Trusted DCS system credible strategy changing method and related device

Abstract

The invention discloses a credible strategy changing method of a credible DCS system and a related device, and belongs to the technical field of credible thermal power DCS systems. Changing the data file by reading the credible strategy; storing strategy change information in the credible strategy change data file into a credible security management platform database; and then strategy change information in the database of the trusted security management platform is sent to the target host, and a strategy issuing log is recorded to complete strategy change. A credible strategy is issued to equipment such as a DCS controller, an engineer station, a history station and an operator station through a visual page of a management platform, the credible strategy of a target host is added, deleted, updated and the like, and changed strategy information is stored in a background database, so that the credible protection strategy of the target host is effectively improved to reach an expected result, and the reliability of the target host is improved. And system safety is ensured.

Description

Technical Field

[0001] The invention belongs to the technical field of a trusted thermal power DCS system, and relates to a trusted strategy changing method of a trusted DCS system and a related device. Background Art

[0002] In the modern power industry, thermal power is a traditional and important way of energy conversion. The advancement and reliability of its control system are directly related to the power generation efficiency, safe production and environmental protection standards. Among them, a reliable thermal power DCS (Distributed Control System) system is not only the core of the automation control of thermal power plants, but also the key to achieving efficient, safe and intelligent operation and maintenance. Through a highly integrated software and hardware architecture, the system centrally manages the originally decentralized control functions, greatly improving the automation level and operation efficiency of thermal power plants. A reliable thermal power DCS system is generally composed of a DCS controller, an engineer station, a history station, and an operator station. These devices will be registered in the management platform and managed uniformly by the trusted management platform.

[0003] As the core processing unit of the entire system, the DCS controller is responsible for receiving real-time data from field sensors, actuators and other equipment, and quickly processing and calculating according to the preset control logic and algorithm, and finally sending control instructions to each actuator to achieve precise control of the production process. These controllers usually adopt redundant configuration, that is, primary and secondary or multiple redundant design, to ensure that when any controller fails, the system can seamlessly switch to the backup controller to ensure the continuity and safety of production. In addition, the DCS controller also has powerful data processing and communication capabilities, and can be seamlessly integrated with other systems (such as SIS, MIS, etc.) to achieve information sharing and collaborative work. The engineer station is a special work platform provided for system engineers and technicians for configuration, programming, debugging, maintenance and fault diagnosis of the DCS system. Engineers can easily modify and optimize the control logic through this station to meet the production needs under different working conditions. At the same time, the engineer station also has a wealth of diagnostic tools, which can monitor the operating status of hardware devices such as controllers and IO modules in real time, discover and locate faults in time, and provide strong support for rapid resumption of production. In addition, the engineer station also bears the important responsibility of system backup and recovery to ensure the security and integrity of system data. The history station is responsible for collecting and storing various historical data during the operation of the DCS system, including process parameters, alarm information, operation records, etc. These data are not only important bases for analyzing the operation status of equipment and optimizing control strategies, but also key information for accident tracing and fault analysis. Through in-depth mining and analysis of historical data, potential problems in the production process can be revealed, providing data support for the refined management of thermal power plants. In addition, the history station also supports a variety of data query and report generation functions, which allows users to flexibly obtain the required information as needed. The operator station is the interactive interface between the operators of the thermal power plant and the DCS system. It displays real-time status information of the production site through an intuitive and friendly graphical interface, such as process flow charts, parameter trend charts, alarm lists, etc. The operators can monitor, operate, adjust, etc. on this basis to ensure the smooth operation of the production process. The operator station also has a wealth of operation authority management functions. Through strict identity authentication and authority allocation mechanisms, it ensures that only personnel with corresponding authority can operate the system, effectively preventing the occurrence of misoperation and illegal access. All of the above devices are registered in the trusted management platform, which realizes unified management and scheduling. The management platform is not only responsible for the centralized display and monitoring of equipment information, but also has multiple functions such as equipment management, authority allocation, log auditing, and security protection. Through this platform, managers can grasp the system operation status in real time, discover and deal with potential problems in a timely manner; at the same time, through the authority allocation mechanism, it ensures that personnel in different positions can only access information within their authority scope to ensure system information security. In addition, the management platform also integrates advanced security protection technologies, such as firewalls and intrusion detection, to provide solid protection for the safe and stable operation of the DCS system.

