Method and related device for safely unlocking configuration picture of trusted industrial control system

Abstract

The invention discloses a trusted industrial control system configuration picture security unlocking method and a related device, and relates to the technical field of industrial automation, and the method comprises the following steps: a user issues a security unlocking instruction for a current configuration picture at a current operation station node; the trusted security center performs multi-factor dynamic authentication verification on the security unlocking instruction, and returns a verification result to the operation station node; the operation station node receives a returned verification result, and if verification fails, the process is ended; and otherwise, performing safe unlocking on the current configuration picture. The trusted computing technology is used to guarantee the communication security of the industrial control system and the monopolization of the current user on the configuration picture editing operation.

Description

Technical Field

[0001] The present invention relates to the technical field of industrial automation, and in particular to a method for securely unlocking a configuration screen of a trusted industrial control system and a related device. Background Art

[0002] Industrial control systems are the "nerve center" of industrial production. However, the security threats faced by industrial control systems are also increasing. Once these industrial control systems are attacked or operated incorrectly, they may lead to major production accidents and even threaten the safety of personnel and social stability. At the same time, screen configuration is one of the most important links in industrial control systems. Users edit the industrial control system screen through screen configuration software, so as to display the real-time operation of the industrial control system. Therefore, it is very important to ensure that users have exclusive access to the current configuration screen. Otherwise, repeated editing of the screen, incorrect editing, and other situations may occur, which seriously affect the display of the industrial control system screen and affect the quality of the industrial control system screen monitoring.

[0003] Traditional methods of unlocking the configuration screen of industrial control systems are usually based on simple user credentials (such as username and password) for identity authentication. However, this method has many security risks, such as credential leakage, password guessing, identity fraud, etc. Once an attacker obtains the credentials of a legitimate user, he can easily access and modify the configuration screen, thereby causing damage to the industrial control system. Summary of the invention

[0004] The purpose of the present invention is to provide a trusted industrial control system configuration screen security unlocking method and related devices to overcome the defects of the prior art. The present invention uses trusted computing technology to ensure the communication security of the industrial control system and the exclusivity of the current user's configuration screen editing operations.

[0005] In order to achieve the above object, the present invention adopts the following technical scheme: The method for securely unlocking the configuration screen of a trusted industrial control system includes the following steps: The user issues a security unlock command for the current configuration screen at the current operation station node; The trusted security center performs multi-factor dynamic authentication verification on the security unlocking instruction and transmits the verification result back to the operation station node; The operation station node receives the returned verification result. If the verification fails, the process ends; otherwise, the current configuration screen is securely unlocked.

[0006] Furthermore, the multi-factor dynamic authentication verification specifically includes: First factor verification: The trusted platform module in the trusted security center performs remote user security verification on the user information. If the verification is successful, the user authorization status is updated to authorized and the second factor verification is entered; otherwise, the user authorization status is updated to untrusted; Second factor verification: The trusted platform module of the trusted security center performs remote device security verification on the operation station node. If the verification is successful, the device authorization status is updated to authorized, and the trusted security audit report is updated based on the trusted verification result; otherwise, the device authorization status is updated to untrusted.

[0007] Furthermore, the trusted security audit report is used to store the trusted verification results and detailed information of the unlocking operation. The trusted security center periodically initiates a trusted security check to the operation station node, and dynamically updates the system trusted status according to the trusted security audit report. If the check result is untrusted, the trusted security audit report is updated and the authorized operation is stopped, and the process ends.

