PLC network control safety management method in industrial internet

Abstract

The invention relates to the technical field of data processing, in particular to a PLC network control safety management method in the industrial internet. The method comprises the following steps: acquiring industrial internet PLC field industrial equipment information and corresponding production data, and acquiring data output of each industrial equipment; dividing production data in the data output into high-sensitivity data and conventional data according to sensitivity requirements; acquiring an edge device corresponding to each industrial device according to the industrial device information, and distributing production data to the edge devices for processing according to the sensitivity requirement and the data output quantity; acquiring processing tasks of the edge devices, and allocating the processing tasks of each edge device to determine load balance of the edge devices; and performing risk assessment on the edge device, and customizing a security policy of the edge device according to a risk assessment result and the traffic of the edge device.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a PLC network control security management method in industrial Internet. Background Art

[0002] With the rapid development of the Industrial Internet, more and more industrial equipment, sensors and systems are connected to the Internet, which poses a threat to the security of industrial control field PLCs. As a large number of industrial field equipment and sensors are involved, data is usually generated in the form of real-time streams and needs to be analyzed and processed in real time, which requires the PLC system in the Industrial Internet to have powerful real-time data processing capabilities;

[0003] In the existing technology, edge computing is usually used to improve the processing power of industrial gateways. Edge computing can process and analyze data near the equipment to reduce data transmission delays; this method can help monitor equipment status in real time, optimize production processes, and make real-time decisions. However, due to the inconsistent protocol standards for edge computing and data processed by industrial PLCs and gateways, the communication effect is poor, which makes the security protection of edge computing have many loopholes; therefore, how to improve the adaptability and security of industrial PLCs and on-site production data computing and processing is a technical problem that needs to be solved. Summary of the invention

[0004] In order to solve the problems existing in the prior art, the present invention provides a PLC network control security management method in the industrial Internet.

[0005] The present invention adopts the following technical solution, a PLC network control security management method in the industrial Internet, comprising:

[0006] Obtain industrial Internet PLC on-site industrial equipment information and corresponding production data, and obtain the data output of each industrial equipment;

[0007] Obtaining sensitivity requirements for each piece of production data, and dividing the production data in the data output into highly sensitive data and regular data according to the sensitivity requirements;

[0008] Acquire an edge device corresponding to each industrial device according to the industrial device information, and assign production data to the edge device for processing according to the sensitivity requirement and the data output;

[0009] Obtain processing tasks of edge devices and allocate processing tasks to each edge device to determine the load balance of edge devices;

[0010] Perform risk assessment on edge devices based on their load balancing, and customize security policies for edge devices based on risk assessment results and edge device traffic.

[0011] Furthermore, the production data is allocated to the edge device for processing according to the sensitivity requirement and the data output, specifically:

[0012] Respectively obtain the proportion of high-sensitivity data and the proportion of conventional data in the data output;

[0013] Compare the proportion of high-sensitivity data with the proportion of regular data, and assign the data with a larger proportion to edge devices for processing.

[0014] Furthermore, comparing the proportion of high-sensitivity data with the proportion of regular data also includes: allocating data with a smaller proportion to the cloud for processing.

[0015] Furthermore, the processing tasks of the edge devices are obtained and the processing tasks of the edge devices are allocated, including:

[0016] Treat all edge devices’ processing data requests as their processing tasks;

[0017] Calculate the processing capability level of each edge device and allocate processing tasks based on the processing capability level of each edge device.

[0018] Furthermore, after calculating the processing capability level of each edge device and allocating processing tasks according to the processing capability level of each edge device, the following is also included:

[0019] Get the number of low-latency data in the processing tasks assigned to each edge device;

[0020] Determine whether the edge device exceeds its processing capacity based on the proportion of low-latency data in the processing tasks assigned to each edge device;

[0021] When the edge device exceeds the processing capacity, the latency level of each low-latency data in the to-be-processed task assigned to the edge device is obtained;

[0022] Low-latency data with a latency level higher than a first latency level threshold is allocated to the cloud for processing; low-latency data with a latency level lower than the first latency level is allocated to the edge device for processing.

[0023] Furthermore, when the edge device exceeds the processing capacity, it also includes:

[0024] Obtain the latency level of each high-latency data in the pending tasks assigned to the edge device;

[0025] Allocate high-latency data with a latency level higher than a second latency level threshold to the cloud for processing;

[0026] High-latency data with a latency level lower than a second latency level threshold and all low-latency data are allocated to the edge device for processing.

