DCS control system upper computer application credibility guarantee method, system, device and medium

Abstract

The invention discloses a DCS control system upper computer application credibility guarantee method, system and device and a medium, and the method comprises the steps: carrying out the integrity verification of an application program, and taking the application program with the qualified integrity verification as a white list application; allowing the white list application to run in the target environment; according to the method, the system, the equipment and the medium, the state of the white list application in the running process is monitored, whether an abnormal behavior exists or not is judged according to the monitored data, when the abnormal behavior exists, an alarm is given, corresponding measures are adopted, the method, the system, the equipment and the medium can normally run software programs, and meanwhile data safety is guaranteed.

Description

Technical Field

[0001] The invention belongs to the field of industrial automation and relates to a DCS control system host computer application trustworthy assurance method, system, equipment and medium. Background Art

[0002] In the field of industrial automation, the distributed control system DCS (Distributed Control System) is an important equipment monitoring and management system. DCS is mainly composed of field controllers, communication networks and host computers. Among them, the host computer, as a monitoring center, is responsible for monitoring the operating status of field equipment and displaying these status data to operators in a visual form.

[0003] However, in actual applications, host computer software faces a variety of security threats, such as malware attacks, data tampering, etc. These threats may lead to serious consequences such as system crashes and data leaks. Summary of the invention

[0004] The present invention aims to solve the problems existing in the prior art and proposes a trusted assurance method, system, device and storage medium for DCS control system host computer application. The method, system, device and storage medium can ensure the normal operation of software programs and guarantee the security of data.

[0005] To achieve the above objectives, the present invention discloses a DCS control system host computer application trust assurance method, comprising: Perform integrity check on each application in the DCS control system host computer, and select applications that pass the integrity check as whitelist applications; Allow whitelisted applications to run in the target environment; Monitor the status of whitelist applications during operation and determine whether there are abnormal behaviors based on the data obtained from the monitoring; When there is abnormal behavior, an alarm is issued, and measures corresponding to the abnormal behavior are taken for the abnormal behavior.

[0006] Furthermore, the process of performing integrity check on each application in the DCS control system host computer is as follows: Determine the priority of each application in the DCS control system host computer; According to the priority of each application, a combination of digital signature and hash value verification is used to verify the integrity of each application. When any application fails the verification, an alarm signal is issued.

[0007] Furthermore, the target environment is a trusted computing environment, which is a computer system environment with hardware, software and data security, wherein the computer equipment in the computer system environment is configured with a security chip, and the security chip is used to protect keys and sensitive data stored in the security chip.

[0008] Furthermore, the measures include at least one of limiting network access rights of abnormal applications, suspending partial functional operations of abnormal applications, recording relevant log information of abnormal behaviors, blocking applications, deleting applications, and restarting the system.

[0009] Furthermore, the process of determining whether there is abnormal behavior based on the monitored data is as follows: Inputting the monitored data into a trained deep neural network machine learning model to obtain spatiotemporal feature information in the monitored data, wherein the deep neural network machine learning model adopts an architecture combining a convolutional neural network and a recurrent neural network; Whether there is abnormal behavior is determined based on the spatiotemporal feature information.

[0010] The present invention discloses a DCS control system host computer application trustworthy guarantee system, comprising: The verification module is used to perform integrity verification on each application in the DCS control system host computer, and the application that passes the integrity verification is used as a whitelist application; Run module, used to allow whitelisted applications to run in the target environment; The monitoring module is used to monitor the status of the whitelist application during operation and determine whether there is abnormal behavior based on the monitored data; The alarm module is used to issue an alarm when there is abnormal behavior, and take measures corresponding to the abnormal behavior.

[0011] Furthermore, the verification module includes: A determination module is used to determine the priority of each application program in the host computer of the DCS control system; The integrity check module is used to perform integrity check on each application according to the priority of each application by combining digital signature and hash value check. When any application fails the check, an alarm signal is issued.

[0012] Furthermore, the monitoring module includes: An extraction module is used to input the monitored data into a trained deep neural network machine learning model to obtain spatiotemporal feature information in the monitored data, wherein the deep neural network machine learning model adopts an architecture combining a convolutional neural network and a recurrent neural network; A judgment module is used to judge whether there is abnormal behavior based on the spatiotemporal feature information.

