DCS upper computer active protection method and system based on dynamic credible verification

Abstract

The invention discloses a DCS upper computer active protection method and system based on dynamic credible verification, and belongs to the technical field of industrial control system.The method comprises the steps that firstly, a dynamic verification strategy is configured, and an application program of an upper computer is monitored and verified in real time; the dynamic verification strategy comprises the name of the application program, a trigger rule of dynamic measurement and a disposal mode of the untrusted application program; when an application program is started, calculating a hash value of a code segment of the application program as a reference value by utilizing the trusted cryptographic module; in the running process of the application program, calculating a hash value of a code segment of the application program based on a trigger rule of dynamic measurement, comparing the hash value with a reference value, and determining the credible state of the application program according to a comparison result; according to the method, the credible state of the application program can be effectively judged, the uncredible application program can be found and handled in time, and the safety and reliability of the system are greatly improved.

Description

Technical Field

[0001] The present invention relates to the technical field of industrial control system safety, and in particular to a DCS host computer active protection method and system based on dynamic trusted verification. Background Art

[0002] In the DCS system (Distributed Control System) of a thermal power plant, the host computer plays a pivotal role. It is not only a bridge connecting the lower computers (such as various sensors, actuators, etc.) and the high-level management system, responsible for conveying control instructions, but also a monitoring center for the operation status of the entire thermal power plant. The host computer receives and processes a large amount of data from core equipment such as boilers, turbines, and generators in real time. After complex data processing and algorithm analysis, these data are displayed to various roles such as business administrators and safety administrators in the form of an intuitive user interface to provide them with decision support.

[0003] In addition, the host computer also bears the heavy responsibility of data storage and maintenance management. It needs to preserve the equipment's operating data, fault records, operation logs, and historical audit information for a long time. These data are crucial for managers to conduct fault analysis, performance optimization, and security strategy formulation in the future. Therefore, the stability and security of the host computer directly affect the operating efficiency and safety of the thermal power plant.

[0004] However, with the rapid development of network technology and the continuous upgrading of hacker attack methods, the DCS system of thermal power plants faces severe security threats. Among them, memory injection attack is an extremely hidden and harmful attack method. The attacker exploits a security vulnerability in the software and constructs a carefully designed malicious input, thereby hijacking the control flow of the software and causing the software to execute external input instruction codes. Once successful, the attacker can obtain remote control permissions of the DCS system and perform illegal operations, such as tampering with data, destroying the DCS system, stealing confidential information, etc., and may even cause the DCS system to crash or be denied service, which has a serious impact on the normal operation of the thermal power plant. Summary of the invention

[0005] In view of the problems existing in the prior art, the present invention provides a DCS host computer active protection method and system based on dynamic trusted verification, which greatly improves the safety and reliability of the DCS system.

[0006] The present invention is achieved through the following technical solutions: First invention, this application provides a DCS host computer active protection method based on dynamic trusted verification, including the following process: Configure dynamic verification strategies to monitor and verify the applications on the host computer in real time; The dynamic verification strategy includes the name of the application, the triggering rules of the dynamic measurement and the disposal method of the untrusted application; When the application is started, the hash value of the application code segment is calculated using the trusted cryptographic module and used as a reference value; During the running of the application, the hash value of the application's code segment is calculated based on the trigger rules of dynamic measurement and compared with the benchmark value. The trusted state of the application is determined based on the comparison result, and the disposal method of the untrusted application is triggered based on the trusted state.

[0007] Preferably, the real-time monitoring and verification of the application program of the host computer includes: Evaluate all applications used by the host computer, determine key applications based on the evaluation results, configure dynamic verification strategies for key applications, and monitor and verify key applications in real time based on the dynamic verification strategies.

[0008] Preferably, the evaluation method of the application comprises: Determine the functions of each application in the DCS system, evaluate the impact of each application failure or abnormality on the production process of the thermal power plant based on the functions, and determine the key applications based on the impact results of each application; Assess the sensitivity and importance of the data processed by each application and identify key applications based on the sensitivity and importance of the data; Obtain historical failure data of each application and identify key applications based on the historical failure data; Or / and, based on the current security threat environment of the DCS system, evaluate the risk level faced by each application and determine the key applications based on the risk level.

[0009] Preferably, the determination of the key application further includes: Weights are assigned to the key applications obtained by each evaluation method, and the weights are integrated to determine the comprehensive score of each key application. The key applications are sorted according to the comprehensive score, and several key applications with high comprehensive scores are determined as the final key applications.

[0010] Preferably, the triggering rules of the dynamic measurement include: Compute hash values ​​for application code segments based on time intervals and / or specific events.

