Industrial control programming platform data security access control method, system, equipment and medium

Abstract

The invention provides an industrial control programming platform data security access control method, system and device and a medium, and relates to the technical field of data security. The method comprises the steps that a user registers an account in a self-service mode and selects a role; monitoring an access behavior of a user on the industrial control programming platform; if the user operates the access behavior, the important log information is sent to a fine-grained management and control server through an http interface; determining whether the fine-grained control strategy needs to be executed or not; determining a fine-grained management and control strategy needing to be executed; determining whether permission reduction is needed; if the permission is required to be reduced, returning a return result of the permission reduction to the industrial control programming platform through the http interface; when the industrial control programming platform receives a return result of permission reduction and the user operates the access behavior again, the user is reminded of no permission operation; determining alarm information; and the safety management platform displays all alarm information related to the industrial control programming platform. According to the invention, user authority control and behavior control can be realized, and the security is improved.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a data security access management and control method, system, device and medium for an industrial control programming platform. Background Art

[0002] Among the current related technologies, although multi-dimensional and fine-grained security protection of industrial control programming platform data can be achieved in complex scenarios, their behaviors are not controlled before the HMI offline configuration provides report configuration and the AT provides online and download functions, making it difficult to achieve user authority control and behavior control, resulting in security risks introduced by cross-domain user access to the industrial control system.

[0003] The information disclosed in the background technology section of this application is only intended to deepen the understanding of the general background technology of this application, and should not be regarded as an admission or any form of suggestion that the information constitutes the prior art already known to those skilled in the art. Summary of the invention

[0004] The present invention provides a method, system, device and medium for data security access control of an industrial control programming platform, which can solve the technical problem that related technologies are difficult to achieve user authority control and behavior control.

[0005] According to a first aspect of the present invention, a method for data security access control of an industrial control programming platform is provided, comprising:

[0006] Users register their accounts by themselves and select one of three roles during the registration process: administrator, engineer or monitor, where different roles have different permissions;

[0007] On the industrial control programming platform, monitoring the user's access behavior, wherein the access behavior includes the HMI offline configuration providing report configuration, and the AT providing online and downloading functions;

[0008] If the user operates the access behavior, the important log information is sent to the fine-grained control server through the http interface, wherein the important log information includes the user name, role, access behavior name, MAC address, IP address and timestamp, and the fine-grained control policy is configured on the fine-grained control server;

[0009] Determine whether the fine-grained control strategy needs to be executed based on the important log information; if the fine-grained control strategy needs to be executed, determine the fine-grained control strategy that needs to be executed based on the important log information;

[0010] Determine whether to downgrade permissions based on the fine-grained control strategy that needs to be executed;

[0011] If the authority needs to be downgraded, the result of the authority downgrade will be returned to the industrial control programming platform through the http interface;

[0012] When the industrial control programming platform receives the return result of the permission reduction, when the user performs the access behavior again, it prompts the user that the operation is not authorized;

[0013] Determine alarm information according to the fine-grained control strategy;

[0014] The alarm information is sent to the security management platform through the fine-grained control server, and the security management platform displays all alarm information related to the industrial control programming platform.

[0015] According to a second aspect of the present invention, there is provided an industrial control programming platform data security access management and control system, comprising:

[0016] The role module is used for users to self-register accounts and select one of three roles during the registration process: administrator, engineer or monitor, where different roles have different permissions;

[0017] An access behavior module is used to monitor the user's access behavior on the industrial control programming platform, wherein the access behavior includes the behavior of providing report configuration for HMI offline configuration and providing online and download functions for AT;

[0018] An important log information module is used to send important log information to a fine-grained control server through an http interface if the user operates the access behavior, wherein the important log information includes user name, role, access behavior name, MAC address, IP address and timestamp, and the fine-grained control policy is configured on the fine-grained control server;

[0019] A judgment execution module, used to determine whether the fine-grained control strategy needs to be executed according to the important log information;

[0020] Determine an execution module, used to determine the fine-grained control strategy to be executed according to the important log information if the fine-grained control strategy needs to be executed;

[0021] A module for determining whether to reduce permissions is used to determine whether permissions need to be reduced according to the fine-grained control strategy that needs to be executed;

[0022] The return module is used to return the result of the permission reduction to the industrial control programming platform through the http interface if permission reduction is required;

[0023] An unauthorized operation module, used for prompting the user that the user has no authority to operate when the industrial control programming platform receives the return result of the authority reduction and the user operates the access behavior again;

[0024] An alarm information module, used to determine alarm information according to the fine-grained control strategy;

[0025] The security management platform module is used to send the alarm information to the security management platform through the fine-grained control server, and the security management platform displays all alarm information related to the industrial control programming platform.