[0008] Furthermore, the secure unlocking of the current configuration screen specifically includes the following steps: S31: querying a screen database according to the screen name of the current configuration screen to obtain a node name of the locked current configuration screen; S32: If the node name of the locked current configuration screen obtained in S31 is consistent with the node name of the current operation station node, it means that the current configuration screen has been safely unlocked at the current operation station node, and the process ends; otherwise, a configuration screen unlocking application message is generated, and the configuration screen unlocking application message is sent to the node of the locked current configuration screen in S31, and S33 is executed; The configuration screen unlocking application message includes the current operation station node name and the screen name of the current configuration screen; S33: the node that has locked the current configuration screen parses the configuration screen unlocking application message in S32, and pops up a screen unlocking inquiry window. If the node user that has locked the current configuration screen allows the screen to be unlocked, a reply message that allows unlocking is sent back to the current operation station node; otherwise, a reply message that rejects the unlocking request is sent back to the current operation station node. S34: The current operation station node parses the response message. If it is a response message allowing unlocking, it means that the current operation station node has completed the security unlocking of the current configuration screen, and queries the screen database according to the screen name of the current configuration screen, and updates the node name of the locked current configuration screen in the screen database described in S31 with the current operation station node name described in S32 as the current operation station node, and the process ends. Otherwise, it prompts that the screen unlocking fails and the process ends.

[0009] Trusted industrial control system configuration screen security unlocking system, including trusted security center and operation station node; The trusted security center is used to receive the security unlocking instruction of the current configuration screen issued by the user at the current operation station node, and perform multi-factor dynamic authentication verification on the security unlocking instruction, and transmit the verification result back to the operation station node; The operation station node is used to receive the verification result and make a judgment. If the verification fails, the process ends; otherwise, the current configuration screen is securely unlocked.

[0010] Furthermore, the multi-factor dynamic authentication verification specifically includes: First factor verification: The trusted platform module in the trusted security center performs remote user security verification on the user information. If the verification is successful, the user authorization status is updated to authorized and the second factor verification is entered; otherwise, the user authorization status is updated to untrusted; Second factor verification: The trusted platform module of the trusted security center performs remote device security verification on the operation station node. If the verification is successful, the device authorization status is updated to authorized, and the trusted security audit report is updated based on the trusted verification result; otherwise, the device authorization status is updated to untrusted.

[0011] Furthermore, the trusted security audit report is used to store the trusted verification results and detailed information of the unlocking operation. The trusted security center periodically initiates a trusted security check to the operation station node, and dynamically updates the system trusted status according to the trusted security audit report. If the check result is untrusted, the trusted security audit report is updated and the authorized operation is stopped, and the process ends.

[0012] Furthermore, the secure unlocking of the current configuration screen specifically includes the following steps: S31: querying a screen database according to the screen name of the current configuration screen to obtain a node name of the locked current configuration screen; S32: If the node name of the locked current configuration screen obtained in S31 is consistent with the node name of the current operation station node, it means that the current configuration screen has been safely unlocked at the current operation station node, and the process ends; otherwise, a configuration screen unlocking application message is generated, and the configuration screen unlocking application message is sent to the node of the locked current configuration screen in S31, and S33 is executed; The configuration screen unlocking application message includes the current operation station node name and the screen name of the current configuration screen; S33: the node that has locked the current configuration screen parses the configuration screen unlocking application message in S32, and pops up a screen unlocking inquiry window. If the node user that has locked the current configuration screen allows the screen to be unlocked, a reply message that allows unlocking is sent back to the current operation station node; otherwise, a reply message that rejects the unlocking request is sent back to the current operation station node. S34: The current operation station node parses the response message. If it is a response message allowing unlocking, it means that the current operation station node has completed the security unlocking of the current configuration screen, and queries the screen database according to the screen name of the current configuration screen, and updates the node name of the locked current configuration screen in the screen database described in S31 with the current operation station node name described in S32 as the current operation station node, and the process ends. Otherwise, it prompts that the screen unlocking fails and the process ends.

[0013] A computer device comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the method for securely unlocking a configuration screen of a trusted industrial control system when executing the computer program.

[0014] A computer storage medium stores a computer program, wherein the computer program, when executed by a processor, implements the steps of the method for securely unlocking a configuration screen of a trusted industrial control system.

