Permission monitoring method based on PLC controller

Abstract

The invention provides an authority monitoring method based on a PLC, and the method comprises the steps: obtaining the identity information of a user when a request instruction of the user is received; the identity information of the user comprises a user IP and user terminal type information; constructing a hash chain table for storing identity information of the user according to the user IP; determining an IP address of a flow source according to the Hash chain table and the passing flow, and obtaining a corresponding ID index; determining a corresponding preset control strategy according to the identity type information in the ID index; and when the current behavior of the user is inconsistent with the use permission and the access limitation recorded in the preset control strategy, limiting multiple permissions of the user based on the danger level of the behavior. According to the invention, authority distribution is carried out on PLC operation, operation monitoring is carried out, the safety of the PLC can be effectively protected, and unauthorized personnel are prevented from modifying a PLC program, so that the production safety and stability of an enterprise are guaranteed, and the safety and stability of an industrial control system are guaranteed.

Description

Technical Field

[0001] The present application relates to the field of automatic control technology, and in particular to an authority monitoring method based on a PLC controller. Background Art

[0002] With the continuous development of industrial automation technology, programmable logic controller (PLC) has become the core control device in the field of industrial automation. Programmable logic controller (PLC), a digital operation controller with a microprocessor for automatic control, can load control instructions into memory at any time for storage and execution. The programmable controller consists of functional units such as CPU, instruction and data memory, input / output interface, power supply, digital analog conversion, etc. PLC controller is widely used in various industrial environments with its high reliability, flexibility and ease of use, such as production line automation, robot control, building automation, etc.

[0003] The PLC controller receives signals from external devices through the input interface. These signals can come from various input devices such as sensors, buttons, switches, encoders, etc. The input signals will be divided into two types: digital and analog, and processed using different interfaces. The received input signals will be passed to the central processing unit (CPU). The CPU is the core component of the PLC. It contains one or more processors to execute the program written by the user. In the calculation stage, the CPU will process the input signals through algorithms, logical operations, and conditional statements. After the CPU processes the input signal, it sends the control command to the output module, which is responsible for passing the signal to the external device to complete a specific task. The output signal can be different types of signals such as current, voltage, frequency, etc., which are output through electromagnetic relays, solid-state relays, inverters and other devices. The PLC controller works in a fixed cycle. Each cycle includes three stages: input, calculation and output. The cycle time can be set according to specific needs. The common cycle time is tens of milliseconds to hundreds of milliseconds. Through the cycle cycle, the PLC controller can achieve real-time control operations.

[0004] Given the importance of PLC in industrial control systems, it is very necessary to monitor its operation. Without permission allocation, anyone can read and write PLC internal registers at will, which will bring great security risks to the enterprise and may even cause serious safety accidents. Summary of the invention

[0005] The present application provides a permission monitoring method based on a PLC controller to solve the problem that unauthorized users in the current PLC controller can access and operate the PLC controller at any time, resulting in data leakage and poor security.

[0006] The present application provides a permission monitoring method based on a PLC controller, the method comprising:

[0007] Upon receiving a user's request instruction, obtaining the user's identity information; the user's identity information includes the user's IP address and the user's terminal type information;

[0008] Build a hash list based on the user's IP address to store the user's identity information;

[0009] Determine the IP address of the traffic source according to the hash chain table and the passing traffic, and obtain the corresponding ID index;

[0010] Determine a corresponding preset control strategy according to the identity type information in the ID index;

[0011] When the user's current behavior is inconsistent with the usage permissions and access restrictions recorded in the preset control policy, the user's various permissions are restricted based on the danger level of the behavior.

[0012] In some possible implementations, the identity type information in the preset control policy is stored in the policy in the form of a bitmap, that is, each identity type corresponds to a unique ID; the preset control policy includes an Internet behavior control policy, an audit control policy, and a traffic control policy.

[0013] In some possible implementations, the method further includes:

[0014] The user's current behavior is matched with the usage permissions recorded in the preset control policy; if the match is successful and the audit policy is hit, the user's Internet behavior is audited; if it is unsuccessful, no audit is performed.

[0015] In some possible implementations, the method further includes:

[0016] The user's current behavior is matched with the usage permissions recorded in the preset control policy; if the match is successful and the traffic control policy is hit, the user's traffic is controlled; if it is unsuccessful, no traffic control is performed.