[0026] According to a third aspect of the present invention, there is provided an industrial control programming platform data security access management device, comprising: a processor; a memory for storing processor executable instructions; wherein the processor is configured to call the instructions stored in the memory to execute the industrial control programming platform data security access management method.

[0027] According to a fourth aspect of the present invention, there is provided a computer-readable storage medium having computer program instructions stored thereon, wherein the computer program instructions, when executed by a processor, implement the industrial control programming platform data security access management and control method.

[0028] Technical effect: According to the present invention, through user self-registration and role selection, different users can only perform operations consistent with their roles, thereby realizing user authority management and control, improving security and management flexibility. Real-time monitoring of user access behavior and recording of important log information are helpful for auditing and analyzing user access behavior, and abnormal behavior can be discovered in time. The implementation of fine-grained control strategies can realize behavior management. Dynamic adjustment of user permissions can effectively reduce potential security risks. By sending alarm information to the security management platform, relevant staff can be notified in time and subsequent processing can be carried out, so that security incidents can be effectively tracked and managed. When determining whether the fine-grained control strategy needs to be executed, it can be determined whether the fine-grained control strategy needs to be executed according to four conditions. According to the operation time, operation frequency, operation computer and role, the monitoring standards of user operation access behavior are refined, and potential security risks can be discovered in time, improving management efficiency. When determining the fine-grained control strategy that needs to be executed, different fine-grained control strategies can be triggered by different conditions, which can improve management efficiency, timely identify and respond to potential risks and improper operations, thereby protecting the overall security of data. By issuing warning prompts, abnormal behavior can be discovered in time, thereby reducing losses and risks. When determining whether to downgrade permissions, the downgrade judgment score can be used to determine whether D o Whether it is necessary to downgrade permissions. By limiting the operations of non-administrator and engineer roles, monitoring high-frequency access behaviors, and judging whether the operation time is within the normal working range and the nature of the computer being operated, management efficiency and data security can be improved, which helps reduce the possibility of data leakage.

[0029] It should be understood that the above general description and the following detailed description are exemplary and explanatory only and do not limit the present invention. Other features and aspects of the present invention will become more apparent from the following detailed description of exemplary embodiments with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present invention. For those of ordinary skill in the art, other embodiments can be obtained based on these drawings without creative work.

[0031] Figure 1 A schematic diagram of a process flow of a data security access control method for an industrial control programming platform according to an embodiment of the present invention is exemplarily shown;

[0032] Figure 2 A role permission diagram of a data security access management method for an industrial control programming platform according to an embodiment of the present invention is exemplarily shown;

[0033] Figure 3 A block diagram of a data security access management system for an industrial control programming platform according to an embodiment of the present invention is exemplarily shown;

[0034] Figure 4 A block diagram of a data security access management device for an industrial control programming platform according to an embodiment of the present invention is exemplarily shown.

[0035] In the figure: 400 - industrial control programming platform data security access management equipment; 401 - communication interface; 402 - processor; 403 - memory; 404 - bus. DETAILED DESCRIPTION

[0036] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0037] The technical solution of the present invention is described in detail with specific embodiments below. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0038] Figure 1A flow chart of a method for data security access control of an industrial control programming platform according to an embodiment of the present invention is exemplarily shown, and the method includes:

[0039] Step S101, the user self-registers an account and selects one of three roles during the registration process: administrator, engineer or monitor, where different roles have different permissions;

[0040] Step S102, monitoring the user's access behavior on the industrial control programming platform, wherein the access behavior includes the behavior of providing report configuration by HMI offline configuration and providing online and downloading functions by AT;

[0041] Step S103: If the user operates the access behavior, important log information is sent to the fine-grained control server through the http interface, wherein the important log information includes the user name, role, access behavior name, MAC address, IP address and timestamp, and the fine-grained control policy is configured on the fine-grained control server;

