Method and system for automatically setting trusted security policy based on DCS (Distributed Control System)

Abstract

The invention provides a trusted security policy automatic setting method and system based on a DCS (Distributed Control System). The method comprises the following steps: S1, a trusted management platform sends a trusted security policy setting message containing a trusted security policy template file to a trusted proxy service module of the DCS; s2, grading the trusted security policy setting message by the trusted proxy service module to obtain trusted security policy template files in one-to-one correspondence with a plurality of different security service modules; s3, the trusted proxy service module analyzes each trusted security policy template file, and performs trusted security policy setting on the corresponding security service module in the DCS according to the analyzed information; and S4, the trusted proxy service module sends the information about whether the trusted security policy is set successfully to the trusted management platform. According to the invention, corresponding credible security policies can be automatically set for different security service modules, and normal operation of a DCS system with a credible security function is ensured.

Description

Technical Field

[0001] The present invention belongs to the field of distributed control systems (DCS), and in particular relates to a method and system for automatically setting a trusted security policy based on a DCS system. Background Art

[0002] Trusted DCS system refers to a highly secure and trustworthy distributed control system. It is widely used in production control in the power, chemical, metallurgical and other industries. It is a comprehensive automation system that centrally monitors, operates, manages and decentralized controls the production process. The software part of the DCS system with trusted security function is based on a real-time operating system that partially complies with the POSXI standard. Its characteristics inevitably lead to this software part containing a large number of executable files, dynamic library files, hardware driver files, databases and other different types of files. The trusted security function realizes the setting of corresponding trusted security policies for different files, and provides corresponding inherent security functions under the premise of ensuring the normal operation of the system. For example: prohibiting files from being tampered with, prohibiting the running of unauthorized binary files, preventing key processes from being exited, and preventing the modification of paragraphs during runtime.

[0003] Setting the correct trusted safety policy is crucial for DCS systems with trusted safety functions. If the wrong trusted safety policy is configured, the system may not be able to operate normally, or the trusted safety function may not be able to perform its corresponding functions. The setting of trusted safety policies currently relies entirely on manual operation, which is a very resource-intensive process. It not only increases labor costs, but also makes it easy for manual operation to cause errors or deviations in the setting of trusted safety policies due to personal factors, which poses a hidden danger to the safe operation of the DCS system. Summary of the invention

[0004] In order to solve the problems of the above-mentioned prior art, the present invention provides a method and system for automatically setting a trusted security policy based on a DCS system, which can automatically set corresponding trusted security policies for different security business modules to ensure the normal operation of a DCS system with trusted security functions. The automated setting of trusted security policies can greatly reduce manual operations and improve the efficiency and accuracy of trusted security policy setting.

[0005] The present invention is achieved through the following technical solutions: The present invention provides a method for automatically setting a trusted security policy based on a DCS system, comprising: S1, the trusted management platform sends a trusted security policy setting message containing a trusted security policy template file to the trusted agent service module of the DCS system; S2, the trusted proxy service module classifies the trusted security policy setting message to obtain a trusted security policy template file corresponding to a plurality of different security service modules; S3, the trusted proxy service module parses each trusted security policy template file respectively, calls the trusted basic function module, and sets a trusted security policy for the corresponding security business module in the DCS system according to the information obtained by parsing the trusted security policy template file; S4, the trusted proxy service module sends information on whether the trusted security policy is successfully set to the trusted management platform.

[0006] Preferably, in the method for automatically setting a trusted security policy based on a DCS system, S1 specifically includes: S11, the trusted management platform reads and parses the trusted security policy template library file corresponding to the DCS system for which the trusted security policy is to be set; S12, the trusted management platform encrypts the information obtained by parsing the trusted security policy template library file to form a trusted security policy setting message; S13, the trusted management platform sends the trusted security policy setting message to the trusted proxy service module.

