Access system and access method of industrial control equipment

Abstract

The invention discloses an access system and an access method of industrial control equipment, and the access system comprises an application program interface which is used for receiving an access request for accessing system resources sent by an application program and transferring a target execution result into the application program, and the application program is written through a programming structure and needs to be pre-loaded into the system; the bridging module is connected with the industrial control equipment through a bus and is connected with the processor in the system; the industrial control equipment is controlled through the input industrial control equipment control instruction, so that the control of the entity industrial control equipment and the sensing of the actual operation condition are realized under the cooperation of the industrial control equipment control instruction and the operation data in the use scene of the industrial control equipment; and the control convenience of the industrial control equipment is greatly improved.

Description

Technical Field

[0001] The invention belongs to the field of communication technology, in particular to an access system and an access method of industrial control equipment. Background Art

[0002] With the continuous development of the Internet and mobile Internet, the scope of business applications has become wider, and more business products can be connected to the Internet to meet users' remote access and remote management needs. With the development of enterprises, the connection between equipment and business has become closer. When equipment fails, it will affect the success rate of business. At the same time, there are many devices in industrial plants, which will lead to the dispersion of manpower and the inability to monitor the status of equipment in time. When equipment fails or is infected with a virus, it will stop working, which will affect the business. The existence of viruses will also affect other business systems and networks.

[0003] Existing remote access and remote management are usually implemented based on a platform-based management model. In platform-based management, users generally need to register an account on the platform in advance, and then obtain the address associated with the business product based on the account and the corresponding password, so as to achieve remote access and remote management. However, in this platform-based management model, on the one hand, users are required to register and configure in advance, and the operation is relatively cumbersome; on the other hand, the account, password and other related data on the platform are also easily attacked and leaked, causing security incidents. Summary of the invention

[0004] In order to solve the above technical problems, the present invention provides an access system and access method for industrial control equipment to solve the problem that the existing remote access and remote management in the prior art are usually implemented based on a platform management mode. In platform management, users generally need to register an account on the platform in advance, and then obtain the address associated with the business product based on the account and the corresponding password.

[0005] In order to achieve the above object, the present invention adopts the following technical solution: The present invention provides an access system for industrial control equipment, comprising: An application program interface, used to receive access requests sent by an application program to access system resources, and transfer target execution results to the application program, wherein the application program is written through a programming structure and pre-loaded into the system; A bridge module is connected to the industrial control device via a bus and is connected to the processor in the system; An acquisition module, used to obtain the data operation delay and holding time of the system and the industrial control equipment respectively; The authentication module is used to authenticate the identity of the user accessing the industrial control device, and when the access request is made to the application program interface of the access service node, it is determined that the accessing user has passed the authentication and entered the secure tunnel; The processor is used to send a read signal or a write signal to the industrial control device through a bus to achieve read access or write access to the industrial control device.

[0006] A further improvement of the present invention is that the application program interface is a set of definitions, programs and protocols, and mutual communication between computer software is achieved through the API interface. One of the main functions of the API is to provide a common function set.

[0007] A further improvement of the present invention is that when the system accesses the industrial control device, the bridge module adjusts the timing of the access signal according to the adjustment parameter so that the system accesses the industrial control device according to the adjusted timing, wherein the access signal is a signal sent by the system to the industrial control device.

[0008] A further improvement of the present invention is that the bridge module includes a read access control signal unit and a write access control signal unit, wherein the read access control signal unit is used to adjust the chip select signal and the read signal sent by the bus according to the adjustment parameters, and send them to another bus to read the data of the industrial control device, wherein the write access control signal unit is used to adjust the chip select signal and the write signal sent by the bus according to the adjustment parameters, and send them to another bus to write the system data into the industrial control device.

[0009] A further improvement of the present invention is that, under the premise of authentication security, the authentication module determines the first secure tunnel based on the forwarding tunnel determination strategy, and forwards the user access request to the corresponding intranet application access service node through the first secure tunnel. Authentication is performed based on the authentication strategy and the information carried in the user access request.

[0010] The present invention also provides an access method for industrial control equipment, comprising: The access rights of the industrial control equipment are set. When receiving the access request, the data operation delay and the holding time are first obtained, and the adjustment parameters are calculated according to the operation delay and the holding time. The authentication information needs to be verified; Send access request information to the preset network through the terminal, verify the application interface account and permissions, authenticate the password and permissions of the access account, and check whether the authentication information is correct; The authentication is correct, and then the remote access to the industrial control device is triggered to enter the industrial control device usage scenario.

[0011] A further improvement of the present invention is that the access request information includes the visitor address of the terminal, the operation type on the industrial control device terminal and the line mark of the visited network where the visited terminal is located. When the preset access conditions are met, the terminal accesses the visited address of the visited network from the preset network structure, and establishes a connection between the terminal and the industrial control device terminal based on the visited address.