[0015] Compared with the prior art, the present invention has the following beneficial technical effects: The method of the present invention adopts multi-factor dynamic authentication verification to improve the security and reliability of identity and device verification. At the same time, the method of the present invention also incorporates trusted computing technology to protect the unlocking process of the configuration screen by building a trusted execution environment. In this environment, only authorized and verified operations can be executed, thereby ensuring the integrity and confidentiality of the configuration screen. Even if an attacker obtains access rights to the industrial control system, he cannot perform unauthorized modification or unlocking operations on the configuration screen.

[0016] In industrial control systems, multiple users may access or modify the same configuration screen at the same time, which may lead to operational conflicts and data inconsistency. The present invention uses an exclusive unlocking mechanism to ensure that only one user can access and control the configuration screen at a certain time, avoiding the problem of multiple users operating at the same time. In this way, each user's operation can be carried out as expected, ensuring the consistency of operation and the stability of the system. This exclusive working environment helps to improve the user's operating efficiency and accuracy, especially in industrial control scenarios that require fast response or high precision.

[0017] In addition, through exclusive unlocking, the industrial control system can record detailed information of each unlocking operation, including operation time, user identity, operation content, etc. This information is very valuable for security auditing and troubleshooting of the industrial control system. Administrators can analyze these records to discover potential security threats or abnormal operations and take appropriate measures to deal with them in a timely manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The drawings in the specification are used to provide further understanding of the present invention and constitute a part of the present invention. The schematic embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0019] Figure 1 It is a schematic diagram of the process of the secure unlocking method of the configuration screen of the trusted industrial control system of the present invention; Figure 2 It is a schematic diagram of the structure of the secure unlocking system of the configuration screen of the trusted industrial control system of the present invention. DETAILED DESCRIPTION

[0020] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0021] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0022] Embodiment 1 See also Figure 1 The present invention provides a method for securely unlocking a configuration screen of a trusted industrial control system, comprising the following steps: The user issues a security unlock command for the current configuration screen at the current operation station node; The trusted security center performs multi-factor dynamic authentication verification on the security unlocking instruction and transmits the verification result back to the operation station node; The operation station node receives the returned verification result. If the verification fails, the process ends; otherwise, the current configuration screen is securely unlocked.

[0023] The method of the present invention adopts multi-factor dynamic authentication verification to improve the security and reliability of identity and device verification. At the same time, the method of the present invention also incorporates trusted computing technology to protect the unlocking process of the configuration screen by building a trusted execution environment. In this environment, only authorized and verified operations can be executed, thereby ensuring the integrity and confidentiality of the configuration screen. Even if an attacker obtains access rights to the industrial control system, he cannot perform unauthorized modification or unlocking operations on the configuration screen.

[0024] Embodiment 2 The present invention provides a method for securely unlocking a configuration screen of a trusted industrial control system, comprising the following steps: Step 1: The user issues a security unlock command for the current configuration screen at the current operation station node; Step 2: The trusted security center performs a multi-factor dynamic authentication check on the security unlocking instruction and transmits the verification result back to the operation station node; the multi-factor dynamic authentication check specifically includes: First factor verification: The trusted platform module in the trusted security center performs remote user security verification on the user information. If the verification is successful, the user authorization status is updated to authorized and the second factor verification is entered; otherwise, the user authorization status is updated to untrusted; Second factor verification: The trusted platform module of the trusted security center performs remote device security verification on the operation station node. If the verification is successful, the device authorization status is updated to authorized, and the trusted security audit report is updated based on the trusted verification result; otherwise, the device authorization status is updated to untrusted.

[0025] The present invention improves the security and reliability of identity and device verification by adopting multi-factor dynamic authentication verification. At the same time, the method of the present invention also incorporates trusted computing technology to protect the unlocking process of the configuration screen by building a trusted execution environment. In this environment, only authorized and verified operations can be executed, thereby ensuring the integrity and confidentiality of the configuration screen. Even if an attacker obtains access rights to the industrial control system, he cannot perform unauthorized modification or unlocking operations on the configuration screen.