[0027] Furthermore, the method for obtaining the latency level of each low latency data in the task to be processed assigned to the edge device is:

[0028]

[0029] Among them, L is the latency level of low-latency data, α1 is the weight corresponding to the data generation frequency, Q1 is the data generation frequency, α2 is the weight corresponding to the impact of data on industrial equipment, Q2 is the impact of data on industrial equipment, α3 is the weight corresponding to the security level of data, Q3 is the security level of data, α4 is the weight corresponding to the latency requirement of data application scenarios, Q4 is the latency requirement of data application scenarios, exp represents the exponential function, Q5 is the current network delay, Q 50 is the network delay threshold corresponding to the data, k1 is the first constant, k2 is the second constant, and [] is the rounding symbol.

[0030] Furthermore, after allocating the tasks to be processed to each edge device, it also includes:

[0031] Obtain the hash value of each task to be processed in the edge device, and obtain the hash value of the processed task in the edge device; when the hash value of the task to be processed in the edge device is the same as the hash value of the processed task, the result of the processed task is used as the processing result of the task to be processed.

[0032] The beneficial effects of the present invention are as follows: the present invention first determines the edge devices corresponding to the respective industrial equipment through the industrial equipment information related to the Industrial Internet, so as to facilitate the subsequent convenient and quick acquisition of the data output of the industrial equipment; divides the high-sensitivity data and the conventional data according to the delay requirements of each data, so as to divide the data processing methods into the edge devices and the cloud respectively, thereby improving the accuracy and adaptability of edge computing, and then formulates and implements the security strategy of the edge device according to the risk assessment results of the edge device and the edge device load, selects the security protection strategy corresponding to the edge device situation to protect the edge computing, and improves the security protection performance of the edge computing. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0034] Figure 1 The present invention is a flowchart of a method for PLC network control security management in the industrial Internet according to an embodiment of the present invention. DETAILED DESCRIPTION

[0035] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0036] In the production site, sensors and other equipment may generate a large amount of data in real time. These data need to be processed in time to grasp the production status in time. Some data have a greater impact on the production process. For example, the working status of a certain equipment. If these data are delayed in processing, it may affect the operation of the entire production process. Therefore, these data need to be processed in time. Or when a certain equipment has an abnormality, if it is not processed in time, it may cause a safety accident. In this case, the data needs to be processed in time.

[0037] A flow chart of a PLC network control security management method in an industrial Internet according to an embodiment of the present invention is as follows: Figure 1 As shown, including:

[0038] Obtain industrial Internet PLC on-site industrial equipment information and corresponding production data, and obtain the data output of each industrial equipment;

[0039] Obtaining sensitivity requirements for each piece of production data, and dividing the production data in the data output into highly sensitive data and regular data according to the sensitivity requirements;

[0040] The judgment of data sensitivity requirements is mainly based on the process data of the PLC control object, and is defined and classified from multiple dimensions. The embodiment of the present invention classifies and grades data according to the sensitivity, value and importance of the data, so as to provide corresponding security protection measures for data of different levels. The specific division method can be set according to the actual situation. Other data that is regarded as ordinary information in a certain field may be crucial sensitive information in another field. Therefore, the process of determining data sensitivity is a dynamic and multi-dimensional evaluation process, which is usually determined by the PLC controller based on the process and time of the control object. For example, product process information and information related to financial statements are usually defined as sensitive information by law. These data require special attention and protection measures when processing to prevent leakage and abuse. It is further necessary to consider the context of the data. The same data may have different sensitivities in different contexts.

[0041] Acquire an edge device corresponding to each industrial device according to the industrial device information, and assign production data to the edge device for processing according to the sensitivity requirement and the data output;

[0042] In the production process, allocating production data to edge devices for processing is an effective resource optimization and task scheduling strategy, which aims to improve computing efficiency, reduce network latency, and enhance the scalability and reliability of the system. Since the computing power of edge devices varies, the amount of production data that each edge device can process depends on its hardware performance and current load. Usually, the allocation ratio will be dynamically adjusted according to the performance of the device and the urgency of the task to ensure efficient and balanced data processing, including:

[0043] Demand-based dynamic allocation: Dynamically allocate production data to edge devices based on the needs of computing tasks. This approach requires real-time monitoring of the computing and storage resources of the devices to achieve optimal resource utilization.

[0044] Allocation based on device performance: According to the performance parameters of the edge device (such as CPU, memory, and storage capacity), the amount of data suitable for its processing is reasonably allocated. High-performance edge devices can handle more or more complex data tasks.

