DCS upper computer file credibility guarantee method based on credible computing and related device

Abstract

The invention belongs to the technical field of a credible thermal power DCS system, and discloses a DCS upper computer file credibility guarantee method based on credible computing and a related device, and the method comprises the following steps: carrying out the integrity verification of a key file according to a hash value, and obtaining the integrity verification information; if the user has the access role and the access permission corresponding to the key file at the same time, the user accesses the key file to obtain access information; after the attribute of the key file is set to be read-only or hidden, encrypting the key file by adopting a file encryption method; detecting an abnormal behavior mode of the key file, and if the abnormal behavior mode is detected, triggering an alarm to obtain abnormal behavior information; and recording and analyzing the integrity verification information, the access information and the abnormal behavior information to obtain potential security risk information, thereby realizing credible guarantee of the DCS upper computer file. The problem that in the prior art, the file security cannot be comprehensively protected when facing complex and changeable network threats is solved.

Description

Technical Field

[0001] The invention belongs to the technical field of trusted thermal power DCS system, and in particular relates to a DCS host computer file trust assurance method based on trusted computing and a related device. Background Art

[0002] In the field of industrial automation, Distributed Control System (DCS) is an important equipment monitoring and management system. DCS is mainly composed of field controllers, communication networks and host computers. Among them, the host computer, as a monitoring center, is responsible for monitoring the operating status of field equipment and displaying these status data to operators in a visual form.

[0003] With the rapid development of industrial automation technology, distributed control systems (DCS), as an important part of the industrial automation field, are widely used in various industrial scenarios. As the core part of the system, the file security of the DCS control system host computer is crucial to the stable operation of the entire system. However, traditional file security mechanisms are inadequate in the face of complex and ever-changing network threats. However, trusted computing is a technology that combines hardware and software to improve the overall security of computer systems. The core idea is to build a trusted root in the computer system, and based on this, through a series of security strategies and mechanisms, ensure that the system runs in a trusted state at all times. Therefore, it is particularly important to develop a trusted protection mechanism for DCS control system host computer files based on trusted computing. Summary of the invention

[0004] The present invention provides a DCS host computer file trust protection method and related devices based on trusted computing to solve the problem that the prior art cannot fully protect file security when facing complex and changeable network threats.

[0005] In order to achieve the above object, the present invention adopts the following technical solutions:

[0006] In a first aspect, a DCS host computer file trust assurance method based on trusted computing comprises the following steps:

[0007] Obtain a file verification list, the file verification list including key files and their corresponding hash values;

[0008] Performing integrity check on the key file according to the hash value to obtain integrity check information;

[0009] Assigning a specific access role and access permission to the key file. If a user has both the access role and access permission corresponding to the key file, the user accesses the key file to obtain access information.

[0010] After setting the attribute of the key file to read-only or hidden, encrypting the key file using a file encryption method;

[0011] Detecting an abnormal behavior pattern of the key file, and if the abnormal behavior pattern is detected, triggering an alarm to obtain abnormal behavior information;

[0012] The integrity check information, access information and abnormal behavior information are recorded and analyzed to obtain potential security risk information and realize the trusted protection of DCS host computer files.

[0013] In some embodiments, the step of performing integrity verification on the key file based on the hash value specifically includes: comparing the hash value corresponding to the key file with the standard hash value of the file verification list; if the hash value corresponding to the key file does not match the standard hash value, the key file has been tampered with.

[0014] In some implementations, the step of performing integrity verification on the key file according to the hash value further includes: signing the hash value using a digital signature technology.

[0015] In some implementations, a role-based access control model is used to assign specific access roles and access rights to the key files.

[0016] In some implementations, the file encryption method includes symmetric encryption, asymmetric encryption, and hybrid encryption.

[0017] In some implementations, the abnormal behavior pattern includes frequent access to critical files and abnormal modification of critical files.

