Method for acquiring sis data

Abstract

The invention discloses a sis data acquisition method. On-site production data is stable in operation, and a stable and efficient data acquisition and transmission system needs to be redeployed due to incomplete data coverage. The method comprises the following steps: deploying a dasserver data acquisition program on a data acquisition interface machine to complete acquisition of water station data; the data acquisition interface machine sends the data to the real-time database server through the one-way isolation device from the first area to the second area, and safe forwarding of the data from the field DCS system to the real-time database is completed; the real-time database server synchronously mirroring second-area real-time data to the third-area mirroring database server through the second-area to third-area one-way isolators, the third area is connected with an office network and is communicated with a company network through an operator special line, and production data is uploaded to a group center side through the Internet in an encryption mode. The method is used for acquisition of the sis data.

Description

Technical Field

[0001] The invention relates to a method for collecting SIS data. Background Art

[0002] The DCS system of the water plant (water intake, purification station, sludge water) has been completed. The system realizes the basic information, operation monitoring, status monitoring, data analysis and other functions on the site. The on-site production data runs stably. Due to the incomplete coverage of the data, it is necessary to redeploy a stable and efficient data acquisition and transmission system to connect the production data to the unified management platform of the plant-level monitoring information system (SIS system). Summary of the invention

[0003] The purpose of the present invention is to solve the above-mentioned problems and provide a method for sis data collection.

[0004] The above purpose is achieved through the following technical solutions: A method for sis data collection, the method comprising the following steps: (1) Deploy the dasserver data collection program on the data collection interface machine to complete the collection of water station data; (2) The data acquisition interface machine sends data to the real-time database server through the one-way isolation device from zone 1 to zone 2, completing the safe forwarding of data from the on-site DCS system to the real-time database; (3) The real-time database server synchronously mirrors the real-time data of Zone 2 to the mirror database server of Zone 3 through the one-way isolator from Zone 2 to Zone 3. Zone 3 is connected to the office network and communicates with the company network through the operator's dedicated line. The production data is uploaded to the group center side through the Internet in an encrypted manner.

[0005] The method for collecting sis data, the one-way isolator from zone one to zone two and the one-way isolator from zone two to zone three are one-way isolators configured with fixed physical addresses, IPs, and port restrictions to ensure one-way flow of data.

[0006] The described method for sis data collection, the described data collection interface machine uses dual network cards, configures communication IP, one is connected to the OPC communication station of the DCS system, and the other is connected to the one-way isolator from zone one to zone two.

[0007] The method for sis data collection is described, wherein the data collection interface machine is connected to the input LAN port of the one-way isolator from zone one to zone two, and the output LAN port of the one-way isolator from zone one to zone two is connected to the real-time database server in zone two. Beneficial Effects

[0008] 1. The present invention strictly distinguishes the security level of each data in the system and the user access rights, so as to achieve the safe management, query and transmission of various confidential information.

[0009] 2. In the present invention, data transmission from each branch to the group adopts a dedicated network, and the communication protocol adopts a private encrypted data communication protocol, which ensures transmission security in multiple dimensions.

[0010] 3. The present invention relies on China Mobile's transmission network resources to provide digital circuit leasing and maintenance services for production data transmission, and establishes a safe, reliable, high-speed dedicated data channel environment to carry and transmit data to the information center computer room. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Figure 1 It is the principle diagram of the present invention; Figure 2 This is a topological diagram of the present invention. DETAILED DESCRIPTION

[0012] A method for sis data collection, the method comprising the following steps: (1) Deploy the dasserver data collection program on the data collection interface machine to complete the collection of water station data; (2) The data acquisition interface machine sends data to the real-time database server through the one-way isolation device from zone 1 to zone 2, completing the safe forwarding of data from the on-site DCS system to the real-time database; (3) The real-time database server synchronously mirrors the real-time data of Zone 2 to the mirror database server of Zone 3 through the one-way isolator from Zone 2 to Zone 3. Zone 3 is connected to the office network and communicates with the company network through the operator's dedicated line. The production data is uploaded to the group center side through the Internet in an encrypted manner.

