脆弱性分析/着色Petri网/网络安全/Diffie-Hellman算法/加密通信/安全漏洞Key words
Industrial control network/Vulnerability analysis/Colored Petri net(CPN)/Network security/Diffie-Hellman(DH) algorithm/Encrypted communications/Security vulnerabilities引用本文复制引用
出版年
2024
NETL
NSTL
万方数据