[0042] Step S104: determining whether the fine-grained control strategy needs to be executed according to the important log information;

[0043] Step S105: if the fine-grained control strategy needs to be executed, determine the fine-grained control strategy that needs to be executed according to the important log information;

[0044] Step S106, determining whether it is necessary to reduce permissions according to the fine-grained control strategy that needs to be executed;

[0045] Step S107: if the authority needs to be downgraded, the result of the authority downgrade is returned to the industrial control programming platform through the http interface;

[0046] Step S108, when the industrial control programming platform receives the return result of the permission reduction, when the user performs the access behavior again, the user is prompted that the operation is not authorized;

[0047] Step S109, determining alarm information according to the fine-grained control strategy;

[0048] Step S110, sending the alarm information to the security management platform through the fine-grained management and control server, and the security management platform displays all alarm information related to the industrial control programming platform.

[0049] According to the data security access control method of the industrial control programming platform of the embodiment of the present invention, through user self-registration and role selection, different users can only perform operations consistent with their roles, thereby realizing user authority control and improving security and management flexibility. Real-time monitoring of user access behavior and recording of important log information are helpful for auditing and analyzing user access behavior, and abnormal behavior can be discovered in time. The implementation of fine-grained control strategies can realize behavior control. Dynamically adjust user permissions to effectively reduce potential security risks. By sending alarm information to the security management platform, relevant staff can be notified in time and subsequent processing can be carried out, so that security incidents can be effectively tracked and managed.

[0050] According to one embodiment of the present invention, in step S101, Figure 2 The role authority diagram of the data security access control method of the industrial control programming platform according to an embodiment of the present invention is exemplarily shown. In the figure, the authority of the report configuration is related to the report configuration provided by the HMI offline configuration in the access behavior, and the online authority of the operator is related to the online and downloading functions provided by AT in the access behavior. The user fills in the necessary personal information (for example, user name) on the registration interface, but needs to select one of the three roles during the registration process. The three roles are administrator, engineer and monitor, and different roles have different authorities.

[0051] According to one embodiment of the present invention, in step S102, the industrial control programming platform can record the user's access behavior in real time. The access behavior includes the behavior of HMI offline configuration providing report configuration and AT providing online and downloading functions, wherein HMI offline configuration providing report configuration means that the user uses the human-machine interface (HMI) to configure the system and generate relevant reports in an offline state. AT provides online and downloading functions means that the user uses the automation tool (AT) to control the device or download the program (i.e. upload or download the program to the device) in an online state. When the user performs any of the above access behaviors, the industrial control programming platform can capture it in time.

[0052] According to one embodiment of the present invention, in step S103, if the user operates any of the three access behaviors, important log information is collected and sent to the fine-grained control server through the http interface, wherein the important log information includes the user name, role, access behavior name, MAC address, IP address and timestamp. The user name is the user name that performs the operation, the role is the role selected by the user (such as administrator, engineer or monitor), the access behavior name is the name of the access behavior, the MAC address is the physical address of the user device (used to identify the device), the IP address is the address of the user device in the network (used to track the access source), and the timestamp is the specific time when the operation access behavior occurs. As a standard application program interface, the http interface can make the information transmission process efficient and secure. After receiving the important log information from the industrial control programming platform, the fine-grained control server can parse and store the information, providing data support for subsequent security audits. On the fine-grained control server, a fine-grained control strategy has been configured, which will be evaluated based on the received important log information to determine whether the access behavior of the user operation meets the preset security standards.

[0053] According to an embodiment of the present invention, in step S104, it is determined whether the fine-grained control strategy needs to be executed based on the important log information.

[0054] According to one embodiment of the present invention, step S104 includes: obtaining the operation time of the user's operation of the access behavior and the operation frequency within a preset time period based on the timestamp and the access behavior name; determining the operating computer on which the user operates the access behavior based on the MAC address and the IP address; determining whether it is necessary to execute the fine-grained management and control strategy based on the operation time, the operation frequency, the operating computer and the role.

[0055] According to an embodiment of the present invention, the specific time of the user's operation access behavior is extracted to obtain the operation time. Within a preset time period, the number of times the user operates the access behavior is counted, and the number is divided by the preset time period to obtain the operation frequency, wherein the preset time period can be set to half an hour, one hour, etc., and the present invention does not limit this. The operating computer used by the user when operating the access behavior can be determined through the user's MAC address and IP address.