[0011] Preferably, the triggering rules based on the dynamic metrics periodically calculate the hash value for the code segment of the application.

[0012] Preferably, the untrusted application is handled by terminating the process of the untrusted application and issuing an alarm.

[0013] Preferably, a hash algorithm is used to calculate the hash value, and the hash algorithm is MD5, SHA-1 or SHA-256 algorithm.

[0014] Second invention, this application provides a DCS host computer active protection system based on dynamic trusted verification, including: The policy module is used to configure dynamic verification policies and conduct real-time monitoring and verification of the host computer's applications; The dynamic verification strategy includes the name of the application, the triggering rules of the dynamic measurement and the disposal method of the untrusted application; A benchmark module, used to calculate a hash value of an application code segment using a trusted cryptographic module when the application is started and use the hash value as a benchmark value; The diagnostic module is used to calculate the hash value of the code segment of the application based on the trigger rules of dynamic measurement during the operation of the application, and compare it with the benchmark value, determine the trusted state of the application according to the comparison result, and trigger the disposal method of the untrusted application according to the trusted state.

[0015] The third invention, the present application provides an electronic device, including: Memory for storing computer programs; The processor is used to implement the steps of the DCS host computer active protection method based on dynamic trusted verification when executing the computer program.

[0016] Compared with the prior art, the present invention has the following beneficial technical effects: The present application provides a DCS host computer active protection method based on dynamic trusted verification. By configuring a flexible dynamic verification strategy, the method realizes real-time monitoring and verification of host computer applications to ensure the safe operation of the applications. At the same time, the method uses a trusted cryptographic module (TCM) to calculate the hash value of a code segment as a benchmark, and performs dynamic comparison during the operation of the application to effectively judge the trusted state of the application, timely discover and deal with untrusted applications, and greatly improve the security and reliability of the DCS system.

[0017] The present application also proposes a DCS host computer active protection system based on dynamic trusted verification and an electronic device, which have all the advantages of the above-mentioned DCS host computer active protection method based on dynamic trusted verification. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0019] Figure 1 The present invention is a flow chart of a DCS host computer active protection method based on dynamic trusted verification.

[0020] Figure 2 The structure diagram of the DCS host computer active protection system based on dynamic trusted verification of the present invention. DETAILED DESCRIPTION

[0021] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various different configurations.

[0022] Therefore, the following detailed description of the embodiments of the present application provided in the accompanying drawings is not intended to limit the scope of the present application for which protection is sought, but merely represents selected embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present application.

[0023] See also Figure 1 , a DCS host computer active protection method based on dynamic trusted verification, comprising the following steps: Configure dynamic verification strategies to monitor and verify the applications on the host computer in real time; The dynamic verification strategy includes the name of the application, the triggering rules of the dynamic measurement and the disposal method of the untrusted application; When the application is started, the trusted cryptographic module is used to calculate the hash value of the application code segment as a reference value; During the subsequent running of the application, the hash value of the application's code segment is periodically calculated and compared with the benchmark value. The trusted state of the application is determined based on the comparison result, and the disposal method of the untrusted application is triggered based on the trusted state.

[0024] In some embodiments, all applications are first evaluated to determine key applications, and dynamic verification policies are configured for the key applications. The evaluation method for the application is as follows: 1. Determine the functions of each application in the DCS system, evaluate the impact of each application failure or abnormality on the production process of the thermal power plant based on the functions, and determine the key applications based on the corresponding impact results of each application. For example, the applications that control core equipment such as boilers and turbines are obviously more critical.

[0025] 2. Evaluate the sensitivity and importance of the data processed by each application, and determine the key applications based on the sensitivity and importance of the data. For example, applications involving key data such as unit operating status and safety parameters require a higher level of protection.

[0026] 3. Obtain the historical failure data of each application, identify which applications have had serious failures or security issues based on the historical failure data, and then determine the key applications.

[0027] 4. Evaluate the risks faced by each application based on the current security threat environment. For example, applications that are exposed to the network boundary or frequently interact with external systems may face higher security risks. High-risk applications should be considered critical applications.

[0028] In some embodiments, the key applications determined by the above-mentioned evaluation methods may be integrated to determine the final key applications.

[0029] Weights are assigned to the key applications obtained by each evaluation method, and the weights are integrated to determine the comprehensive score of each key application. The key applications are sorted according to the comprehensive score, and the key applications with higher comprehensive scores are determined as the final key applications.

[0030] It should be noted that, among the above four application evaluation methods, at least one evaluation method can be selected according to actual needs to determine the key application.

