Deployment method, system and device of trusted DCS host computer system and storage medium

Abstract

This invention belongs to the field of industrial automation technology and discloses a deployment method, system, equipment, and storage medium for a trusted DCS host computer system. The method includes: determining whether the host computer to be deployed is trusted; if trusted, adding a new user and installing the RPM package; configuring parameters for the host computer to be deployed and writing the configuration parameters into the corresponding configuration file dcs.xml in the / user / dcs folder; installing QT and Python dynamic libraries into the / usr / local folder; determining whether the DCS system is already installed in the / user / dcs folder of the DCS system; if installed, installing the corresponding functional modules into the / user / dcs folder according to the installation type in the configuration parameters; writing the execution permissions for the database, screens, and tools according to the installation type in the DCS system config file; adding all executable applications of the DCS system to the trusted whitelist and verifying whether they can start successfully; if successful, the deployment of the trusted DCS host computer system is complete. This invention enables the rapid deployment of a trusted DCS host computer system.

Description

Technical Field

[0001] This invention belongs to the field of industrial automation technology, specifically relating to the deployment method, system, equipment, and storage medium of a trusted DCS host computer system. Background Technology

[0002] In thermal power systems, the DCS (Distributed Control System) is a crucial component in the power generation process. Before a thermal power plant is put into operation, multiple supervisory control (SCADA) computers need to be deployed as DCS systems. These SCADA computers are categorized into operator stations, engineer stations, and historical stations based on their intended use, requiring separate configuration for each purpose—a cumbersome and time-consuming process. Furthermore, various compilation environments need to be installed and configured before DCS system deployment, which is inefficient and highly repetitive. In addition, after system deployment, its reliability, security, and normal operation must be tested, further increasing the workload. Therefore, a new method is needed to rapidly deploy a reliable DCS supervisory control system. Summary of the Invention

[0003] To address the problems existing in the prior art, the purpose of this invention is to provide a deployment method, system, device, and storage medium for a trusted DCS host computer system. This invention enables the rapid deployment of a trusted DCS host computer system.

[0004] The technical solution adopted in this invention is as follows:

[0005] The deployment method of a trusted DCS host computer system includes the following process:

[0006] Perform a trustworthiness test on the installation environment of the host computer to be deployed to determine whether the host computer to be deployed is trustworthy;

[0007] When the host computer to be deployed is trusted, add a new user to the host computer to be deployed;

[0008] Install the RPM package;

[0009] Configure the host computer for deployment and write the configuration parameters into the corresponding configuration file dcs.xml in the specified path / user / dcs folder;

[0010] Install QT and Python dynamic libraries to the specified path / usr / local.

[0011] Determine if the DCS system is installed in the / user / dcs folder of the DCS system;

[0012] If no DCS system is installed in the / user / dcs folder, install the corresponding functional modules into the / user / dcs folder according to the installation type of the configuration parameters; if a DCS system is installed in the / user / dcs folder, delete the old DCS system files in the / user / dcs folder, and then install the corresponding functional modules into the / user / dcs folder according to the installation type of the configuration parameters.

[0013] Write the execution permissions for the database, screen, and tools for the specified installation type in the DCS system config file;

[0014] Add all executable applications of the DCS system to the trusted whitelist and verify that all applications can start successfully. If all applications start successfully, the deployment of the trusted DCS host computer system is complete.

[0015] Preferably, when performing trustworthiness checks on the installation environment of the host computer to be deployed, the interface of the first-level overall trustworthiness status is called to perform trustworthiness checks on the installation environment of the host computer.

[0016] Trustworthiness testing of the host computer's installation environment involves judging the overall state of three trustworthiness verification states: static trustworthiness verification state, trustworthiness startup verification state, and dynamic trustworthiness verification state. If all three trustworthiness verification states are trustworthy, the host computer to be deployed is considered trustworthy.

[0017] Preferably, the process of adding a new user on the host computer to be deployed includes: adding a new user dcs and creating a dedicated dcs user folder / user / dcs, and executing chown -R dcs:dcs / user / dcs (i.e., the command to change the folder owner) to change the owner of the / user / dcs folder to dcs.

[0018] Preferably, the process of installing rpm packages includes: based on the rpm package name, based on the function commands for granting executable permissions and marking the rpm package as a whitelisted program, synthesizing a Linux string command for granting permissions and marking as a whitelisted program, and using the function QProcess::start(Linux string command) to start an external process to install the rpm package required by the DCS system.

