DCS controller credible alarm uploading method, system and device and storage medium

Abstract

The invention belongs to the field of distributed control systems, and provides a DCS controller credible alarm uploading method, system and device and a storage medium, and the method comprises the steps: S1, a credible proxy service module monitors and obtains alarm information generated by a credible module in a DCS controller in real time; s2, the trusted proxy service module analyzes the alarm information and generates an alarm information message; s3, the trusted proxy service module sends the alarm information message to DCS system control software; the DCS system control software runs in an operating system of the DCS controller; s4, the DCS system control software receives the alarm information message and sends the alarm information message to a trusted management center by using a communication link; wherein the communication link is an encrypted communication link based on a UDP (User Datagram Protocol) and depending on a TPM (Trusted Platform Module). According to the invention, the alarm information can be sent timely, efficiently and safely, and the reliability and safety of the DCS system are improved.

Description

Technical Field

[0001] The invention belongs to the field of distributed control systems, and in particular relates to a method, system, device and storage medium for sending a trusted alarm of a DCS controller. Background Art

[0002] Distributed Control System (DCS) is a new generation of instrument control system based on microprocessor, which adopts the design principle of decentralized display of control functions, centralized operation, and takes into account the principle of decentralized autonomy and comprehensive coordination. Its main features are centralized management and decentralized control, that is, the control functions are decentralized on multiple controllers, while the operation and management are carried out through centralized operator stations. DCS system is widely used in various industries such as power, metallurgy, petrochemical, pharmaceutical, water treatment, etc., and is one of the important technologies in the field of modern industrial automation.

[0003] The DCS system mainly consists of the following parts: (1) Control station: responsible for system monitoring, data acquisition and control algorithm execution, and is the core part of the DCS system. (2) Controller: executes the control algorithm and controls field equipment, such as valves, motors, etc. (3) Communication network: used to connect the control station, controller and field equipment to achieve real-time data transmission and remote control of instructions. (4) Human-machine interface: provides a window for users to interact with the DCS system, such as the operator station, which is used to display production data, adjust control parameters and perform fault diagnosis. (5) Database: stores DCS system data and configuration information, and provides data support for the normal operation of the DCS system.

[0004] A DCS system with trusted functions is a trusted distributed control system developed based on industrial technology. It is necessary to improve the security and reliability of the DCS system during operation. In order for the trusted management center to fully and in real time understand the trusted component status of all DCS controllers, and to provide more accurate security services to the managed DCS controllers and display the current status of the trusted security policy, the DCS controller needs to send alarm information based on the trusted function in a timely and accurate manner.

[0005] Existing alarm information uploading usually relies on external communication networks. For methods that rely on external communication networks to upload alarm information, such as emails, text messages, etc., their stability and reliability are affected by the external network, resulting in poor stability and reliability, which can easily cause the alarm information to be not uploaded in time or fail to be uploaded, posing a threat to the security of the DCS system. Summary of the invention

[0006] In order to solve the above-mentioned problems of the prior art, the present invention provides a DCS controller trusted alarm sending method, system, device and storage medium, which can monitor the alarm information generated by the trusted module in the DCS controller in real time, and can send the alarm information in a timely, efficient and safe manner, thereby improving the reliability and security of the DCS system.

[0007] The present invention is achieved through the following technical solutions: In a first aspect, the present invention provides a method for sending a trusted alarm of a DCS controller, comprising: S1, the trusted proxy service module monitors and obtains the alarm information generated by the trusted module in the DCS controller in real time; S2, the trusted proxy service module parses the alarm information and generates an alarm information message; S3, the trusted proxy service module sends the alarm information message to the DCS system control software; the DCS system control software runs on the operating system of the DCS controller; S4, the DCS system control software receives the alarm information message and sends the alarm information message to the trusted management center using a communication link; wherein the communication link is an encrypted communication link based on the User Datagram Protocol (UDP) and relying on the Trusted Platform Module (TPM).