[0056] According to an embodiment of the present invention, determining whether the fine-grained control strategy needs to be executed according to the operation time, the operation frequency, the operation computer and the role includes: obtaining a first condition C1, a second condition C2, a third condition C3 and a fourth condition C4 according to formula (1),

[0057]

[0058] Among them, f i is the operation frequency of the ith access behavior, f i,p is the preset operation frequency of the ith access behavior, t c The operation time of the user's access behavior, t a,p is the start time of normal work, t b,p is the end time of normal work, [t a,p ,t b,p ] is the time range for normal operation, i is a positive integer; when any one of the first condition C1, the second condition C2, the third condition C3 and the fourth condition C4 is met, it is determined that the fine-grained control strategy needs to be executed.

[0059] According to one embodiment of the present invention, in the first condition C1 of formula (1), role ≠ administrator or engineer indicates that the role registered by the user who performs the access operation is not an administrator or an engineer, that is, the user whose role is not an administrator or an engineer has no authority to perform the access operation, and needs to execute the fine-grained control strategy for security protection.

[0060] According to one embodiment of the present invention, in the second condition C2, f i ≥f i,p The operation frequency of the i-th access behavior is greater than or equal to the preset operation frequency of the i-th access behavior, indicating frequent operations and security risks, and the fine-grained control strategy needs to be executed.

[0061] According to one embodiment of the present invention, in the third condition C3, The operation time of the user's access behavior is not within the normal working time range, which means that the operation within the non-normal working time range has security risks and the fine-grained control strategy needs to be executed.

[0062] According to one embodiment of the present invention, in the fourth condition C4, the operating computer ≠ engineer station indicates that the operating computer of the user's operating access behavior is not an engineer station, wherein the engineer station is a computer workstation with specific functions and uses. In theory, all computers that can operate access behaviors are engineer stations. Therefore, if the operating computer of the user's operating access behavior is not an engineer station, there is a security risk, and the fine-grained control strategy needs to be executed.

[0063] In this way, it is possible to determine whether the fine-grained control strategy needs to be executed based on four conditions. By refining the monitoring standards for user operation access behaviors based on operation time, operation frequency, operation computer, and role, potential security risks can be discovered in a timely manner, thus improving management efficiency.

[0064] According to an embodiment of the present invention, in step S105, if the fine-grained control strategy needs to be executed, the fine-grained control strategy that needs to be executed is determined based on the important log information.

[0065] According to one embodiment of the present invention, step S105 includes: if the first condition C1 is met, the fine-grained control policy that needs to be executed is that operations at non-system administrator or engineer level are risky; if the second condition C2 is met, the fine-grained control policy that needs to be executed is to issue warning prompts for frequent operations; if the third condition C3 is met, the fine-grained control policy that needs to be executed is to issue warning prompts for operations within abnormal working hours; if the fourth condition C4 is met, the fine-grained control policy that needs to be executed is that the computer for report configuration, online, and downloading is an engineer station, and warning prompts are given for other computer operations.

[0066] According to one embodiment of the present invention, if the first condition C1 is met, that is, the user's role is not a system administrator or engineer, in this case, the fine-grained control policy that needs to be executed is that non-system administrator or engineer-level operations are risky, indicating that the user's role is a monitor, and the authority is insufficient to operate the access behavior and there is a risk. If the second condition C2 is met, that is, the i-th operation frequency is higher than or equal to the preset operation frequency of the i-th access behavior, in this case, the fine-grained control policy that needs to be executed is to issue a warning prompt for frequent operations, indicating that the user's operation frequency is abnormally high and a warning prompt is required. If the third condition C3 is met, that is, the user's operation time is not within the normal working hours, in this case, the fine-grained control policy that needs to be executed is to issue a warning prompt for operations within the non-normal working hours, indicating that when the user operates during non-working hours, there are security risks or improper behaviors, and a warning prompt is required. If the fourth condition C4 is met, that is, the operating computer used by the user is not an engineer station, in this case, the fine-grained control strategy that needs to be executed is that the computer used for report configuration, online, and downloading is an engineer station, and operations on other computers will give warning prompts, indicating that only operation access behaviors on the engineer station are allowed. Operations on other computers will trigger warnings, prompting users that their operations may not comply with security regulations.