[0013] The present invention discloses a computer device, comprising a memory, a processor and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of the DCS control system host computer application trustworthy assurance method are implemented.

[0014] The invention discloses a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the DCS control system host computer application trustworthy assurance method are implemented.

[0015] The present invention has the following advantages: In actual operation, the trusted guarantee method for the DCS control system host computer application of the present invention performs integrity check on each application in the DCS control system host computer, so that only the application that has passed the verification is run in the target environment, thereby introducing trusted computing technology, ensuring that the host computer software has a high degree of security during operation, and effectively resisting various security threats, thereby improving the security of the system. In addition, the present invention ensures the stability and reliability of the host computer software through integrity check and real-time monitoring, reduces the risk of system failure and data loss, and improves the stability of the system. At the same time, through automatic monitoring and abnormal feedback, the workload of the system administrator is reduced and the management efficiency is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The accompanying drawings are a part of the present invention and are used to further illustrate the present invention. The schematic embodiments and descriptions in the accompanying drawings are intended to explain the present invention and do not constitute improper limitations on the present invention. In the accompanying drawings: Figure 1 is a flow chart of the method of embodiment 1; Figure 2 is a flow chart of the method of Embodiment 2; Figure 3 This is a system structure diagram of Example 3. DETAILED DESCRIPTION

[0017] In conjunction with the accompanying drawings, the embodiments of the present invention will describe the technical solution in detail. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0018] In the description of the present invention, the terms “include” and “comprising” indicate the existence of the described features, integers, steps, operations, elements and / or components, but do not exclude the existence or addition of one or more other features, integers, steps, operations, elements, components and / or combinations thereof.

[0019] It should also be understood that the terms used in the present specification are only used for the purpose of describing specific embodiments and are not intended to limit the present invention. As used in the present specification and the appended claims, the singular forms "a", "an" and "the" shall include plural forms unless the context clearly indicates otherwise.

[0020] It should be further understood that the term "and / or" used in the present specification and the appended claims refers to any combination of one or more of the associated listed items and all possible combinations, and includes these combinations. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the present invention, the " / " character generally indicates that the relationship between the associated objects is "or".

[0021] It should be understood that, although the terms first, second, third, etc. may be used to describe preset ranges, etc. in the embodiments of the present invention, these preset ranges should not be limited to these terms. These terms are only used to distinguish different preset ranges. For example, without departing from the scope of the embodiments of the present invention, the first preset range may also be referred to as the second preset range, and similarly, the second preset range may also be referred to as the first preset range.

[0022] The word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrases "if it is determined" or "if (stated condition or event) is detected" may be interpreted as "when it is determined" or "in response to determining" or "when detecting (stated condition or event)" or "in response to detecting (stated condition or event)", depending on the context. In order to make the purpose, technical scheme and advantages of the embodiments of the present invention clearer, the technical scheme in the embodiments of the present invention will be described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the accompanying drawings can be arranged and designed by various different configurations. Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely represents selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work belong to the scope of protection of the present invention.

[0023] The accompanying drawings show various structural schematic diagrams of the embodiments disclosed in the present invention. These figures are not drawn to scale, and some details are magnified and some details may be omitted for the purpose of clear expression. The shapes of various regions and layers shown in the figures and the relative sizes and positional relationships therebetween are only exemplary, and may deviate in practice due to manufacturing tolerances or technical limitations, and those skilled in the art may design regions / layers with different shapes, sizes, and relative positions according to actual needs.

