Trusted policy increment issuing method and related device
By adopting the incremental issuance method of trusted policy in the DCS management system, the problem of inconsistency between the equipment and management platform policies is solved through comparing and reorganizing the policies, ensuring system security and stable operation, and reducing management costs.
Patent Information
- Application Number
- CN202411258129.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-09
- Publication Date
- 2024-12-27
AI Technical Summary
After the DCS management system is upgraded, the policies in the equipment cannot be consistent with the policies of the management platform, which poses problems such as security risks and high management costs.
Using the incremental issuance method of trusted policy, by obtaining the issuance of trusted policies and the device's existing trusted policies, opening the comparison thread for comparison, reorganizing the policies based on the comparison results, ensuring that the policies on the device are consistent with the policies of the management platform. And after obtaining updates through multi-threading, a trusted policy is issued to complete the incremental issuance of the trusted policy.
It realizes policy consistency between the policies on the device and the management platform, reduces traffic expenses, avoids the problem of the system being unable to operate due to the reduction of policies, enhances system security, and reduces management costs.
Smart Images
Figure CN119210804A_ABST
Abstract
Description
Technical Field
[0001] The invention belongs to the technical field of trusted thermal power DCS systems, and in particular relates to a trusted strategy incremental delivery method and related devices. Background Art
[0002] With the increasing complexity of industrial environments and the increasing severity of network security threats, the security of domestic trusted DCS (Distributed Control System) management systems has become an important issue that cannot be ignored. Traditional security measures can no longer meet the current industrial system's demand for high reliability. Therefore, in the design and implementation of domestic trusted DCS management systems, special emphasis is placed on the importance of trusted strategies. Domestic trusted DCS management systems are usually composed of a complete management system consisting of DCS, host computers, and historical stations. The DCS system integrates advanced control algorithms, high-speed data processing capabilities, and remote monitoring functions. It is widely used in many key industries such as power, chemical, petroleum, and metallurgy, and plays a vital role in ensuring production safety and improving operational efficiency. These devices have set trusted strategies for the system when they leave the factory: trusted startup, static trusted verification, dynamic trusted verification, trusted whitelist, process protection, and application access control. Each type of strategy ensures the security of the firmware and files on the device, and together builds a multi-level defense system to prevent security threats such as unauthorized access, malware intrusion, and data tampering.
[0003] However, as the system or software is continuously upgraded, these policies will change with the upgrade. Some files may not even have policies. In this process, it brings great security risks to the system. Therefore, the management of trusted policies is very important. It is necessary to ensure the consistency between the policies of the management platform and the policies on the device, and to ensure that the policies on the device will not cause security problems caused by lack of management or omissions. It is also necessary to ensure that the policies on the device will not cause problems such as the inability to modify files and the inability to execute programs due to excessive management. Summary of the invention
[0004] The present invention provides a trusted policy incremental delivery method and related devices to solve the problem in the prior art that the policies in the upgraded equipment of a DCS management system cannot be kept consistent with the policies of a management platform.
[0005] In order to achieve the above object, the present invention adopts the following technical solutions:
[0006] In a first aspect, a method for incrementally issuing a trusted policy includes the following steps:
[0007] Obtain the issued trusted policy and the existing trusted policy of the device;
[0008] After starting the comparison thread, the issued trusted policy and the existing trusted policy of the device are compared to obtain a comparison result, the existing trusted policy of the device is managed according to the comparison result, and the comparison result is classified to obtain a classification result;
[0009] The issued trusted policy is reorganized according to the classification result to obtain an updated issued trusted policy. The DCS device starts multi-threading to obtain the updated issued trusted policy to complete the incremental issuance of the trusted policy.
[0010] In some implementations, when obtaining the issued trusted policy and the existing trusted policy of the device, check whether the issued trusted policy is legal. If legal, start a comparison thread to compare the issued trusted policy with the existing trusted policy of the device; if illegal, stop obtaining the issued trusted policy.
[0011] In some implementations, the comparison result includes: the issued trusted policy is consistent with the existing trusted policy of the device, the issued trusted policy is more than the existing trusted policy of the device, and the issued trusted policy is less than the existing trusted policy of the device.
[0012] In some implementations, the step of managing the existing trusted policy of the device according to the comparison result specifically includes:
[0013] If the comparison result is that the issued trusted policy is consistent with the existing trusted policy of the device, the DCS device stops obtaining the issued trusted policy;
[0014] If the comparison result shows that the number of trusted policies issued is greater than the number of trusted policies already in the device, reorganizing the trusted policies issued according to the classification result;
[0015] If the comparison result is that the issued trusted policy is less than the existing trusted policy of the device, the part of the existing trusted policy of the device that is not included in the issued trusted policy is deleted.