[0013] The one-way isolator from zone 1 to zone 2 and the one-way isolator from zone 2 to zone 3 are one-way isolators configured with fixed physical addresses, IPs, and port restrictions to ensure one-way flow of data.

[0014] 3. The data acquisition interface machine is connected to the OPC communication station of the DCS system through dual network cards and the communication IP is configured, and the other is connected to the one-way isolator from zone 1 to zone 2.

[0015] The data acquisition interface machine is connected to the input LAN port of the one-way isolator from zone 1 to zone 2, and the output LAN port of the one-way isolator from zone 1 to zone 2 is connected to the real-time database server in zone 2.

[0016] The entire network structure has two layers of network security isolation: One-way isolator Limitations of one-way isolators: Equipped with one-way isolators that have been configured with fixed physical addresses, IPs, and port restrictions to ensure one-way flow of data (that is, any data and signals can only be transmitted in one direction along the DSC, interface machine, isolator, and database server, preventing any reverse input of network signals or data).

[0017] The safety isolation device (forward) has the following functions: 1) Realize secure data exchange between two safety zones in a non-network manner and ensure that the two processing systems inside and outside the safety isolation device are not connected at the same time.

[0018] 2) The data of presentation layer and application layer are transmitted in completely one-way direction, that is, the TCP response from security zone III to security zone I / II is prohibited from carrying application data.

[0019] 3) Transparent working mode: virtual host IP address, hidden MAC address.

[0020] 4) Comprehensive message filtering and access control based on MAC, IP, transmission protocol, transmission port and communication direction.

[0021] 5) Support NAT.

[0022] 6) Prevent penetrating TCP connections: prohibit the establishment of direct TCP connections between two applications, and decompose the TCP connection between the internal and external applications into two TCP virtual connections from the internal and external applications to the two internal and external network cards of the isolation device respectively. The two internal and external network cards of the isolation device are non-network connections within the device, and only one-way data transmission is allowed.

[0023] Key points for device safety assurance The dedicated safety isolation device itself should have a high safety protection capability, and its safety requirements mainly include: 1) Using a microprocessor other than the INTEL instruction system (or compatible); 2) Secure and hardened operating system; 3) There are no security loopholes in design and implementation; 4) Defend against known network attacks other than DOS.

Claims

1. A method for sis data collection, characterized in that: The method comprises the following steps: (1) Deploy the dasserver data collection program on the data collection interface machine to complete the collection of water station data; (2) The data acquisition interface machine sends data to the real-time database server through the one-way isolation device from zone 1 to zone 2, completing the safe forwarding of data from the on-site DCS system to the real-time database; (3) The real-time database server synchronously mirrors the real-time data of Zone 2 to the mirror database server of Zone 3 through the one-way isolator from Zone 2 to Zone 3. Zone 3 is connected to the office network and communicates with the company network through the operator's dedicated line. The production data is uploaded to the group center side through the Internet in an encrypted manner.

2. The method for sis data collection according to claim 1, characterized in that: The one-way isolator from zone 1 to zone 2 and the one-way isolator from zone 2 to zone 3 are one-way isolators configured with fixed physical addresses, IPs, and port restrictions to ensure one-way flow of data.

3. The method for sis data collection according to claim 1, characterized in that: The data acquisition interface machine is connected to the OPC communication station of the DCS system through dual network cards and the communication IP is configured, and the other is connected to the one-way isolator from zone 1 to zone 2.

4. The method for sis data collection according to claim 1, characterized in that: The data acquisition interface machine is connected to the input LAN port of the one-way isolator from zone 1 to zone 2, and the output LAN port of the one-way isolator from zone 1 to zone 2 is connected to the real-time database server in zone 2.

Images