Double layer blockchain-assisted trusted data flow model for industrial control systems

With the development of information technology (IT), the blurred network boundary between the Operational Technology (OT) network and the IT network poses a higher risk of cyber-attacks on the flow of data in Industrial Control System (ICS). Deep isolation of ICS, enhanced data access control in ICS, and proactive defense against cyber-attacks in ICS can help achieve the secure flow of highly sensitive data in ICS. This article proposes a dual-layer blockchain-assisted data flow protection framework for ICS, driven by blockchain, and conducts simulation and analysis. Firstly, OT-blockchain and IT-blockchain were designed to redefine the network boundary of ICS. Secondly, an identity-assisted authentication mechanism based on Bloom filters and trusted databases was designed to rapidly identify dishonest nodes. Then, an ICS-RBAC zero-trust access control mechanism based on RBAC was designed to ensure the security of the OT blockchain and achieve zero-trust data exchange between the IT-blockchain and ICS physical devices. And, an active defense mechanism for ICS was designed based on the principle of the heartbeat mechanism. Finally, model analysis and simulation verification are conducted. The results indicate that this study can achieve trusted data flow in ICS and fine-grained zero-trust access control, providing security guarantees.