[0018] In the second aspect, a DCS host computer file trust protection system based on trusted computing includes:

[0019] A key file acquisition module is used to obtain a file verification list, wherein the file verification list includes key files and their corresponding hash values;

[0020] An integrity check module, used to perform an integrity check on the key file according to the hash value to obtain integrity check information;

[0021] An authorized access control module is used to assign specific access roles and access rights to the key file. If a user has both the access role and access rights corresponding to the key file, the user accesses the key file and obtains access information;

[0022] An encryption module, used to encrypt the key file using a file encryption method after setting the attribute of the key file to read-only or hidden;

[0023] An abnormal behavior detection module is used to detect abnormal behavior patterns of the key files, and if the abnormal behavior patterns are detected, an alarm is triggered to obtain abnormal behavior information;

[0024] The potential risk analysis module is used to record and analyze the integrity verification information, access information and abnormal behavior information to obtain potential security risk information and realize the trustworthy protection of DCS host computer files.

[0025] In a third aspect, a computer device includes a memory, a processor, and a computer program stored in the memory and executable in the processor, wherein when the processor executes the computer program, the steps of a DCS host computer file trust assurance method based on trusted computing are implemented.

[0026] In a fourth aspect, a computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method for ensuring the trustworthiness of DCS host computer files based on trusted computing are implemented.

[0027] In a fifth aspect, a computer program product is provided, the computer product comprising a computer program, characterized in that when the computer program is executed by a processor, the steps of the method for ensuring the trustworthiness of DCS host computer files based on trusted computing are implemented.

[0028] Compared with the prior art, the present invention has the following beneficial effects:

[0029] The present invention provides a DCS host computer file trust protection method based on trusted computing. By introducing trusted computing, multiple protection measures such as integrity verification of key files according to hash values, verification of user access roles and access rights to key files, encryption of key files, and detection of abnormal behavior patterns of key files are adopted to greatly improve the security of host computer files and effectively prevent security threats such as malicious tampering, illegal access, and data leakage. The file trust protection method ensures that the host computer files run stably in the system. By real-time monitoring of file status, detecting abnormal behavior, and responding in time, the system can avoid system crash or performance degradation caused by file damage or abnormal operation. This greatly enhances the stability and reliability of the DCS control system and provides solid technical support for the continuous production of enterprises. In addition, the present invention records the integrity verification information, access information, and abnormal behavior information and analyzes them by implementing a log recording and analysis mechanism, thereby providing administrators with comprehensive and real-time system operation status monitoring. Once a security incident or abnormal behavior occurs, the administrator can quickly locate the problem, analyze the cause, and take corresponding countermeasures. This greatly improves the emergency response capability of the system, shortens the fault recovery time, and reduces the economic losses of the enterprise. The guarantee method provided by the present invention fully considers the characteristics and requirements of different DCS control systems and has strong compatibility. Whether it is a hardware platform, an operating system or application software, the guarantee method can be well integrated and work in coordination with them, which provides enterprises with greater flexibility and convenience when selecting and deploying DCS control systems.

[0030] Furthermore, the present invention combines the file encryption method and the digital signature technology to ensure the confidentiality and integrity of key files during transmission and storage. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 A flow chart of a DCS host computer file trust assurance method based on trusted computing provided in Example 1;

[0032] Figure 2 A schematic diagram of the structure of a DCS host computer file trust protection system based on trusted computing provided in Example 2;

[0033] Figure 3 This is a schematic diagram of the computer device structure used in the present invention. DETAILED DESCRIPTION

[0034] In order to enable those skilled in the art to better understand the solution of the present invention, the technical solution of the present invention will be further described in detail below in conjunction with the accompanying drawings, and the described content is intended to explain the present invention rather than to limit it.

[0035] It should be noted that the terms "including" and "having" and any variations thereof in the specification and claims of the present invention are intended to cover non-exclusive inclusions. For example, a process, method, system, product or apparatus comprising a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units that are not explicitly listed or are inherent to these processes, methods, systems, products or apparatus.

[0036] Embodiment 1

[0037] like Figure 1 As shown, this embodiment provides a DCS host computer file trust protection method based on trusted computing. The method realizes the security protection of host computer files by introducing trusted computing technology and combining system hardware and software resources. The method mainly includes six aspects: file integrity verification, file access control, file resistance to abnormal tampering, file authorized access, abnormal behavior detection and log record analysis;

[0038] File integrity verification: A file integrity verification mechanism based on a hash algorithm is used. The host system generates a unique hash value for key files and performs real-time verification during file transmission, storage, and execution. If the content of a file changes, its hash value will also change accordingly, so that it is possible to detect whether the file has been tampered with in a timely manner. In addition, combined with digital signature technology, the file publisher can sign the file hash value to ensure the credibility of the verification process.

