Petroleum refining system multiple safety demand generation method and system based on Secure Tropos

Abstract

The invention discloses a Secure Tropos-based method and system for generating multiple safety requirements of a petroleum refining system, and belongs to the field of safety engineering.The method comprises the following steps: aiming at a safety protection target of a petroleum refining device, analyzing a dependency relationship and a safety threat among system function modules involved in the whole process of the petroleum refining device; analyzing the structure and the data interaction type of the petroleum refining device, and establishing a security entity and a data interaction model; analyzing data flow and control flow features, determining corresponding function requirements, and deducing security constraints in combination with a security protection target; and carrying out model inspection on the established security entity and data interaction model, automatically generating an inspection report, and carrying out security constraint violation analysis on report content to respectively obtain a public security demand and a special security demand. The method can be used for quickly generating high-quality safety requirements meeting functional requirements and related standards for the petroleum refining device, and the efficiency, the effect and the accuracy are greatly improved.

Description

Technical Field

[0001] The present invention belongs to the field of safety engineering in chemical industry production, and more specifically, relates to a method and system for generating multiple safety requirements of a petroleum refining system based on SecureTropos. Background Art

[0002] Petroleum products are the foundation of national development and people's lives. As a key basic industrial facility, petroleum refining units are responsible for crude oil processing, separation and conversion, and ultimately obtain various petroleum products. However, with the development of industrial control systems, new sensor networks and data communication technologies, the operation of petroleum refining units faces more and more security risks and has gradually become a common target of cyber attacks. Since the products of petroleum refining units are flammable and explosive, once they are attacked by cyber attacks, they are very likely to cause major production safety accidents. Therefore, how to use emerging technologies to ensure the safe operation of petroleum refining units has become a research focus.

[0003] Comprehensive and accurate security requirements generation is an important basis for ensuring the safe operation of oil refining units and deploying safety protection measures. Existing security requirements generation mostly adopts a method that combines risk analysis with demand engineering, which generally has problems such as long time consumption, strong subjectivity, poor scalability or excessive safety design. For the security requirements generation of oil refining units, it is necessary to consider not only the traditional physical safety of chemical production, but also the security requirements of industrial control systems, communication networks, regulations and standards, business continuity, etc. In addition, since the security threats to oil refining units during operation are dynamic and time-varying, there are higher requirements for the timeliness and generation efficiency of security requirements. However, when applied to large-scale oil refining units, the current security requirements generation method cannot quickly obtain comprehensive and accurate security requirements. Summary of the invention

[0004] In view of the above defects or improvement needs of the prior art, the present invention provides a method and system for generating multiple security requirements for a petroleum refining system based on Secure Tropos, which can reduce the complexity of large-scale system security requirement modeling, quickly generate high-quality security requirements that meet functional requirements and relevant standards, and greatly improve efficiency, effect and accuracy.

[0005] To achieve the above object, according to a first aspect of the present invention, a method for generating multiple security requirements for a petroleum refining system based on Secure Tropos is provided, comprising:

[0006] S1, determine the security protection objectives, dependency types and security threats of petroleum refining equipment;

[0007] S2, dividing the oil refining system into monitoring system, power system, human-computer interaction and refining equipment by functions, and establishing a safety entity and data interaction model of the oil refining system in Secure Tropos software based on the safety protection objectives, security threat types and dependency types; dividing the oil refining system into a reaction regeneration subsystem, a fractionation subsystem and an absorption stabilization subsystem according to the oil refining process flow, and establishing a safety entity and data interaction model of the oil refining system and a safety entity and data interaction model of each subsystem in Secure Tropos software based on the safety protection objectives, security threat types and dependency types;

[0008] S3, determining corresponding functional requirements according to the data flow and control flow characteristics of the oil refining system, and obtaining corresponding security constraints in combination with the security protection objectives; and importing the security constraints into each model respectively;

[0009] S4, perform model inspection on each model respectively to obtain the corresponding inspection report; perform security constraint violation analysis on the inspection report of the security entity and data interaction model of the petroleum refining system and the inspection report of the security entity and data interaction model of each subsystem respectively to obtain the public safety requirements of the petroleum refining system and the special safety requirements of each subsystem.

[0010] According to a second aspect of the present invention, there is provided a system for generating multiple security requirements for a petroleum refining system based on Secure Tropos, comprising: a computer-readable storage medium and a processor;

[0011] The computer-readable storage medium is used to store executable instructions;

[0012] The processor is used to read the executable instructions stored in the computer-readable storage medium and execute the method as described in the first aspect.

[0013] According to a third aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to cause a processor to execute the method as described in the first aspect.