[0019] Preferably, the process of configuring the host computer to be deployed and writing the configuration parameters to the corresponding file in the specified path includes:

[0020] In the DCS configuration page, configure the hostname of the host computer to be deployed, fill in the hostname of other host computers in the same site and the IP addresses of network A and network B, the IP addresses of network A and network B of the host computer to be deployed, the site name, the hostname of the two file servers that need to be configured in the DCS system, and the type of the host computer to be deployed.

[0021] Based on the configuration parameters, modify the hostname, hosts, and site name files in the specified path / etc, write the configuration parameters into the corresponding files, and configure the IP addresses for network A and network B.

[0022] Preferably, the process of installing the corresponding functional modules into the / user / dcs folder according to the installation type configured in the parameters includes:

[0023] Read the configuration parameters. First, obtain the type of the host computer to be deployed. If the installation type is a history station, install all functional modules, including database, file service, history service, and data transfer service, into the / user / dcs file. If the installation type is an operator station or an engineer station, install all functional modules except database, file service, history service, and data transfer service into the / user / dcs file.

[0024] Preferably, the process of writing the execution permissions for the database, screen, and tools for the installation type in the DCS system config file includes:

[0025] If the host computer to be deployed is a historical station, write all operational permissions for the database, screen, and tools in the config file; if the host computer to be deployed is an engineer station, write monitoring permissions for the database, screen, and tools in the config file; if the host computer to be deployed is an operator station, write monitoring permissions for the database and operational permissions for the screen and tools in the config file.

[0026] This invention also provides a deployment system for a trusted DCS host computer system, comprising:

[0027] Trustworthy Detection Module: Used to perform trustworthy detection on the installation environment of the host computer to be deployed, and to determine whether the host computer to be deployed is trustworthy;

[0028] Add User Module: Used to add new users to the host computer to be deployed when the host computer is trusted;

[0029] First installation module: Used to install RPM packages;

[0030] Configuration parameter module: Used to configure parameters for the host computer to be deployed, and write the configuration parameters into the corresponding configuration file dcs.xml in the specified path / user / dcs folder;

[0031] The second installation module is used to install QT and Python dynamic libraries to the specified path / usr / local.

[0032] Decision module: Used to determine whether the DCS system is installed in the / user / dcs folder of the DCS system;

[0033] Third installation module

[0034] Block: When no DCS system is installed in the / user / dcs folder, the corresponding functional modules are installed into the / user / dcs folder according to the installation type configured in the configuration parameters; when a DCS system is installed in the / user / dcs folder, the old DCS system files in the / user / dcs folder are deleted, and then the corresponding functional modules are installed into the / user / dcs folder according to the installation type configured in the configuration parameters.

[0035] Permission writing module: Used to write the execution permissions of the installation type for the database, screen, and tools into the DCS system config file;

[0036] Verification module: This module adds all executable applications of the DCS system to the trusted whitelist and verifies whether all applications can start successfully. If all applications start successfully, the trusted DCS host computer system deployment is complete.

[0037] The present invention also provides an electronic device, comprising:

[0038] One or more processors;

[0039] A storage device on which one or more programs are stored;

[0040] When the one or more programs are executed by the one or more processors, the one or more processors implement the deployment method of the trusted DCS host computer system of the present invention as described above.

[0041] The present invention also provides a storage medium storing a computer program thereon, wherein the computer program, when executed by a processor, implements the deployment method of the trusted DCS host computer system described above.

[0042] The present invention has the following beneficial effects:

[0043] In the deployment method and system of the trusted DCS host computer system of this invention, before deploying the DCS system, it first checks whether the host computer has a tcm0 device. If not, a trusted environment is deployed first. The DCS deployment program is marked as a whitelisted program to prevent trusted systems from blocking the execution of the DCS deployment system. Before deploying the DCS system, the DCS deployment program calls the trusted interface to check whether the host computer's installation environment is in a trusted environment, preventing the host computer from being in an untrusted state, which could cause security risks during DCS operation. The DCS deployment program only requires filling in the configuration parameters in the pop-up configuration page, and the DCS deployment system will deploy the DCS system according to the configuration parameters, simplifying the deployment process and saving deployment time. The DCS deployment program will assign different permissions according to the host computer type and verify whether the installed program can start normally, simplifying the configuration process after installation, while ensuring that the host computer system environment is in a trusted environment, thus ensuring the production safety of the power plant. Attached Figure Description

[0044] Figure 1 This is a flowchart illustrating the deployment method of the trusted DCS host computer system of the present invention. Detailed Implementation

[0045] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present application.