[0024] Embodiment 1 refer to Figure 1 The trusted assurance method for the DCS control system host computer application of the present invention comprises the following steps: 1) Perform integrity check on each application in the DCS control system host computer, and place the applications that pass the integrity check as whitelist applications; 2) Allow whitelisted applications to run in the target environment; 3) Monitor the status of whitelist applications during operation and determine whether there are abnormal behaviors based on the data obtained from the monitoring; 4) When there is abnormal behavior, an alarm signal is issued, and measures corresponding to the abnormal behavior are taken for the abnormal behavior, and the measures at least include limiting the network access rights of abnormal applications, suspending the operation of some functions of abnormal applications, recording relevant log information of abnormal behavior, blocking applications, deleting applications, and restarting the system. When abnormal behavior is monitored, an alarm is triggered and response measures are initiated, and the response measures include isolating affected components, terminating malicious processes and rolling back to the previous safe state, and deleting applications; when the abnormality cannot be resolved, the system is restarted and the application trusted whitelist protection mechanism is executed again; 5) Updating the whitelist based on the relevant log information.

[0025] In this embodiment, the priority of each application is first determined, and then the integrity of the application is checked by combining digital signature and hash value verification; the verification result is compared with the preset standard result. If there is any inconsistency, an alarm is issued to notify the management personnel, and the emergency repair program is started to restore the application file from the backup storage, and the relevant log information of this integrity check is sent to the system log server for storage, and the relevant log information is used for auditing and troubleshooting.

[0026] In this embodiment, the target environment is a trusted computing environment, which is a computer system environment with hardware, software and data security, wherein the computer device in the computer system environment is configured with a security chip, and the security chip is used to protect the keys and sensitive data stored in the security chip.

[0027] In this embodiment, the process of determining whether there is abnormal behavior based on the monitored data is as follows: Inputting the monitored data into a trained deep neural network machine learning model to obtain spatiotemporal feature information in the monitored data, wherein the deep neural network machine learning model adopts an architecture combining a convolutional neural network and a recurrent neural network; Whether there is abnormal behavior is determined based on the spatiotemporal feature information.

[0028] Among them, during the training stage of the deep neural network machine learning model, the deep neural network machine learning model is trained in supervised learning using historical normal operation data and labeled abnormal data samples.

[0029] In actual operation, the present invention introduces trusted computing technology to ensure that the host computer software has a high degree of security during operation, effectively resist various security threats, and thus improve the security of the system. In addition, through integrity verification and real-time monitoring, the stability and reliability of the host computer software are ensured, the risk of system failure and data loss is reduced, and the stability of the system is improved. At the same time, through automatic monitoring and abnormal feedback, the workload of the system administrator is reduced and the management efficiency is improved.

[0030] Embodiment 2 refer to Figure 2 The trusted assurance method for the DCS control system host computer application of the present invention comprises the following steps: 1) Determine the whitelist application; Determine whether the application is trustworthy. If the application is trustworthy, list it as a whitelist application and allow the whitelist application to run in the target environment.

[0031] Specifically, an integrity check is performed on the application, that is, the binary code of the application is checked to ensure that the application has not been tampered with or damaged during transmission, storage and execution.

[0032] To implement application integrity verification, the present invention uses a combination of digital signature and hash value verification. Specifically, when developers publish applications, they use private keys to digitally sign the applications, and publish the signatures together with the applications to users. When users install and run applications, they use public keys to verify the digital signatures, and calculate the hash value of the application and compare it with the hash value provided by the developer to ensure the integrity and security of the application, and list qualified applications as whitelist applications.

[0033] 2) Implement whitelist strategy: Only whitelisted applications are allowed to run in the target environment, and non-whitelisted applications cannot run in the target environment. This can be achieved through the operating system or security policy. The security policy supports user customization.

[0034] The target environment is a trusted computing environment, which has a computer system environment with hardware, software and data security, and can protect the confidentiality, integrity and availability of data. By introducing a trusted computing environment, the present invention provides a strong security guarantee for the host computer application of the DCS control system.

[0035] To achieve a trusted computing environment, the present invention uses a computer device with a security chip that can protect the keys and sensitive data stored therein, ensuring the confidentiality and integrity of the data. At the same time, the present invention also uses an operating system with a secure boot function to ensure the security of the system startup process and prevent the injection and execution of malicious code.

[0036] 3) Monitor whitelist applications; Monitor the status of whitelisted applications during operation and determine whether abnormal behavior occurs based on the monitored data. If abnormal behavior occurs, an alarm is issued based on the security hazard level of the abnormal behavior and corresponding measures are taken, such as blocking the application, deleting the application, or restarting the system.