[0012] A further improvement of the present invention is that the visitor address obtains the corresponding user information of the access data of the target device, loads the target display platform matching the target user, and triggers the target display platform to send a target data query request to the target search engine corresponding to the target user.

[0013] A further improvement of the present invention is that, when presetting access rights, the pre-set network is connected to the terminal of the industrial control device via a network structure.

[0014] A further improvement of the present invention is that, when the authentication information is passed, a visitor address is sent to the visited network so that the visited network can configure access settings to allow access by the visitor terminal; and a visited address of the visited network is sent to the visitor terminal so that the visitor terminal can establish a connection with the industrial control device terminal.

[0015] Compared with the prior art, the present invention has at least the following beneficial technical effects: The present invention provides an access system and an access method for industrial control equipment. When an intranet application access service node fails, there is no need to change the user-side networking and the forwarding tunnel is directly switched to ensure the user's intranet access service. In addition, multiple intranet application access service nodes can authenticate user access requests at the same time, thereby improving the stability and high reliability of user service access.

[0016] The present invention provides an access system and method for industrial control equipment, which accesses the industrial control equipment by triggering in a terminal to enter the industrial control equipment use scenario, listens to the input industrial control equipment control instructions in the scenario interface, and reports them to the server to obtain the operating data returned by the server, and broadcasts the working process of the industrial control equipment according to the operating data in the industrial control equipment use scenario.

[0017] In addition, the industrial control equipment is controlled by input industrial control equipment control instructions. Therefore, in the industrial control equipment usage scenario, the coordination of industrial control equipment control instructions and operating data realizes the control of the physical industrial control equipment and the perception of the actual operating status. Since this is all done through the network, the convenience of industrial control equipment control is greatly improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1It is a structural block diagram of an access system for industrial control equipment of the present invention; Figure 2 The present invention is a flowchart of a method for accessing industrial control equipment. DETAILED DESCRIPTION

[0019] In the following, only some exemplary embodiments are briefly described. As those skilled in the art will appreciate, the described embodiments may be modified in various ways without departing from the spirit or scope of the present invention. Therefore, the drawings and descriptions are considered to be exemplary and non-restrictive in nature.

[0020] It should be understood that when used in this specification and the appended claims, the terms "include" and "comprises" indicate the presence of described features, integers, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or combinations thereof.

[0021] It should also be understood that the terms used in the present specification are only for the purpose of describing specific embodiments and are not intended to limit the present invention. As used in the present specification and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include plural forms.

[0022] It should be further understood that the term "and / or" used in the present description and the appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0023] Various structural schematic diagrams of the embodiments disclosed in the present invention are shown in the accompanying drawings. These figures are not drawn to scale, and some details are magnified and some details may be omitted for the purpose of clear expression. The shapes of various regions and layers shown in the figures and the relative sizes and positional relationships therebetween are only exemplary, and may deviate in practice due to manufacturing tolerances or technical limitations, and those skilled in the art may additionally design regions / layers with different shapes, sizes, and relative positions according to actual needs.

[0024] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0025] Example 1 like Figure 1 As shown, this embodiment provides an access system for industrial control equipment, including: An application program interface, used to receive access requests sent by applications to access system resources and transfer target execution results to the applications, wherein the applications are written through programming structures and need to be pre-loaded into the system; A bridge module is connected to the industrial control device via a bus and is connected to the processor in the system; An acquisition module, used to obtain the data operation delay and holding time of the system and the industrial control equipment respectively; The authentication module is used to authenticate the identity of the user accessing the industrial control device, and when the access request is made to the application program interface of the access service node, it is determined that the accessing user has passed the authentication and entered the secure tunnel; The processor is used to send a read signal or a write signal to the industrial control device through a bus to achieve read access or write access to the industrial control device.

[0026] As an embodiment of the present invention, an application program interface is a set of definitions, programs and protocols. The API interface enables mutual communication between computer software. One of the main functions of the API is to provide a common function set. The API interface is a protocol or tool set that enables software applications to communicate with each other. Through the API, a software application (called a client) can request another software application (called a server or API provider) to perform certain functions without knowing the implementation details inside the server. The API defines a set of rules, standards or interfaces to enable data to be exchanged between the client and the server.

[0027] As an embodiment of the present invention, when the system accesses the industrial control device, the bridge module adjusts the timing of the access signal according to the adjustment parameters, so that the system accesses the industrial control device according to the adjusted timing, wherein the access signal is a signal sent by the system to the industrial control device. In the industrial automation system, the bridge module plays a key role, especially when the system needs to access the industrial control device. These bridge modules can adjust the timing of the access signal according to the adjustment parameters to ensure that the system can accurately interact with the industrial control device according to the optimized timing.