[0039] File access control: To ensure the security of files, the present invention implements a strict file access control strategy. By setting file access rights and access rules, the access rights of different users or processes to files are restricted. At the same time, the role-based access control (RBAC) model is introduced to assign corresponding file access rights according to the user's role and responsibilities, ensuring that only authorized users can access sensitive files.

[0040] Files are protected from abnormal tampering: First, the file protection mechanism of the operating system is used to set key files to read-only or hidden attributes to prevent unauthorized modification. Second, file encryption technology is introduced to encrypt the storage and transmission of sensitive files to ensure that the file content is not stolen or tampered with during the transmission process. In addition, a file integrity verification mechanism is used to promptly detect and repair tampered files.

[0041] File authorization access: Based on file access control, this embodiment implements a file authorization access mechanism. Before a user or process accesses a file, it must pass identity authentication and authorization verification. Identity authentication ensures the authenticity of the visitor's identity, and authorization verification determines whether the visitor has the authority to access the file based on the visitor's permissions and access rules. Only visitors who pass both identity authentication and authorization verification can access the corresponding files.

[0042] Abnormal behavior detection: In order to timely discover and respond to potential security threats, this embodiment implements an abnormal behavior detection mechanism. By analyzing and monitoring file access behavior, file operation behavior, etc., abnormal behavior patterns are discovered. For example, frequent access to sensitive files, abnormal file modification operations, etc. When abnormal behavior is detected, the system will immediately trigger an alarm mechanism and take corresponding disposal measures, such as blocking access, recording logs, etc.

[0043] Log recording and analysis: To facilitate post-event tracing and auditing, the present invention implements a log recording and analysis mechanism. All file accesses, file operations and other behaviors will be recorded in the log, including the visitor's identity, access time, accessed file name, operation type and other information. At the same time, the system also provides a log analysis tool to help administrators quickly locate potential security risks and problems, and provide strong support for optimizing system security policies.

[0044] Based on the above content, the file trust assurance method includes the following steps:

[0045] S1: When the system starts, the trusted computing environment is initialized and key information such as security policies, keys and certificates are loaded. At the same time, a file verification list is generated, including key files that need to be protected and their corresponding hash values. The file verification list is obtained, and the file verification list includes key files and their corresponding hash values;

[0046] S2: Perform integrity check on the key file according to the hash value to obtain integrity check information; compare the hash value corresponding to the key file with the standard hash value of the file check list. If the hash value corresponding to the key file does not match the standard hash value, the key file has been tampered with, triggering an alarm and taking corresponding security measures, such as blocking file access, isolating processes, etc.

[0047] S3: Allocate a specific access role and access permission to the key file. If the user has both the access role and access permission corresponding to the key file, the user accesses the key file to obtain access information.

[0048] The access control mechanism based on roles and permissions strictly controls the access to the host computer files. Only users who have been authenticated and have the corresponding permissions can access sensitive files, ensuring the security and confidentiality of the files.

[0049] By customizing security policies, you can set specific file access permissions for specific applications. Only applications that have been authenticated and have the corresponding permissions can access sensitive files, ensuring the security and confidentiality of files.

[0050] S4: After setting the attribute of the key file to read-only or hidden, encrypting the key file using a file encryption method;

[0051] File encryption methods include symmetric encryption, asymmetric encryption and hybrid encryption. File encryption methods set up sensitive files in the host computer to resist abnormal tampering to ensure the security of the files.

[0052] S5: Detecting an abnormal behavior pattern of the key file, and if the abnormal behavior pattern is detected, triggering an alarm to obtain abnormal behavior information;

[0053] Specifically, the system monitors the operating status of the host computer system in real time to detect abnormal behavior or potential security threats. Once an abnormality is found, an alarm is triggered immediately and relevant log information is recorded to provide a basis for subsequent security audits and troubleshooting.