[0067] In this way, different fine-grained control strategies can be triggered by different conditions, which can improve management efficiency, timely identify and respond to potential risks and improper operations, and thus protect the overall security of data. By issuing warning prompts, abnormal behaviors can be discovered in time, thereby reducing losses and risks.

[0068] According to an embodiment of the present invention, in step S106, it is determined whether permission reduction is required based on the fine-grained control policy that needs to be executed.

[0069] According to one embodiment of the present invention, step S106 includes: obtaining permission level results, operation frequency results, operation time results and operation computer results according to the fine-grained control policy that needs to be executed; determining whether it is necessary to downgrade permissions based on the permission level results, the operation frequency results, the operation time results and the operation computer results.

[0070] According to an embodiment of the present invention, according to the fine-grained control policy that needs to be executed, the permission level result, operation frequency result, operation time result and operation computer result are obtained. For example, if the fine-grained control policy that needs to be executed is that non-system administrator or engineer-level operation is risky, it means that the first condition C1 is met and the permission level result is 1. If the fine-grained control policy that needs to be executed is to issue a warning prompt for frequent operations, it means that the second condition C2 is met and the operation frequency result is 1. If the fine-grained control policy that needs to be executed is to issue a warning prompt for operations within the abnormal working time range, it means that the third condition C3 is met and the operation time result is 1. If the fine-grained control policy that needs to be executed is that the computer for report configuration, online, and downloading is an engineer station, and other computer operations give warning prompts, it means that the fourth condition C4 is met and the operation computer result is 1. The fine-grained control policy that needs to be executed has a corresponding result of 1, and the fine-grained control policy that does not need to be executed has a corresponding result of 0.

[0071] According to an embodiment of the present invention, determining whether it is necessary to downgrade permissions based on the permission level result, the operation frequency result, the operation time result and the operation computer result includes: obtaining a downgrade decision score D according to formula (2) o ,

[0072] D o =α1S+α2H+α3M+α4N (2),

[0073] Among them, S is the result of the authority level, H is the result of the operation frequency, M is the result of the operation time, N is the result of the operation computer, α1, α2, α3 and α4 are the preset weights, and

[0074] Among them, when the authority reduction judgment score D o If the value is greater than or equal to the preset threshold, it is determined that the privilege needs to be downgraded.

[0075] According to one embodiment of the present invention, in formula (2), S is the result of the permission level. If the user's role is a monitor, it means that the user's permission is insufficient to operate the access behavior, and there is a security risk. The value of S is 1. If the user's role is an administrator or engineer, it means that the user's permission can operate the access behavior, and there is no security risk. The value of S is 0. H is the result of the operation frequency. If the operation frequency of the i-th access behavior is greater than or equal to the preset operation frequency of the i-th access behavior, it means that the user frequently operates and there is a security risk. The value of H is 1. Otherwise, the value of H is 0. M is the result of the operation time. If the operation time of the user's operation access behavior does not belong to the normal working time range, it means that the user operates within the abnormal working time range and there is a security risk. The value of M is 1. Otherwise, the value of M is 0. N is the result of the operation computer. If the operation computer of the user's operation access behavior is not an engineer station, there is a security risk. The value of N is 1. Otherwise, the value of N is 0. Multiply S, H, M and N by preset weights α1, α2, α3 and α4, and add the weighted values ​​to obtain a privilege reduction determination score. The larger the privilege reduction determination score, the higher the security risk, and the more privilege reduction is needed.

[0076] In this way, the score D can be determined by downgrading the authority. o Determine whether it is necessary to downgrade permissions. By limiting the operations of non-administrators and engineer roles, monitoring high-frequency access behaviors, and determining whether the operation time is within the normal working range and the nature of the computer being operated, management efficiency and data security can be improved, helping to reduce the possibility of data leakage.

[0077] According to one embodiment of the present invention, in step S107, if permission reduction is required, a corresponding permission reduction return result is generated, and the permission reduction return result is returned to the industrial control programming platform through the http interface, so that the industrial control programming platform can take corresponding measures.