[0017] In some possible implementations, the method further includes:

[0018] The user's current behavior is matched with the usage permissions recorded in the preset control policy; if the match is successful and the audit policy is hit, the user's Internet behavior is audited; if it is unsuccessful, no audit is performed.

[0019] In some possible implementations, the user information sent by the DDI address management device is received by calling the restful interface for user online and offline provided by SAM+.

[0020] In some possible implementations, the method further includes:

[0021] Real-time monitoring of whether the user's current behavior is consistent with the permission behavior recorded in the preset control policy. If abnormal behavior is detected, the user's risk level is evaluated through the built-in first preset model to obtain the risk assessment result;

[0022] Based on the risk assessment results, the control system dynamically adjusts user permissions and access restrictions.

[0023] In some possible implementations, the risk assessment results include level one, level two, and level three;

[0024] When the risk assessment result is level 1, the user is prohibited from importing and / or exporting information to the user profile;

[0025] When the risk assessment result is level 2, the user's access rights to read and modify the profile are disabled;

[0026] When the risk assessment result is level three, users are prohibited from adding or deleting profiles from the list.

[0027] In some possible implementations, the method further includes:

[0028] Record user operation behaviors;

[0029] Downloading a user identity feature map constructed based on a second preset model from a server;

[0030] Compare the user behavior after filtering out redundancy with the behavior pattern in the user identity feature map, and detect abnormal behavior that deviates significantly from the normal behavior pattern through an anomaly detection algorithm;

[0031] Score and categorize detected abnormal behaviors and collect multi-factor data related to users;

[0032] Extract key features from multi-factor data and perform comprehensive risk assessment through ensemble learning algorithms.

[0033] In some possible implementations, the method further includes:

[0034] Monitor user usage in real time and dynamically adjust user permissions and configurations based on actual user behavior and feedback;

[0035] The control system sets upper and lower limits for permissions, and sets the conditions and thresholds for triggering permission adjustments. If it is determined that the user's behavior exceeds the limit, the security response mechanism is activated.

[0036] From the above content, it can be seen that the present application provides a permission monitoring method based on a PLC controller, which includes obtaining the user's identity information when receiving the user's request instruction; the user's identity information includes the user IP and the user terminal type information; constructing a hash chain table for storing the user's identity information according to the user IP; determining the IP address of the traffic source according to the hash chain table and the traffic passing through, and obtaining the corresponding ID index; determining the corresponding preset control strategy according to the identity type information in the ID index; when the user's current behavior is inconsistent with the use authority and access restrictions recorded in the preset control strategy, the user's multiple permissions are restricted based on the danger level of the behavior. The present application implements permission allocation and operation monitoring for PLC operations, which can effectively protect the security of PLCs and prevent unauthorized personnel from modifying PLC programs, thereby ensuring the production safety and stability of enterprises, and ensuring the security and stability of industrial control systems. At the same time, operation implementation monitoring can also help engineers better understand the operation of PLCs, promptly discover and solve operation problems, and improve the efficiency and reliability of industrial control systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the technical solution of the present application, the drawings required for use in the embodiments are briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0038] Figure 1 A flow chart of a permission monitoring method based on a PLC controller provided in an embodiment of the present application. DETAILED DESCRIPTION

[0039] The following embodiments are described in detail, and examples thereof are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementations described in the following embodiments do not represent all implementations consistent with the present application. They are only examples of systems and methods consistent with some aspects of the present application as detailed in the claims.

[0040] With the continuous development of industrial automation technology, programmable logic controller (PLC) has become the core control device in the field of industrial automation. Programmable logic controller (PLC), a digital operation controller with a microprocessor for automatic control, can load control instructions into memory at any time for storage and execution. The programmable controller consists of functional units such as CPU, instruction and data memory, input / output interface, power supply, digital analog conversion, etc. PLC controller is widely used in various industrial environments with its high reliability, flexibility and ease of use, such as production line automation, robot control, building automation, etc.