[0007] Furthermore, in the DCS system-based trusted security policy automated setting method, S13 specifically comprises: the trusted management platform sends the trusted security policy setting message to the DCS system; and the DCS system forwards the received trusted security policy setting message to the trusted proxy service module.

[0008] Furthermore, in the method for automatically setting a trusted security policy based on a DCS system, in S12, the encryption method used is the national encryption sm3 algorithm.

[0009] Furthermore, in the method for automatically setting a trusted security policy based on a DCS system, S2 is specifically: the trusted proxy service module decrypts the trusted security policy setting message, and classifies the decrypted trusted security policy setting message according to the security business module to obtain a trusted security policy template file corresponding to multiple different security business modules.

[0010] Preferably, in the DCS system-based trusted security policy automated setting method, in S3, after the trusted security policy is set, the trusted basic function module returns information on whether the trusted security policy is set successfully to the trusted proxy service module.

[0011] Preferably, in the method for automatically setting a trusted security policy based on a DCS system, in S4, the trusted proxy service module sends information on whether the trusted security policy is successfully set to a trusted management platform through the DCS system.

[0012] The present invention also provides a trusted security policy automatic setting system based on a DCS system, comprising: A trusted management platform, used for sending a trusted security policy setting message including a trusted security policy template file to a trusted proxy service module of a DCS system; A trusted proxy service module is used to classify the trusted security policy setting message to obtain a trusted security policy template file corresponding to a plurality of different security business modules; parse each trusted security policy template file respectively, call the trusted basic function module, and perform trusted security policy setting for the corresponding security business module in the DCS system according to the information obtained by parsing the trusted security policy template file; and send information on whether the trusted security policy is successfully set to the trusted management platform; The trusted basic function module is used to set a trusted security policy for the corresponding security business module in the DCS system according to the information obtained by parsing the trusted security policy template file.

[0013] Preferably, the trusted management platform reads and parses the trusted security policy template library file corresponding to the DCS system for which the trusted security policy is to be set; encrypts the information obtained by parsing the trusted security policy template library file to form a trusted security policy setting message; and sends the trusted security policy setting message to the trusted proxy service module.

[0014] Preferably, the trusted basic function module is used to set a trusted security policy for the corresponding security business module in the DCS system according to the information obtained by parsing the trusted security policy template file, and after the trusted security policy is set, return information on whether the trusted security policy is set successfully to the trusted proxy service module.

[0015] Compared with the prior art, the present invention has the following beneficial effects: The present invention automatically sets a trusted security policy for a security business module of a DCS system through a trusted management platform and a trusted proxy service module, can automatically set corresponding trusted security policies on a large scale quickly and accurately, and receive a response generated by setting a trusted security policy in the DCS system in real time, thereby preventing erroneous trusted security policy settings and greatly improving the reliability, security and operability of the DCS system; and at the same time, it does not rely on manual operations, which will greatly reduce the use and management overhead of the DCS system and help system administrators better utilize trusted functions.

[0016] Furthermore, the information obtained by parsing the trusted security policy template library file is encrypted to form a trusted security policy setting message, which is then transmitted, thereby ensuring the security of the information and preventing it from being leaked or tampered with. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0018] Figure 1 The present invention is a flow chart of a method for automatically setting a trusted security policy based on a DCS system. DETAILED DESCRIPTION

[0019] The following describes the embodiments of the present invention through specific examples, and those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention.

[0020] It should be noted that the process equipment or devices not specifically specified in the following embodiments are all conventional equipment or devices in the art.

[0021] It should be noted that the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices. Moreover, unless otherwise specified, the numbering of each method step is only a convenient tool for identifying each method step, and is not intended to limit the order of arrangement of each method step or to define the scope of the present invention. Changes or adjustments in their relative relationships should also be regarded as the scope of the present invention without substantially changing the technical content.