[0004] With the growth of DCS system operation security requirements, in order to improve the stability and reliability of the system, it is necessary to change the trusted policy. However, due to the complex network environment and system architecture of the DCS system, it is difficult to synchronize the changes of the trusted policy to the target host in time, thus affecting the stable operation of the DCS system. Summary of the invention

[0005] The purpose of the present invention is to provide a trusted DCS system trusted policy change method and related devices to solve the technical problem in the prior art that the trusted policy change is difficult to synchronize to the target host in time, thereby affecting the stable operation of the DCS system.

[0006] In order to achieve the above object, the present invention adopts the following technical solutions:

[0007] In a first aspect, the present invention provides a method for changing a trusted DCS system trusted strategy, comprising the following steps:

[0008] Read the trusted policy change data file;

[0009] Storing the policy change information in the trusted policy change data file in the trusted security management platform database;

[0010] Send the policy change information in the trusted security management platform database to the target host, record the policy issuance log, and complete the policy change.

[0011] Furthermore, the trusted policy change data file is a file in json format.

[0012] Furthermore, the step of storing the policy change information in the trusted policy change data file into the trusted security management platform database specifically includes: judging the read status of the trusted security management platform database, and when the read status is yes, storing the policy change information in the trusted policy change data file into the trusted security management platform database; when the read status is no, re-executing the instruction to read the policy change data file.

[0013] Furthermore, the step of sending the policy change information in the trusted security management platform database to the target host specifically includes:

[0014] Establish communication connection between the trusted security management platform and the target host;

[0015] Check the connection status and make a policy request when the connection is successful;

[0016] The policy change information in the trusted security management platform database is read according to the policy issuance request, and the read policy change information is sent to the target host.

[0017] Furthermore, the step of recording the policy issuance log specifically includes: monitoring the policy issuance status, determining the policy issuance result, generating the policy issuance log according to the policy issuance result, and saving the policy issuance log to the trusted security management platform database.

[0018] Furthermore, the step of generating a policy issuance log based on the policy issuance result specifically includes: determining the policy issuance result, generating a policy issuance success log when the issuance result is successful, and transmitting the policy issuance success log to the trusted security management platform database; generating a policy issuance failure log when the issuance result is a failure, and transmitting the policy issuance failure log to the trusted security management platform database.

[0019] Furthermore, it also includes: after the policy is issued, a policy issuance completion instruction is returned, a policy issuance report is formed according to the policy issuance log in the trusted security management platform database, and the operation of adding, deleting or updating the trusted policy is recorded.

[0020] In a second aspect, the present invention provides a trusted DCS system trusted policy change system, comprising:

[0021] A reading module, used to read the trusted policy change data file;

[0022] A storage module, used to store the policy change information in the trusted policy change data file into the trusted security management platform database;

[0023] The issuing module is used to send the policy change information in the trusted security management platform database to the target host, record the policy issuing log, and complete the policy change.

[0024] In a third aspect, the present invention provides a computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above method when executing the computer program.

[0025] In a fourth aspect, the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the above method are implemented.

[0026] Compared with the prior art, the present invention has the following beneficial effects:

[0027] The invention discloses a trusted policy changing method and related device of a trusted DCS system. The method stores policy change information in a trusted policy changing data file into a trusted security management platform database. Trusted policies are issued to devices such as a DCS controller, an engineer station, a history station, and an operator station through a management platform visualization page. The trusted policies of a target host are added, deleted, updated, and the like, and the changed policy information is saved in a background database. When the policies are issued, the trusted agents of the devices such as the DCS controller, the engineer station, the history station, and the operator station are communicated with to issue the policies in the database to the target host. The policy issuing status is monitored throughout the process on a trusted security management platform visualization page, and a policy issuing log is generated. The trusted protection policy of the target host is effectively improved to achieve the expected result, and the system security is ensured. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0029] Figure 1 is a flow chart of the method of the present invention;

[0030] Figure 2 is a schematic diagram of the system of the present invention;

[0031] Figure 3 It is a flowchart of the overall process of an embodiment of the present invention;

[0032] Figure 4 It is a schematic diagram of the computer device structure of the present invention. DETAILED DESCRIPTION

[0033] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings here can be arranged and designed in various different configurations.