[0054] S6: Record and analyze the integrity check information, access information and abnormal behavior information to obtain potential security risk information and realize the trusted protection of DCS host computer files.

[0055] Specifically, it can record all operation logs and security events related to file trustworthiness. By analyzing the log data, it can timely discover system security vulnerabilities and potential risks, and provide support for the continuous improvement and optimization of the system.

[0056] Through the detailed implementation of the above steps, the DCS host computer file trust protection method based on trusted computing in this embodiment can achieve comprehensive protection of host computer files, improve the security and stability of the system, and provide a strong guarantee for the sustainable development of the industrial automation field. It mainly has the following advantages:

[0057] Improve file security: By introducing trusted computing technology, multiple safeguards such as file integrity verification, access control, and abnormal behavior detection are strengthened. This greatly improves the security of host computer files and effectively prevents security threats such as malicious tampering, illegal access, and data leakage. At the same time, combined with file encryption and digital signature technology, the confidentiality and integrity of files during transmission and storage are also guaranteed.

[0058] Enhanced system stability: The implementation of this guarantee method ensures the stable operation of the host computer files in the system. By real-time monitoring of file status, detecting abnormal behavior and responding in a timely manner, the system can avoid system crashes or performance degradation caused by file damage or abnormal operations. This greatly enhances the stability and reliability of the DCS control system and provides solid technical support for the company's continuous production.

[0059] Improve emergency response capabilities: By implementing a log recording and analysis mechanism, this protection mechanism provides administrators with comprehensive, real-time monitoring of system operation status. Once a security incident or abnormal behavior occurs, the administrator can quickly locate the problem, analyze the cause, and take appropriate countermeasures. This greatly improves the system's emergency response capabilities, shortens fault recovery time, and reduces the company's economic losses.

[0060] Strong compatibility: This method fully considers the characteristics and requirements of different DCS control systems and has strong compatibility. Whether it is a hardware platform, operating system or application software, the guarantee mechanism can be well integrated and work with them. This provides enterprises with greater flexibility and convenience when selecting and deploying DCS control systems.

[0061] Embodiment 2

[0062] like Figure 2 As shown, this embodiment provides a DCS host computer file trust protection system based on trusted computing, including:

[0063] A key file acquisition module is used to obtain a file verification list, wherein the file verification list includes key files and their corresponding hash values;

[0064] An integrity check module, used to perform an integrity check on the key file according to the hash value to obtain integrity check information;

[0065] An authorized access control module is used to assign specific access roles and access rights to the key file. If a user has both the access role and access rights corresponding to the key file, the user accesses the key file and obtains access information;

[0066] An encryption module, used to encrypt the key file using a file encryption method after setting the attribute of the key file to read-only or hidden;

[0067] An abnormal behavior detection module is used to detect abnormal behavior patterns of the key files, and if the abnormal behavior patterns are detected, an alarm is triggered to obtain abnormal behavior information;

[0068] The potential risk analysis module is used to record and analyze the integrity verification information, access information and abnormal behavior information to obtain potential security risk information and realize the trustworthy protection of DCS host computer files.

[0069] The division of modules in the embodiments of the present invention is schematic and is only a logical function division. There may be other division methods in actual implementation. In addition, each functional module in each embodiment of the present invention may be integrated into one processor, or may exist physically separately, or two or more modules may be integrated into one module. The above-mentioned integrated modules may be implemented in the form of hardware or in the form of software functional modules.

[0070] like Figure 3 As shown, a computer device is also provided in this embodiment, which includes a processor and a memory, the memory is used to store a computer program (in this embodiment, the computer program includes a computing component and an iterative component, which can perform model calculation and model update), the computer program includes program instructions, and the processor is used to execute the program instructions stored in the computer storage medium. The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. It is the computing core and control core of the terminal, which is suitable for implementing one or more instructions, and is specifically suitable for loading and executing one or more instructions in the computer storage medium to implement the corresponding method flow or corresponding function; the processor described in the embodiment of the present invention can be used for the operation of the DCS host computer file trusted assurance method based on trusted computing.