[0014] In general, the above technical solutions conceived by the present invention can achieve the following beneficial effects compared with the prior art:

[0015] The method provided by the present invention applies Secure Tropos to the security requirements analysis of the petroleum refining device, establishes a security entity and data interaction model based on the environmental constraints, dependency relationships, security threats and other factors of the petroleum refining device, and derives security constraints in combination with data flow and control flow characteristics, and combines with automated model checking to quickly generate security requirements that meet functional requirements and relevant standards for the petroleum refining device, thereby improving the security protection capability of the petroleum refining device; a formal modeling language is used in the modeling process, which helps to accurately capture and express the security requirements of the system and avoid ambiguity or ambiguity; in addition, the method considers the interaction and dependency relationships between multiple parties in the requirements modeling, supports the traceability of requirements, and tracks the entire process of requirements from conceptual design to implementation; in summary, the method provided by the present invention can reduce the complexity of large-scale system security requirements modeling, quickly generate high-quality security requirements that meet functional requirements and relevant standards, and greatly improve efficiency, effect and accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 A flow chart of a method for generating multiple security requirements for a petroleum refining device based on Secure Tropos provided in an embodiment of the present invention;

[0017] Figure 2 A schematic diagram of the distribution relationship of four dependencies in a petroleum refining device provided by an embodiment of the present invention;

[0018] Figure 3 A schematic diagram of a security entity and data interaction model of a petroleum refining system provided by an embodiment of the present invention;

[0019] Figure 4 A schematic diagram of a safety entity and data interaction modeling process for a petroleum refining device subsystem provided in an embodiment of the present invention;

[0020] Figure 5 A schematic diagram of a safety entity and data interaction model of a reaction regeneration system provided in an embodiment of the present invention;

[0021] Figure 6 A schematic diagram of a safety constraint generation process combining data flow and control flow features provided in an embodiment of the present invention;

[0022] Figure 7 A schematic diagram of a UML-based safety specification generation process provided in an embodiment of the present invention;

[0023] Figure 8 A schematic diagram of a UML graphical expression of the security constraint attributes of a CSR1 security-critical component provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0024] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention. In addition, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0025] Secure Tropos is an agent-oriented security requirements engineering method. By decomposing the object system into different participants and analyzing their functional goals, data resources, security mechanisms, security threats and other related entities one by one, it provides a systematic method to integrate security issues into the early security requirements development, allowing developers to build secure and reliable software and hardware systems. In addition, because Secure Tropos has many exclusive modeling tools and supports formal verification, it helps to quickly generate comprehensive and accurate security requirements for large-scale oil refining plants with high efficiency, good effect and scalability. Based on this, an embodiment of the present invention provides a method for generating multiple security requirements for oil refining systems based on Secure Tropos. Figure 1 As shown, including:

[0026] S1, determine the security protection objectives, dependency types and security threats of petroleum refining equipment.

[0027] Specifically, the security objectives of the oil refining device can be selected according to actual needs, and the embodiment of the present invention does not limit this to a uniqueness. As an example, preferably, the security objectives include: accessibility, integrity, confidentiality, authentication, and utility, a total of 5 categories.

[0028] Among the above five types of security protection goals, accessibility, integrity and confidentiality belong to the traditional security protection goals in the field of information security and are a consensus in the industry; authenticability, as a supplement to the security protection goals, requires that the user identity be authenticated before any system operation is performed to ensure that the system operation is only performed by authorized users; utility, as a supplement to the security protection goals, requires that the system's data transmission and action execution meet the functional requirements. For example, when a network attack successfully carries out a denial of service attack (DoS), the main damage is the "utility" in the security protection goal. This is because the DoS attack blocks the data transmission, so that the instruction cannot be transmitted to the receiving end within the specified time, and the actuator cannot receive the instruction and does not perform the action, which ultimately leads to the failure to meet the functional requirements. In this process, the blocked data can still be transmitted through the channel and is not rejected (satisfying accessibility), the data field is not intercepted or deleted (satisfying integrity), the data is not leaked to a third party (satisfying confidentiality), and the authentication mechanism is not bypassed or damaged (satisfying authenticability). Therefore, the other four security protection goals are met, and only "utility" is not met;

[0029] The types of system dependencies are determined in sequence based on system functional modules, control loops, data flows and time sequences, that is, the dependency relationships between system components are determined based on physical layer functional components and information layer data transmission channels.

[0030] The type of system dependency can be selected according to actual needs, and the embodiment of the present invention does not limit this to a uniqueness. As an example, preferably, the types of dependency include: timing dependency, data dependency, component dependency, and functional dependency, a total of 4 types.