[0046] The host computer described in this invention can be divided into operator stations, engineer stations, and historical stations, depending on its purpose. All host computers are equipped with a trusted computing chip.

[0047] The deployment method of the trusted DCS host computer system of the present invention mainly includes the following process: preparing the installation environment, configuring parameters, installing dependent libraries, and installing the DCS system.

[0048] For details, see Figure 1 The deployment method of the trusted DCS host computer system of the present invention includes the following steps:

[0049] (1) Call the interface of the first-level overall trust status to perform a trustworthiness check on the installation environment of the host computer to be deployed. The return value is 0, 1, and 2, which represent trusted, untrusted, and unknown, respectively. If the return value is trusted, proceed to the next step of installation; if it is untrusted, the installation will exit.

[0050] The first-level overall trust status is determined by judging the overall three states: static trust verification state, trust start verification state, and dynamic trust verification state. When any of these three verification states is untrustworthy, the status is returned as untrustworthy; when any of these three verification states is unknown, the status is returned as unknown; and when all three verification states are trustworthy, the status is returned as trustworthy.

[0051] (2) Execute the command to add a new user dcs and create a dedicated user folder / user / dcs, and execute the command chown -R dcs:dcs / user / dcs to change the owner of the folder / user / dcs to dcs.

[0052] (3) Based on the rpm package name, and based on the function commands to grant executable permissions and mark as a whitelist program to the rpm package, synthesize the Linux string command to grant permissions and mark as a whitelist, and use the function QProcess::start(Linux string command) to start external processes to install the rpm package required by the DCS system.

[0053] (4) On the DCS configuration page, configure the hostname of this host computer (i.e., the host computer to be deployed), fill in the hostnames of other host computers in the same site, the IPs of network A and network B, the IPs of this host computer's network A and network B, the site name, the hostnames of the two file servers that need to be configured in the DCS system, and the type of this host computer. The host computer types are divided into historical site, engineer site, and operator site. Among them, network A and network B refer to the redundancy design, which are essentially two communication networks with different IPs. When any one of the network channels has a problem, it will not affect the overall communication.

[0054] (5) According to the configuration parameters, change the hostname, hosts and site name files in the specified path / etc, write the configuration parameters into the corresponding configuration file dcs.xml, and configure the IP of network A and network B.

[0055] (6) Copy the QT and Python dynamic libraries to the specified path / usr / local.

[0056] (7) First, determine whether the DCS system is already installed in the / user / dcs folder. If it is installed, delete the old DCS system files in the / user / dcs folder and then proceed to the next installation step. If it is not installed, proceed directly to the next installation step.

[0057] (8) Read the configuration parameters. First, obtain the type of installation on the local machine (i.e., the host machine to be deployed). If the installation type is historical station, then all functional modules, including database, file service, historical service, and data transfer service, will be installed in the / user / dcs file. If the installation type is operator station and engineer station, then all functional modules other than database, file service, historical service, and data transfer service will be installed in the / user / dcs file.

[0058] (9) After the installation in step (8) is completed, write the execution permissions for the database, screen and tools in the DCS system config file. If the local machine is a historical station, write all the operation permissions for the database, screen and tools in the config file. You can modify the data and issue commands to the database, screen and tools. If the local machine is an engineer station, write the monitoring permissions for the database, screen and tools in the config file. There are no operation permissions. If the local machine is an operator station, write the monitoring permissions for the database and the operation permissions for the screen and tools in the config file.

[0059] (10) Obtain the absolute paths of all executable applications in the DCS system, combine the paths of the executable applications into a Linux string command for whitelisting operations, and execute them one by one using the external process start function QProcess::start(Linux string command). At the same time, combine the Linux string command for starting the application, and start the application using the external process start function QProcess::start(Linux string command). Query the process identifier (PID) of the application to determine whether the application has started successfully. If the start fails, after three failed attempts, the deployment process is interrupted. The DCS deployment program is completed.

[0060] The deployment method of the trusted DCS host computer system of this invention enables rapid deployment of DCS systems. As can be seen from the above scheme, when deploying the DCS system, the host computer's trusted status is detected to ensure the security and trustworthiness of its deployment environment. Furthermore, integrated installation shortens cumbersome steps and saves time.

