A PLC control logic security protection method based on information coding technology

Abstract

The present invention discloses a PLC control logic security protection method based on information coding technology. The method acts on the user login system stage and the editing, compiling, saving, downloading, loading and running stages of the PLC control logic. In the editing stage, user access control is performed, and the integrity and confidentiality of the source code generated by the editing are protected; in the compilation stage, user access control is performed, and the integrity and confidentiality of the target code generated by the compilation are protected; in the saving process, the source code and the target code are encrypted and signed to achieve security protection; in the downloading stage, user access control is performed, the target code is signed, and the downloading process performs two-way identity authentication; in the loading stage, executable tasks are generated after signature verification calculation; in the running stage, the process control logic is executed and the running value is checked, so as to ensure the safety of the task stage. The method improves the security of the PLC control logic in all directions, improves the security of the entire control system, and thus ensures the safe operation of the controlled equipment.

Description

Technical Field

[0001] The present invention relates to the field of industrial control, and in particular to a PLC control logic safety protection method based on information coding technology. Background Art

[0002] With the development of information technology, the process of industrial automation has gradually accelerated. PLC, as the core control unit of industrial control systems, is widely used in the field of industrial automation and plays an important role in industrial production. Its reliability and safety are directly related to the safety and stability of the entire control system. Therefore, to improve the security protection level of industrial control systems, we must first improve the security protection level of the PLC system itself.

[0003] The security of PLC control logic is related to the safety and stable operation of the entire system, involving editing, compiling, saving, downloading, loading, and running. Information leakage and damage in any link will affect the normal operation of the control system and the controlled equipment, resulting in immeasurable losses. In order to improve the security of PLC control logic, some studies have provided active defense solutions to improve security. However, the existing active defense methods for PLC control logic have the following weaknesses: 1) It cannot act on the full task stages of PLC such as editing, compiling, saving, downloading, loading, and running, and the protection is not comprehensive enough; 2) There is a lack of integrity measurement for the control logic, and it is impossible to verify whether the control logic has been illegally tampered with; 3) There is a lack of user access control, and any user can perform operations on the system, which increases the access risk. It can be seen that the security assurance capability of the PLC system is still at a relatively weak stage.

[0004] In order to meet the security requirements of industrial automation for control systems and improve the security protection capabilities of PLC systems, combined with the shortcomings of existing technical solutions, this invention proposes a PLC control logic security protection solution based on information coding technology. This solution covers the editing, compiling, saving, downloading, loading, and running stages of PLC control logic, and protects the confidentiality and integrity of the control logic. Combined with role-based access control technology, it provides identity authentication and authority control for access users, ensures the legality of access to the PLC control logic source code and target code, the confidentiality and integrity of storage and transmission, and the credibility of loading and running, thereby improving the security of the PLC system. Summary of the invention

[0005] To achieve the above purpose, the present invention implements the following technical solutions: a PLC control logic security protection method based on information coding technology. The method acts on the user login system stage and the editing, compiling, saving, downloading, loading, and running stages of the PLC control logic. In the editing stage, user access control is performed, and the integrity and confidentiality of the source code generated by the editing are protected by information coding technology; in the compilation stage, user access control is performed, and the integrity and confidentiality of the target code generated by the compilation are protected by information coding technology; in the saving process, the source code and the target code are encrypted and signed to achieve security protection; in the downloading stage, user access control is performed, the target code is signed, and the downloading process performs two-way identity authentication; in the loading stage, an executable task is generated after signature verification calculation; in the running stage, the process control logic is executed and the running value is checked. The method specifically includes:

[0006] Step 1: User role permission control: The system administrator assigns user roles to access users based on actual needs and binds corresponding permissions.

[0007] Step 2, user logs into the system: the authorized user authenticates his / her identity by entering the user name and password as well as the biometric information; if the system passes the verification, the user is allowed to log into the system, and the system allows the user to perform corresponding operations on the PLC according to the role permissions.

[0008] Step 3, Edit and Save: Authorize the user to write the source code of the control logic through the logic configuration software; after the code is written, encrypt and digitally sign the source code to achieve security and confidentiality protection.

[0009] Step 4, compile and save: The authorized user compiles the source code generated in the editing phase through the logic configuration software, generates the target code after compilation, and performs encryption calculation and digital signature calculation on the target code to achieve security and confidentiality protection.

[0010] Step 5, download: the authorized user reads the target code through the logic configuration software and sends the control logic with signature information to the PLC controller through a secure channel; after the PLC controller verifies the signature, it uses its own digital certificate to re-digitally sign the target code and adds the control logic task to the task whitelist.