[0028] As an embodiment of the present invention, the bridge module includes a read access control signal unit and a write access control signal unit, wherein the read access control signal unit is used to adjust the chip select signal and the read signal sent by the bus according to the adjustment parameters, and send them to another bus to read the data of the industrial control device, wherein the write access control signal unit is used to adjust the chip select signal and the write signal sent by the bus according to the adjustment parameters, and send them to another bus to write the system data to the industrial control device. The main responsibility of the read access control signal unit is to adjust the chip select signal (Chip Select, CS) and the read signal (Read, RD) received from the system bus according to the preset adjustment parameters. These adjustments may include signal delay, width change or phase adjustment, etc., to ensure that when the signal reaches the interface of the industrial control device, its timing meets the requirements of the device. The adjusted signal will be sent to another bus (which may be an internal bus connected to the industrial control device), thereby triggering the device to perform a read operation and return the data to the system. Similar to the read access control signal unit, the write access control signal unit is also responsible for adjusting the chip select signal and the write signal sent by the system bus according to the adjustment parameters. However, during the write access process, the unit also needs to send the data that the system wants to write to the industrial control device together with the adjusted write signal to the target bus. In this way, when the industrial control device receives the write signal and data, it can be updated or configured accordingly according to the content of the data.

[0029] As an implementation mode of the present invention, the authentication module, under the premise of authentication security, determines the first secure tunnel according to the forwarding tunnel determination strategy, and forwards the user access request to the corresponding intranet application access service node through the first secure tunnel. The authentication is performed based on the authentication strategy and the information carried in the user access request.

[0030] As an embodiment of the present invention, the processor is used to send a read signal or a write signal to the industrial control device through the bus to achieve read access or write access to the industrial control device. The processor is a functional unit that interprets and executes instructions, also known as a central processing unit (CPU). It is the central nervous system of the computer, responsible for executing instructions in the computer program, performing data processing and logical judgment. The main functions of the processor include interpreting computer instructions, processing data in computer software, and controlling the operation of the computer system.

[0031] Example 2 like Figure 2 As shown, this embodiment provides a method for accessing an industrial control device, including: The access rights of the industrial control equipment are set. When receiving the access request, the data operation delay and the holding time are first obtained, and the adjustment parameters are calculated according to the operation delay and the holding time. The authentication information needs to be verified; Send access request information to the preset network through the terminal, verify the application interface account and permissions, authenticate the password and permissions of the access account, and check whether the authentication information is correct; The authentication is correct, and then the remote access to the industrial control device is triggered to enter the industrial control device usage scenario.

[0032] As an embodiment of the present invention, the access request information includes the visitor address of the terminal, the operation type of the industrial control device terminal and the line mark of the visited network where the visited terminal is located. When the preset access conditions are met, the terminal accesses the visited address of the visited network from the preset network structure, and establishes a connection between the terminal and the industrial control device terminal based on the visited address.

[0033] As an implementation mode of the present invention, the visitor address obtains the corresponding user information of the access data of the target device, loads the target display platform matching the target user, and triggers the target display platform to send a target data query request to the target search engine corresponding to the target user.

[0034] As an implementation manner of the present invention, when the access rights are preset, the preset network is connected to the terminal of the industrial control device through a network structure.

[0035] As an embodiment of the present invention, when the authentication information is passed, a visitor address is sent to the visited network so that the visited network configures access settings to allow access by the visitor terminal; and a visited address of the visited network is sent to the visitor terminal so that the visitor terminal establishes a connection with the industrial control device terminal.

[0036] The industrial control device on which this embodiment is based is controlled by input industrial control device control instructions. Therefore, in the industrial control device usage scenario, the coordination of industrial control device control instructions and operating data realizes the control of the physical industrial control device and the perception of the actual operating status. Since this is all done through the network, the convenience of industrial control device control is greatly improved.

[0037] Example 3 This embodiment provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method for accessing an industrial control device are implemented.

[0038] The choice of application interface depends on the periodicity of data packet transmission in the network. The choice of bridge module will affect the flexibility of classification. When the bridge module is too large, abnormal packets will be judged as normal, thereby reducing the recall rate. If the bridge module value is too small, any slight change in the data packet will be judged as abnormal, increasing the false alarm rate. In order to balance the two, the bridge module is set to 0.2, as well as the setting of distributed control system (DCS), a system used for process control, which monitors and controls the production process through field control units. Programmable logic controller (PLC), used in various industrial automation scenarios, such as machinery manufacturing, automobile manufacturing, petrochemicals, etc., is responsible for receiving input signals, executing control logic and outputting control signals. Remote terminal unit (RTU), used for remote monitoring and data acquisition, adapted to industrial application scenarios that require remote monitoring.

[0039] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0040] The present application is described with reference to the flowcharts and / or block diagrams of the methods, systems and computer program products according to the embodiments of the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A system that specifies the functions of a box or boxes.