[0031] The distribution of the above four dependencies in the oil refining unit is shown as follows: Figure 2As shown. The petroleum refining unit contains multiple system functional modules, among which the dependency relationship between functional modules is the functional dependency. For example, when the main air system and the flue gas turbine system are both turned on and reach the expected state, the crude oil supply system will be turned on to deliver crude oil to the regeneration system. Dependency is realized through 0-1 coding during the modeling process. For example, the opening and closing of the main air system (MA) are coded as MA01 and MA00 respectively, the opening and closing of the flue gas turbine (GT) are coded as GT01 and GT00 respectively, and the opening and closing of the crude oil supply system (OS) are coded as OS01 and OS00 respectively. Then the opening condition of the regeneration system (RRS) can be set to (MA01∪GT01∪…∪XX01)∪OS01, where XX01 represents the opening of other system functional modules parallel to the main air system and the flue gas turbine system, ∪ is a parallel symbol, and the upper If any of the above conditions is not met, the anti-restart system will not start; at the same time, each functional module is composed of multiple control loops, each loop contains three types of control components, namely sensors, controllers and actuators, and the dependency between control components is component dependency; the channel between control components contains a large number of data streams, and its process includes data acquisition, data encoding, data transmission and data decoding, and the dependency between processes is data dependency; the data between every two processes is continuous and multi-group, so there is a time series relationship, and the dependency between measurement data of different time series is time series dependency. The four dependency relationships are all realized through 0-1 coding in the subsequent modeling process.

[0032] Identify typical security threats that need to be considered based on information security incidents in oil refining facilities.

[0033] The types of security threats can be selected according to actual needs, and the embodiments of the present invention do not limit this to a uniqueness. As an example, preferably, security threats include: denial of service, false data injection, eavesdropping, replay, malware, and virus, a total of 6 categories.

[0034] The above six typical security threats are the most common security threats against the chemical industry in the past decade, with greater harm and impact. The above six security threats can cover more than 98% of the network attack scenarios against chemical systems.

[0035] S2, dividing the oil refining system into monitoring system, power system, human-computer interaction and refining equipment by functions, and establishing a security entity and data interaction model of the oil refining system in Secure Tropos software based on the security protection objectives, security threat types and dependency types;

[0036] According to the petroleum refining process flow, the petroleum refining system is divided into a reaction regeneration subsystem, a distillation subsystem and an absorption stabilization subsystem; based on the security protection objectives, security threat types and dependency types, the security entity and data interaction model of the petroleum refining system and the security entity and data interaction model of each subsystem are established in the Secure Tropos software.

[0037] The following describes the process of establishing the security entity and data interaction model of the petroleum refining system and the process of establishing the security entity and data interaction model of each subsystem.

[0038] (1) The process of establishing the security entity and data interaction model of the petroleum refining system is as follows:

[0039] Analysis of the structure and data interaction types of petroleum refining equipment: The structure of petroleum refining equipment is mainly divided into monitoring system, power system, human-computer interaction and refining equipment. Among them, the monitoring system is used to monitor a series of system states related to production; the power system is used to ensure the power supply of petroleum refining equipment; the human-computer interaction system allows operators to supervise the production status of the workshop, send specific control instructions, and conduct human intervention in emergency situations to ensure production safety; refining equipment includes a series of container tanks, connectors, sensors, actuators and other components, which are usually controlled objects; the data interaction types of petroleum refining equipment can be divided into monitoring data, operation data, power system data and safety data.

[0040] In the modeling process, the monitoring system, power system, human-computer interaction and refining equipment are set as the first-level participants (Actor); the monitoring data, operation data, power system data and safety data are set as the first-level resources (Resource).

[0041] In the monitoring system, the monitoring function and the control function are set as the first-level functional goals (Goal), and the catalyst, wastewater composition, emission, energy and water consumption, communication, regeneration system, fractionation system, absorption stabilization system, distributed control system (DCS), safety instrument (SIS), alarm device and valve are set as the second-level functional goals (Goal); in the monitoring system, the data interaction types generated include monitoring data, operation data and safety data;

[0042] In the power system, power energy control is the first-level functional goal (Goal); power maintenance, monitoring and control, and power efficiency are set as the second-level functional goals (Goal); supervisory control system SCADA, emergency power system, voltage regulation, switchgear and circuit breakers, transformers, protection relays, and energy management system are set as the third-level functional goals (Goal); in the power system, the data type generated is power system data;

[0043] In human-computer interaction, "communication with oil refining equipment" is set as the functional goal. In order to achieve this goal, four types of data resources are required, including monitoring data, operation data, power system data and safety data.

[0044] In the refining equipment, "data interaction" is set as the functional goal. In order to achieve this goal, two types of data resources are required, including monitoring data and operation data. The final security entity and data interaction model of the petroleum refining system is as follows: Figure 3 shown.

[0045] It is worth noting that actors, resources, and functional goals are all settings in the SecureTropos software. In the present invention, the first-level actors only include monitoring systems, power systems, human-computer interactions, and refining equipment; the first-level resources only include monitoring data, operating data, power system data, and security data; the oil refining system security entity and data interaction model established in the Secure Tropos software is used to derive public safety requirements CSR.

[0046] (2) The process of establishing the security entity and data interaction model of each subsystem is as follows:

[0047] The petroleum refining process is decomposed into the reaction regeneration system RRS, the fractionation system FS and the absorption stabilization system ASS. The three subsystem security entities and data interaction models are established in the Secure Tropos software. The modeling process is as follows: Figure 4 As shown. The present invention takes the reaction regeneration system RRS as an example for explanation, and its security entity and data interaction model are as follows Figure 5 shown.