[0045] Predictive allocation based on historical data: By analyzing historical data and building a predictive model, future computing needs can be predicted and resources can be pre-allocated accordingly. This method can adjust the resource status of edge devices in advance to cope with upcoming production data processing needs.

[0046] The amount of production data that each edge device can process is limited by the following factors:

[0047] Limited by device performance: The processing power of edge devices is limited by their hardware configuration. For example, an edge device with a high-performance CPU and large memory can process multiple data streams simultaneously, while a device with lower hardware configuration may only be able to process a small amount of data or a single task.

[0048] Affected by the current load: If an edge device is already processing other tasks, its available resources will be reduced accordingly, so the amount of production data that can be allocated to it will also be reduced. The system needs to monitor the load of the device in real time and make dynamic adjustments.

[0049] Limited by communication bandwidth: The communication bandwidth between edge devices and main servers or data centers will also affect their data processing capabilities. In the case of limited bandwidth, too much data may cause transmission delays, thus affecting the overall processing efficiency.

[0050] Obtain processing tasks of edge devices and allocate processing tasks to each edge device to determine the load balance of edge devices;

[0051] In the embodiment of the present invention, the processing data requests of all edge devices are taken as their processing tasks; further, the processing capability level of each edge device is calculated, so as to allocate the processing tasks according to the processing capability level of each edge device; after the allocation is completed, the processing tasks of each edge device are adjusted by monitoring the load of each edge device, and the adjustment content includes:

[0052] Obtain the amount of low-latency data in the processing tasks assigned to each edge device; determine whether the edge device exceeds the processing capacity based on the proportion of low-latency data in the processing tasks assigned to each edge device;

[0053] When the edge device exceeds the processing capacity, the latency level of each low-latency data in the task to be processed assigned to the edge device is obtained; the low-latency data with a latency level higher than the first latency level threshold is allocated to the cloud for processing; the low-latency data with a latency level lower than the first latency level is allocated to the edge device for processing.

[0054] When the edge device exceeds the processing capacity, it also includes: obtaining the latency level of each high-latency data in the task to be processed assigned to the edge device; allocating the high-latency data with a latency level higher than the second latency level threshold to the cloud for processing; allocating the high-latency data with a latency level lower than the second latency level threshold and all low-latency data to the edge device for processing.

[0055] The method for obtaining the latency level of each low-latency data in the pending task assigned to the edge device is:

[0056]

[0057] Among them, L is the latency level of low-latency data, α1 is the weight corresponding to the data generation frequency, Q1 is the data generation frequency, α2 is the weight corresponding to the impact of data on industrial equipment, Q2 is the impact of data on industrial equipment, α3 is the weight corresponding to the security level of data, Q3 is the security level of data, α4 is the weight corresponding to the latency requirement of data application scenarios, Q4 is the latency requirement of data application scenarios, exp represents the exponential function, Q5 is the current network delay, Q 50 is the network delay threshold corresponding to the data, k1 is the first constant, k2 is the second constant, and [] is the rounding symbol.

[0058] In the embodiment of the present invention, processing a data request generally involves the following steps:

[0059] Receiving data requests: First, you need to receive data requests from the client. This can be achieved through HTTP requests, WebSocket connections, or other communication protocols.

[0060] Parsing the request: After receiving the request, the content of the request needs to be parsed to determine the operation the client wants to perform and the data required. This includes extracting request parameters, path information, query strings, etc.

[0061] Processing requests: Performing corresponding operations based on the parsed request content to process requests, including accessing databases, calling other APIs, performing calculations, etc.

[0062] Generate response: When the request is processed and the result is obtained, it needs to be converted into an appropriate format (such as JSON, XML, etc.) and sent back to the client as a response.

[0063] Error handling: Possible errors need to be handled throughout the process, such as invalid requests, internal server errors, etc. These errors should be logged and reported appropriately, and appropriate error messages should be returned to the client.

[0064] Conduct risk assessment on edge devices and customize security policies for edge devices based on risk assessment results and edge device traffic.

[0065] Edge device traffic refers to the amount of data that passes through an edge device over a period of time. This includes packets uploaded and downloaded, as well as the amount of information transmitted between edge devices.

[0066] Edge device load: refers to the amount of traffic from industrial sites, mainly PLCs, that edge devices need to handle in a specific period of time. These tasks may include data analysis, storage operations, or running applications.

[0067] The embodiment of the present invention determines the asset information on the edge device and identifies the risk of external attack to evaluate the vulnerability of the edge device itself, and performs risk assessment on the edge device based on the asset information, the risk of external attack and its own vulnerability.