[0022] See also Figure 1 The method for automatically setting a trusted security policy based on a DCS system of the present invention comprises: S1, the trusted management platform sends a trusted security policy setting message containing a trusted security policy template file to the trusted agent service module of the DCS system; S2, the trusted proxy service module classifies the trusted security policy setting message to obtain a trusted security policy template file corresponding to a plurality of different security service modules; S3, the trusted proxy service module parses each trusted security policy template file respectively, calls the trusted basic function module, and sets a trusted security policy for the corresponding security business module in the DCS system according to the information obtained by parsing the trusted security policy template file; S4, the trusted proxy service module sends information on whether the trusted security policy is successfully set to the trusted management platform.

[0023] As a preferred embodiment of the present invention, S1 specifically includes: S11, the trusted management platform reads and parses the trusted security policy template library file corresponding to the DCS system for which the trusted security policy is to be set; S12, the trusted management platform encrypts the information obtained by parsing the trusted security policy template library file to form a trusted security policy setting message; S13, the trusted management platform sends the trusted security policy setting message to the trusted proxy service module.

[0024] In a preferred embodiment of the present invention, the trusted management platform sends the trusted security policy setting message to the trusted proxy service module through the DCS system. That is, the trusted management platform sends the trusted security policy setting message to the DCS system; the DCS system forwards the received trusted security policy setting message to the trusted proxy service module.

[0025] The present invention automatically sets a trusted security policy for a security business module of a DCS system through a trusted management platform and a trusted proxy service module, can automatically set corresponding trusted security policies on a large scale quickly and accurately, and receive a response generated by setting a trusted security policy in the DCS system in real time, thereby preventing erroneous trusted security policy settings and greatly improving the reliability, security and operability of the DCS system; and at the same time, it does not rely on manual operations, which will greatly reduce the use and management overhead of the DCS system and help system administrators better utilize trusted functions.

[0026] The present invention provides a trusted security policy automatic setting system based on a DCS system, comprising: A trusted management platform, used for sending a trusted security policy setting message including a trusted security policy template file to a trusted proxy service module of a DCS system; A trusted proxy service module is used to classify the trusted security policy setting message to obtain a trusted security policy template file corresponding to a plurality of different security business modules; parse each trusted security policy template file respectively, call the trusted basic function module, and perform trusted security policy setting for the corresponding security business module in the DCS system according to the information obtained by parsing the trusted security policy template file; and send information on whether the trusted security policy is successfully set to the trusted management platform; The trusted basic function module is used to set a trusted security policy for the corresponding security business module in the DCS system according to the information obtained by parsing the trusted security policy template file.

[0027] The trusted management platform of the present invention is a system that integrates multiple security and management functions, and improves the overall performance and security of the system by centrally monitoring, configuring, managing and optimizing the DCS system. The trusted management platform usually includes hardware and software, and can realize comprehensive monitoring and management of the DCS system.

[0028] The trusted proxy service module of the present invention is an important component responsible for data communication, information processing and security management in the DCS system. The trusted proxy service module ensures the overall performance and security of the DCS system by providing reliable data transmission, efficient information processing and strict security control.

[0029] Example 1 The present invention is based on the DCS system trusted security policy automatic setting method, the steps include: (1) The trusted management platform reads and parses the trusted security policy template library file corresponding to the DCS system for which the trusted security policy is to be set.

[0030] The trusted security policy template library file includes multiple different trusted security policy template files, which correspond to multiple different business security modules, and the trusted security policy template files correspond to the business security modules one by one. The trusted security policy template library file is pre-stored in the trusted management platform.

[0031] The multiple different business security modules include different types of files such as executable files, dynamic library files, hardware driver files, and databases in the DCS system.

[0032] An executable file is a file that can be loaded and executed by the operating system. It is a binary form of a computer program that is used to contain and execute computer instructions.

[0033] Dynamic library files are also commonly called link library files. They are executable files that are loaded into memory when a program is running. They contain code and data that can be used by multiple programs at the same time. Dynamic libraries allow multiple programs to share the same code, saving storage space. When a dynamic library is updated, only the library file needs to be replaced, without recompiling or linking the programs that use these libraries.