[0048] In the safety entity and data interaction model of the reaction regeneration system RRS, a total of three secondary participants (Actors) are set up, namely the reaction regeneration system, the fractionation system and the control center. Among them, the fractionation system FS is the adjacent section of the reaction regeneration system RRS, and the product of RRS will directly enter the FS for reaction, so there is an interactive relationship between them; the control center receives monitoring data from the reaction regeneration system and sends control instructions to it to regulate the operation of the system;

[0049] In the secondary participant (Actor) reaction regeneration system, "providing information to the control center" is set as the primary functional goal (Goal), and "receiving static data", "receiving dynamic data", "analyzing received data" and "sending analyzed data" are set as the secondary functional goals (Goal). The secondary resources (Resource) required include - static data of the reaction and regeneration system, operation data of the fractionation system, catalyst monitoring data, waste component monitoring data, waste component safety data, communication quality and safety data, control system monitoring data, control system operation data, safety instrument operation data, alarm device operation data, valve operation data and other operation data; the secondary resources (Resource) generated include - dynamic data of the reaction and regeneration system, operation data of the reaction and regeneration system, and safety data of the reaction and regeneration system.

[0050] In the secondary participant (Actor) fractionation system, "interacting with the reaction system" is set as the primary functional goal (Goal), and "accepting reaction system data" and "sending data to the reaction system" are set as the secondary functional goals (Goal). The required data resources include reaction system dynamic data, reaction system operation data, reaction system safety data and fractionation system operation data, all of which are set as secondary resources (Resource).

[0051] In the secondary participant (Actor) control center, "interact with the anti-reinforcement system" is also set as the primary functional goal (Goal), and "accept anti-reinforcement system data" and "send data to the anti-reinforcement system" are set as secondary functional goals (Goal). The required data resources include anti-reinforcement system dynamic data and control system dynamic data, all of which are set as secondary resources (Resource).

[0052] Among them, the reaction regeneration system and the fractionation system as the secondary participants (Actor), since the input of the fractionation system depends on the output of the reaction regeneration system, the fractionation system can be set as the dependent, and the reaction regeneration system can be set as the dependent, and the interaction data types between the two include the fractionation system operation data, the reaction regeneration system dynamic data, the reaction regeneration system operation data and the reaction regeneration system safety data; the reaction regeneration system and the control center as the secondary participants (Actor), since the operation of the reaction regeneration system is regulated by the control center, the reaction regeneration system in this relationship can be set as the dependent, and the control center can be set as the dependent, and the interaction data types between the two include the reaction regeneration system dynamic data and the control system dynamic data. Among them, the above six types of interaction data are all set as secondary resources (Resource).

[0053] Specifically, the resource transmission between the depender and the dependee may have multiple security objectives and security mechanisms at the same time. Figure 5 In the resource transmission between the reaction regeneration system and the control center shown in the figure, the security protection goals of both the dependent and the dependent include integrity, availability, authentication and utility; each security protection goal is supported by a corresponding security mechanism. For example, in order to meet the integrity requirement, the security mechanisms taken into consideration include storage backup, data encryption, data transmission backup, function list backup and control configuration backup.

[0054] It is worth noting that the safety entity and data interaction model of the fractionation system FS and the absorption stabilization system ASS can be established by referring to the safety entity and data interaction model of the reaction regeneration system RRS;

[0055] For example, in the security entity and data interaction model of the fractionation system FS, three secondary participants (Actors) are set, namely the fractionation system, the reaction regeneration system and the control center. In the secondary participant (Actor) fractionation system, "providing information to the control center" is set as the primary functional goal (Goal), and "receiving static data", "receiving dynamic data", "analyzing received data" and "sending analyzed data" are set as the secondary functional goals (Goal); the secondary resources (Resource) generated include the dynamic data of the fractionation system, the operation data of the fractionation system, and the safety data of the fractionation system; in the secondary participant (Actor) reaction regeneration system, "interacting with the fractionation system" is set as the primary functional goal (Goal), and "receiving data from the fractionation system" and "sending data to the control center" are set as the secondary functional goals (Goal); The required data resources include the distillation system dynamic data, the distillation system operation data, the distillation system safety data and the distillation system operation data, all of which are set as secondary resources. In the secondary actor control center, "interacting with the distillation system" is set as the primary functional goal, and "accepting distillation system data" and "sending data to the distillation system" are set as the secondary functional goals. The required data resources include the distillation system dynamic data and the control system dynamic data, all of which are set as secondary resources.

