A configuration management method for a virtual industrial controller

Abstract

The present invention discloses a configuration management method for a mimetic industrial controller. The method distinguishes downloaded configurations by marking, so that heterogeneous executives in the controller obtain configuration files that match them. The downloaded configuration data is temporarily stored in a download buffer. If the download fails, configuration recovery is performed; if the download is successful, configuration update is performed. After the update is completed, the newly obtained configuration data is backed up. The method enables heterogeneous executives in the mimetic industrial controller to obtain correct configuration files, realizes online configuration update without disturbing the control site, and reduces the risk of configuration data being attacked and destroyed by backing up the configuration in a non-volatile storage medium. At the same time, it can be used for the executive to be newly powered on or to be restored online after being cleaned by mimetic.

Description

Technical Field

[0001] The present invention relates to the fields of industrial control and information security, and in particular to a configuration management method for a pseudo-industrial controller. Background Art

[0002] With the continuous advancement of the industrial Internet and the proposal of the "Made in China 2025" plan, industrial control systems have gradually moved from traditional information islands to interconnected external networks. Traditional industrial control systems are mainly designed from the perspective of functional safety, and almost no consideration is given to information security defense. This makes traditional industrial control systems face greater security risks under the trend of the industrial Internet. In terms of information security defense, cyberspace mimicry defense is an active defense theory pioneered by a domestic research team. It provides defense theories and methods with universal and innovative significance to deal with unknown threats based on unknown vulnerabilities, backdoors, viruses or Trojans at relevant application levels in different fields of cyberspace.

[0003] Applying cyberspace mimicry defense technology to the mimicry industrial controllers in traditional industrial controllers can enable industrial controllers to add information security functions on the basis of functional safety; however, this also increases the complexity of industrial controllers, especially in the configuration management of controllers. Since the mimicry industrial controller is a multi-executor heterogeneous redundant design, its configuration is also heterogeneous and multiple, and each executive corresponds to its own configuration file; therefore, the configuration management method of traditional industrial controllers for a single configuration, a single executive, or a single configuration and multiple isomorphic executives cannot be applied to mimicry industrial controllers; therefore, studying a configuration management method that is applicable to mimicry industrial controllers and has universal significance has become a key issue that needs to be solved urgently. Summary of the invention

[0004] In view of the problems existing in the above-mentioned prior art, the present invention provides a configuration management method for a virtual industrial controller, which can effectively solve the above-mentioned problems.

[0005] In order to achieve the above-mentioned purpose, the present invention is implemented through the following technical solutions: a configuration management method of a mimetic industrial controller, including a mimetic industrial controller, characterized in that the mimetic industrial controller includes a plurality of executive bodies, and when the executive body downloads a configuration file, the downloaded configuration file is marked and distinguished, different marks correspond to different executive bodies, and each executive body will only select a matching configuration file to receive, and the mimetic industrial controller marks the downloaded configuration data to form a configuration file; the executive body caches the downloaded configuration file data in a configuration download buffer, and if the download process fails or is unexpectedly terminated, the download failure state is entered, and the executive body performs a configuration recovery action; if the download is successful, the download completion state is entered, and the executive body performs a configuration update action; after the configuration update is completed, the executive body backs up the newly obtained configuration file data for the executive body to be used for new power-on or re-online recovery after being mimetic cleaned.

[0006] Furthermore, if an error occurs or the configuration file download process is terminated unexpectedly, the executable body enters a download failure state and performs configuration recovery: the contents of the configuration real-time running area are reversely copied to the configuration download buffer, so that the contents in the buffer are restored to the state before the configuration download, and the consistency of the contents in the buffer and the running area is maintained; if the configuration file download process is successful, the executable body enters a download completion state and performs a configuration update: the executable body copies all the contents to be updated in the configuration download buffer to the configuration real-time running area within one control cycle, and completes the update of all configurations at one time.

[0007] Furthermore, after the configuration update is completed, the executive body backs up the newly obtained configuration file: the executive body writes all the contents in the configuration download buffer into the configuration backup area in batches within multiple control cycles, and completes the configuration backup in batches through multiple control cycles. The configuration backup area is located in a non-volatile storage medium and is used for recovery when the executive body is newly powered on or cleaned by the mimicry defense strategy. At the same time, the storage medium is considered to be relatively safe and not vulnerable to attacks in the application of mimicry defense technology.