[0071] This embodiment also provides a storage medium, specifically a computer-readable storage medium (Memory), which is a memory device in a computer device for storing programs and data. It is understandable that the computer-readable storage medium here can include both built-in storage media in the computer device and, of course, extended storage media supported by the computer device. The computer-readable storage medium provides a storage space, which stores the operating system of the terminal. In addition, one or more instructions suitable for being loaded and executed by the processor are also stored in the storage space, and these instructions can be one or more computer programs (including program codes). It should be noted that the computer-readable storage medium here can be a high-speed RAM memory or a non-volatile memory, such as at least one disk memory. The processor can load and execute one or more instructions stored in the computer-readable storage medium to implement the corresponding steps of the DCS host computer file trust assurance method based on trusted computing in the above embodiment.

[0072] This embodiment further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the corresponding steps of the DCS host computer file trust assurance method based on trusted computing in the above embodiment are implemented.

[0073] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0074] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0075] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0076] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0077] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A DCS host computer file trust assurance method based on trusted computing, characterized in that: The following steps are involved: Obtain a file verification list, the file verification list including key files and their corresponding hash values; Performing integrity check on the key file according to the hash value to obtain integrity check information; Assigning a specific access role and access permission to the key file. If a user has both the access role and access permission corresponding to the key file, the user accesses the key file to obtain access information. After setting the attribute of the key file to read-only or hidden, encrypting the key file using a file encryption method; Detecting an abnormal behavior pattern of the key file, and if the abnormal behavior pattern is detected, triggering an alarm to obtain abnormal behavior information; The integrity check information, access information and abnormal behavior information are recorded and analyzed to obtain potential security risk information and realize the trusted protection of DCS host computer files.

2. A DCS host computer file trust assurance method based on trusted computing according to claim 1, characterized in that: The step of performing integrity verification on the key file according to the hash value specifically includes: comparing the hash value corresponding to the key file with the standard hash value of the file verification list; if the hash value corresponding to the key file does not match the standard hash value, the key file has been tampered with.

3. A DCS host computer file trust assurance method based on trusted computing according to claim 1, characterized in that: The step of performing integrity verification on the key file according to the Hash value further includes: signing the Hash value using a digital signature technology.

4. A DCS host computer file trust assurance method based on trusted computing according to claim 1, characterized in that: A role-based access control model is used to assign specific access roles and access rights to the key files.

5. A DCS host computer file trust assurance method based on trusted computing according to claim 1, characterized in that: The file encryption method includes symmetric encryption, asymmetric encryption and hybrid encryption.

6. A DCS host computer file trust assurance method based on trusted computing according to claim 1, characterized in that: The abnormal behavior patterns include frequent access to key files and abnormal modification of key files.

7. A DCS host computer file trust protection system based on trusted computing, characterized in that: include: A key file acquisition module is used to obtain a file verification list, wherein the file verification list includes key files and their corresponding hash values; An integrity check module, used to perform an integrity check on the key file according to the hash value to obtain integrity check information; An authorized access control module is used to assign specific access roles and access rights to the key file. If a user has both the access role and access rights corresponding to the key file, the user accesses the key file and obtains access information; An encryption module, used to encrypt the key file using a file encryption method after setting the attribute of the key file to read-only or hidden; An abnormal behavior detection module is used to detect abnormal behavior patterns of the key files, and if the abnormal behavior patterns are detected, an alarm is triggered to obtain abnormal behavior information; The potential risk analysis module is used to record and analyze the integrity verification information, access information and abnormal behavior information to obtain potential security risk information and realize the trustworthy protection of DCS host computer files.

8. A computer device, characterized in that: The invention comprises a memory, a processor and a computer program stored in the memory and executable in the processor. When the processor executes the computer program, the steps of a DCS host computer file trust assurance method based on trusted computing as described in any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of a DCS host computer file trust assurance method based on trusted computing as described in any one of claims 1 to 6 are implemented.

10. A computer program product, the computer product comprising a computer program, characterized in that: When the computer program is executed by a processor, the steps of a DCS host computer file trust assurance method based on trusted computing as described in any one of claims 1 to 6 are implemented.

Images