[0056] In the security entity and data interaction model of the absorption stabilization system ASS, three secondary participants (Actors) are set, namely the absorption stabilization system, the fractionation system and the control center. In the secondary participant (Actor) absorption stabilization system, "providing information to the control center" is set as the primary functional goal (Goal), and "receiving static data", "receiving dynamic data", "analyzing received data" and "sending analyzed data" are set as the secondary functional goals (Goal); the secondary resources (Resource) generated include the absorption stabilization system dynamic data, the absorption stabilization system operation data, and the absorption stabilization system security data; in the secondary participant (Actor) fractionation system, "interacting with the absorption stabilization system" is set as the primary functional goal (Goal), and "receiving absorption stabilization system data" and "sending data to the absorption stabilization system" are set. The required data resources include the absorption stability system dynamic data, the absorption stability system operation data, the absorption stability system safety data and the absorption stability system operation data, all of which are set as secondary resources (Resource); in the secondary participant (Actor) control center, set "interact with the absorption stability system" as the first-level functional goal (Goal), set "accept absorption stability system data" and "send data to the absorption stability system" as the second-level functional goals (Goal), and the required data resources include the absorption stability system dynamic data and the control system dynamic data, all of which are set as second-level resources (Resource).

[0057] The three subsystem security entities and data interaction models established in the Secure Tropos software are used to derive special security requirements SSR.

[0058] It can be understood that in the process of establishing the above-mentioned oil refining system security entity and data interaction model and the security entity and data interaction model of each subsystem, the corresponding first-level or second-level participants, functional objectives and resource types are all exemplary illustrations, and the present invention does not make a unique limitation on this. Those skilled in the art can select various types according to the actual situation of the oil refining system. For example, some data resources of some oil refining systems may not be easy to obtain, and such data resources may not be used in the corresponding modeling process.

[0059] S3, determining corresponding functional requirements according to the data flow and control flow characteristics of the oil refining system, and obtaining corresponding security constraints in combination with the security protection goals; and importing the security constraints into each model respectively.

[0060] Specifically, the data flow and control flow characteristics in the petroleum refining unit are analyzed, and the corresponding functional requirements are determined. The security constraints are derived in combination with the security protection goals, and the security constraints are introduced into the subsystem security entity and data interaction model. The process is as follows: Figure 6shown.

[0061] The data stream feature types can be selected according to actual needs, and the embodiments of the present invention do not limit this to uniqueness. As an example, preferably, the data stream feature types include: real-time, continuity, diversity, and sparsity, a total of 4 categories;

[0062] Specifically, real-time refers to the ability of the system to process and respond to data in a very short time after the data is generated or an event occurs. To this end, efficient algorithms and low-latency processing mechanisms are required to ensure that data can be processed and analyzed in a timely manner; continuity refers to the continuous transmission of data streams without interruption within a complete execution cycle, requiring the system to be able to continuously process data to avoid performance degradation or crashes; diversity refers to the fact that the data types and formats in the data stream may be diverse, including structured data, semi-structured data, and unstructured data; sparsity refers to the fact that in the data stream, many data points may be sparse or zero-valued, or the data density is low. To this end, effective storage and processing methods are required to cope with large amounts of sparse data and avoid excessive consumption of computing resources. For example, one of the characteristics of a denial of service DoS attack is that it consumes a large amount of computing resources of the target system, reduces the effective transmission and processing efficiency of data, and ultimately paralyzes the target system.

[0063] The types of control flow features can be selected according to actual needs, and the embodiments of the present invention do not limit this to uniqueness. As an example, preferably, the types of control flow features include: sequentiality, conditionality, cyclicity, branching, abnormality, recursion, and concurrency, a total of 7 categories;

[0064] Specifically, sequentiality refers to the execution of instructions in a program in the order in which they appear in the code. This is the most basic form of control flow, ensuring that the program proceeds as expected; conditionality refers to the program deciding which part of the code to execute based on the truth or falsity of a certain condition, so that the program can execute the corresponding code according to different situations; cyclicity refers to the program repeatedly executing a certain section of code until a certain condition is met, which is used to handle tasks that need to be repeatedly executed; branching refers to the program branching based on certain conditions, and different execution paths can be selected in different situations; abnormality refers to the program being able to capture and handle these exceptions when encountering abnormal situations or errors, rather than directly causing the program to crash, which is used to enhance the robustness and error handling capabilities of the program; recursion refers to the function calling itself directly or indirectly; concurrency refers to the program being able to execute multiple tasks or processes at the same time, which is used to improve the execution efficiency and responsiveness of the program. Control flow determines the execution order and method of the control program. Common network virus attacks can directly act on the program itself, such as modifying the operating conditions to make the system fall into an infinite loop, or writing special symbols to destroy the normal control flow characteristics of the program, thereby destroying the normal execution of the program and the virus detection function.