[0037] 4) Response and recovery; When any abnormal behavior is monitored or possible malicious activities are detected, an alarm signal is triggered and response measures are initiated, including isolating the affected components, terminating the malicious process, and rolling back to the previous safe state. If the abnormality cannot be resolved, the system will automatically restart and the application trust guarantee mechanism will be executed again.

[0038] In addition, it should be noted that the present invention also supports remote monitoring and anomaly detection. By remotely accessing the control system, the administrator can view the system's operating status, receive warning information, view abnormal reports, etc. in real time, which provides great convenience for the administrator, enabling the administrator to promptly discover and handle abnormal situations and ensure the stability and reliability of the DCS control system.

[0039] Through the present invention, application trustworthiness guarantees that only verified and trusted applications run in the system, thereby greatly reducing the risk of unsafe applications attacking the system. At the same time, continuous monitoring and response mechanisms can also promptly detect and respond to potential security threats, ensuring the stability and security of the system.

[0040] Embodiment 3 refer to Figure 3 The DCS control system host computer application trusted assurance system of the present invention includes: The verification module is used to perform integrity verification on each application in the DCS control system host computer, and the application that passes the integrity verification is used as a whitelist application; Run module, used to allow whitelisted applications to run in the target environment; The monitoring module is used to monitor the status of the whitelist application during operation and determine whether there is abnormal behavior based on the monitored data; The alarm module is used to issue an alarm when there is abnormal behavior, and take measures corresponding to the abnormal behavior.

[0041] In this embodiment, the verification module includes: A determination module is used to determine the priority of each application program in the host computer of the DCS control system; The integrity check module is used to perform integrity check on each application according to the priority of each application by combining digital signature and hash value check. When any application fails the check, an alarm signal is issued.

[0042] In this embodiment, the monitoring module includes: An extraction module is used to input the monitored data into a trained deep neural network machine learning model to obtain spatiotemporal feature information in the monitored data, wherein the deep neural network machine learning model adopts an architecture combining a convolutional neural network and a recurrent neural network; A judgment module is used to judge whether there is abnormal behavior based on the spatiotemporal feature information.

[0043] The division of modules in the embodiments of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation. In addition, each functional module in each embodiment of the present application may be integrated into a processor, or may exist physically separately, or two or more modules may be integrated into one module. The above-mentioned integrated modules may be implemented in the form of hardware or in the form of software functional modules.

[0044] Embodiment 4 A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of implementing the trusted assurance method for the application of the DCS control system host computer are implemented, for example, including: performing integrity check on each application in the DCS control system host computer, and using the application that passes the integrity check as a whitelist application; allowing the whitelist application to run in the target environment; monitoring the state of the whitelist application during operation, and determining whether there is abnormal behavior based on the monitored data; when there is abnormal behavior, an alarm is issued, and measures corresponding to the abnormal behavior are taken for the abnormal behavior. Among them, the memory may include a memory, such as a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk memory, etc.; the processor, the network interface, and the memory are interconnected through an internal bus, and the internal bus may be an industrial standard architecture bus, a peripheral component interconnection standard bus, an extended industrial standard architecture bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. The memory is used to store programs. Specifically, the program may include a program code, and the program code includes computer operation instructions. The memory may include a memory and a non-volatile memory, and provide instructions and data to the processor.

[0045] Embodiment 5 A computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the DCS control system host computer application trust assurance method are implemented, for example, including: performing integrity check on each application in the DCS control system host computer, and using the application that passes the integrity check as a whitelist application; allowing the whitelist application to run in the target environment; monitoring the state of the whitelist application during operation, and determining whether there is abnormal behavior based on the monitored data; when there is abnormal behavior, an alarm is issued, and measures corresponding to the abnormal behavior are taken for the abnormal behavior. Specifically, the computer-readable storage medium includes, but is not limited to, for example, volatile memory and / or non-volatile memory. The volatile memory may include random access memory and / or cache memory, etc. The non-volatile memory may include a read-only memory, a hard disk, a flash memory, an optical disk, a magnetic disk, etc.