[0078] According to one embodiment of the present invention, in step S108, when the industrial control programming platform receives the return result of the permission reduction, it updates the user's permission status and adjusts the user's permission level to the downgraded state. If the user performs the access behavior again, the user is prompted that the operation is not authorized. For example, when the role is an administrator or an engineer, the industrial control programming platform receives the return result of the permission reduction, immediately performs the permission reduction operation, and then outputs a prompt that the user has no permission to operate. When the role is a monitor, the industrial control programming platform receives the return result of the permission reduction, skips the permission reduction operation, does not execute the return result, but outputs a prompt that the user has no permission to operate.

[0079] According to an embodiment of the present invention, in step S109, alarm information is determined according to the fine-grained control strategy.

[0080] According to one embodiment of the present invention, step S109 includes: if the fine-grained control policy that needs to be executed is that there are risks for non-system administrator or engineer-level operations, then the alarm information is determined to be that there are risks for access behavior that is not operated by the system administrator and there are risks for access behavior that is not operated by the engineer; if the fine-grained control policy that needs to be executed is to provide warning prompts for frequent operations, then the alarm information is determined to be that there are risks for access behavior that is frequently operated by the user or role; if the fine-grained control policy that needs to be executed is to provide warning prompts for operations within abnormal working hours, then the alarm information is determined to be that there are risks for the user or role's operations during abnormal working hours; if the fine-grained control policy that needs to be executed is that the computer for report configuration, online, and downloading is an engineer station, and other computer operations give warning prompts, then the alarm information is determined to be that there is a risk for access behavior triggered by a non-operable platform.

[0081] According to an embodiment of the present invention, risky behaviors are intelligently identified under different fine-grained control strategies, and corresponding alarm information is generated, thereby strengthening the monitoring and management of operations and improving security.

[0082] According to one embodiment of the present invention, in step S110, the generated alarm information is transmitted through the fine-grained control server. The fine-grained control server acts as an intermediary to send the alarm information from the industrial control programming platform to the security management platform. The security management platform processes and organizes the received alarm information, and displays all the alarm information of the relevant industrial control programming platform on the user interface, such as the type, time, specific content, and processing status of the alarm, so as to provide managers with intuitive and clear alarm information display, so as to respond and make decisions in a timely manner.

[0083] According to the data security access control method of the industrial control programming platform of the embodiment of the present invention, through user self-registration and role selection, different users can only perform operations consistent with their roles, thereby realizing user authority control and improving security and management flexibility. Real-time monitoring of user access behavior and recording of important log information are helpful for auditing and analyzing user access behavior, and abnormal behavior can be discovered in time. The implementation of fine-grained control strategy can realize behavior control. Dynamic adjustment of user authority can effectively reduce potential security risks. By sending alarm information to the security management platform, relevant staff can be notified in time and subsequent processing can be carried out, so that security incidents can be effectively tracked and managed. When determining whether the fine-grained control strategy needs to be executed, it can be determined whether the fine-grained control strategy needs to be executed according to four conditions. According to the operation time, operation frequency, operation computer and role, the monitoring standard of user operation access behavior is refined, and potential security risks can be discovered in time, thereby improving management efficiency. When determining the fine-grained control strategy that needs to be executed, different fine-grained control strategies can be triggered by different conditions, which can improve management efficiency, timely identify and respond to potential risks and improper operations, thereby protecting the overall security of data. By issuing warnings, abnormal behavior can be discovered in time, thereby reducing losses and risks. When determining whether to downgrade permissions, the downgrade score D can be used to determine whether to downgrade permissions. o Determine whether it is necessary to downgrade permissions. By limiting the operations of non-administrators and engineer roles, monitoring high-frequency access behaviors, and determining whether the operation time is within the normal working range and the nature of the computer being operated, management efficiency and data security can be improved, helping to reduce the possibility of data leakage.