[0016] In some implementations, the updated trusted policies include: trusted startup policies, static trusted verification policies, dynamic trusted verification policies, trusted whitelist policies, process protection policies, and application access control delivery policies.
[0017] In some implementations, each DCS device starts six threads, and each thread obtains a corresponding trusted policy for issuing after update.
[0018] In a second aspect, a trusted policy incremental delivery system includes:
[0019] A trusted policy acquisition module is used to acquire the trusted policies issued and the existing trusted policies of the device;
[0020] A trusted policy comparison module is used to compare the issued trusted policy with the existing trusted policy of the device after starting a comparison thread to obtain a comparison result, manage the existing trusted policy of the device according to the comparison result, and classify the comparison result to obtain a classification result;
[0021] The trusted policy issuing module is used to reorganize the issued trusted policy according to the classification result to obtain the updated issued trusted policy. The DCS device starts multi-threading to obtain the updated issued trusted policy to complete the incremental issuance of the trusted policy.
[0022] In a third aspect, a computer device includes a memory, a processor, and a computer program stored in the memory and executable in the processor, wherein the processor implements the steps of the method for incrementally delivering a trusted policy when executing the computer program.
[0023] In a fourth aspect, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method for incrementally delivering a trusted policy are implemented.
[0024] In a fifth aspect, a computer program product is provided, the computer product comprising a computer program, and the computer program, when executed by a processor, implements the steps of the method for incrementally delivering a trusted policy.
[0025] Compared with the prior art, the present invention has the following beneficial effects:
[0026] The present invention provides a method for incrementally issuing a trusted policy. After starting a comparison thread, the issued trusted policy is compared with an existing trusted policy of a device. The existing trusted policy of the device is managed according to the comparison result. Meanwhile, the comparison result is classified. According to the classification result, the issued trusted policy is reorganized to obtain an updated issued trusted policy. A DCS device starts multiple threads to obtain the updated issued trusted policy, and the incremental issuance of the trusted policy is completed. The policy on the device can be made consistent with the managed policy. After the comparison, the policy message is issued, and the traffic expenditure can be reduced. Meanwhile, the method can ensure that the policy on the device is consistent with the policy of the management platform, and will not affect the operation of the system on the device. The key process of the system will not be unable to be started due to the reduction of the policy, so that the security problem caused by under-management or over-management of the trusted policy is avoided, and the management cost is greatly reduced.
[0027] Furthermore, the present invention performs a legality check before obtaining and issuing a trusted policy, thereby preventing illegal or malicious policies from being issued to a device, thereby enhancing system security.
[0028] Furthermore, the present invention enables multi-threaded acquisition of trusted policies, which can improve the parallel processing capability of the system and is suitable for scenarios of large-scale device clusters. BRIEF DESCRIPTION OF THE DRAWINGS
[0029] Figure 1 A specific flow chart of the method for incrementally issuing a trusted policy provided in Example 1;
[0030] Figure 2 A flow chart of the method for incrementally issuing trusted policies provided by the present invention;
[0031] Figure 3 A schematic diagram of the structure of the system for incrementally issuing trusted policies provided in Example 2;
[0032] Figure 4 This is a schematic diagram of the computer device structure used in the present invention. DETAILED DESCRIPTION
[0033] In order to enable those skilled in the art to better understand the solution of the present invention, the technical solution of the present invention will be further described in detail below in conjunction with the accompanying drawings, and the described content is intended to explain the present invention rather than to limit it.
[0034] It should be noted that the terms "including" and "having" and any variations thereof in the specification and claims of the present invention are intended to cover non-exclusive inclusions. For example, a process, method, system, product or apparatus comprising a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units that are not explicitly listed or are inherent to these processes, methods, systems, products or apparatus.
[0035] Embodiment 1
[0036] With the continuous advancement of technology and the growing demand, DCS systems and their management software inevitably need to be frequently upgraded and updated. In this process, the original trusted policy may face many challenges. On the one hand, the upgrade may introduce new software components or configuration files. If these new elements are not included in the trusted policy management scope in time, security vulnerabilities will be generated, exposing the system to potential security risks; on the other hand, if the original trusted policy is accidentally deleted or modified during the upgrade process, the system's security protection capabilities may be weakened, and even the system cannot operate normally. The management of trusted policies also needs to balance flexibility and rigor. It is necessary to ensure the consistency of the policies on the management platform and the device to maintain the security and unity of the entire system; and to avoid the problems of "over-management" or "missing management" caused by poor policy management. "Over-management" may restrict legal operations and affect the normal maintenance and upgrade of the system; "missing management" may leave security risks and expose the system to potential threats. Therefore, this embodiment provides a method for incremental issuance of trusted policies to effectively manage the trusted policies in the DCS system, ensuring that the trusted policies issued during the system upgrade process are consistent with the existing trusted policies of the device, such as Figure 1 and Figure 2 As shown, the following steps are included:
[0037] S1: Obtain the issued trusted policy and the existing trusted policy of the device;
[0038] Specifically, S1.1: After the device is upgraded, the key trusted policy is first configured, and the policy on the device is used as a basic template;
[0039] S1.2: After selecting an online host and issuing the basic template, check whether the issued trusted policy is legal. If it is legal, proceed to step S2; if it is not legal, stop obtaining the issued trusted policy;
[0040] During the trusted policy delivery process, the target devices need to be screened to ensure that only hosts that are online and ready receive the basic template, avoiding unnecessary network traffic and ensuring the success rate of delivery.