[0046] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, optical storage, etc.) containing computer-usable program codes.

[0047] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0048] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0049] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0050] Those skilled in the art will readily appreciate other embodiments of the present invention after considering the specification and disclosure of the invention. This application is intended to cover any variations, uses or adaptations of the present invention that follow the general principles of the present invention and include common knowledge or customary techniques in the art that are not disclosed by the present invention. The specification and examples are to be considered exemplary only, and the true scope and spirit of the present invention are indicated by the following claims.

[0051] It should be understood that the present invention is not limited to the exact construction that has been described above and shown in the drawings and that various modifications and changes may be made without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

[0052] The above description is only a preferred embodiment of the present invention and does not limit the present invention in any way. Any simple modification, change and equivalent structural change made to the above embodiment based on the technical essence of the present invention still falls within the protection scope of the technical solution of the present invention.

Claims

1. A DCS control system host computer application trustworthy assurance method, characterized in that: include: Perform integrity check on each application in the DCS control system host computer, and select applications that pass the integrity check as whitelist applications; Allow whitelisted applications to run in the target environment; Monitor the status of whitelist applications during operation and determine whether there are abnormal behaviors based on the data obtained from the monitoring; When there is abnormal behavior, an alarm is issued, and measures corresponding to the abnormal behavior are taken for the abnormal behavior.

2. According to claim 1, the DCS control system host computer application trust guarantee method is characterized in that: The process of performing integrity check on each application program in the host computer of the DCS control system is as follows: Determine the priority of each application in the DCS control system host computer; According to the priority of each application, a combination of digital signature and hash value verification is used to verify the integrity of each application. When any application fails the verification, an alarm signal is issued.

3. According to claim 1, the DCS control system host computer application trust guarantee method is characterized in that: The target environment is a trusted computing environment, which is a computer system environment with hardware, software and data security, wherein the computer equipment in the computer system environment is configured with a security chip, and the security chip is used to protect keys and sensitive data stored in the security chip.

4. According to claim 1, the DCS control system host computer application trust guarantee method is characterized in that: The measures include at least one of limiting the network access rights of abnormal applications, suspending the operation of some functions of abnormal applications, recording relevant log information of abnormal behavior, blocking applications, deleting applications, and restarting the system.

5. According to claim 1, the DCS control system host computer application trust guarantee method is characterized in that: The process of determining whether there is abnormal behavior based on the monitored data is as follows: Inputting the monitored data into a trained deep neural network machine learning model to obtain spatiotemporal feature information in the monitored data, wherein the deep neural network machine learning model adopts an architecture combining a convolutional neural network and a recurrent neural network; It is determined whether there is abnormal behavior based on the spatiotemporal feature information.

6. A DCS control system host computer application trustworthy assurance system, characterized in that: include: The verification module is used to perform integrity verification on each application in the DCS control system host computer, and the application that passes the integrity verification is used as a whitelist application; Run module, used to allow whitelisted applications to run in the target environment; The monitoring module is used to monitor the status of the whitelist application during operation and determine whether there is abnormal behavior based on the monitored data; The alarm module is used to issue an alarm when there is abnormal behavior, and take measures corresponding to the abnormal behavior.

7. The DCS control system host computer application trustworthy assurance system according to claim 6 is characterized in that: The verification module comprises: A determination module is used to determine the priority of each application program in the host computer of the DCS control system; The integrity check module is used to perform integrity check on each application according to the priority of each application by combining digital signature and hash value check. When any application fails the check, an alarm signal is issued.

8. The DCS control system host computer application trustworthy assurance system according to claim 6 is characterized in that: The monitoring module comprises: An extraction module is used to input the monitored data into a trained deep neural network machine learning model to obtain spatiotemporal feature information in the monitored data, wherein the deep neural network machine learning model adopts an architecture combining a convolutional neural network and a recurrent neural network; A judgment module is used to judge whether there is abnormal behavior based on the spatiotemporal feature information.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the DCS control system host computer application trust assurance method as described in any one of claims 1 to 5 is implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by the processor, the DCS control system host computer application trust assurance method as described in any one of claims 1 to 5 is implemented.

Images