[0008] Preferably, in S1, the trusted module includes a static trusted module, an unknown program immunity module, a process trusted module and an application access control module.

[0009] Preferably, in S1, the trusted proxy service module divides the acquired different alarm information into high priority, medium priority and low priority, and performs S2 in the order of high priority, medium priority and low priority.

[0010] Furthermore, high-priority alarm information includes: information that components, files or processes of DCS system control software have been tampered with.

[0011] Furthermore, the medium priority alarm information includes: information on the start-up or exit of the monitoring object of the trusted module.

[0012] Furthermore, low-priority alarm information includes: information generated periodically.

[0013] Preferably, in S4, after receiving the alarm information message, the DCS system control software returns an ACK (Acknowledge character) to the trusted proxy service module.

[0014] In a second aspect, the present invention provides a DCS controller trusted alarm sending system, comprising: The trusted proxy service module is used to monitor and obtain the alarm information generated by the trusted module in the DCS controller in real time; parse the alarm information and generate an alarm information message; send the alarm information message to the DCS system control software; the DCS system control software runs on the operating system of the DCS controller; The DCS system control software is used to receive the alarm information message and send the alarm information message to the trusted management center using a communication link; wherein the communication link is an encrypted communication link based on the UDP protocol and relying on the TPM module.

[0015] In a third aspect, the present invention provides a computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the DCS controller trusted alarm uploading method as described above when executing the computer program.

[0016] In a fourth aspect, the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the DCS controller trusted alarm sending method as described above is implemented.

[0017] Compared with the prior art, the present invention has the following beneficial effects: The DCS controller trusted alarm uploading method of the present invention can use the trusted proxy service module to monitor the alarm information generated by the trusted module in the DCS controller in real time, timely discover the trusted security-related problems that are more threatening, improve the reliability and security of the DCS system, greatly reduce the security management overhead of the DCS system, and help the system administrator to better understand the operation of the DCS system. At the same time, the alarm information message is sent to the trusted management center using an encrypted communication link based on the UDP protocol and relying on the TPM module. The UDP protocol can improve the data transmission efficiency, and the TPM module can ensure the security of the data during the transmission process. Therefore, the present invention uses an encrypted communication link based on the UDP protocol and relying on the TPM module to transmit the alarm information message, which not only has high transmission efficiency, but also can ensure the integrity and security of the alarm information message during the transmission process. And the present invention can use the communication link of the original DCS system control software to send the trusted security-related alarm information of each DCS controller to the trusted management center without occupying too many system resources.

[0018] Furthermore, the alarm information is divided into different levels, and the processing of alarm information of different levels is divided into different priorities of high, medium and low, so as to achieve a balance between function realization and resource occupation, occupying fewer system resources to ensure that the DCS controller has sufficient resources to quickly respond to business needs. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0020] Figure 1 The present invention is a flow chart of the DCS controller trusted alarm sending method. DETAILED DESCRIPTION

[0021] The following describes the embodiments of the present invention through specific examples, and those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention.

[0022] It should be noted that the process equipment or devices not specifically specified in the following embodiments are all conventional equipment or devices in the art.

[0023] In addition, it should be understood that one or more method steps mentioned in the present invention do not exclude the existence of other method steps before or after the combination step or the insertion of other method steps between these explicitly mentioned steps, unless otherwise specified; it should also be understood that the combination connection relationship between one or more devices / apparatuses mentioned in the present invention does not exclude the existence of other devices / apparatuses before or after the combination device / apparatus or the insertion of other devices / apparatuses between these explicitly mentioned two devices / apparatuses, unless otherwise specified. Moreover, unless otherwise specified, the numbering of each method step is only a convenient tool for identifying each method step, and is not intended to limit the order of arrangement of each method step or the scope of the present invention. Changes or adjustments in their relative relationships should also be regarded as the scope of the present invention without substantially changing the technical content.