[0008] Furthermore, the executive body refers to a basic control unit in the simulated industrial controller that has heterogeneous redundancy characteristics and can independently complete the functions of the complete industrial controller.

[0009] Furthermore, the configuration real-time operation area refers to a configuration data area located in the execution body operation memory and is actually used during the real-time control operation of the execution body.

[0010] Furthermore, the configuration download buffer refers to a configuration data area located in the execution body's running memory, which is used to temporarily store all configuration data to be updated during the configuration download process of the execution body; it has a data structure that is completely consistent with the configuration real-time running area, and its content is completely consistent with the configuration real-time running area during the normal operation of the execution body, that is, non-configuration download process.

[0011] Furthermore, the configuration backup area refers to a configuration data area located in the non-volatile storage medium of the executable body, which saves the new configuration data for backup after the executable body configuration is downloaded and updated; after the executable body is newly powered on or cleaned and restored, if the configuration data is saved in the configuration backup area, it will be loaded into the configuration real-time running area and the configuration download buffer.

[0012] Furthermore, the control cycle refers to the minimum scheduling cycle of the control operation in the simulated industrial controller, and the controller executes a complete control process within one control cycle; the control cycle is user-configurable, and the control cycle is 50ms by default.

[0013] Through the above scheme, the present invention has at least the following advantages: the method enables the heterogeneous executive bodies in the simulated industrial controller to obtain the correct configuration files, realizes the online update of the configuration without disturbing the control site, and reduces the risk of configuration data being attacked and destroyed by backing up the configuration to a non-volatile storage medium. At the same time, it can be used for the executive body to be powered on or restored online after being cleaned by the simulation. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 It is a structural schematic diagram of the present invention. DETAILED DESCRIPTION

[0015] The present invention will be further described below in conjunction with the accompanying drawings.

[0016] A configuration management method for a simulated industrial controller is disclosed. The downloaded configuration is distinguished by marking. Different executive bodies only receive configuration files that match them. The executive body caches the downloaded configuration data in a download buffer first. If the download process fails or is unexpectedly terminated, the download failure state is entered, and the executive body performs a configuration recovery action. If the download is successful, the download completion state is entered, and the executive body performs a configuration update action. After the configuration update is completed, the executive body backs up the newly obtained configuration for the executive body to be used for re-online recovery work after it is newly powered on or cleaned by simulation.

[0017] The configuration management method of the virtual industrial controller includes the following aspects:

[0018] (1) When downloading configuration, the downloaded configuration is distinguished by tags. Different tags correspond to different executables. Each executable will only select the configuration file that matches it to receive;

[0019] (2) The executive body caches all the downloaded configuration data in the download buffer first, instead of directly updating it to the configuration operation area, so as to achieve configuration update without disturbing the control site, and also provide the possibility of configuration recovery after configuration download failure:

[0020] (a) If the configuration download process fails or is unexpectedly terminated, the execution body enters the download failure state and performs configuration recovery: the contents of the configuration real-time running area are reversely copied to the configuration download buffer, so that the contents in the buffer are restored to the state before the configuration download, and the contents in the buffer and the running area are kept consistent, so as to prevent unexpected data updates in the running area after the next configuration download;

[0021] (b) If the configuration download is successful, the executive body enters the download completion state and performs configuration update: the executive body copies all the contents to be updated in the configuration download buffer to the configuration real-time operation area within one control cycle, and completes the update of all configurations at one time, thereby minimizing the disturbance to the control site and realizing the non-disturbance update of the controller configuration, that is, online update;

[0022] (3) After the configuration update is completed, the executive body backs up the newly acquired configuration: the executive body writes all the contents in the configuration download buffer into the configuration backup area in batches within multiple control cycles, and completes the configuration backup in batches through multiple control cycles to minimize the disturbance to the control site. The configuration backup area is located in a non-volatile storage medium (such as Flash) to be used for recovery when the executive body is newly powered on or cleaned by the mimic defense strategy. At the same time, such storage media are considered to be relatively safe and not vulnerable to attacks in the application of mimic defense technology.

[0023] The actuator refers to a basic control unit in a mimetic industrial controller that has heterogeneous redundancy characteristics and can independently complete the functions of a complete industrial controller. Dynamic random scheduling and majority decision of different actuators by mimetic industrial controllers are important means in the application of mimetic defense technology. This method adopts a 4-degree-of-redundancy dynamic heterogeneous redundancy design architecture, that is, there are 4 heterogeneous redundant actuators in a mimetic industrial controller.

