Abstract: A revocable lightweight group authentication method and system for an edge controller is described here. When the edge controller needs to be registered, an edge server generates a private key of the edge controller and sends the private key to the edge controller, and meanwhile adds the edge controller to a group list of the edge server; the edge server updates a certificate of the edge controller, adds the certificate to a certificate list of the edge server and sends the certificate to the edge controller so that the edge controller updates the private key according to the updated certificate; and then the edge controller generates a signature according to the updated private key, and sends the signature to the edge server so that the edge server authenticates the edge controller after determining that the signature meets preset requirements.

Abstract: The present invention relates to the field of intelligent driving. Disclosed is a method for detecting the position relation between a vehicle and a lane line. The method for detecting the position relation between a vehicle and a lane line comprises: obtaining a vehicle model, the vehicle model being represented by a plurality of first coordinates in a world coordinate system; obtaining a lane line image, the lane line image being captured by a camera disposed on a vehicle; obtaining a calibration parameter of the camera; determining, according to the lane line image and the calibration parameter, a first line segment of a lane line mapped into the world coordinate system; and determining the position relation between the lane line and the vehicle according to the position relation between the first line segment and the plurality of first coordinates in the world coordinate system.

Abstract: A revocable lightweight group authentication method and system for an edge controller is described here. When the edge controller needs to be registered, an edge server generates a private key of the edge controller and sends the private key to the edge controller, and meanwhile adds the edge controller to a group list of the edge server; the edge server updates a certificate of the edge controller, adds the certificate to a certificate list of the edge server and sends the certificate to the edge controller so that the edge controller updates the private key according to the updated certificate; and then the edge controller generates a signature according to the updated private key, and sends the signature to the edge server so that the edge server authenticates the edge controller after determining that the signature meets preset requirements.

Abstract: The present invention relates to a trusted measurement and control network authentication method based on double cryptographic values and chaotic encryption. The specific method comprises realizing identity authentication and key negotiation processes through double cryptographic values and chaotic public key ciphers and realizing secure transmission and verification of user identity credentials on the basis of building a trust chain through trusted computation for realizing a secure and trusted operating environment, thereby building a secure and trusted data transmission channel. The identity authentication method in the present invention comprises multiple links such as secure generation of user identity identifiers, read protection encapsulation, secure transmission and key negotiation. Each link adopts a unique and confidential cryptographic function for secure data generation, thereby ensuring the security of the authentication device access in an industrial measurement and control network.

Abstract: The present invention relates to a working condition state modeling and model correcting method, comprising collecting data, and arranging the data in a chronological order to form a time sequence data set; preprocessing the time sequence data set; clustering the preprocessed time sequence data set, computing a central point data set of the duster, and generating a working condition data set and a working condition process data set; counting a working condition transition probability for the working condition process data set to form a working condition transition probability model data set; collecting the data, and detecting and processing the data; computing a working condition state transition mode phase by phase and processing.

Abstract: The present invention relates to a network guard unit for an industrial embedded system and a guard method. The specific method is to form the network guard unit (NGU) through security technologies, such as integrated access control, identity authentication and communication data encryption, to provide active guard for a site control device. The NGU comprises an access control module, an identity authentication module, a data encryption module, a key negotiation module and a PCIE communication module, and supports the communication modes of dual network cards and PCIE bus. The present invention builds a secure and trusted operating environment for industrial control systems in combination with an active guard technical means in the field of information security on the basis of ensuring the correctness and the feasibility of security of various terminal devices in the industrial control systems.

Abstract: A method for starting a trusted embedded platform based on TPM industrial control includes taking a Core Root of Trust Measurement (CRTM) as a source of a trust chain and executing CRTM after electrifying an embedded platform; conducting trust measurement of BIOS and starting BIOS after passing measurement; BIOS measuring Bootloader and extending a measured value into PCR corresponding to TPM; after passing the measurement, transferring a control execution right to Bootloader; and Bootloader measuring OS kernel start process, recording a measured value into PCR of TPM, and executing a start flow of OS after passing the measurement. The method performs measurement before start of each part of a start process, and measured values are also stored in the PCR corresponding to TPM. When the start process is tampered by an attacker, an integrity measurement mechanism terminates the execution of a program, thereby ensuring the security of the embedded platform.

Abstract: The present invention relates to a security processing unit of PLC and a bus arbitration method thereof, to provide PLC with an active defense means to build a PLC hardware and software security layer. On a hardware security layer, a part of hardware processing mechanism is added to support trusted measurement, encryption algorithms and signature algorithms, and a virtual isolation technology is used; and on a software security layer, transparent encryption and decryption, integrity verification, backup recovery and virtual isolation security mechanism are provided. The security processing aspect is improved to achieve the purpose of security and reliability. The present invention can correctly establish a trusted environment of PLC to ensure that PLC is guided by a strictly verified path. A new star type trusted structure is designed to reduce loss during information transmission and increase information transmission efficiency.