[0031] In some embodiments, periodically calculating a hash value for a code segment of an application is implemented as follows: Set a fixed time interval, such as hourly, daily, or weekly, to calculate the hash value of the application code segment.

[0032] For example, if you choose to calculate once every hour, the DCS system will automatically trigger the hash calculation process at a specific time point every hour (such as the hour).

[0033] In addition to fixed time intervals, hash value calculations can also be triggered based on specific events in the DCS system.

[0034] For example, when the DCS system starts, when the application starts, when the DCS system performs important operations (such as equipment start and stop, parameter adjustment), or when the DCS system detects abnormal behavior (such as illegal access, data anomaly), the hash value calculation can be triggered immediately. Another way of event triggering is that when the DCS system detects suspicious behavior or abnormal activities (such as attempting to access unauthorized resources), the hash value calculation can also be performed immediately to verify the integrity of the code.

[0035] You can also combine fixed time intervals with specific events to trigger hash value calculations to provide more comprehensive protection.

[0036] For example, you can set the hash value to be calculated once an hour, and also perform hash calculations when the application executes key functional points.

[0037] According to the security requirements of the DCS system, select a suitable hash algorithm to calculate the hash value of the code segment. Hash algorithms include MD5 (Message-Digest Algorithm 5), SHA-1 (Secure Hash Algorithm 1), SHA-256 (Secure Hash Algorithm 256-bit), etc. When the set cycle arrives, the DCS system will read the code segment of the application from the storage medium and use the selected hash algorithm to calculate the code segment to obtain the current hash value.

[0038] When an application is first deployed, the hash value of its code segment is calculated and stored as the baseline value. In the subsequent periodic hash value calculation process, the currently calculated hash value is compared with the baseline value. If the two are consistent, it means that the code segment has not been tampered with; if they are inconsistent, it means that there may be security risks and further inspection and processing are required.

[0039] For example, assuming that a boiler control application in a DCS system of a thermal power plant is one of the key applications, the DCS system decides to perform periodic hash value calculations on its code segments.

[0040] Set cycle: The DCS system is set to perform a hash value calculation on the code segment of the boiler control application at 2 a.m. every day. In addition, when the boiler control application is started, a hash value calculation is also triggered immediately.

[0041] Hash value calculation: When the set period arrives, the DCS system reads the code segment of the boiler control application from the hard disk or memory and calculates it using the SHA-256 algorithm to obtain the current hash value.

[0042] Hash value verification: The DCS system compares the currently calculated hash value with the reference value. If the two are consistent, it means that the code segment of the boiler control application has not been tampered with; if they are inconsistent, the DCS system will issue an alarm and notify the management personnel to conduct further inspection and processing.

[0043] By periodically calculating hash values ​​for application code segments, the DCS system of a thermal power plant can effectively prevent the code from being maliciously tampered with or damaged, ensuring the security and reliability of the DCS system. At the same time, this security measure also helps to promptly detect and respond to potential security threats, improving the overall security level of the DCS system of a thermal power plant.

[0044] Example 1 A DCS host computer active protection method based on dynamic trusted verification includes the following steps: Step 1: Configure a dynamic verification strategy for the key applications of the host computer. The dynamic verification strategy includes recording the application name, the interval time of dynamic measurement, and the disposal method of untrusted applications. Record application names: Make it clear which applications are critical applications that require dynamic verification.

[0045] Dynamic measurement interval: Set the interval for periodic verification of key applications to ensure that potential security threats are discovered and dealt with in a timely manner.

[0046] How to deal with untrusted applications: When a critical application is found to be untrusted, clearly define the measures to be taken, such as shutting down the process, issuing an alarm, etc.

[0047] Step 2: When the key application is started for the first time, the hash value of the code segment of the key application is calculated based on the trusted cryptographic module and used as the reference value A. The reference value A of the key application, the PID (Process Identifier) ​​of the key application, and the corresponding relationship with the name of the key application are recorded; A trusted cryptographic module is a hardware security module that can provide a trusted computing environment and ensure the accuracy and non-tamperability of calculation results.

[0048] When a key application is started, a hash value is calculated, and a unique hash value is calculated using a code segment of the key application as a reference value A of the key application.

[0049] Record the correspondence: Establish a one-to-one correspondence between the benchmark value A and the PID of the key application and the name of the key application for subsequent verification.

[0050] Step 3: During the subsequent operation of the key application, periodically calculate the hash value B for the code segment of the key application, and compare the reference value A with the hash value B; The trusted cryptographic module uses its built-in hash operation unit to perform operations when calculating the hash value of the key application code segment.