[0011] Step 6, loading: The PLC controller confirms that the task to be loaded is in the task whitelist based on the control instruction received, and performs signature verification calculation on the target code to be loaded. After the signature verification passes, the target code is loaded to generate the corresponding control logic task.

[0012] Step 7, Run: The PLC controller executes the control logic task according to the received control instruction, runs the corresponding process control logic, and performs an operation value check after each execution.

[0013] A PLC control logic security protection method based on information coding technology is characterized in that: the objects of role-based access control include: users who need to access the system; the objects of encryption calculation and signature calculation include: source code of PLC control logic edited by the user and target code generated after compiling the source code.

[0014] A PLC control logic security protection method based on information coding technology, wherein the main feature of step 1 is: using role-based access control technology: different user groups are divided according to the different job responsibilities of system users, each user group is bound to a corresponding operation action, the system sets roles in the user group, and grants corresponding permissions to the role according to the operation actions and operation objects that the user group can perform. The permissions of a specific user are determined by the role of the user.

[0015] The main feature of step 2 is that the user's identity authentication adopts a combination of username / password verification and biometric identification. After both verifications are passed, the identity authentication is judged to be successful, and the user can perform subsequent operations.

[0016] The main features of step 3 and step 4 are that a symmetric cryptographic algorithm is used to encrypt the source code and target code of the PLC control logic for confidentiality protection, and an asymmetric cryptographic algorithm is used to sign the source code or target code of the PLC control logic for integrity protection.

[0017] The confidentiality protection method adopts a symmetric encryption algorithm. The edited source code is encrypted using a random key generated by an internal or external encryption chip, and the ciphertext obtained after the encryption calculation is saved together with the required information in a secure area of ​​the target file or disk; when the authorized user or PLC controller needs to operate the control logic, the original information of the source code is restored through decryption calculation before the operation can be performed. The same encryption and decryption method is used to protect the confidentiality of the target code generated after compilation.

[0018] The integrity protection method adopts an asymmetric cryptographic algorithm. The hash value of the source code is signed and calculated using its own digital certificate private key, and the calculated signature value is saved in a secure area of ​​the target file or disk. When an authorized user or PLC controller needs to operate the control logic, the legality and validity of the signature certificate are first verified, and the digital signature is verified using the public key carried in the signature certificate; if the verification passes, it is determined that the original source code has not been modified before the operation can be performed. The same signature and verification method is used to protect the integrity of the target code generated after compilation.

[0019] The main feature of step 5 is that the PLC control logic is downloaded to the PLC controller through a secure channel, the secure channel uses a digital certificate signature method to perform two-way authentication on the identities of the host computer and the PLC controller, uses a randomly generated session key to encrypt the data to be transmitted, and verifies the integrity of the data.

[0020] The beneficial effects of the present invention are as follows: the objects of the encryption calculation and signature calculation include: the source code of the PLC control logic edited by the user, and the target code generated after the source code is compiled; the objects of the role-based access control include: users who need to access the system. The action stages of the scheme include: editing, compiling, saving, downloading, loading, and running the PLC control logic. The method has clear protection objectives, covers the entire life cycle of the protected object, and comprehensively protects the security of the control logic to avoid the existence of protection loopholes.

[0021] The method adopts a symmetric cryptographic algorithm to perform encryption calculation on the source code and target code of the control logic, and stores them in ciphertext, thereby ensuring the confidentiality of the PLC control logic, thereby protecting key information of the control system from being illegally stolen and avoiding the occurrence of major safety accidents.

[0022] The method uses an asymmetric cryptographic algorithm to calculate the signature of the source code and target code of the PLC control logic. Only after the control logic is verified, the user or PLC controller can perform subsequent operations. If the system finds that the control logic has been illegally tampered with, it will refuse to perform subsequent operations, thereby ensuring the integrity of the PLC control logic and preventing accidents.

[0023] The method uses role-based permission control technology to ensure that only authorized users can perform operations within their permission scope, and unauthorized users or illegal users cannot perform operations. Role-based permission control can effectively prevent unauthorized users or illegal users from performing editing, compiling, saving, downloading, loading, and running operations of control logic, thereby preventing control logic from being maliciously damaged. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] The present invention is further described below in conjunction with the accompanying drawings and embodiments.

[0025] Figure 1 A typical PLC control logic generation and user execution process.

[0026] Figure 2 Schematic diagram of user organization and role authorization.

[0027] Figure 3 Encryption signature, signature verification and decryption process.