[0084] Figure 3The block diagram of the data security access control system of the industrial control programming platform according to the embodiment of the present invention is exemplarily shown, and the system includes: a role module, which is used for users to self-register accounts and select one of three roles during the registration process: administrator, engineer or monitor, wherein different roles have different permissions; an access behavior module, which is used to monitor the user's access behavior on the industrial control programming platform, wherein the access behavior includes the behavior of HMI offline configuration providing report configuration and AT providing online and downloading functions; an important log information module, which is used to send important log information to the fine-grained control server through the http interface if the user operates the access behavior, wherein the important log information includes the user name, role, access behavior name, MAC address, IP address and timestamp, and the fine-grained control policy is configured on the fine-grained control server; a judgment execution module, which is used to determine according to the important log information Determine whether it is necessary to execute the fine-grained control strategy; determine the execution module, which is used to determine the fine-grained control strategy that needs to be executed according to the important log information if the fine-grained control strategy needs to be executed; determine the authority reduction module, which is used to determine whether it is necessary to reduce the authority according to the fine-grained control strategy that needs to be executed; return module, which is used to return the return result of the authority reduction to the industrial control programming platform through the http interface if the authority reduction is required; unauthorized operation module, which is used to prompt the user that he has no authority to operate when the industrial control programming platform receives the return result of the authority reduction and the user operates the access behavior again; alarm information module, which is used to determine the alarm information according to the fine-grained control strategy; security management platform module, which is used to send the alarm information to the security management platform through the fine-grained control server, and the security management platform displays all alarm information related to the industrial control programming platform.

[0085] According to one embodiment of the present invention, see Figure 4 , provides an industrial control programming platform data security access management device 400, including: a communication interface 401, a processor 402, a bus 404 and a memory 403 for storing processor executable instructions; the processor 402, the communication interface 401 and the memory 403 are connected through the bus 404; wherein the processor 402 is configured to call the instructions stored in the memory 403 to execute the industrial control programming platform data security access management method.

[0086] According to one embodiment of the present invention, a computer-readable storage medium is provided, on which computer program instructions are stored. When the computer program instructions are executed by the processor 402, the industrial control programming platform data security access management method is implemented.

[0087] The present invention may be a method, an apparatus, a system and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for executing various aspects of the present invention.

[0088] It should be understood by those skilled in the art that the embodiments of the present invention described above and shown in the accompanying drawings are only examples and do not limit the present invention. The purpose of the present invention has been fully and effectively achieved. The functional and structural principles of the present invention have been demonstrated and explained in the embodiments, and the embodiments of the present invention may be deformed or modified in any way without departing from the principles.

Claims

1. A data security access management method for an industrial control programming platform, characterized in that: include: The user registers an account by himself and selects one of three roles during the registration process: administrator, engineer or monitor, where different roles have different permissions; on the industrial control programming platform, the user's access behavior is monitored, where the access behavior includes the report configuration provided by the HMI offline configuration and the online and download functions provided by the AT; If the user operates the access behavior, the important log information is sent to the fine-grained control server through the http interface, wherein the important log information includes the user name, role, access behavior name, MAC address, IP address and timestamp, and the fine-grained control policy is configured on the fine-grained control server; Determine whether to execute the fine-grained control strategy based on the important log information; If the fine-grained control strategy needs to be executed, determine the fine-grained control strategy that needs to be executed based on the important log information; Determine whether to downgrade permissions based on the fine-grained control strategy that needs to be executed; If the authority needs to be downgraded, the result of the authority downgrade will be returned to the industrial control programming platform through the http interface; When the industrial control programming platform receives the return result of the permission reduction, when the user performs the access behavior again, it prompts the user that the operation is not authorized; Determine alarm information according to the fine-grained control strategy; The alarm information is sent to the security management platform through the fine-grained control server, and the security management platform displays all alarm information related to the industrial control programming platform.

2. The data security access management method for industrial control programming platform according to claim 1 is characterized in that: Determining whether to execute the fine-grained control strategy based on the important log information includes: According to the timestamp and the name of the access behavior, obtaining the operation time of the user operating the access behavior and the operation frequency within a preset time period; Determine the computer on which the user performs the access behavior based on the MAC address and the IP address; Determine whether the fine-grained control strategy needs to be executed based on the operation time, the operation frequency, the operation computer and the role.

3. The data security access management method for industrial control programming platform according to claim 2 is characterized in that: Determining whether to execute the fine-grained control strategy according to the operation time, the operation frequency, the operation computer, and the role includes: According to the formula The first condition C1, the second condition C2, the third condition C3 and the fourth condition C4 are obtained, wherein f i is the operation frequency of the ith access behavior, f i,p is the preset operation frequency of the ith access behavior, t c The operation time of the user's access behavior, t a,p is the start time of normal work, t b,p is the end time of normal work, [t a,p ,t b,p ] is the time range for normal operation, i is a positive integer; when any one of the first condition C1, the second condition C2, the third condition C3 and the fourth condition C4 is met, it is determined that the fine-grained control strategy needs to be executed.