[0051] Periodic verification: According to the interval of dynamic measurement set in step 1, the code segment of the key application is regularly calculated to obtain the hash value B.

[0052] Comparing reference value A with hash value B: Compare the calculated hash value B with reference value A to determine the credibility of the critical application.

[0053] Step 4: If the hash value B is equal to the reference value A, the key application is determined to be credible and the audit log is recorded; if the hash value B is not equal to the reference value A, the key application is determined to be untrustworthy. A dynamic credible alarm is issued to trigger the process shutdown operation.

[0054] Optionally, the hash value B is equal to the reference value A: the critical application is determined to be trustworthy, and the audit log is recorded for subsequent security analysis and auditing.

[0055] Hash value B is not equal to reference value A: The critical application is judged to be untrustworthy. The critical application may have been attacked by memory injection or its code segment may have been tampered with by a virus or Trojan. At this time, a dynamic trusted alarm is issued to notify the security administrator or related system, and the shutdown process is triggered to prevent the further spread of malicious behavior.

[0056] The DCS host computer active protection method based on dynamic trusted verification provided by the present application can timely discover and deal with potential security threats by periodically performing dynamic verification on the application, ensuring the safe and stable operation of the host computer; secondly, the hash value of the code segment of the application is calculated using a trusted cryptographic module to ensure the accuracy and non-tamperability of the verification result; in addition, the DCS host computer active protection method based on dynamic trusted verification is an active protection method that can provide early warning and disposal before or at the beginning of the application being attacked or tampered with, effectively improving the security protection capability of the host computer. Different dynamic verification strategies can also be configured according to the importance and sensitivity of different applications to meet security requirements in different scenarios. By recording audit logs, it is convenient for security administrators to conduct subsequent security analysis and audits, thereby improving the efficiency and accuracy of security management.

[0057] Based on the above DCS host computer active protection method based on dynamic trusted verification, correspondingly, refer to Figure 2 The present application also provides a DCS host computer active protection system based on dynamic trusted verification, including: The policy module is used to configure dynamic verification policies and conduct real-time monitoring and verification of the host computer's applications; The dynamic verification strategy includes the name of the application, the triggering rules of the dynamic measurement and the disposal method of the untrusted application; A benchmark module, used to calculate a hash value of an application code segment using a trusted cryptographic module when the application is started and use the hash value as a benchmark value; The diagnostic module is used to calculate the hash value of the code segment of the application based on the trigger rules of dynamic measurement during the operation of the application, and compare it with the benchmark value, determine the trusted state of the application according to the comparison result, and trigger the disposal method of the untrusted application according to the trusted state.

[0058] It should be noted that in the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of each module is only a logical function division. There may be other division methods in actual implementation. For example, multiple modules can be combined or integrated into another device, or some features can be ignored or not executed. The module described as a separate component may or may not be physically separated. The component displayed as a module may be a physical unit or multiple physical units, that is, it may be located in one place, or it may be distributed in multiple different places. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment.

[0059] In addition, each module in each embodiment of the present invention may be integrated into a processing unit, each module may exist physically separately, or two or more modules may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of a software functional unit.

[0060] An electronic device provided in an embodiment of the present application includes a memory and a processor. A computer program is stored in the memory. When the processor executes the computer program, the steps of the DCS host computer active protection method based on dynamic trusted verification as described in any of the above embodiments are implemented.

[0061] Another electronic device provided in the embodiment of the present application may also include: an input port connected to the processor, used to transmit multimodal data collected by an external acquisition device to the processor; and a display unit connected to the processor, used to display the processing results of the processor to the outside world; a communication module connected to the processor, used to realize the communication between the electronic device and the outside world. The display unit can be a display panel, a laser scanning display, etc.; the communication method adopted by the communication module includes but is not limited to mobile high-definition link technology, universal serial bus (USB, Universal Serial Bus), high-definition multimedia interface (HDMI, High-Definition Multimedia Interface), wireless connection (including wireless fidelity technology, Bluetooth communication technology, low-power Bluetooth communication technology, communication technology based on IEEE802.11s), IEEE 802.11s is a standard formulated by IEEE (Institute of Electrical and Electronics Engineers) for wireless local area networks, specifically used to support the construction and management of wireless networks.

[0062] An embodiment of the present application provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the steps of the DCS host computer active protection method based on dynamic trusted verification as described in any of the above embodiments are implemented.