[0065] Starting from the characteristics of data flow and control flow, the corresponding functional requirements are determined, and combined with the safety protection goals to generate safety constraints. Table 1 gives an example of safety constraint generation for the reaction regeneration system RRS:

[0066] Table 1 Example of safety constraint generation for the reaction regeneration system RRS

[0067]

[0068]

[0069] It should be noted that the four types of data flow features and the seven types of control flow features are common concepts in the fields of computer science and technology, network security and automation, etc. The embodiments of the present invention do not propose these concepts, but integrate the above concepts to generate security constraint content in a more comprehensive, directional and systematic manner.

[0070] The generated security constraint content is imported into the subsystem security entity and data interaction model, and a connection relationship is established with the corresponding security protection goals and secondary functional goals, thus completing all security entity and data interaction modeling work.

[0071] It is worth mentioning that the security constraint is a setting in the Secure Tropos software, into which the required security constraint content can be written.

[0072] S4, perform model inspection on each model respectively to obtain the corresponding inspection report; perform security constraint violation analysis on the inspection report of the security entity and data interaction model of the petroleum refining system and the inspection report of the security entity and data interaction model of each subsystem respectively to obtain the public safety requirements of the petroleum refining system and the special safety requirements of each subsystem.

[0073] Specifically, model checking is performed on the established safety entity and data interaction model of the petroleum refining system and the safety entity and data interaction models of the three subsystems, and a check report is generated, and corresponding security requirements are obtained based on the check report.

[0074] Model checks are performed on the security entity and data interaction model of the petroleum refining system established in the Secure Tropos software, as well as the security entity and data interaction models of the three subsystems. After the check passes, a model check report will be automatically generated, and the report content will be analyzed for security constraint violations to obtain security requirements. Among them, the security requirements obtained from the system structure and data interaction model of the petroleum refining unit are common security requirements CSR, and the security requirements obtained from the subsystem security entity and data interaction model are special security requirements SSR.

[0075] The following is an example of analyzing the contents of the inspection report for security constraints violations to obtain security requirements.

[0076] For the safety entity and data interaction model of the petroleum refining system, some of the model check contents are shown in Table 2:

[0077] Table 2 Examples of some contents of the model check of the safety entity and data interaction model of the petroleum refining system

[0078]

[0079] So far, the model check content "Attackers rely on malware in human-computer interaction to inject unauthorized false data into the operation data required by DCS to destroy integrity and practicality" has been obtained. A security constraint violation analysis is performed manually. The steps and corresponding analysis content are as follows:

[0080] Step 1: Identify the violation, the violated security objectives, and the security constraints, as follows:

[0081] Violation: Unauthorized operation

[0082] Security objectives violated: integrity, effectiveness

[0083] The security constraints violated are: 1. Provide the required data; 2. Ensure the data timing is accurate; 3. Ensure data integrity; 4. Ensure the timing is verifiable; 5. Ensure the function is fully executed

[0084] Step 2: Analyze the background and causes of the security constraint violation, including:

[0085] Context 1: Employees rely on human-computer interaction systems to access and operate behaviors;

[0086] Context 2: The goal of the human-computer interaction system is to communicate with a petroleum refining unit;

[0087] Context 3: A large number of employees have access to the system and have access rights but not operational rights;

[0088] Context 4: A small number of employees may have both access rights and operation rights;

[0089] Reason 1: Current authentication mechanisms are inadequate, allowing attackers to impersonate employees.

[0090] Reason 2: The current permission setting mechanism is imperfect and lacks separation of duties and permission restrictions.

[0091] Step 3: Derive security requirements based on the reasons and integrate them, including:

[0092] Safety requirements SR1, SR2 and SR3 are derived from reason 1, including:

[0093] SR1: Implement multi-factor authentication for employees logging into human-computer interaction systems;

[0094] SR2: Enhance login session management to detect and prevent session hijacking;

[0095] SR3: Regularly update and audit authentication mechanisms to ensure they meet current security standards.

[0096] Safety requirements SR4, SR5, SR6 and SR7 are derived from reason 2, including:

[0097] SR4: Requires that all operations above a certain application level be approved by the operator;

[0098] SR5: Limit employee privileges so that they can only access the human-computer interaction system but not operate it;

[0099] SR6: Ensure that sensitive tasks require double confirmation, involving at least two different employees;

[0100] SR7: Regularly audit operation records to ensure that operations comply with the principle of separation of duties;

[0101] By integrating the above seven security requirements, we get a complete security requirement: "Follow the principle of separation of duties, ensure that the execution of sensitive tasks requires the participation of multiple personnel, and limit the authority of each employee so that they can only access and operate necessary systems." Since this requirement is obtained from the model inspection report of the security entity and data interaction model of the petroleum refining system, it belongs to the public safety requirement CSR.

[0102] Preferably, in order to better organize and manage security requirements, especially to enhance the structure when compiling security requirements documents, and to facilitate query, update and later maintenance, after obtaining the two types of security requirements CSR and SSR, it also includes: classifying the public security requirements and special security requirements according to environmental constraints, and dividing them into different types of security requirements. That is, classifying the two types of security requirements CSR and SSR obtained.