[0026] Among them, the trusted security audit report is used to store the trusted verification results and detailed information of the unlocking operation. The trusted security center periodically initiates a trusted security check to the operation station node, and dynamically updates the system trusted status according to the trusted security audit report. If the check result is untrusted, the trusted security audit report is updated and the authorization operation is stopped, and the process ends.

[0027] Step 3: The operation station node receives the verification result sent back. If the verification fails, the process ends; otherwise, the current configuration screen is securely unlocked. The secure unlocking of the current configuration screen specifically includes the following steps: S31: querying a screen database according to the screen name of the current configuration screen to obtain a node name of the locked current configuration screen; S32: If the node name of the locked current configuration screen obtained in S31 is consistent with the node name of the current operation station node, it means that the current configuration screen has been safely unlocked at the current operation station node, and the process ends; otherwise, a configuration screen unlocking application message is generated, and the configuration screen unlocking application message is sent to the node of the locked current configuration screen in S31, and S33 is executed; The configuration screen unlocking application message includes the current operation station node name and the screen name of the current configuration screen; S33: the node that has locked the current configuration screen parses the configuration screen unlocking application message in S32, and pops up a screen unlocking inquiry window. If the node user that has locked the current configuration screen allows the screen to be unlocked, a reply message that allows unlocking is sent back to the current operation station node; otherwise, a reply message that rejects the unlocking request is sent back to the current operation station node. S34: The current operation station node parses the response message. If it is a response message allowing unlocking, it means that the current operation station node has completed the security unlocking of the current configuration screen, and queries the screen database according to the screen name of the current configuration screen, and updates the node name of the locked current configuration screen in the screen database described in S31 with the current operation station node name described in S32 as the current operation station node, and the process ends. Otherwise, it prompts that the screen unlocking fails and the process ends.

[0028] The present invention ensures that only one user can access and control the configuration screen at a certain time through an exclusive unlocking mechanism, avoiding the problem of multiple users operating at the same time. In this way, each user's operation can be carried out as expected, ensuring the consistency of operation and the stability of the system. This exclusive working environment helps to improve the user's operating efficiency and accuracy, especially in industrial control scenarios that require fast response or high precision. In addition, through exclusive unlocking, the industrial control system can record detailed information of each unlocking operation, including operation time, user identity, operation content, etc., which is very valuable for security auditing and troubleshooting of the industrial control system. Administrators can analyze these records to discover potential security threats or abnormal operations, and take corresponding measures to deal with them in a timely manner.

[0029] Embodiment 3 See also Figure 2 , the present invention provides a trusted industrial control system configuration screen security unlocking system, including a trusted security center and an operation station node; The trusted security center is used to receive the security unlocking instruction of the current configuration screen issued by the user at the current operation station node, and perform multi-factor dynamic authentication verification on the security unlocking instruction, and return the verification result to the operation station node; the multi-factor dynamic authentication verification specifically includes: First factor verification: The trusted platform module in the trusted security center performs remote user security verification on the user information. If the verification is successful, the user authorization status is updated to authorized and the second factor verification is entered; otherwise, the user authorization status is updated to untrusted; Second factor verification: The trusted platform module of the trusted security center performs remote device security verification on the operation station node. If the verification is successful, the device authorization status is updated to authorized, and the trusted security audit report is updated based on the trusted verification result; otherwise, the device authorization status is updated to untrusted.

[0030] Among them, the trusted security audit report is used to store the trusted verification results and detailed information of the unlocking operation. The trusted security center periodically initiates a trusted security check to the operation station node, and dynamically updates the system trusted status according to the trusted security audit report. If the check result is untrusted, the trusted security audit report is updated and the authorization operation is stopped, and the process ends.