[0034] Hardware driver files, also known as drivers for short, are small pieces of code added to the operating system that contain information about hardware devices. These files are configuration files written by hardware manufacturers based on the operating system. They play a vital role and can be figuratively understood as a bridge between hardware devices and the operating system, which is used to enable the operating system to correctly identify, manage, and use the corresponding hardware devices.

[0035] A database refers to programs and files used to organize, store, and manage data. The database stores data that users or systems need to save and provides a quick data operation interface.

[0036] (2) The trusted management platform encrypts the information obtained after parsing the trusted security policy template library file, using the national encryption sm3 algorithm to form a trusted security policy setting message and send it to the DCS system. The trusted security policy setting message includes: message header, message unique number, message signature, and encrypted message content.

[0037] The present invention can effectively utilize the data transmission channel of the original DCS system, use standard Ethernet, and send and receive encrypted and signed trusted security policy setting messages through the UDP protocol. This method is also used for the DCS system to communicate other conventional business messages without adding additional overhead.

[0038] (3) The DCS system forwards the received trusted security policy setting message to the trusted proxy service module.

[0039] (4) The trusted proxy service module decrypts the trusted security policy setting message, and classifies the decrypted trusted security policy setting message according to the security business module and the corresponding real-time requirements, to obtain trusted security policy template files corresponding to multiple different security business modules, and parses each trusted security policy template file separately.

[0040] (5) The trusted proxy service module calls the trusted basic function module, sets the trusted security policy for the corresponding security business module according to the information obtained after parsing the trusted security policy template file, and waits for the return information of whether the trusted security policy of the trusted basic function module is set successfully.

[0041] (6) The trusted proxy service module parses and packages the return information on whether the trusted security policy is successfully set from the trusted basic function module and sends it to the trusted management platform through a communication link.

[0042] Example 2 This embodiment provides a trusted security policy automatic setting system based on a DCS system, including: The trusted management platform reads and parses the trusted security policy template library file corresponding to the DCS system for which the trusted security policy is to be set; encrypts the information obtained by parsing the trusted security policy template library file to form a trusted security policy setting message; and sends the trusted security policy setting message to the trusted proxy service module.

[0043] The trusted proxy service module is used to classify the trusted security policy setting messages to obtain trusted security policy template files corresponding to multiple different security business modules; parse each trusted security policy template file separately, call the trusted basic function module, and set the trusted security policy for the corresponding security business module in the DCS system according to the information obtained by parsing the trusted security policy template file; and send information on whether the trusted security policy is set successfully to the trusted management platform.

[0044] The trusted basic function module is used to set the trusted security policy for the corresponding security business module in the DCS system according to the information obtained by parsing the trusted security policy template file. After the trusted security policy is set, the information on whether the trusted security policy is set successfully is returned to the trusted proxy service module.

[0045] The present invention performs automatic setting of trusted security policies on a trusted DCS system through a trusted management platform and a trusted proxy service module. The trusted proxy service module timely and accurately completes the setting of the trusted security policies of the corresponding business security modules and notifies the trusted management platform of the setting results through the DCS system. The trusted proxy service module will decrypt the trusted security policy setting message in real time, parse the special message containing the trusted security policy template from the trusted management platform, divide different business security modules, call the trusted basic function module to accurately set the corresponding trusted security policies for the business security modules according to the trusted security policy template in the trusted security policy setting message, and parse the information of whether the trusted security policies of the business security modules returned by the trusted basic function module are successfully set, repackage and send to the trusted management platform through the DCS system for display and management. Through this method, the corresponding trusted security policies can be automatically set on a large scale safely, quickly and accurately, and the response generated by the setting policies in the DCS system can be received in real time, so as to prevent wrong policy settings, greatly improve the reliability and security of the DCS system, and greatly reduce the use and management overhead of the DCS system, so as to help system administrators better utilize the trusted functions.