[0061] The present invention also provides a deployment system based on the trusted DCS host computer system described above, the system including a DCS deployment program, as referred to Figure 1Before deploying the system, copy the DCS deployment program to the host computer to be deployed and begin preparing the installation environment configuration. First, the DCS deployment program checks if a device named tcm0 exists under the / dev route. If not, it begins installing the trusted installation package (i.e., trusting the underlying computing services) and deploys the trusted environment on the host computer. If the tcm0 device exists, first mark the DCS deployment program as a whitelisted program, and then start the DCS deployment program.

[0062] Specifically, the DCS deployment procedure of the present invention includes:

[0063] Trustworthy Detection Module: Used to perform trustworthy detection on the installation environment of the host computer to be deployed, and to determine whether the host computer to be deployed is trustworthy;

[0064] Add User Module: Used to add new users to the host computer to be deployed when the host computer is trusted;

[0065] First installation module: Used to install RPM packages;

[0066] Configuration parameter module: Used to configure parameters for the host computer to be deployed, and write the configuration parameters into the corresponding configuration file dcs.xml in the specified path / user / dcs folder;

[0067] The second installation module is used to install QT and Python dynamic libraries to the specified path / usr / local.

[0068] Decision module: Used to determine whether the DCS system is installed in the / user / dcs folder of the DCS system;

[0069] The third installation module is used to install the corresponding functional modules into the / user / dcs folder according to the installation type configured in the configuration parameters when no DCS system is installed in the / user / dcs folder; when a DCS system is installed in the / user / dcs folder, the old DCS system files in the / user / dcs folder are deleted, and then the corresponding functional modules are installed into the / user / dcs folder according to the installation type configured in the configuration parameters.

[0070] Permission writing module: Used to write the execution permissions of the installation type for the database, screen, and tools into the DCS system config file;

[0071] Verification module: This module adds all executable applications of the DCS system to the trusted whitelist and verifies whether all applications can start successfully. If all applications start successfully, the trusted DCS host computer system deployment is complete.

[0072] The embodiments of the present invention also provide corresponding devices and computer-readable storage media for implementing the solutions provided in the embodiments of the present invention.

[0073] The device includes a memory and a processor. The memory is used to store instructions or code, and the processor is used to execute the instructions or code to enable the device to perform the deployment method of the trusted DCS host computer system according to any embodiment of this application.

[0074] In practical applications, the computer-readable storage medium can be any combination of one or more computer-readable media. The computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium.

[0075] Computer-readable storage media can be, for example, but not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatuses, or devices, or any combination thereof. More specific examples of computer-readable storage media (a non-exhaustive list) include: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, a computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0076] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, capable of sending, propagating, or transmitting programs for use by or in connection with an instruction execution system, apparatus, or device.

[0077] Program code contained on a computer-readable medium may be transmitted using any suitable medium, including but not limited to wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0078] Computer program code for performing the operations of this invention can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as "C" or similar languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider). It should be noted that the various embodiments in this specification are described in a progressive manner, and similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the apparatus embodiments are basically similar to the method embodiments, so the description is relatively simple, and relevant parts can be referred to the description of the method embodiments. The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components indicated as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0079] It should be noted that the various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, for the device embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the description of the method embodiments. The device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separate. The components indicated as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment solution according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0080] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A deployment method for a trusted DCS host computer system, characterized in that, The process includes the following: Perform a trustworthiness test on the installation environment of the host computer to be deployed to determine whether the host computer to be deployed is trustworthy; When the host computer to be deployed is trusted, add a new user to the host computer to be deployed; Installing RPM packages; specifically, the process of installing RPM packages includes: based on the RPM package name, based on the function commands for granting executable permissions and marking the RPM package as a whitelisted program, synthesizing a Linux string command for granting permissions and marking as a whitelisted program, and using the function QProcess::start(Linux string command) to start an external process to install the RPM packages required by the DCS system; Configure the host computer for deployment and write the configuration parameters into the corresponding configuration file dcs.xml in the specified path / user / dcs folder; Install QT and Python dynamic libraries to the specified path / usr / local. Determine if the DCS system is installed in the / user / dcs folder of the DCS system; If no DCS system is installed in the / user / dcs folder, install the corresponding functional modules into the / user / dcs folder according to the installation type of the configuration parameters; if a DCS system is installed in the / user / dcs folder, delete the old DCS system files in the / user / dcs folder, and then install the corresponding functional modules into the / user / dcs folder according to the installation type of the configuration parameters. Write the execution permissions for the database, screen, and tools for the specified installation type in the DCS system config file; Add all executable applications of the DCS system to the trusted whitelist and verify that all applications can start successfully. If all applications start successfully, the deployment of the trusted DCS host computer system is complete.