[0041] S1.3: Obtain the existing trusted policy of the device running on the device.
[0042] S2: after starting a comparison thread, compare the issued trusted policy with the existing trusted policy of the device to obtain a comparison result, manage the existing trusted policy of the device according to the comparison result, and classify the comparison result to obtain a classification result;
[0043] Specifically, the existing trusted policy of the device is compared with the issued trusted policy. If the comparison result shows that the issued trusted policy is consistent with the existing trusted policy of the device, no operation is performed and the DCS device stops obtaining the issued trusted policy. If the comparison result shows that the issued trusted policy is more than the existing trusted policy of the device, the issued trusted policy is directly issued after reorganizing the issued trusted policy. If the comparison result shows that the issued trusted policy is less than the existing trusted policy of the device, the redundant part of the existing trusted policy of the device is deleted to ensure that the policy on the device is consistent with the policy of the management center.
[0044] Specifically, in order to improve efficiency and accuracy, one or more comparison threads can be started to process comparison tasks in parallel. Each thread can be responsible for the policy comparison of one or more devices, and compare the issued trusted policies in the template with the existing trusted policies of the device one by one to find out the parts that need to be updated or modified.
[0045] S3: Reorganize the issued trusted policy according to the classification result to obtain the updated issued trusted policy. The DCS device starts six threads to obtain the updated issued trusted policy, wherein the updated issued trusted policy includes: trusted startup policy, static trusted verification policy, dynamic trusted verification policy, trusted whitelist policy, process protection policy and application access control issuance policy, and completes the incremental issuance of trusted policies.
[0046] Specifically, the trusted policies are reorganized and issued according to the classification results. For the policy parts that need to be updated, new configuration files and instructions will be generated, and the policy parts that remain unchanged will be skipped directly.
[0047] After all policies are issued, the final issuance results will be returned to the management center. The issuance results include a list of successfully issued policies, unsuccessfully issued policies and their reasons, etc.
[0048] The method of this embodiment can make the policy on the device consistent with the managed policy, and then send the policy message after comparison, reducing traffic expenses; ensure that the policy on the device is consistent with the trusted policy sent, so that the policy of the key file will not affect the operation of the system on the device, and the key process of the system will not be unable to start due to the reduction of the policy, so as to achieve the security problems caused by less or more management of the trusted policy, and greatly reduce the management cost. In the process of policy issuance, the existing policy on the device is compared with the policy to be issued on the management platform. If the policy on the device is more than the policy to be issued, the policy on the device is deleted; if the policy on the device is less than the policy to be issued, it is directly issued. At the same time, the managed policy is checked. If the policy of the key file is not configured, the issued policy will not be executed. If the policy is completely consistent after comparison, the policy will not be issued, ensuring that the managed policy of the management center and the policy on the device are always consistent, and the policy on the device is managed simply and conveniently, enhancing the security of the device and reducing the potential safety hazards of the device.
[0049] Embodiment 2
[0050] like Figure 3 As shown, this embodiment provides a trusted policy incremental delivery system, including a trusted policy acquisition module, a trusted policy comparison module and a trusted policy delivery module;
[0051] A trusted policy acquisition module is used to acquire the trusted policies issued and the existing trusted policies of the device;
[0052] A trusted policy comparison module is used to compare the issued trusted policy with the existing trusted policy of the device after starting a comparison thread to obtain a comparison result, manage the existing trusted policy of the device according to the comparison result, and classify the comparison result to obtain a classification result;
[0053] The trusted policy issuing module is used to reorganize the issued trusted policy according to the classification result to obtain the updated issued trusted policy. The DCS device starts multi-threading to obtain the updated issued trusted policy to complete the incremental issuance of the trusted policy.
[0054] The division of modules in the embodiments of the present invention is schematic and is only a logical function division. There may be other division methods in actual implementation. In addition, each functional module in each embodiment of the present invention may be integrated into one processor, or may exist physically separately, or two or more modules may be integrated into one module. The above-mentioned integrated modules may be implemented in the form of hardware or in the form of software functional modules.