[0034] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention claimed for protection, but merely represents selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0035] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0036] In the description of the embodiments of the present invention, it should be noted that if the terms "upper", "lower", "horizontal", "inner", etc. indicate an orientation or positional relationship based on the orientation or positional relationship shown in the drawings, or the orientation or positional relationship in which the product of the invention is usually placed when in use, it is only for the convenience of describing the present invention and simplifying the description, and does not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the present invention. In addition, the terms "first", "second", etc. are only used to distinguish the description, and cannot be understood as indicating or implying relative importance.

[0037] In addition, if the term "horizontal" appears, it does not mean that the component must be absolutely horizontal, but can be slightly tilted. For example, "horizontal" only means that its direction is more horizontal than "vertical", which does not mean that the structure must be completely horizontal, but can be slightly tilted.

[0038] In the description of the embodiments of the present invention, it is also necessary to explain that, unless otherwise clearly specified and limited, the terms "set", "install", "connect", and "connect" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal connection of two components. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0039] The present invention is further described in detail below in conjunction with the accompanying drawings:

[0040] See also Figure 1 and Figure 3 The embodiment of the present invention discloses a method for changing a trusted strategy of a trusted DCS system, comprising the following steps:

[0041] S1, read the trusted policy change data file;

[0042] The terminal reads the trusted policy change data file through the trusted security management platform visualization program; the trusted policy change data file is a file in json format, and the trusted policy is set in the json file.

[0043] S2, storing the policy change information in the trusted policy change data file into the trusted security management platform database;

[0044] Determine the read status of the trusted security management platform database. When the read status is yes, store the policy change information in the trusted policy change data file into the trusted security management platform database; when the read status is no, re-execute the instruction to read the policy change data file.

[0045] S3, sends the policy change information in the trusted security management platform database to the target host, and records the policy issuance log to complete the policy change.

[0046] S301, establishing a communication connection between the trusted security management platform and the target host;

[0047] S302, check the connection status, and make a policy issuance request when the connection is successful;

[0048] S303, reading the policy change information in the trusted security management platform database according to the policy delivery request, and sending the read policy change information to the target host.

[0049] S304, monitor the policy issuance status, determine the policy issuance result, generate a policy issuance log according to the policy issuance result, and save the policy issuance log to the trusted security management platform database.

[0050] Specifically, determine the policy issuance result, generate a policy issuance success log when the issuance result is successful, and transmit the policy issuance success log to the trusted security management platform database; generate a policy issuance failure log when the issuance result is failed, and transmit the policy issuance failure log to the trusted security management platform database.

[0051] S305, after the policy is issued, a policy issuance completion instruction is returned, and a policy issuance report is formed according to the policy issuance log in the trusted security management platform database to record the operation of adding, deleting or updating the trusted policy.

[0052] The embodiment of the present invention issues trusted policies to DCS controllers, engineer stations, history stations, operator stations and other devices through the management platform visualization page, adds, deletes, updates and other operations on the trusted policies of the target host, and saves the changed policy information to the background database. When the policy is issued, the trusted agent communicates with the DCS controller, engineer station, history station, operator station and other devices to issue the policy in the database to the target host, and monitors the policy issuance status throughout the process on the trusted security management platform visualization page. Through this method, the target host trusted protection policy can be effectively improved to achieve the expected results and ensure system security.

[0053] See also Figure 2 The embodiment of the present invention discloses a trusted DCS system trusted policy change system, including:

[0054] The reading module is used to read the trusted policy change data file; the terminal reads the trusted policy change data file through the trusted security management platform visualization program; the trusted policy change data file is a file in json format, and the trusted policy is set in the json file.

[0055] A storage module is used to store the policy change information in the trusted policy change data file into the trusted security management platform database; specifically, the reading status of the trusted security management platform database is judged, and when the reading status is yes, the policy change information in the trusted policy change data file is stored into the trusted security management platform database; when the reading status is no, the instruction to read the policy change data file is re-executed.