[0041] The PLC controller receives signals from external devices through the input interface. These signals can come from various input devices such as sensors, buttons, switches, encoders, etc. The input signals will be divided into two types: digital and analog, and processed using different interfaces. The received input signals will be passed to the central processing unit (CPU). The CPU is the core component of the PLC. It contains one or more processors to execute the program written by the user. In the calculation stage, the CPU will process the input signals through algorithms, logical operations, and conditional statements. After the CPU processes the input signal, it sends the control command to the output module, which is responsible for passing the signal to the external device to complete a specific task. The output signal can be different types of signals such as current, voltage, frequency, etc., which are output through electromagnetic relays, solid-state relays, inverters and other devices. The PLC controller works in a fixed cycle. Each cycle includes three stages: input, calculation and output. The cycle time can be set according to specific needs. The common cycle time is tens of milliseconds to hundreds of milliseconds. Through the cycle cycle, the PLC controller can achieve real-time control operations.

[0042] Given the importance of PLC in industrial control systems, it is very necessary to monitor its operation. Without permission allocation, anyone can read and write PLC internal registers at will, which will bring great security risks to the enterprise and may even cause serious safety accidents.

[0043] Based on this, the present application provides a permission monitoring method based on a PLC controller. By allocating permissions to PLC operations and performing operation monitoring, the security of the PLC can be effectively protected, and unauthorized personnel can be prevented from modifying the PLC program, thereby ensuring the production safety and stability of the enterprise and the security and stability of the industrial control system. At the same time, operation implementation monitoring can also help engineers better understand the operation of the PLC, promptly discover and solve operation problems, and improve the efficiency and reliability of the industrial control system.

[0044] In some embodiments, Figure 1 As shown, the present application provides a permission monitoring method based on a PLC controller, the method comprising:

[0045] S1: Upon receiving a request from a user, obtain the user's identity information.

[0046] S2: Build a hash list based on the user's IP address to store the user's identity information.

[0047] S3: Determine the IP address of the traffic source according to the hash linked list and the passing traffic, and obtain the corresponding ID index.

[0048] S4: Determine a corresponding preset control strategy according to the identity type information in the ID index.

[0049] S5: When the user's current behavior is inconsistent with the usage permissions and access restrictions recorded in the preset control policy, the user's various permissions are restricted based on the danger level of the behavior.

[0050] By configuring the Unity software, user permissions are configured for PLC program operations, and a series of operations such as generation, modification, and forcing are recorded in the system log of the Windows system. By writing C# software, relevant PLC operation records in the Windows system log are extracted and written into the SQLServer database. Through C# programming, the records in SQLServer are displayed on the web page, so that users in the LAN can query and view them.

[0051] In some embodiments, the information of identity types in the preset control policy is stored in the policy in the form of a bitmap, that is, each identity type corresponds to a unique ID; the preset control policy includes an Internet behavior control policy, an audit control policy, and a traffic control policy.

[0052] Since the identity type information is stored in the form of a bitmap, fast matching of identity types in the policy can be achieved. Different control strategies are matched for different identity types: Internet behavior control, Internet behavior auditing, and allocation of different bandwidth control strategies, which are applicable to a variety of different application scenarios. The method provided in this application supports the import of identity type files, realizes the rapid update of the final identity type list, and thus satisfies the control of newly added identity types.

[0053] In some embodiments, the method further comprises:

[0054] The user's current behavior is matched with the usage permissions recorded in the preset control policy; if the match is successful and the audit policy is hit, the user's Internet behavior is audited; if it is unsuccessful, no audit is performed.

[0055] In some embodiments, the method further comprises:

[0056] The user's current behavior is matched with the usage permissions recorded in the preset control policy; if the match is successful and the traffic control policy is hit, the user's traffic is controlled; if it is unsuccessful, no traffic control is performed.

[0057] In some embodiments, the method further comprises:

[0058] The user's current behavior is matched with the usage permissions recorded in the preset control policy; if the match is successful and the audit policy is hit, the user's Internet behavior is audited; if it is unsuccessful, no audit is performed.

[0059] The Internet behavior control strategy, audit strategy and flow control strategy are three different types of control strategies. According to the priority, the Internet behavior control strategy and flow control strategy have higher priority than the audit strategy. Therefore, in the actual operation process, the Internet behavior control strategy and flow control strategy must be matched and controlled before the audit strategy can be matched and controlled. Since the Internet behavior control strategy and flow control strategy are independent of each other and have no connection with each other, in actual applications, only one or more control strategies may be implemented according to different scenarios.

[0060] In some embodiments, the user information sent by the DDI address management device is received by calling the restful interface for user online and offline provided by SAM+.

[0061] After the PLC controller obtains user information (including user IP, user terminal type, etc.), it calls the restful interface for user online and offline provided by SAM+ (http: / / SAM server address: port number / sam / rest / dhcp / userOnline) and uploads relevant information to the server in json format.