[0031] The operation station node is used to receive the verification result and make a judgment. If the verification fails, the process ends; otherwise, the current configuration screen is securely unlocked, which specifically includes the following steps: S31: querying a screen database according to the screen name of the current configuration screen to obtain a node name of the locked current configuration screen; S32: If the node name of the locked current configuration screen obtained in S31 is consistent with the node name of the current operation station node, it means that the current configuration screen has been safely unlocked at the current operation station node, and the process ends; otherwise, a configuration screen unlocking application message is generated, and the configuration screen unlocking application message is sent to the node of the locked current configuration screen in S31, and S33 is executed; The configuration screen unlocking application message includes the current operation station node name and the screen name of the current configuration screen; S33: the node that has locked the current configuration screen parses the configuration screen unlocking application message in S32, and pops up a screen unlocking inquiry window. If the node user that has locked the current configuration screen allows the screen to be unlocked, a reply message that allows unlocking is sent back to the current operation station node; otherwise, a reply message that rejects the unlocking request is sent back to the current operation station node. S34: The current operation station node parses the response message. If it is a response message allowing unlocking, it means that the current operation station node has completed the security unlocking of the current configuration screen, and queries the screen database according to the screen name of the current configuration screen, and updates the node name of the locked current configuration screen in the screen database described in S31 with the current operation station node name described in S32 as the current operation station node, and the process ends. Otherwise, it prompts that the screen unlocking fails and the process ends.

[0032] Embodiment 4 The present invention also provides a computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the method for securely unlocking a configuration screen of a trusted industrial control system when executing the computer program.

[0033] Embodiment 5 The present invention also provides a computer storage medium, wherein the computer storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method for securely unlocking the configuration screen of a trusted industrial control system are implemented.

[0034] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0035] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0036] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0037] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0038] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit its protection scope. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the field should understand that after reading the present invention, those skilled in the art can still make various changes, modifications or equivalent substitutions to the specific implementation methods of the invention, but these changes, modifications or equivalent substitutions are all within the protection scope of the pending claims of the invention.

Claims

1. A method for securely unlocking a configuration screen of a trusted industrial control system, characterized in that: The following steps are involved: The user issues a security unlock command for the current configuration screen at the current operation station node; The trusted security center performs multi-factor dynamic authentication verification on the security unlocking instruction and transmits the verification result back to the operation station node; The operation station node receives the verification result sent back. If the verification fails, the process ends; Otherwise, the current configuration screen is unlocked for security.

2. The method for securely unlocking the configuration screen of a trusted industrial control system according to claim 1, characterized in that: The multi-factor dynamic authentication verification specifically includes: First factor verification: The trusted platform module in the trusted security center performs remote user security verification on the user information. If the verification is successful, the user authorization status is updated to authorized and the second factor verification is entered; otherwise, the user authorization status is updated to untrusted; Second factor verification: The trusted platform module of the trusted security center performs remote device security verification on the operation station node. If the verification is successful, the device authorization status is updated to authorized, and the trusted security audit report is updated based on the trusted verification result; otherwise, the device authorization status is updated to untrusted.

3. The method for securely unlocking the configuration screen of a trusted industrial control system according to claim 2, characterized in that: The trusted security audit report is used to store the trusted verification results and detailed information of the unlocking operation. The trusted security center periodically initiates a trusted security check to the operation station node, and dynamically updates the system trusted status according to the trusted security audit report. If the check result is untrusted, the trusted security audit report is updated and the authorized operation is stopped, and the process ends.