[0024] The configuration real-time operation area refers to a configuration data area located in the execution body operation memory and is actually used during the real-time control operation of the execution body.

[0025] The configuration download buffer refers to a configuration data area located in the execution body's running memory, which is used to temporarily store all configuration data to be updated during the configuration download process of the execution body. It has a data structure that is completely consistent with the configuration real-time running area. During the normal operation of the execution body, that is, the non-configuration download process, its content is also completely consistent with the configuration real-time running area.

[0026] The configuration backup area refers to a configuration data area located in the non-volatile storage medium of the executable body, where the new configuration data is saved for backup after the executable body configuration is downloaded and updated. After the executable body is powered on or cleaned and restored, if the configuration data is saved in the configuration backup area, it will be loaded into the configuration real-time running area and the configuration download buffer.

[0027] The control cycle refers to the minimum scheduling cycle of the control operation in the simulated industrial controller. The controller executes a complete control process within one control cycle. The control cycle in this method is user-configurable and is 50ms by default.

Claims

1. A configuration management method for a simulated industrial controller, comprising a simulated industrial controller, characterized in that: The mimetic industrial controller includes several executive bodies. When the executive body downloads the configuration file, the downloaded configuration file is marked and distinguished. Different marks correspond to different executive bodies. Each executive body selects a matching configuration file to receive. The mimetic industrial controller marks the downloaded configuration data to form a configuration file; the executive body caches the downloaded configuration file data in a configuration download buffer. If the download process fails or is unexpectedly terminated, the download failure state is entered, and the executive body performs a configuration recovery action; if the download is successful, the download completion state is entered, and the executive body performs a configuration update action; after the configuration update is completed, the executive body backs up the newly obtained configuration file data for the executive body to be used for new power-on or online recovery after being cleaned by mimetic cleaning.

2. The configuration management method of the virtual industrial controller according to claim 1, characterized in that: The configuration recovery is to copy the contents of the configuration real-time running area in reverse to the configuration download buffer, so that the contents in the buffer are restored to the state before the configuration download, and the consistency of the contents in the buffer and the running area is maintained; if the configuration file download process is successful, the execution body enters the download completion state and performs configuration update: the execution body copies all the contents to be updated in the configuration download buffer to the configuration real-time running area within one control cycle, and completes the update of all configurations at one time.

3. The configuration management method of the virtual industrial controller according to claim 1, characterized in that: After the configuration update is completed, the executive body backs up the newly obtained configuration file, that is, the executive body writes all the contents in the configuration download buffer into the configuration backup area in batches within multiple control cycles, and completes the configuration backup in batches through multiple control cycles. The configuration backup area is located in a non-volatile storage medium and is used for recovery when the executive body is newly powered on or cleaned by the mimicry defense strategy. At the same time, the storage medium is considered to be relatively safe and not vulnerable to attacks in the application of mimicry defense technology.

4. The configuration management method of the virtual industrial controller according to claim 1, characterized in that: The executive body refers to a basic control unit in the simulated industrial controller that has heterogeneous redundancy characteristics and can independently complete the functions of the complete industrial controller.

5. The configuration management method of the virtual industrial controller according to claim 1, characterized in that: The configuration real-time operation area refers to a configuration data area located in the execution body operation memory and is actually used during the real-time control operation of the execution body.

6. The configuration management method of the virtual industrial controller according to claim 1, characterized in that: The configuration download buffer refers to a configuration data area located in the execution body's running memory, which is used to temporarily store all configuration data to be updated during the execution body's configuration download process; it has a data structure that is completely consistent with the configuration real-time running area, and its content is completely consistent with the configuration real-time running area during the normal operation of the execution body, that is, non-configuration download process.

7. The configuration management method of a virtual industrial controller according to claim 1, characterized in that: The configuration backup area refers to a configuration data area located in the non-volatile storage medium of the executable body, where the new configuration data is saved for backup after the executable body configuration is downloaded and updated; after the executable body is newly powered on or cleaned and restored, if the configuration data is saved in the configuration backup area, it will be loaded into the configuration real-time running area and the configuration download buffer.

8. The configuration management method of a virtual industrial controller according to claim 1, characterized in that: The control cycle refers to the minimum scheduling cycle of the control operation in the simulated industrial controller. The controller executes a complete control process within one control cycle. The control cycle is user-configurable and is 50ms by default.

Images