[0055] like Figure 4 As shown, a computer device is also provided in this embodiment, which includes a processor and a memory, the memory is used to store a computer program (in this embodiment, the computer program includes a computing component and an iterative component, which can perform model calculation and model update), the computer program includes program instructions, and the processor is used to execute the program instructions stored in the computer storage medium. The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. It is the computing core and control core of the terminal, which is suitable for implementing one or more instructions, and is specifically suitable for loading and executing one or more instructions in a computer storage medium to implement a corresponding method flow or a corresponding function; the processor described in the embodiment of the present invention can be used for the operation of a trusted policy incremental delivery method.
[0056] This embodiment also provides a storage medium, specifically a computer-readable storage medium (Memory), which is a memory device in a computer device for storing programs and data. It is understandable that the computer-readable storage medium here can include both built-in storage media in a computer device and, of course, extended storage media supported by the computer device. The computer-readable storage medium provides a storage space, which stores the operating system of the terminal. In addition, one or more instructions suitable for being loaded and executed by a processor are also stored in the storage space, and these instructions can be one or more computer programs (including program codes). It should be noted that the computer-readable storage medium here can be a high-speed RAM memory or a non-volatile memory, such as at least one disk memory. The processor can load and execute one or more instructions stored in the computer-readable storage medium to implement the corresponding steps of a trusted policy incremental delivery method in the above embodiment.
[0057] This embodiment further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the corresponding steps of a method for incrementally issuing a trusted policy in the above embodiment are implemented.
[0058] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0059] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.
[0060] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.
[0061] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.
[0062] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.
Claims
1. A method for incrementally issuing a trusted policy, characterized in that: The following steps are involved: Obtain the issued trusted policy and the existing trusted policy of the device; After starting the comparison thread, the issued trusted policy and the existing trusted policy of the device are compared to obtain a comparison result, the existing trusted policy of the device is managed according to the comparison result, and the comparison result is classified to obtain a classification result; The issued trusted policy is reorganized according to the classification result to obtain an updated issued trusted policy. The DCS device starts multi-threading to obtain the updated issued trusted policy to complete the incremental issuance of the trusted policy.
2. A method for incrementally issuing a trusted policy according to claim 1, characterized in that: When obtaining the issued trusted policy and the existing trusted policy of the device, checking whether the issued trusted policy is legal, and if legal, starting a comparison thread to compare the issued trusted policy with the existing trusted policy of the device; If it is illegal, stop obtaining the issued trusted policy.
3. A method for incrementally issuing a trusted policy according to claim 1, characterized in that: The comparison result includes: the issued trusted policy is consistent with the existing trusted policy of the device, the issued trusted policy is more than the existing trusted policy of the device, and the issued trusted policy is less than the existing trusted policy of the device.
4. A method for incrementally issuing a trusted policy according to claim 3, characterized in that: The step of managing the existing trusted policy of the device according to the comparison result specifically includes: If the comparison result is that the issued trusted policy is consistent with the existing trusted policy of the device, the DCS device stops obtaining the issued trusted policy; If the comparison result shows that the number of trusted policies issued is greater than the number of trusted policies already in the device, reorganizing the trusted policies issued according to the classification result; If the comparison result is that the issued trusted policy is less than the existing trusted policy of the device, the part of the existing trusted policy of the device that is not included in the issued trusted policy is deleted.
5. A method for incrementally issuing a trusted policy according to claim 1, characterized in that: The updated trusted policies issued include: trusted startup policy, static trusted verification policy, dynamic trusted verification policy, trusted whitelist policy, process protection policy and application access control issuance policy.
6. A method for incrementally issuing a trusted policy according to claim 5, characterized in that: Each DCS device starts six threads, and each thread obtains a corresponding updated trusted policy.
7. A trusted policy incremental delivery system, characterized in that: include: A trusted policy acquisition module is used to acquire the trusted policies issued and the existing trusted policies of the device; A trusted policy comparison module is used to compare the issued trusted policy with the existing trusted policy of the device after starting a comparison thread to obtain a comparison result, manage the existing trusted policy of the device according to the comparison result, and classify the comparison result to obtain a classification result; The trusted policy issuing module is used to reorganize the issued trusted policy according to the classification result to obtain the updated issued trusted policy. The DCS device starts multi-threading to obtain the updated issued trusted policy to complete the incremental issuance of the trusted policy.
8. A computer device, characterized in that: The invention comprises a memory, a processor and a computer program stored in the memory and executable in the processor, wherein the processor implements the steps of a method for incrementally issuing a trusted policy as described in any one of claims 1 to 6 when executing the computer program.
9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method for incrementally issuing a trusted policy according to any one of claims 1 to 6 are implemented.
10. A computer program product, the computer product comprising a computer program, characterized in that: When the computer program is executed by a processor, the steps of a method for incrementally issuing a trusted policy as described in any one of claims 1 to 6 are implemented.