4. The data security access management method for industrial control programming platform according to claim 3 is characterized in that: If the fine-grained control strategy needs to be executed, the fine-grained control strategy that needs to be executed is determined according to the important log information, including: If the first condition C1 is met, the fine-grained control policy that needs to be executed is that non-system administrator or engineer-level operations are risky; If the second condition C2 is met, the fine-grained control strategy to be executed is to issue warning prompts for frequent operations; If the third condition C3 is met, the fine-grained control strategy to be executed is to issue a warning for operations within the non-normal working hours; If the fourth condition C4 is met, the fine-grained control strategy that needs to be executed is that the computer for report configuration, online, and downloading is the engineer station, and warning prompts are given for other computer operations.

5. The data security access management method for industrial control programming platform according to claim 4 is characterized in that: Determine whether to downgrade permissions based on the fine-grained control strategy that needs to be executed, including: According to the fine-grained control strategy that needs to be executed, obtain the permission level results, operation frequency results, operation time results and operation computer results; Determine whether it is necessary to downgrade permissions based on the permission level result, the operation frequency result, the operation time result and the operation computer result.

6. The method for data security access control of an industrial control programming platform according to claim 5 is characterized in that: Determining whether to reduce permissions according to the permission level result, the operation frequency result, the operation time result, and the operation computer result includes: According to formula D o =α1S+α2H+α3M+α4N to obtain the authority reduction judgment score D o , where S is the authority level result, H is the operation frequency result, M is the operation time result, N is the operation computer result, α1, α2, α3 and α4 are preset weights, and When the authority reduction judgment score D o If the value is greater than or equal to the preset threshold, it is determined that the privilege needs to be downgraded.

7. The data security access management method for industrial control programming platform according to claim 4 is characterized in that: According to the fine-grained control strategy, the alarm information is determined, including: If the fine-grained control policy to be executed is that non-system administrator or engineer-level operations are risky, the alarm information is determined to be that access behavior non-system administrator operation is risky and access behavior non-engineer operation is risky; If the fine-grained control policy to be executed is to issue warnings for frequent operations, the warning information is determined to be that the frequent operation access behavior of the user or role poses a risk; If the fine-grained control policy to be executed is to issue a warning for operations performed during non-normal working hours, then the warning information is determined to be that the user or role's operation is at risk during non-normal working hours; If the fine-grained control strategy that needs to be executed is that the computer for report configuration, online, and downloading is an engineer station, and other computer operations give warning prompts, then it is determined that the alarm information is triggered by the access behavior of a non-operable platform and there is a risk.

8. A data security access management and control system for an industrial control programming platform, characterized in that: include: The role module is used for users to self-register accounts and select one of three roles during the registration process: administrator, engineer or monitor, where different roles have different permissions; An access behavior module is used to monitor the user's access behavior on the industrial control programming platform, wherein the access behavior includes the behavior of providing report configuration for HMI offline configuration and providing online and download functions for AT; An important log information module is used to send important log information to a fine-grained control server through an http interface if the user operates the access behavior, wherein the important log information includes user name, role, access behavior name, MAC address, IP address and timestamp, and the fine-grained control policy is configured on the fine-grained control server; A judgment execution module, used to determine whether the fine-grained control strategy needs to be executed according to the important log information; Determine an execution module, used to determine the fine-grained control strategy to be executed according to the important log information if the fine-grained control strategy needs to be executed; A module for determining whether to reduce permissions is used to determine whether permissions need to be reduced according to the fine-grained control strategy that needs to be executed; The return module is used to return the result of the permission reduction to the industrial control programming platform through the http interface if permission reduction is required; An unauthorized operation module, used for prompting the user that the user has no authority to operate when the industrial control programming platform receives the return result of the authority reduction and the user operates the access behavior again; An alarm information module, used to determine alarm information according to the fine-grained control strategy; The security management platform module is used to send the alarm information to the security management platform through the fine-grained control server, and the security management platform displays all alarm information related to the industrial control programming platform.

9. A data security access control device for an industrial control programming platform, characterized in that: include: processor; A memory for storing processor-executable instructions; wherein the processor is configured to call the instructions stored in the memory to execute the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: Computer program instructions are stored thereon, and when the computer program instructions are executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images