中圖分類號：TP309文獻標志碼：ADOI:10.19358/j.issn.2097-1788.2026.06.002中文引用格式：王蕊，徐志浩，董良遇.融合國密算法的工控協議動態自適應加固體系設計［J］.網絡安全與數據治理，2026，45（6）：9-16. 英文引用格式：Wang Rui，Xu Zhihao，Dong Liangyu.Design of dynamic adaptive reinforcement system for industrial control protocols integrated with national cryptographic algorithms［J］.Cyber Security and Data Governance，2026，45（6）：9-16.
Design of dynamic adaptive reinforcement system for industrial control protocols integrated with national cryptographic algorithms
Wang Rui1,2，Xu Zhihao1,2，Dong Liangyu1,2
1. China Industrial Control Systems Cyber Emergency Response Team; 2. Key Laboratory of Industrial Information Security Perception and Evaluation Technology, Ministry of Industry and Information Technology
Abstract： Aiming at the prominent security defects and insufficient protection capability of industrial control protocols under the integration of the industrial internet,this paper conducts research on security analysis and reinforcement system of industrial control protocols.By analyzing the architecture and communication mechanisms of typical industrial control protocols,the security shortcomings are identified,and the attack paths and damage mechanisms at the protocol layer are revealed.Breaking through the limitations of traditional singlepoint defense,a scheme integrating national cryptographic algorithms,humanmachine collaborative reverse engineering and dynamic adaptive reinforcement is proposed,constructing a fulllifecycle protection system covering protocol parsing,vulnerability detection and active defense.Experimental verification shows that the proposed scheme can significantly improve attack interception and vulnerability defense performance while ensuring realtime performance and compatibility.The research results can provide technical support for security detection,vulnerability mining and reinforcement implementation of industrial control protocols,and help enhance the attack resistance of critical infrastructure.
Key words : industrial control protocol; protocol reverse analysis; security hardening; national cryptography SM9; dynamic
引言
隨著工業4.0與智能制造的快速推進，工業控制系統(Industrial Control System，ICS)正逐步打破封閉運行模式，實現OT網絡與IT網絡、互聯網的深度融合。工控協議作為設備間指令交互、數據傳輸的核心載體，其安全邊界不斷模糊。不同于傳統網絡協議追求大帶寬、廣覆蓋的特點，工控協議的設計初心更聚焦于高實時性、高可靠性與強抗干擾性，但卻忽視了安全防護機制的構建，導致傳統工控協議，例如Modbus、分布式網絡協議3(Distributed Network Protocol 3，DNP3)等存在先天安全缺陷［1］。同時，工業領域中大量私有工控協議因缺乏統一的設計規范與公開文檔，其協議格式、字段語義的不透明性為漏洞挖掘與攻擊實施提供了可乘之機［2］。
2025年,美國網絡安全和基礎設施安全局(Cybersecurity and Infrastructure Security Agency，CISA)累計發布ICS相關網絡安全官方通告超340份，其中高危/致命漏洞占比超55%，大量漏洞可實現遠程代碼執行、系統接管、權限提升，覆蓋施耐德、西門子、羅克韋爾等頭部廠商核心產品，攻擊者可通過協議漏洞實現遠程代碼執行、系統接管等惡意操作，波及能源、制造、水處理等關鍵信息基礎設施領域［3］。這些事件充分暴露了工控協議安全防護的緊迫性，也凸顯了對工控協議進行深度分析與創新加固的重要意義。現有工控協議研究主要分為協議逆向分析與安全加固兩類。協議逆向分析以報文序列分析為主，對系統影響較小，但字段語義推斷精度低、私有協議適配性不足［4］。安全加固多采用安全傳輸層協議(Transport Layer Security，TLS)加密、訪問控制等被動防御手段，實時性適配差，難以抵御零日漏洞與未知攻擊，且國密算法融合應用不足，無法滿足關鍵信息基礎設施安全合規要求。為此，亟需構建兼顧實時性、兼容性與安全性的工控協議動態防護體系。