[0046] The embodiments of the present disclosure have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The selection of terms used herein is intended to best explain the principles of the embodiments, practical applications, or technical improvements to the technology in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A method for automatically setting a trusted security policy based on a DCS system, characterized in that: include: S1, the trusted management platform sends a trusted security policy setting message containing a trusted security policy template file to the trusted agent service module of the DCS system; S2, the trusted proxy service module classifies the trusted security policy setting message to obtain a trusted security policy template file corresponding to a plurality of different security service modules; S3, the trusted proxy service module parses each trusted security policy template file respectively, calls the trusted basic function module, and sets a trusted security policy for the corresponding security business module in the DCS system according to the information obtained by parsing the trusted security policy template file; S4, the trusted proxy service module sends information on whether the trusted security policy is successfully set to the trusted management platform.

2. The method for automatically setting a trusted security policy based on a DCS system according to claim 1, characterized in that: S1 specifically includes: S11, the trusted management platform reads and parses the trusted security policy template library file corresponding to the DCS system for which the trusted security policy is to be set; S12, the trusted management platform encrypts the information obtained by parsing the trusted security policy template library file to form a trusted security policy setting message; S13, the trusted management platform sends the trusted security policy setting message to the trusted proxy service module.

3. The method for automatically setting a trusted security policy based on a DCS system according to claim 2, characterized in that: S13 specifically includes: the trusted management platform sends the trusted security policy setting message to the DCS system; the DCS system forwards the received trusted security policy setting message to the trusted proxy service module.

4. The method for automatically setting a trusted security policy based on a DCS system according to claim 2, characterized in that: In S12, the encryption method used is the national encryption sm3 algorithm.

5. The method for automatically setting a trusted security policy based on a DCS system according to claim 2, characterized in that: S2 is specifically: the trusted proxy service module decrypts the trusted security policy setting message, and classifies the decrypted trusted security policy setting message according to the security business module to obtain a trusted security policy template file corresponding to multiple different security business modules.

6. The method for automatically setting a trusted security policy based on a DCS system according to claim 1, characterized in that: In S3, after the trusted security policy is set, the trusted basic function module returns information on whether the trusted security policy is set successfully to the trusted proxy service module.

7. The method for automatically setting a trusted security policy based on a DCS system according to claim 1, characterized in that: In S4, the trusted proxy service module sends information on whether the trusted security policy is successfully set to the trusted management platform through the DCS system.

8. A trusted security policy automation setting system based on a DCS system, characterized in that: include: A trusted management platform, used for sending a trusted security policy setting message including a trusted security policy template file to a trusted proxy service module of a DCS system; A trusted proxy service module, used to classify the trusted security policy setting message to obtain a trusted security policy template file corresponding to a plurality of different security service modules; Parse each trusted security policy template file separately, call the trusted basic function module, and set the trusted security policy for the corresponding security business module in the DCS system according to the information obtained by parsing the trusted security policy template file; Sending information on whether the trusted security policy is successfully set to the trusted management platform; The trusted basic function module is used to set a trusted security policy for the corresponding security business module in the DCS system according to the information obtained by parsing the trusted security policy template file.

9. The DCS system-based trusted security policy automation setting system according to claim 8, characterized in that: The trusted management platform reads and parses the trusted security policy template library file corresponding to the DCS system for which the trusted security policy is to be set; encrypts the information obtained by parsing the trusted security policy template library file to form a trusted security policy setting message; and sends the trusted security policy setting message to the trusted proxy service module.

10. The DCS system-based trusted security policy automation setting system according to claim 8, characterized in that: The trusted basic function module is used to set a trusted security policy for the corresponding security business module in the DCS system according to the information obtained by parsing the trusted security policy template file. After the trusted security policy is set, the trusted proxy service module returns information on whether the trusted security policy is set successfully.

Images