[0041] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0042] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0043] The above shows and describes the basic principles and main features of the present invention and the advantages of the present invention. It is obvious to those skilled in the art that the present invention is not limited to the details of the above exemplary embodiments, and the present invention can be implemented in other specific forms without departing from the spirit or basic features of the present invention. Therefore, no matter from which point of view, the embodiments should be regarded as exemplary and non-restrictive. The scope of the present invention is defined by the attached claims rather than the above description, and it is intended that all changes falling within the meaning and scope of the equivalent elements of the claims are included in the present invention. Any figure mark in the claims should not be regarded as limiting the claims involved.

[0044] In addition, it should be understood that although this specification is described in accordance with the implementation modes, not every implementation mode contains only one independent technical solution. This description of the specification is only for the sake of clarity. Those skilled in the art should regard the specification as a whole. The technical solutions in each embodiment can also be appropriately combined to form other implementation modes that can be understood by those skilled in the art. The above content is only to illustrate the technical idea of ​​the present invention, and cannot be used to limit the protection scope of the present invention. Any changes made on the basis of the technical solution according to the technical idea proposed by the present invention shall fall within the protection scope of the claims of the present invention.

Claims

1. An access system for industrial control equipment, characterized in that: include: An application program interface, used to receive access requests sent by an application program to access system resources, and transfer target execution results to the application program, wherein the application program is written through a programming structure and pre-loaded into the system; A bridge module is connected to the industrial control device via a bus and is connected to the processor in the system; An acquisition module, used to obtain the data operation delay and holding time of the system and the industrial control equipment respectively; The authentication module is used to authenticate the identity of the user accessing the industrial control device, and when the access request is made to the application program interface of the access service node, it is determined that the accessing user has passed the authentication and entered the secure tunnel; The processor is used to send a read signal or a write signal to the industrial control device through a bus to achieve read access or write access to the industrial control device.

2. The access system for industrial control equipment according to claim 1, characterized in that: An application programming interface is a set of definitions, programs, and protocols that enable computer software to communicate with each other through the API interface. One of the main functions of the API is to provide a common set of functions.

3. The access system for industrial control equipment according to claim 1, characterized in that: When the system accesses the industrial control device, the bridge module adjusts the timing of the access signal according to the adjustment parameter, so that the system accesses the industrial control device according to the adjusted timing, wherein the access signal is a signal sent by the system to the industrial control device.

4. The access system for industrial control equipment according to claim 1, characterized in that: The bridge module includes a read access control signal unit and a write access control signal unit, wherein the read access control signal unit is used to adjust the chip select signal and the read signal sent by the bus according to the adjustment parameters, and send them to another bus to read the data of the industrial control device, wherein the write access control signal unit is used to adjust the chip select signal and the write signal sent by the bus according to the adjustment parameters, and send them to another bus to write the system data into the industrial control device.

5. The access system for industrial control equipment according to claim 1, characterized in that: Under the premise of authentication security, the authentication module determines the first secure tunnel based on the forwarding tunnel determination strategy, and forwards the user access request to the corresponding intranet application access service node through the first secure tunnel. Authentication is performed based on the authentication strategy and the information carried in the user access request.

6. A method for accessing industrial control equipment, characterized in that: The method is based on the access system of the industrial control device according to any one of claims 1 to 5, comprising: The access rights of the industrial control equipment are set. When the access request is received, the data operation delay and the holding time are first obtained, and the adjustment parameters are calculated according to the operation delay and the holding time. The authentication information needs to be verified; Send access request information to the preset network through the terminal, verify the application interface account and permissions, authenticate the password and permissions of the access account, and check whether the authentication information is correct; If the authentication is correct, remote access to the industrial control device is triggered to enter the industrial control device usage scenario.

7. The method for accessing industrial control equipment according to claim 6, characterized in that: The access request information includes the visitor address of the terminal, the operation type on the industrial control device terminal and the line mark of the visited network where the visited terminal is located. When the preset access conditions are met, the terminal accesses the visited address of the visited network from the preset network structure, and establishes a connection between the terminal and the industrial control device terminal based on the visited address.

8. The method for accessing industrial control equipment according to claim 7, characterized in that: The visitor address obtains the corresponding user information of the access data of the target device, loads the target display platform matching the target user, and triggers the target display platform to send a target data query request to the target search engine corresponding to the target user.

9. The method for accessing industrial control equipment according to claim 6, characterized in that: When the access rights are preset, the preset network is connected to the terminal of the industrial control device through a network structure.

10. The method for accessing industrial control equipment according to claim 6, characterized in that: When the authentication information is passed, the visitor address is sent to the visited network so that the visited network can configure access settings to allow access by the visitor terminal; and the visited address of the visited network is sent to the visitor terminal so that the visitor terminal can establish a connection with the industrial control device terminal.

Images