[0062] In some embodiments, the method further comprises:

[0063] Real-time monitoring of whether the user's current behavior is consistent with the permission behavior recorded in the preset control policy. If abnormal behavior is detected, the user's risk level is evaluated through the built-in first preset model to obtain the risk assessment result;

[0064] Based on the risk assessment results, the control system dynamically adjusts user permissions and access restrictions.

[0065] Real-time monitoring of user behavior can promptly detect potential abnormal behavior; by comparing with user identity feature maps and using anomaly detection algorithms, the system can accurately identify abnormal behaviors that deviate significantly from normal behavior patterns, effectively reducing false positives and false negatives; if abnormal behavior is detected, the built-in risk assessment model will be used to assess the user's risk level based on multiple factors. These factors include the user's history, behavior patterns, and current environment; based on the risk assessment results, the system can dynamically adjust the user's permissions and access restrictions. For example, for users with higher risks, the system can restrict their access to specific interfaces, or require additional security measures such as secondary verification.

[0066] In some embodiments, the risk assessment results include level one, level two, and level three;

[0067] When the risk assessment result is level 1, the user is prohibited from importing and / or exporting information to the user profile;

[0068] When the risk assessment result is level 2, the user's access rights to read and modify the profile are disabled;

[0069] When the risk assessment result is level three, users are prohibited from adding or deleting profiles from the list.

[0070] In some embodiments, the method further comprises:

[0071] Record user operation behaviors;

[0072] Downloading a user identity feature map constructed based on a second preset model from a server;

[0073] Compare the user behavior after filtering out redundancy with the behavior pattern in the user identity feature map, and detect abnormal behavior that deviates significantly from the normal behavior pattern through an anomaly detection algorithm;

[0074] Score and categorize detected abnormal behaviors and collect multi-factor data related to users;

[0075] Extract key features from multi-factor data and perform comprehensive risk assessment through ensemble learning algorithms.

[0076] Through the built-in deep learning model, the user's multimodal identity data and historical behavior data are analyzed to build a user identity feature map. This map can comprehensively reflect the user's identity characteristics and behavior patterns; it monitors in real time whether the user's current behavior is consistent with the map. If abnormal behavior is detected, the built-in risk assessment model is used to assess the user's risk level based on multiple factors. After abnormal behavior is discovered in a timely manner, risk assessment is conducted, and targeted rapid response and disposal measures are taken to effectively reduce the impact of potential risks; through real-time monitoring, accurate identification and comprehensive evaluation, the system can improve the security and reliability of the system and ensure the security and stable operation of user data and system resources.

[0077] In some embodiments, the method further comprises:

[0078] Monitor user usage in real time and dynamically adjust user permissions and configurations based on actual user behavior and feedback;

[0079] The control system sets upper and lower limits for permissions, and sets the conditions and thresholds for triggering permission adjustments. If it is determined that the user's behavior exceeds the limit, the security response mechanism is activated.

[0080] By setting upper and lower limits for permissions, and setting conditions and thresholds for triggering permission adjustments, when the user's behavior exceeds the limit, the system will automatically adjust the permissions or trigger a security response mechanism to protect the security and stability of the system and effectively prevent malicious operations and security threats; based on the user's actual behavior and feedback, the permissions and configuration of the interface are dynamically adjusted to enable users to access the required interface functions more efficiently, reducing unnecessary operation steps and time consumption, and improving the overall efficiency and performance of the system.

[0081] The PLC controller-based permission monitoring method provided in the above embodiment can effectively protect the security of the PLC by allocating permissions for PLC operations and performing operation monitoring, and prevent unauthorized personnel from modifying the PLC program, thereby ensuring the production safety and stability of the enterprise and the security and stability of the industrial control system.

[0082] It can be seen from the above embodiments that the present application provides a permission monitoring method based on a PLC controller, the method comprising obtaining the user's identity information when receiving a user's request instruction; the user's identity information includes the user IP and the user terminal type information; constructing a hash chain table for storing the user's identity information according to the user IP; determining the IP address of the traffic source according to the hash chain table and the traffic passing through, and obtaining the corresponding ID index; determining the corresponding preset control strategy according to the identity type information in the ID index; when the user's current behavior is inconsistent with the usage permissions and access restrictions recorded in the preset control strategy, the user's multiple permissions are restricted based on the danger level of the behavior. The present application implements permission allocation and operation monitoring for PLC operations, which can effectively protect the security of PLCs and prevent unauthorized personnel from modifying PLC programs, thereby ensuring the production safety and stability of enterprises, and ensuring the security and stability of industrial control systems. At the same time, operation implementation monitoring can also help engineers better understand the operation of PLCs, promptly discover and solve operation problems, and improve the efficiency and reliability of industrial control systems.