[0068] In a specific embodiment of the present invention, the safety interlock function is to monitor multiple sensor signals through PLC, and automatically lock the workflow when certain conditions do not meet safety requirements to prevent dangerous operations from occurring. This function is particularly important in occasions such as mechanical protective doors. This application implements a safety interlock strategy through PLC. When the operator opens the protective door for cleaning or maintenance, the PLC will automatically cut off the power supply of the equipment to ensure the safety of the operator; in addition, if the pressure in the equipment cavity is detected to be too high, the PLC will also shut down immediately to prevent equipment damage caused by excessive pressure.

[0069] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A PLC network control security management method in the industrial Internet, characterized in that: include: Obtain industrial Internet PLC on-site industrial equipment information and corresponding production data, and obtain the data output of each industrial equipment; Obtaining sensitivity requirements for each piece of production data, and dividing the production data in the data output into highly sensitive data and regular data according to the sensitivity requirements; Acquire an edge device corresponding to each industrial device according to the industrial device information, and assign production data to the edge device for processing according to the sensitivity requirement and the data output; Obtain processing tasks of edge devices and allocate processing tasks to each edge device to determine the load balance of edge devices; Perform risk assessment on edge devices based on their load balancing, and customize security policies for edge devices based on risk assessment results and edge device traffic.

2. According to a PLC network control security management method in industrial Internet according to claim 1, it is characterized by: The production data is allocated to the edge device for processing according to the sensitivity requirements and the data output, specifically: Respectively obtain the proportion of high-sensitivity data and the proportion of conventional data in the data output; Compare the proportion of high-sensitivity data with the proportion of regular data, and assign the data with a larger proportion to edge devices for processing.

3. According to a PLC network control security management method in industrial Internet according to claim 2, it is characterized by: Compare the proportion of high-sensitivity data with the proportion of regular data, and also include: allocating data with a smaller proportion to the cloud for processing.

4. According to a PLC network control security management method in industrial Internet according to claim 1, it is characterized by: Obtain processing tasks of edge devices and assign processing tasks to edge devices, including: Treat all edge devices’ processing data requests as their processing tasks; Calculate the processing capability level of each edge device and allocate processing tasks based on the processing capability level of each edge device.

5. According to a PLC network control safety management method in industrial Internet according to claim 4, it is characterized in that: After calculating the processing capability level of each edge device and allocating processing tasks according to the processing capability level of each edge device, it also includes: Get the number of low-latency data in the processing tasks assigned to each edge device; Determine whether the edge device exceeds its processing capacity based on the proportion of low-latency data in the processing tasks assigned to each edge device; When the edge device exceeds the processing capacity, the latency level of each low-latency data in the task to be processed assigned to the edge device is obtained; Low-latency data with a latency level higher than a first latency level threshold is allocated to the cloud for processing; low-latency data with a latency level lower than the first latency level is allocated to the edge device for processing.

6. According to a PLC network control safety management method in industrial Internet according to claim 5, it is characterized in that: When edge devices exceed processing capacity, this also includes: Obtain the latency level of each high-latency data in the pending tasks assigned to the edge device; Allocate high-latency data with a latency level higher than a second latency level threshold to the cloud for processing; High-latency data with a latency level lower than a second latency level threshold and all low-latency data are allocated to the edge device for processing.

7. The PLC network control safety management method in the industrial Internet according to claim 5 is characterized in that: The method for obtaining the latency level of each low-latency data in the pending task assigned to the edge device is: Among them, L is the latency level of low-latency data, α1 is the weight corresponding to the data generation frequency, Q1 is the data generation frequency, α2 is the weight corresponding to the impact of data on industrial equipment, Q2 is the impact of data on industrial equipment, α3 is the weight corresponding to the security level of data, Q3 is the security level of data, α4 is the weight corresponding to the latency requirement of data application scenarios, Q4 is the latency requirement of data application scenarios, exp represents the exponential function, Q5 is the current network delay, Q 50 is the network delay threshold corresponding to the data, k1 is the first constant, k2 is the second constant, and [] is the rounding symbol.

8. The PLC network control security management method in the industrial Internet according to claim 1 is characterized by: After allocating the tasks to be processed to each edge device, it also includes: Obtain the hash value of each task to be processed in the edge device, and obtain the hash value of the processed task in the edge device; when the hash value of the task to be processed in the edge device is the same as the hash value of the processed task, the result of the processed task is used as the processing result of the task to be processed.

Images