[0024] See also Figure 1 The present invention provides a DCS controller trusted alarm sending method, comprising: S1, the trusted proxy service module monitors and obtains the alarm information generated by the trusted module in the DCS controller in real time; S2, the trusted proxy service module parses the alarm information and generates an alarm information message; S3, the trusted proxy service module sends the alarm information message to the DCS system control software; the DCS system control software runs on the operating system of the DCS controller; S4, the DCS system control software receives the alarm information message and sends the alarm information message to the trusted management center using a communication link; wherein the communication link is an encrypted communication link based on the UDP protocol and relying on the TPM module.

[0025] The DCS controller trusted alarm uploading method of the present invention can utilize the trusted proxy service module to monitor the alarm information generated by the trusted module in the DCS controller in real time, timely discover the trusted security-related issues that are more threatening, and improve the reliability and security of the DCS system. At the same time, the alarm information message is sent to the trusted management center using an encrypted communication link based on the UDP protocol and relying on the TPM module. UDP is a connectionless protocol, which means that there is no need to establish a connection before sending data, thereby reducing the overhead required to establish a connection, reducing transmission delays, and improving transmission efficiency. The TPM module can generate and store encryption keys for encrypting data to ensure the security of data during transmission. Therefore, the present invention utilizes an encrypted communication link based on the UDP protocol and relying on the TPM module to transmit the alarm information message, which not only has high transmission efficiency, but also can ensure the integrity and security of the alarm information message during the transmission process.

[0026] Specifically, in S1, the trusted proxy service module monitors and obtains the alarm information generated by the trusted module in the DCS controller in real time through the inter-process communication (IPC, InterProcesses Communication) mechanism of the operating system of the DCS controller.

[0027] In S2, the trusted proxy service module parses the alarm information by parsing the keywords in the alarm information, judging the flag bits in the alarm information, and reading the disk file according to the alarm information content, to obtain the alarm information message, and then reformats the alarm information message in the format agreed with the host computer. At the same time, in order to improve readability, the alarm information message can be converted into json format, thereby generating a readable alarm information message.

[0028] In S3, the trusted proxy service module sends the readable alarm information message to the DCS system control software through the inter-process communication mechanism.

[0029] In some specific embodiments of the present invention, the trusted module includes a static trusted module, an unknown program immunity module, a process trusted module and an application access control module.

[0030] The static trusted module refers to a module that is responsible for performing a series of verification and measurement operations during the startup or initialization phase of the DCS controller to ensure the integrity and credibility of each component of the DCS controller. The unknown program immunity module is a module that identifies and blocks the execution of potential malware without relying on known virus signatures or behavior patterns. The process trusted module is an integrated security module that verifies, monitors and controls the processes running in the DCS controller through a series of mechanisms to ensure that their behavior complies with preset security policies and rules. The application access control module is a security mechanism that ensures that only authorized users can access specific resources of the application by verifying user identities and managing and controlling access rights.

[0031] In order to achieve a balance between function realization and resource occupancy, the trusted proxy service module described in the present invention divides the different alarm information obtained into different priorities, specifically including high priority, medium priority and low priority, and sends the alarm information in the order of high priority, medium priority and low priority.

[0032] Specifically, high-priority alarm information, such as information about tampering of components, files or processes of DCS system control software, such as tampering of key components such as the measurement and control process of external devices and system configuration files in DCS system control software; medium-priority alarm information, such as information about the start or exit of the monitoring object of the trusted module, the monitoring object includes but is not limited to the program that periodically synchronizes the clock with the host computer; low-priority alarm information, such as periodically generated information, the information includes but is not limited to heartbeat information for the host computer. Therefore, by dividing the priority of the alarm information and sending the alarm information according to the priority, the present invention can ensure that the DCS controller has sufficient resources to quickly respond to business needs while occupying less system resources.