2. The deployment method of the trusted DCS host computer system according to claim 1, characterized in that, When performing trustworthiness checks on the installation environment of the host computer to be deployed, the interface of the first-level overall trustworthiness status is called to perform trustworthiness checks on the installation environment of the host computer. Trustworthiness testing of the host computer's installation environment involves judging the overall state of three trustworthiness verification states: static trustworthiness verification state, trustworthiness startup verification state, and dynamic trustworthiness verification state. If all three trustworthiness verification states are trustworthy, the host computer to be deployed is considered trustworthy.

3. The deployment method of the trusted DCS host computer system according to claim 1, characterized in that, The process of adding a new user on the host computer to be deployed includes: adding a new user dcs and creating a dedicated dcs user folder / user / dcs, and executing the command to change the folder owner to dcs.

4. The deployment method of the trusted DCS host computer system according to claim 1, characterized in that, The process of configuring the host computer for deployment and writing the configuration parameters to the corresponding file in the specified path includes: In the DCS configuration page, configure the hostname of the host computer to be deployed, fill in the hostname of other host computers in the same site and the IP addresses of network A and network B, the IP addresses of network A and network B of the host computer to be deployed, the site name, the hostname of the two file servers that need to be configured in the DCS system, and the type of the host computer to be deployed. Based on the configuration parameters, modify the hostname, hosts, and site name files in the specified path / etc, write the configuration parameters into the corresponding files, and configure the IP addresses for network A and network B.

5. The deployment method of the trusted DCS host computer system according to claim 1, characterized in that, The process of installing the corresponding functional modules into the / user / dcs folder according to the installation type configured in the parameters includes: Read the configuration parameters. First, obtain the type of the host computer to be deployed. If the installation type is a history station, install all functional modules, including database, file service, history service, and data transfer service, into the / user / dcs file. If the installation type is an operator station or an engineer station, install all functional modules except database, file service, history service, and data transfer service into the / user / dcs file.

6. The deployment method of the trusted DCS host computer system according to claim 1, characterized in that, The process of writing the execution permissions for the database, screen, and tools for the installation type in the DCS system config file includes: If the host computer to be deployed is a historical station, write all operational permissions for the database, screen, and tools in the config file; if the host computer to be deployed is an engineer station, write monitoring permissions for the database, screen, and tools in the config file; if the host computer to be deployed is an operator station, write monitoring permissions for the database and operational permissions for the screen and tools in the config file.

7. A deployment system for a trusted DCS host computer system, characterized in that, include: Trustworthy Detection Module: Used to perform trustworthy detection on the installation environment of the host computer to be deployed, and to determine whether the host computer to be deployed is trustworthy; Add User Module: Used to add new users to the host computer to be deployed when the host computer is trusted; The first installation module is used to install RPM packages. Specifically, the process of installing RPM packages includes: based on the RPM package name, based on the function commands that grant executable permissions to the RPM package and mark it as a whitelisted program, synthesizing a Linux string command for granting permissions and marking it as a whitelisted program, and using the function QProcess::start(Linux string command) to start an external process to install the RPM packages required by the DCS system. Configuration parameter module: Used to configure parameters for the host computer to be deployed, and write the configuration parameters into the corresponding configuration file dcs.xml under the specified path / user / dcs folder; The second installation module is used to install QT and Python dynamic libraries to the specified path / usr / local. Decision module: Used to determine whether the DCS system is installed in the / user / dcs folder of the DCS system; The third installation module is used to install the corresponding functional modules into the / user / dcs folder according to the installation type configured in the configuration parameters when no DCS system is installed in the / user / dcs folder; when a DCS system is installed in the / user / dcs folder, the old DCS system files in the / user / dcs folder are deleted, and then the corresponding functional modules are installed into the / user / dcs folder according to the installation type configured in the configuration parameters. Permission writing module: Used to write the execution permissions of the installation type for the database, screen, and tools into the DCS system config file; Verification module: This module adds all executable applications of the DCS system to the trusted whitelist and verifies whether all applications can start successfully. If all applications start successfully, the trusted DCS host computer system deployment is complete.

8. An electronic device, characterized in that, include: One or more processors; A storage device on which one or more programs are stored; When the one or more programs are executed by the one or more processors, the one or more processors implement the deployment method of the trusted DCS host computer system as described in any one of claims 1 to 6.

9. A storage medium, characterized in that, It stores a computer program, wherein when the computer program is executed by a processor, it implements the deployment method of the trusted DCS host computer system as described in any one of claims 1 to 6.

Images