Abstract: The present invention discloses a method for controlling transmission security of an industrial communication flow based on an SDN architecture. The method comprises: designing a flow security control module in a management controller, performing in-depth parsing on industrial communication flow data, matching the parsing result with each preset industrial rule policy, and executing a control processing operation of the industrial rule policy, to implement transmission control of an industrial communication flow. The management controller comprises an industrial rule policy database used for storing all industrial rule policies set by a user. An SDN switch maintains a structure of a flow table, and an industrial communication flow is forwarded according to the flow table. The flow table comprises a security control identifier used for indicating whether security transmission of this communication flow needs to be controlled.

Abstract: The present invention relates to a dynamic security method and system based on multi-fusion linkage response. In the method, a site control device conducts active response and passive response through identity authentication and key management to give an alarm for abnormal behaviors. The system comprises an access authentication active response module, an access control active response module, an access control passive response module, an abnormal pretending passive response module, a key vulnerability passive response module and an abnormal state passive response mechanism module. On the basis of ensuring validity and feasibility for the security of a terminal device, the present invention can build a secure and trusted industrial control system operating environment.

Abstract: Proposed is an anomaly detection method for communication behaviors in an industrial control system based on an OCSVM algorithm. According to the present invention, a normal behavior profile model and an abnormal behavior profile model, i.e. a dual-outline model, of communication behaviors in an industrial control system are established, parameter optimization is performed by means of a particle swarm optimization (PSO) algorithm, an optimal intrusion detection model is obtained, and abnormal Modbus TCP communication traffic is identified. According to the present invention, the false alarm rate is reduced by means of cooperative discrimination of the dual-outline detection model, the efficiency and reliability of anomaly detection are improved, and the method is more applicable to practical applications.

Abstract: The present invention discloses a method for trusted booting of PLC based on a measurement mechanism, comprising the following steps: a step of initializing self firmware verification; a step of reading and computing firmware information about a PLC; a step of checking and storing one by one; and a step of verifying at the operation start stage. In the method of the present invention, a chip with a trusted function is used as a core of hardware computation. The PLC extends a Flash bus for loading by hardware of the method of the present invention. The hardware of the method of the present invention recognizes necessary boot information, verifies the integrity of the boot loader necessary for the PLC system through the integrity check method and ensures that the booted PLC system is in a trusted state. On the basis of ensuring validity and feasibility for the safety of a terminal device, the present invention can build a safe and trusted industrial control system operating environment.

Abstract: The present application discloses a method for automatically establishing an intrusion detection model based on an industrial control network, including: judging whether a first intrusion detection model meets preset detection requirements, and extracting communication behavior traffic data in real time if not; setting a training data set and a test date set according to the communication behavior traffic data; establishing an initial intrusion detection model according to the training data set; and testing the initial intrusion detection model using the test date set, and establishing a second intrusion detection model meeting the preset detection requirements according to the test result. The second intrusion detection model has high detection accuracy, thereby increasing intrusion detection rate of abnormal behavior and reducing false positive rate and false negative rate.

Abstract: The present invention discloses a method for controlling transmission security of an industrial communication flow based on an SDN architecture. The method comprises: designing a flow security control module in a management controller, performing in-depth parsing on industrial communication flow data, matching the parsing result with each preset industrial rule policy, and executing a control processing operation of the industrial rule policy, to implement transmission control of an industrial communication flow. The management controller comprises an industrial rule policy database used for storing all industrial rule policies set by a user. An SDN switch maintains a structure of a flow table, and an industrial communication flow is forwarded according to the flow table. The flow table comprises a security control identifier used for indicating whether security transmission of this communication flow needs to be controlled.

Abstract: Proposed is an anomaly detection method for communication behaviours in an industrial control system based on an OCSVM algorithm. According to the present invention, a normal behaviour profile model and an abnormal behaviour profile model, i.e. a dual-outline model, of communication behaviours in an industrial control system are established, parameter optimization is performed by means of a particle swarm optimization (PSO) algorithm, an optimal intrusion detection model is obtained, and abnormal Modbus TCP communication traffic is identified. According to the present invention, the false alarm rate is reduced by means of cooperative discrimination of the dual-outline detection model, the efficiency and reliability of anomaly detection are improved, and the method is more applicable to practical applications.