[0083] Similar parts between the embodiments provided in this application can be referenced to each other. The specific implementation methods provided above are only a few examples under the general concept of this application and do not constitute a limitation on the protection scope of this application. For those skilled in the art, any other implementation methods expanded based on the scheme of this application without creative work belong to the protection scope of this application.

Claims

1. A permission monitoring method based on a PLC controller, characterized in that: The method comprises: Upon receiving a user's request instruction, obtaining the user's identity information; the user's identity information includes the user's IP address and the user's terminal type information; Build a hash list based on the user's IP address to store the user's identity information; Determine the IP address of the traffic source according to the hash chain table and the passing traffic, and obtain the corresponding ID index; Determine a corresponding preset control strategy according to the identity type information in the ID index; When the user's current behavior is inconsistent with the usage permissions and access restrictions recorded in the preset control policy, the user's various permissions are restricted based on the danger level of the behavior.

2. The authority monitoring method based on PLC controller according to claim 1 is characterized in that: The information of identity types in the preset control strategy is stored in the strategy in the form of a bitmap, that is, each identity type corresponds to a unique ID; The preset control strategies include Internet behavior control strategy, audit control strategy and traffic control strategy.

3. The authority monitoring method based on PLC controller according to claim 2 is characterized in that: The method further comprises: The user's current behavior is matched with the usage permissions recorded in the preset control policy; if the match is successful and the audit policy is hit, the user's Internet behavior is audited; if it is unsuccessful, no audit is performed.

4. The authority monitoring method based on PLC controller according to claim 3 is characterized in that: The method further comprises: The user's current behavior is matched with the usage permissions recorded in the preset control policy; if the match is successful and the traffic control policy is hit, the user's traffic is controlled; if it is unsuccessful, no traffic control is performed.

5. The authority monitoring method based on PLC controller according to claim 4 is characterized in that: The method further comprises: The user's current behavior is matched with the usage permissions recorded in the preset control policy; if the match is successful and the audit policy is hit, the user's Internet behavior is audited; if it is unsuccessful, no audit is performed.

6. The authority monitoring method based on PLC controller according to claim 1 is characterized in that: Receive user information sent by the DDI address management device based on the restful interface for user online and offline provided by SAM+.

7. The authority monitoring method based on PLC controller according to claim 1 is characterized in that: The method further comprises: Real-time monitoring of whether the user's current behavior is consistent with the permission behavior recorded in the preset control policy. If abnormal behavior is detected, the user's risk level is evaluated through the built-in first preset model to obtain the risk assessment result; Based on the risk assessment results, the control system dynamically adjusts user permissions and access restrictions.

8. The authority monitoring method based on PLC controller according to claim 7 is characterized in that: The risk assessment results include level one, level two and level three; When the risk assessment result is level 1, the user is prohibited from importing and / or exporting information to the user profile; When the risk assessment result is level 2, the user's access rights to read and modify the profile are disabled; When the risk assessment result is level three, users are prohibited from adding or deleting profiles from the list.

9. The authority monitoring method based on PLC controller according to claim 1 is characterized in that: The method further comprises: Record user operation behaviors; Downloading a user identity feature map constructed based on a second preset model from a server; Compare the user behavior after filtering out redundancy with the behavior pattern in the user identity feature map, and detect abnormal behavior that deviates significantly from the normal behavior pattern through an anomaly detection algorithm; Score and categorize detected abnormal behaviors and collect multi-factor data related to users; Extract key features from multi-factor data and perform comprehensive risk assessment through ensemble learning algorithms.

10. The authority monitoring method based on PLC controller according to claim 1 is characterized in that: The method further comprises: Monitor user usage in real time and dynamically adjust user permissions and configurations based on actual user behavior and feedback; The control system sets upper and lower limits for permissions, and sets the conditions and thresholds for triggering permission adjustments. If it is determined that the user's behavior exceeds the limit, the security response mechanism is activated.

Images