[0033] After the DCS system control software receives the alarm information message, it returns an ACK to the trusted proxy service module to confirm the successful reception of the alarm information message, thereby ensuring the reliable transmission of the alarm information message.

[0034] Example This embodiment proposes a trusted alarm method for hierarchical processing on a DCS controller with a trusted function and sending the result to a trusted management center.

[0035] The trusted proxy service module will upload alarm information timely and accurately. Through automatic identification, the alarm information can be divided into different priorities. The alarm information of different priorities will be uploaded in the order of high priority, medium priority and low priority, so as to achieve a balance between function realization and resource occupation, occupy less system resources to ensure that the DCS controller has enough resources to respond quickly to business needs. The trusted proxy service module will monitor the alarm information sent by the static trusted module, unknown program immunity module, process trusted module and application access control module in real time, parse the corresponding alarm information, divide the priority and repackage it through the DCS system control software to send it to the trusted management center for display and management. The DCS system control software uploads the alarm information message to the trusted management center through an encrypted communication link based on the UDP protocol and relying on the TPM module. In this way, the alarm information generated by the trusted module in the DCS controller can be monitored in real time, and the more threatening trusted security-related issues can be discovered in time, the reliability and security of the DCS system can be improved, the security management overhead of the DCS system control software can be greatly reduced, and the system administrator can be helped to better understand the operation of the DCS system.

[0036] Specifically, the specific implementation process of this embodiment is as follows: (1) The trusted agent module monitors and obtains the alarm information generated by different trusted modules in the DCS controller in real time; the trusted modules include static trusted modules, unknown program immunity modules, process trusted modules and application access control modules.

[0037] (2) The trusted proxy service module divides the different alarm information obtained into different priorities and sends them up in the order of high priority, medium priority and low priority; the trusted proxy service module parses the alarm information generated by different trusted modules and generates alarm information messages of different formats; the different formats refer to different message headers of the alarm information messages.

[0038] (3) The trusted proxy service module sends the generated alarm information message to the DCS system control software in real time; the DCS system control software runs on the operating system of the DCS controller.

[0039] (4) After receiving the alarm information message, the DCS system control software returns an ACK to the trusted proxy service module; and uses the communication link of the DCS system control software to send the alarm information message to the trusted management center to achieve centralized control of the controller; wherein the communication link is an encrypted communication link based on the UDP protocol and relies on the TPM module.

[0040] (5) If the trusted management center receives an alarm message from the DCS system control software, it will give a clear prompt on the page or interface and take corresponding measures.

[0041] The DCS controller trusted alarm uploading method of this embodiment is a method for enhancing system security and reliability by uploading relevant alarm messages through the communication link of the DCS system control software. The trusted proxy service module can monitor the alarm information generated by the trusted module in the DCS controller in real time, timely discover the more threatening trusted security-related problems, improve the reliability and security of the DCS system, greatly reduce the security management overhead of the DCS system, and help system administrators better understand the operation of the DCS system. At the same time, the alarm information message is sent to the trusted management center using an encrypted communication link based on the UDP protocol and relying on the TPM module. The UDP protocol can improve the data transmission efficiency, and the TPM module can ensure the security of the data during the transmission process. Therefore, the present invention uses an encrypted communication link based on the UDP protocol and relying on the TPM module to transmit the alarm information message, which can improve the transmission efficiency and ensure the integrity and security of the alarm information message during the transmission process.

[0042] The following are device embodiments of the present invention, which can be used to perform method embodiments of the present invention. For details not disclosed in the device embodiments, please refer to the method embodiments of the present invention.

[0043] In yet another embodiment of the present invention, the present invention further provides a DCS controller trusted alarm sending system, comprising: The trusted proxy service module is used to monitor and obtain the alarm information generated by the trusted module in the DCS controller in real time; parse the alarm information and generate an alarm information message; send the alarm information message to the DCS system control software; the DCS system control software runs on the operating system of the DCS controller; The DCS system control software is used to receive the alarm information message and send the alarm information message to the trusted management center using a communication link; wherein the communication link is an encrypted communication link based on the UDP protocol and relying on the TPM module.