4. The method for securely unlocking a configuration screen of a trusted industrial control system according to claim 1, characterized in that: The secure unlocking of the current configuration screen specifically includes the following steps: S31: querying a screen database according to the screen name of the current configuration screen to obtain a node name of the locked current configuration screen; S32: If the node name of the locked current configuration screen obtained in S31 is consistent with the node name of the current operation station node, it means that the current configuration screen has been safely unlocked at the current operation station node, and the process ends; otherwise, a configuration screen unlocking application message is generated, and the configuration screen unlocking application message is sent to the node of the locked current configuration screen in S31, and S33 is executed; The configuration screen unlocking application message includes the current operation station node name and the screen name of the current configuration screen; S33: the node that has locked the current configuration screen parses the configuration screen unlocking application message in S32, and pops up a screen unlocking inquiry window. If the node user that has locked the current configuration screen allows the screen to be unlocked, a reply message that allows unlocking is sent back to the current operation station node; otherwise, a reply message that rejects the unlocking request is sent back to the current operation station node. S34: The current operation station node parses the response message. If it is a response message allowing unlocking, it means that the current operation station node has completed the security unlocking of the current configuration screen, and queries the screen database according to the screen name of the current configuration screen, and updates the node name of the locked current configuration screen in the screen database described in S31 with the current operation station node name described in S32 as the current operation station node, and the process ends. Otherwise, it prompts that the screen unlocking fails and the process ends.

5. Trusted industrial control system configuration screen security unlocking system, characterized by: Includes trusted security center and operation station nodes; The trusted security center is used to receive the security unlocking instruction of the current configuration screen issued by the user at the current operation station node, and perform multi-factor dynamic authentication verification on the security unlocking instruction, and transmit the verification result back to the operation station node; The operation station node is used to receive the verification result and make a judgment. If the verification fails, the process ends; Otherwise, the current configuration screen is unlocked for security.

6. The trusted industrial control system configuration screen security unlocking system according to claim 5, characterized in that: The multi-factor dynamic authentication verification specifically includes: First factor verification: The trusted platform module in the trusted security center performs remote user security verification on the user information. If the verification is successful, the user authorization status is updated to authorized and the second factor verification is entered; otherwise, the user authorization status is updated to untrusted; Second factor verification: The trusted platform module of the trusted security center performs remote device security verification on the operation station node. If the verification is successful, the device authorization status is updated to authorized, and the trusted security audit report is updated based on the trusted verification result; otherwise, the device authorization status is updated to untrusted.

7. The trusted industrial control system configuration screen security unlocking system according to claim 6, characterized in that: The trusted security audit report is used to store the trusted verification results and detailed information of the unlocking operation. The trusted security center periodically initiates a trusted security check to the operation station node, and dynamically updates the system trusted status according to the trusted security audit report. If the check result is untrusted, the trusted security audit report is updated and the authorized operation is stopped, and the process ends.

8. The trusted industrial control system configuration screen security unlocking system according to claim 5, characterized in that: The secure unlocking of the current configuration screen specifically includes the following steps: S31: querying a screen database according to the screen name of the current configuration screen to obtain a node name of the locked current configuration screen; S32: If the node name of the locked current configuration screen obtained in S31 is consistent with the node name of the current operation station node, it means that the current configuration screen has been safely unlocked at the current operation station node, and the process ends; otherwise, a configuration screen unlocking application message is generated, and the configuration screen unlocking application message is sent to the node of the locked current configuration screen in S31, and S33 is executed; The configuration screen unlocking application message includes the current operation station node name and the screen name of the current configuration screen; S33: the node that has locked the current configuration screen parses the configuration screen unlocking application message in S32, and pops up a screen unlocking inquiry window. If the node user that has locked the current configuration screen allows the screen to be unlocked, a reply message that allows unlocking is sent back to the current operation station node; otherwise, a reply message that rejects the unlocking request is sent back to the current operation station node. S34: The current operation station node parses the response message. If it is a response message allowing unlocking, it means that the current operation station node has completed the security unlocking of the current configuration screen, and queries the screen database according to the screen name of the current configuration screen, and updates the node name of the locked current configuration screen in the screen database described in S31 with the current operation station node name described in S32 as the current operation station node, and the process ends. Otherwise, it prompts that the screen unlocking fails and the process ends.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method for securely unlocking the configuration screen of a trusted industrial control system as described in any one of claims 1 to 4 are implemented.

10. A computer storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the method for securely unlocking the configuration screen of a trusted industrial control system as claimed in any one of claims 1 to 4 are implemented.

Images