[0063] The computer-readable storage medium involved in this application includes random access memory (RAM, Read-Only Memory), internal memory, read-only memory ROM, electrically programmable ROM, electrically erasable programmable ROM, registers, hard disks, removable disks, CD-ROMs (Compact Disc Read-Only Memory), or any other form of storage medium known in the technical field.

[0064] For the description of the relevant parts of the DCS host computer active protection system based on dynamic trusted verification, the electronic device and the computer-readable storage medium provided in the embodiment of the present application, please refer to the detailed description of the corresponding parts in the DCS host computer active protection method based on dynamic trusted verification provided in the embodiment of the present application, which will not be repeated here. In addition, the parts of the above technical solutions provided in the embodiment of the present application that are consistent with the implementation principles of the corresponding technical solutions in the prior art are not described in detail to avoid excessive elaboration.

[0065] The above contents are only for explaining the technical idea of ​​the present invention and cannot be used to limit the protection scope of the present invention. Any changes made on the basis of the technical solution in accordance with the technical idea proposed by the present invention shall fall within the protection scope of the claims of the present invention.

Claims

1. A DCS host computer active protection method based on dynamic trusted verification, characterized in that: The process includes: Configure dynamic verification strategies to monitor and verify the applications on the host computer in real time; The dynamic verification strategy includes the name of the application, the triggering rules of the dynamic measurement and the disposal method of the untrusted application; When the application is started, the hash value of the application code segment is calculated using the trusted cryptographic module and used as a reference value; During the running of the application, the hash value of the application's code segment is calculated based on the trigger rules of dynamic measurement and compared with the benchmark value. The trusted state of the application is determined based on the comparison result, and the disposal method of the untrusted application is triggered based on the trusted state.

2. According to claim 1, a DCS host computer active protection method based on dynamic trusted verification is characterized in that: The real-time monitoring and verification of the application program of the host computer includes: Evaluate all applications used by the host computer, determine key applications based on the evaluation results, configure dynamic verification strategies for key applications, and monitor and verify key applications in real time based on the dynamic verification strategies.

3. According to claim 2, a DCS host computer active protection method based on dynamic trusted verification is characterized in that: The evaluation methods for the application include: Determine the functions of each application in the DCS system, evaluate the impact of each application failure or abnormality on the production process of the thermal power plant based on the functions, and determine the key applications based on the impact results of each application; Assess the sensitivity and importance of the data processed by each application and identify key applications based on the sensitivity and importance of the data; Obtain historical failure data of each application and identify key applications based on the historical failure data; Or / and, based on the current security threat environment of the DCS system, evaluate the risk level faced by each application and determine the key applications based on the risk level.

4. A DCS host computer active protection method based on dynamic trusted verification according to claim 3, characterized in that: The identification of critical applications also includes: Weights are assigned to the key applications obtained by each evaluation method, and the weights are integrated to determine the comprehensive score of each key application. The key applications are sorted according to the comprehensive score, and several key applications with high comprehensive scores are determined as the final key applications.

5. A DCS host computer active protection method based on dynamic trusted verification according to any one of claims 1 to 4, characterized in that: The triggering rules of the dynamic measurement include: Compute hash values ​​for application code segments based on time intervals and / or specific events.

6. A DCS host computer active protection method based on dynamic trusted verification according to claim 5, characterized in that: The triggering rules based on dynamic metrics periodically calculate hash values ​​for the code segments of the application.

7. A DCS host computer active protection method based on dynamic trusted verification according to claim 1 or 6, characterized in that: The untrusted application is disposed of by terminating the process of the untrusted application and issuing an alarm.

8. The DCS host computer active protection method based on dynamic trusted verification according to claim 1 is characterized in that: A hash algorithm is used to calculate the hash value. The hash algorithm is MD5, SHA-1, or SHA-256.

9. A DCS host computer active protection system based on dynamic trusted verification, characterized in that: include: The policy module is used to configure dynamic verification policies and conduct real-time monitoring and verification of the host computer's applications; The dynamic verification strategy includes the name of the application, the triggering rules of the dynamic measurement and the disposal method of the untrusted application; A benchmark module, used to calculate a hash value of an application code segment using a trusted cryptographic module when the application is started and use the hash value as a benchmark value; The diagnostic module is used to calculate the hash value of the code segment of the application based on the trigger rules of dynamic measurement during the operation of the application, and compare it with the benchmark value, determine the trusted state of the application according to the comparison result, and trigger the disposal method of the untrusted application according to the trusted state.

10. An electronic device, characterized in that: include: Memory for storing computer programs; A processor is used to implement the steps of a DCS host computer active protection method based on dynamic trusted verification as described in any one of claims 1 to 8 when executing the computer program.

Images