[0103] The type of security requirement can be set according to actual needs. The embodiment of the present invention does not make any unique limitation on this. As an example, preferably, the types of security requirements include: personnel management security, asset management security, access control security, cryptographic security, physical and environmental security, operational security, communication security, system development and maintenance security, supply chain security, security incident management, business management security, and compliance management security, totaling 12 categories.

[0104] It is worth noting that the classification of security requirements is based on environmental constraints. For example, the security requirement type "personnel management security" comes from the environmental constraint "human resources"; the security requirement type "access control security" comes from the environmental constraints "security measures" and "communication".

[0105] The types of environmental constraints can be determined based on relevant standards and laws and regulations. The embodiment of the present invention does not limit this to uniqueness. As an example, preferably, environmental constraints include: operating conditions, emissions, communications, safety measures, computing resources, network attacks, human resources, catalyst management, wastewater management, policies and regulations, energy consumption, and water consumption, a total of 12 categories;

[0106] Specifically, the operating conditions may refer to the flammable and combustible liquid storage standard NFPA 30 and the workplace hazardous chemical handling standard OSHA 29CFR; the emissions may refer to the air emissions standard EPA 40CFR Part 60 and the environmental management system standard ISO 14001; the communications may refer to the industrial control system security guide NIST SP 800-82; the safety measures may refer to the safety and health management system assessment standard API RP 754 and the functional safety standard IEC 61511; the computing resources may refer to the information security management system standard ISO / IEC 27001; the network attacks may refer to the security standard ISA-62443; the human resources may refer to the health and safety management system standard ANSI Z10; the catalyst management may refer to the chemical accident prevention rules EPA40CFR and the gas use standard NFPA 55; the wastewater management may refer to the industrial emission standard EPA 40CFR Part 401; the policies and regulations may refer to the workplace hazardous chemical handling standard OSHA Process Safety Management Standard and the chemical hazardous materials handling plan EPA Risk Management Program (RMP); the energy consumption may refer to the energy management system standard ISO 50001; the water consumption is based on the environmental management system standard ISO 14001.

[0107] The classification and content examples of the generated public safety demand CSR are shown in Table 3:

[0108] Table 3 Classification and content examples of public safety demand CSR

[0109]

[0110] The classification and content of the special security requirement SSR can refer to the public security requirement CSR example. You only need to replace the requirement number and security requirement content in the table.

[0111] Preferably, in order to further clarify and concretize the abstract security requirements and to improve the verifiability and compliance of the security requirements, the public security requirements and special security requirements are converted into public security specifications and special security specifications respectively in a one-to-one correspondence.

[0112] Specifically, the above transformation may adopt existing tools, such as use case diagram, sequence diagram, state diagram, activity diagram, etc. in UML. The embodiment of the present invention does not make a unique limitation to this.

[0113] The following uses the use case diagram in UML to convert the public safety requirements and special safety requirements into public safety specifications and special safety specifications one by one as an example to illustrate the conversion process.

[0114] The use case diagram in UML is used to convert the public safety requirements and special safety requirements into public safety specifications and special safety specifications one by one:

[0115] The security-critical elements and security constraint attributes of the public security requirements and special security requirements are respectively identified, and converted into public security specifications and special security specifications in XML format through the UML model.

[0116] Specifically, a UML model is developed to express the common safety requirements CSR and special safety requirements SSR in a graphical way, and restore the relationship and interaction between safety requirements, among which;

[0117] The types of security critical elements and security constraint attributes can be set according to actual needs. The embodiments of the present invention do not limit this to uniqueness. As an example, security critical elements include security critical components, security critical interactions, and security critical behaviors, a total of 3 types;

[0118] There are five types of safety constraint attributes, including performance limitations, operating conditions, failure modes, fault tolerance requirements, and safety-related standards.

[0119] The security critical elements of the system identified in the security requirements include components, interactions, and behaviors that have a direct impact on security. For example, for the public security requirement CSR1 (see Table 2), the identified security critical elements are shown in Table 4:

[0120] Table 4 Example of identification of critical safety elements for public safety requirement CSR1

[0121]

[0122]

[0123] Specify the security constraint attributes related to the identified security critical elements, including performance limitations, operating conditions, failure modes, fault tolerance requirements and security related standards. Take the security critical component "user identity management system" of public security requirement CSR1 as an example, and its security constraint attribute example is shown in Table 5:

[0124] Table 5 Example of security constraint attributes for CSR1 security-critical component “User identity management system”

[0125]

[0126] Furthermore, all security constraint attributes are modeled using a use case diagram to convert security requirements into UML graphical expressions. Taking the security-critical components in the public security requirement CSR1 (see Table 3) as an example, the UML graphical expression of its security constraint attributes is as follows: Figure 8 shown.