Claims

1. A PLC control logic safety protection method based on information coding technology, characterized in that: This method is used in the user login stage and the PLC control logic editing, compiling, saving, downloading, loading and running stages. In the editing stage, user access control is performed, and the integrity and confidentiality of the source code generated by the editing are protected through information coding technology. During the compilation phase, user access is controlled, and the integrity and confidentiality of the compiled target code are protected through information encoding technology; The preservation process encrypts and signs the source code and object code to achieve security protection; During the downloading phase, user access control is performed, the target code is signed, and two-way identity authentication is performed during the downloading process; During the loading phase, executable tasks are generated after signature verification and calculation; The operation phase executes the process control logic and performs the operation value check, and the specific methods include: Step 1: User role permission control: The system administrator assigns user roles to access users according to actual needs and binds corresponding permissions; Step 2, user logs into the system: the authorized user enters the user name and password and biometric information for identity authentication; if the system verification is successful, the user is allowed to log into the system, and the system allows the user to perform corresponding operations on the PLC according to the role authority; Step 3, Edit and Save: Authorize the user to write the source code of the control logic through the logic configuration software; after the code is written, encrypt and digitally sign the source code to achieve security and confidentiality protection; Step 4, compile and save: the authorized user compiles the source code generated in the editing stage through the logic configuration software, generates the target code after compilation, and performs encryption calculation and digital signature calculation on the target code to achieve security and confidentiality protection; Step 5, download: the authorized user reads the target code through the logic configuration software and sends the control logic with signature information to the PLC controller through the secure channel; after the PLC controller verifies the signature, it uses its own digital certificate to re-digitally sign the target code and adds the control logic task to the task whitelist; Step 6, loading: The PLC controller confirms that the task to be loaded is in the task whitelist according to the received control instruction, and performs signature verification calculation on the target code to be loaded. After the signature verification passes, the target code is loaded to generate the corresponding control logic task; Step 7, Run: The PLC controller executes the control logic task according to the received control instruction, runs the corresponding process control logic, and performs an operation value check after each execution.

2. The PLC control logic safety protection method based on information coding technology according to claim 1 is characterized in that: The objects of role-based access control include: users who need to access the system; the objects of encryption calculation and signature calculation include: the source code of PLC control logic edited by the user and the target code generated after the source code is compiled.

3. The PLC control logic safety protection method based on information coding technology according to claim 1 is characterized in that: The main feature of step 1 is: adopting role-based access control technology: different user groups are divided according to the different job responsibilities of system users, each user group is bound to a corresponding operation action, the system sets roles in the user group, and grants corresponding permissions to the roles according to the operation actions and operation objects that can be executed by the user group. The permissions of a specific user are determined by the role of the user.

4. The PLC control logic safety protection method based on information coding technology according to claim 1 is characterized in that: The main feature of step 2 is that the user's identity authentication adopts a combination of username / password verification and biometric identification. After both verifications are passed, the identity authentication is judged to be successful and the user can perform subsequent operations.

5. The PLC control logic safety protection method based on information coding technology according to claim 1 is characterized in that: The main features of step 3 and step 4 are: using a symmetric cryptographic algorithm to encrypt the source code and target code of the PLC control logic for confidentiality protection, and using an asymmetric cryptographic algorithm to sign the source code or target code of the PLC control logic for integrity protection.

6. The PLC control logic safety protection method based on information coding technology according to claim 5 is characterized in that: The edited source code is encrypted using a random key generated by an internal or external encryption chip, and the ciphertext obtained after the encryption calculation is saved together with the required information in a secure area of ​​the target file or disk; when an authorized user or PLC controller needs to operate the control logic, the operation can only be performed after the original information of the source code is restored through decryption calculation, and the same encryption and decryption methods are used to protect the confidentiality of the target code generated after compilation.

7. The PLC control logic safety protection method based on information coding technology according to claim 5 is characterized in that: The hash value of the source code is signed and calculated using its own digital certificate private key, and the calculated signature value is saved in a secure area of ​​the target file or disk. When an authorized user or PLC controller needs to operate the control logic, the legality and validity of the signature certificate are first verified, and the digital signature is verified using the public key carried in the signature certificate. If the verification passes, it is determined that the original source code has not been modified before the operation can be performed, and the same signature and verification method is used to protect the integrity of the target code generated after compilation.

8. The PLC control logic safety protection method based on information coding technology according to claim 1 is characterized in that: The main feature of step 5 is that the PLC control logic is downloaded to the PLC controller through a secure channel, the secure channel uses a digital certificate signature method to perform two-way authentication on the identities of the host computer and the PLC controller, uses a randomly generated session key to encrypt the data to be transmitted, and verifies the integrity of the data.

Images