[0044] In another embodiment of the present invention, a computer device is provided, the computer device includes a processor and a memory, the memory is used to store a computer program, the computer program includes program instructions, and the processor is used to execute the program instructions stored in the computer storage medium. The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. It is the computing core and control core of the terminal, which is suitable for implementing one or more instructions, and is specifically suitable for loading and executing one or more instructions in the computer storage medium to implement the corresponding method flow or corresponding function; the processor described in the embodiment of the present invention can be used for the operation of the DCS controller trusted alarm uploading method.

[0045] In another embodiment of the present invention, the present invention further provides a storage medium, specifically a computer-readable storage medium (Memory), which is a memory device in a computer device for storing programs and data. It is understandable that the computer-readable storage medium here can include both built-in storage media in the computer device and, of course, extended storage media supported by the computer device. The computer-readable storage medium provides a storage space, which stores the operating system of the terminal. In addition, one or more instructions suitable for being loaded and executed by the processor are also stored in the storage space, and these instructions can be one or more computer programs (including program codes). It should be noted that the computer-readable storage medium here can be a high-speed RAM memory or a non-volatile memory, such as at least one disk memory. The processor can load and execute one or more instructions stored in the computer-readable storage medium to implement the corresponding steps of the DCS controller trusted alarm uploading method in the above embodiment.

[0046] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, optical storage, etc.) containing computer-usable program code.

[0047] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0048] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0049] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0050] Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents, and any modifications or equivalent replacements that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the present invention.

Claims

1. A method for sending a trusted alarm to a DCS controller, characterized in that: include: S1, the trusted proxy service module monitors and obtains the alarm information generated by the trusted module in the DCS controller in real time; S2, the trusted proxy service module parses the alarm information and generates an alarm information message; S3, the trusted proxy service module sends the alarm information message to the DCS system control software; the DCS system control software runs on the operating system of the DCS controller; S4, the DCS system control software receives the alarm information message and sends the alarm information message to the trusted management center using a communication link; wherein the communication link is an encrypted communication link based on the UDP protocol and relying on the TPM module.

2. The DCS controller trusted alarm sending method according to claim 1 is characterized in that: In S1, the trusted modules include a static trusted module, an unknown program immunity module, a process trusted module and an application access control module.

3. The DCS controller trusted alarm sending method according to claim 1 is characterized in that: In S1, the trusted proxy service module divides the acquired different alarm information into high priority, medium priority and low priority, and performs S2 in the order of high priority, medium priority and low priority.

4. The DCS controller trusted alarm sending method according to claim 3 is characterized in that: High-priority alarm information includes: information that components, files or processes of the DCS system control software have been tampered with.

5. The DCS controller trusted alarm sending method according to claim 3 is characterized in that: Medium priority alarm information includes: information about the start or exit of the monitoring object of the trusted module.

6. The DCS controller trusted alarm sending method according to claim 3 is characterized in that: Low-priority alarm information includes: periodically generated information.

7. The DCS controller trusted alarm sending method according to claim 1 is characterized in that: In S4, after receiving the alarm information message, the DCS system control software returns an ACK to the trusted proxy service module.

8. The DCS controller trusted alarm sending system is characterized by: include: Trusted agent service module, used to monitor and obtain alarm information generated by trusted modules in DCS controller in real time; Analyze the alarm information and generate an alarm information message; Sending the alarm information message to the DCS system control software; the DCS system control software runs on the operating system of the DCS controller; The DCS system control software is used to receive the alarm information message and send the alarm information message to the trusted management center using a communication link; wherein the communication link is an encrypted communication link based on the UDP protocol and relying on the TPM module.

9. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the DCS controller trusted alarm sending method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the DCS controller trusted alarm sending method according to any one of claims 1 to 7 is implemented.

Images