[0127] (3) Generate safety specifications based on the UML model and verify, record, update, and maintain them, including:

[0128] The security constraint attributes of all security requirements (including public security requirements CSR and special security requirements SSR) are converted into security specifications in XML format through the UML model, and the analysis and export function in the Secure Tropos software is used to automatically generate XML files. For example, for public security requirement CSR1, the security specification XML content involving the user identity management system can be shown in Table 6:

[0129] Table 6 Example of XML content of the security specification for the user identity management system part of CSR1

[0130]

[0131]

[0132] Furthermore, the written security specifications are reviewed and verified to ensure the completeness, accuracy and consistency of the security requirements; the review and verification may use verification techniques such as code review, simulation, fuzz testing, etc., which are not specifically specified here.

[0133] If the system structure and equipment of the petroleum refining unit are changed during the later maintenance, it is necessary to update the system entities and subsystem entities, generate updated security requirement reports to update and maintain the safety specifications, and ensure that the safety specifications are consistent with the actual safety requirements of the system.

[0134] An embodiment of the present invention provides an electronic device, characterized by comprising: a computer-readable storage medium and a processor;

[0135] The computer-readable storage medium is used to store executable instructions;

[0136] The processor is used to read the executable instructions stored in the computer-readable storage medium and execute the method described in any of the above embodiments.

[0137] An embodiment of the present invention provides a computer-readable storage medium, characterized in that the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to execute the method described in any of the above embodiments.

[0138] It will be easily understood by those skilled in the art that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for generating multiple security requirements for a petroleum refining system based on Secure Tropos, characterized in that: include: S1, determine the security protection objectives, dependency types and security threats of petroleum refining equipment; S2, dividing the oil refining system into monitoring system, power system, human-computer interaction and refining equipment by functions, and establishing a safety entity and data interaction model of the oil refining system in Secure Tropos software based on the safety protection objectives, security threat types and dependency types; dividing the oil refining system into a reaction regeneration subsystem, a fractionation subsystem and an absorption stabilization subsystem according to the oil refining process flow, and establishing a safety entity and data interaction model of the oil refining system and a safety entity and data interaction model of each subsystem in Secure Tropos software based on the safety protection objectives, security threat types and dependency types; S3, determining corresponding functional requirements according to the data flow and control flow characteristics of the oil refining system, and obtaining corresponding security constraints in combination with the security protection objectives; and importing the security constraints into each model respectively; S4, perform model inspection on each model respectively to obtain the corresponding inspection report; perform security constraint violation analysis on the inspection report of the security entity and data interaction model of the petroleum refining system and the inspection report of the security entity and data interaction model of each subsystem respectively to obtain the public safety requirements of the petroleum refining system and the special safety requirements of each subsystem.

2. The method according to claim 1, characterized in that The security protection objectives include: accessibility, integrity, confidentiality, authentication, and utility; The dependencies include: data dependency, timing dependency, component dependency, and functional dependency; The security threats include: denial of service, false data injection, eavesdropping, replay, malware, and viruses.

3. The method according to claim 1 or 2, characterized in that After step S4, the method further includes: converting the public safety requirements and special safety requirements into public safety specifications and special safety specifications respectively in a one-to-one correspondence.

4. The method according to claim 3, characterized in that The use case diagram in UML is used to convert the public safety requirements and special safety requirements into public safety specifications and special safety specifications one by one: The security-critical elements and security constraint attributes of the public security requirements and special security requirements are respectively identified, and converted into public security specifications and special security specifications in XML format through the UML model.

5. The method according to claim 4, characterized in that The safety-critical elements include safety-critical components, safety-critical interactions, and safety-critical behaviors; The safety constraint attributes include performance limitations, operating conditions, failure modes, fault tolerance requirements, and safety-related standards.

6. The method according to claim 3, characterized in that After step S4, before converting the public safety requirements and special safety requirements into public safety specifications and special safety specifications respectively, the method further includes: The public safety needs and special safety needs are classified according to environmental constraints and divided into different safety need types.

7. The method according to claim 6, characterized in that The environmental constraints include: operating conditions, emissions, communications, security measures, computing resources, cyber attacks, human resources, catalyst management, wastewater management, policies and regulations, energy consumption, and water consumption; The types of security requirements include: personnel management security, asset management security, access control security, cryptographic security, physical and environmental security, operational security, communications security, system development and maintenance security, supply chain security, security incident management, business management security, and compliance management security.

8. The method according to claim 1, characterized in that The data stream characteristics include: real-time, continuity, diversity, and sparsity; The control flow characteristics include: sequentiality, conditionality, cyclicity, branching, abnormality, recursion, and concurrency.

9. A multiple security requirements generation system for a petroleum refining system based on Secure Tropos, characterized in that: include: A computer readable storage medium and a processor; The computer-readable storage medium is used to store executable instructions; The processor is used to read the executable instructions stored in the computer-readable storage medium and execute the method according to any one of claims 1 to 8.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to execute the method according to any one of claims 1 to 8.

Images