关键词: 工业互联网, APT攻击, 零信任, 动态认证, CNNBiLST

Abstract: The deep integration of newgeneration information technology and industrial systems has improved the connectivity of industrial control systems and industrial equipment networks, making the industrial Internet a key target for APT attacks. In view of the problem that existing methods that prefer static authentication make it difficult to identify the “puppet identity” obtained by APT attackers controlling internal compromised terminals, thereby causing sensitive data leakage, a zerotrust dynamic authentication solution for the industrial Internet is proposed. Fusion of CNNBiLSTM to build a hybrid neural network, and use its time series characteristics to design a behavioral factor prediction model. Features are extracted through a deep convolutional network composed of multiple residual blocks, and a twoway long shortterm memory network performs time series analysis to generate behavioral factor predictions for the subject, which serve as important credentials for zerotrust dynamic authentication. In order to quickly identify the “puppet identity”, the IPKSPA dynamic authentication mechanism is designed by incorporating behavioral factors. Use lightweight identification public key technology to adapt to the massive number of terminals in the industrial Internet, and use zerotrust singlepackage authorization technology to hide the boundaries of industrial control networks. Security analysis and experimental results show that the proposed dynamic authentication scheme has better “puppet identity” identification capabilities and is helpful in combating the threat of data theft caused by APT identity compromise in the industrial Internet environment.

Key words: industrial Internet, APT attack, zerotrust, dynamic authentication, CNNBiLSTM