无线工业控制系统安全实验平台及算法验证

发布时间：2018-05-05 09:25

本文选题：工业无线控制系统 + 安全　；参考：《浙江大学》2017年硕士论文

【摘要】：由于近年来针对工控系统的恶意攻击事件不断发生,工控系统安全引起了国家高度重视。同时随着工业无线技术的发展,工业无线因其成本低廉、易于部署等特点在工控系统中得到了广泛的应用。但是工业无线开放的通信方式也给工控系统带来了新的安全隐患。目前针对无线工控系统安全性的研究主要侧重于攻击建模、攻击检测、攻击防御等理论方面的研究,缺少实际无线工控系统下对理论结果的实验验证。鉴于此,本文通过搭建无线工业控制系统安全实验平台,研究工业无线安全性并检验工控无线安全理论在实际网络中的有效性。具体研究内容包含如下几个方面:(1)本文设计并搭建了无线工业安全实验平台,平台主要包括四个部分:分别是通过Matlab搭建的虚拟被控对象、可编程逻辑控制器和上位机相结合的控制器、控制器与被控对象之间的通信网络以及无线攻击外设。同时,本文还对平台整体功能进行了测试。(2)考虑实际无线工业系统存在丢包、延时等现象,通过实验平台研究理论结果在实际网络中的有效性有着重要意义。本文对无线工控系统中最常见的拒绝服务攻击(Denial-of-Service,DoS)攻击展开研究,重点研究了线性二次高斯(Linear-Quadratic-Gaussian,LQG)控制下最优DoS攻击策略理论在实际工业无线网络中是否依旧成立。通过在平台中搭建二级倒立摆系统和LQG控制器,并利用软件无线电外设对DTD433M无线端子实施相应攻击策略,本文验证了最优DoS攻击策略在实际工业无线网络中的有效性。(3)DTD433M无线端子将有线ModBus设备通讯数据转化成无线传输,因其在通信中不具跳频特性很容易受DoS攻击。本文针对工控系统典型的WirelessHART无线协议展开研究,重点分析了其跳频机制,通过安全实验平台采集WirelessHART通信过程中的信道数据验证了 WirelessHART跳频伪随机漏洞,并利用软件无线电外设成功对其实施了 DoS攻击。
[Abstract]:Due to the malicious attacks against industrial control system in recent years, the security of industrial control system has attracted great attention. With the development of industrial wireless technology, industrial wireless has been widely used in industrial control system because of its low cost and easy deployment. However, industrial wireless open communication mode also brings a new security hazard to industrial control system. At present, the research on the security of wireless industrial control system mainly focuses on the theory of attack modeling, attack detection, attack defense and so on, and lacks the experimental verification of the theoretical results under the actual wireless industrial control system. In view of this, this paper studies the industrial wireless security and verifies the effectiveness of the industrial control wireless security theory in the actual network by setting up a wireless industrial control system security experimental platform. The specific research content includes the following aspects: 1) this paper designs and builds a wireless industrial safety experimental platform, which consists of four parts: a virtual controlled object built by Matlab, A programmable logic controller combined with a host computer, a communication network between the controller and the controlled object, and a wireless attack peripheral. At the same time, the whole function of the platform is tested. 2) considering the phenomena of packet loss and delay in the actual wireless industrial system, it is of great significance to study the effectiveness of the theoretical results in the actual network through the experimental platform. In this paper, the most common denial of service attack (Deni al-of-Service dos) attack in wireless industrial control systems is studied. The emphasis is on whether the theory of optimal DoS attack strategy under the control of Linear Quadratic-Quadratic-Gaussian DoS (LQG) is still valid in industrial wireless networks. By setting up the two-stage inverted pendulum system and LQG controller in the platform, and using the software radio peripheral to implement the corresponding attack strategy to the DTD433M wireless terminal, This paper verifies the effectiveness of the optimal DoS attack strategy in practical industrial wireless networks. The wireless terminal converts wired ModBus device communication data into wireless transmission because it is vulnerable to DoS attack without frequency hopping characteristics in communication. In this paper, the typical WirelessHART wireless protocol of industrial control system is studied, and its frequency hopping mechanism is analyzed. The channel data in WirelessHART communication is collected from the security experiment platform to verify the pseudo-random loophole of WirelessHART frequency hopping. The DoS attack is successfully carried out by using the software radio peripherals.
【学位授予单位】：浙江大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP273;TP309

【相似文献】