[0056] The issuing module is used to send the policy change information in the trusted security management platform database to the target host, record the policy issuing log, and complete the policy change. Specifically, the policy in the database is issued to the specified terminal agent. The policy issuing log is recorded and the policy issuing status is monitored. After the policy is issued, it returns.

[0057] In one embodiment of the present invention, see Figure 4 , a computer device is provided, the computer device includes a processor and a memory, the memory is used to store a computer program, the computer program includes program instructions, and the processor is used to execute the program instructions stored in the computer storage medium. The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. It is the computing core and control core of the terminal, which is suitable for implementing one or more instructions, and is specifically suitable for loading and executing one or more instructions in the computer storage medium to implement the corresponding method flow or corresponding function; the processor described in the embodiment of the present invention can be used for the operation of the trusted policy change method of the trusted DCS system.

[0058] The present invention also provides a storage medium, specifically a computer-readable storage medium (Memory), which is a memory device in a computer device for storing programs and data. It is understandable that the computer-readable storage medium here can include both built-in storage media in the computer device and, of course, extended storage media supported by the computer device. The computer-readable storage medium provides a storage space, which stores the operating system of the terminal. In addition, one or more instructions suitable for being loaded and executed by the processor are also stored in the storage space, and these instructions can be one or more computer programs (including program codes). It should be noted that the computer-readable storage medium here can be a high-speed RAM memory or a non-volatile memory (non-volatile memory), such as at least one disk memory. The processor can load and execute one or more instructions stored in the computer-readable storage medium to implement the corresponding steps of the trusted policy change method of the trusted DCS system in the above embodiment.

[0059] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0060] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0061] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1A function specified in one or more boxes.

[0062] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0063] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A trusted DCS system trusted strategy change method, characterized in that: The following steps are involved: Read the trusted policy change data file; Storing the policy change information in the trusted policy change data file in the trusted security management platform database; Send the policy change information in the trusted security management platform database to the target host, record the policy issuance log, and complete the policy change.

2. A trusted DCS system trusted strategy change method according to claim 1, characterized in that: The trusted policy change data file is a file in json format.

3. A trusted DCS system trusted strategy change method according to claim 1, characterized in that: The step of storing the policy change information in the trusted policy change data file into the trusted security management platform database specifically includes: judging the read status of the trusted security management platform database, and when the read status is yes, storing the policy change information in the trusted policy change data file into the trusted security management platform database; when the read status is no, re-executing the instruction to read the policy change data file.

4. A trusted DCS system trusted strategy change method according to claim 1, characterized in that: The step of sending the policy change information in the trusted security management platform database to the target host specifically includes: Establish communication connection between the trusted security management platform and the target host; Check the connection status and make a policy request when the connection is successful; The policy change information in the trusted security management platform database is read according to the policy issuance request, and the read policy change information is sent to the target host.

5. A trusted DCS system trusted strategy change method according to claim 1, characterized in that: The step of recording the policy issuance log specifically includes: monitoring the policy issuance status, determining the policy issuance result, generating the policy issuance log according to the policy issuance result, and saving the policy issuance log to the trusted security management platform database.

6. A trusted DCS system trusted strategy change method according to claim 5, characterized in that: The step of generating a policy issuance log based on the policy issuance result specifically includes: determining the policy issuance result, generating a policy issuance success log when the issuance result is successful, and transmitting the policy issuance success log to the trusted security management platform database; generating a policy issuance failure log when the issuance result is a failure, and transmitting the policy issuance failure log to the trusted security management platform database.

7. A trusted DCS system trusted strategy change method according to claim 6, characterized in that: Also includes: After the policy is issued, the policy issuance completion instruction is returned, and a policy issuance report is formed based on the policy issuance log in the trusted security management platform database to record the operations of adding, deleting or updating the trusted policy.

8. A trusted DCS system trusted policy change system, characterized in that: include: A reading module, used to read the trusted policy change data file; A storage module, used to store the policy change information in the trusted policy change data file into the trusted security management platform database; The issuing module is used to send the policy change information in the trusted security management platform database to the target host, record the policy issuing log, and complete the policy change.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images