Credible DCS upper computer data report generation method and related device

Abstract

The invention discloses a trusted DCS upper computer data report generation method and a related device, and relates to the technical field of data report generation. Generating report attributes according to the report generation information; acquiring data from a database of the credible DCS upper computer according to the report attributes; encrypting the obtained data to obtain encrypted data, and decrypting the encrypted data through the report attributes and the encrypted data to obtain decrypted data; generating an initial report according to the decrypted data; generating a report digital signature based on the initial report, adding the report digital signature into the initial report, and generating a final report. The credible DCS report function safety protection capability can be improved, and the usability and the high efficiency of the report function are further improved.

Description

Technical Field

[0001] The present invention relates to the technical field of data report generation, and in particular to a method for generating a data report of a trusted DCS host computer and a related device. Background Art

[0002] Power safety is an important cornerstone for ensuring safety and stability. Most of the existing power generation control systems did not consider safety features at the beginning of their design. They relied on traditional additional deployment of security protection tools, patch-style anti-virus and detection methods, which had problems such as difficulty in tool updates and complex maintenance, making it difficult to ensure the safety of industrial control systems in the long term. The development of a trusted distributed control system (DCS) has achieved intrinsic safety coverage of the entire chain of "static startup-dynamic operation-real-time trust" for power generation control equipment based on trusted computing, blocking the behavior of attacking the power generation system through the network and effectively resisting existing social engineering attacks.

[0003] As an important part of the trusted DCS, the host computer integrates applications such as alarms, reports, databases, interface displays, and planning curves for decentralized control and centralized management of the system. For traditional DCS report production, data is generally transmitted from the client to the server, and the core data of the system is transmitted in the system in plain text, which makes the system data prone to hijacking and leakage. At the same time, for the report function, the operation and maintenance personnel on site usually directly export data from the measurement points in the selected database based on experience, without strict authority classification and data verification, resulting in a huge workload for the operation and maintenance personnel and further increased risk of data leakage. Summary of the invention

[0004] The purpose of the present invention is to provide a trusted DCS host computer data report generation method and related devices to overcome the defects of the prior art. The present invention can improve the security protection capability of the trusted DCS report function, while further improving the usability and efficiency of the report function.

[0005] In order to achieve the above object, the present invention adopts the following technical scheme: The method for generating a data report of a trusted DCS host computer includes the following steps: Select the information to generate the report; Generate report attributes based on the information of the generated report; According to the report attributes, data is obtained from the trusted DCS host computer database; Encrypt the acquired data to obtain encrypted data, and decrypt the encrypted data through report attributes and the encrypted data to obtain decrypted data; Generate initial reports based on decrypted data; Generate a report digital signature based on the initial report, add the report digital signature to the initial report, and generate a final report.

[0006] Furthermore, the information of the generated report includes: the name of the report, the measuring points displayed in the report, the step length of the report display, the time granularity of the report display, and whether the report uses a template.

[0007] Furthermore, the report attributes include basic attributes, measurement point attributes, generation attributes and template attributes; The basic attributes include name, generation time, number of rows and columns, type, format, user authority, start and end time of measurement point information, and measurement point display step length; The measuring point attributes include the number of measuring points, the measuring point names and the measuring point index numbers; The generated attributes include whether it is a master node, data type, and trust status; The template attributes include whether to select a template and the type of template selected.

[0008] Furthermore, in the process of generating report attributes according to the information of generating the report, if the report selects a template, the template attributes are added to the report attributes, otherwise the template attributes are empty.

[0009] Furthermore, after generating the final report, the process also includes opening the final report, extracting the report digital signature, comparing it with the pre-stored report digital signature, and marking the final report as credible after confirming that the signature is correct.

[0010] Furthermore, the initial report and the final report are both system files based on the XML file format.

[0011] Furthermore, the generation process of the initial report is as follows: Call the XML file generation interface of the trusted DCS host computer; Generate an XML file from the decrypted data according to the XML file requirements; The trusted DCS host computer automatically generates an initial report based on the generated XML file.

[0012] Trusted DCS host computer data report generation system, including: Information input module: used to select information for generating reports; Report attribute module: used to generate report attributes based on the information of generated reports; Database module: used to obtain data from the trusted DCS host computer database according to report attributes; Trusted module: used to encrypt the acquired data to obtain encrypted data, and decrypt the encrypted data through report attributes and encrypted data to obtain decrypted data; Initial report generation module: used to generate initial reports based on decrypted data; Final report generation module: used to generate a report digital signature based on the initial report, add the report digital signature to the initial report, and generate the final report.

[0013] A computer device comprises a memory, a processor and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of the method for generating a data report of a trusted DCS host computer are implemented.

[0014] A computer storage medium stores a computer program, which, when executed by a processor, implements the steps of the method for generating a data report of a trusted DCS host computer.

[0015] Compared with the prior art, the present invention has the following beneficial technical effects: The present invention encrypts the data required for report generation through a trusted DCS, thereby avoiding direct transmission of data in plain text in the system and solving the risk of data leakage after malicious hijacking; at the same time, the digital signature of the report file generated based on the trusted function can measure the integrity and accuracy of the report file.

[0016] Furthermore, the present invention fully considers the work requirements of operation and maintenance personnel, adopts a parameterized and templated production process, reduces the work intensity and workload of operation and maintenance personnel in producing reports, and reduces the requirements for database technology of operation and maintenance personnel.

[0017] Furthermore, by comparing the digital signature of the report, it can be determined whether the report file has been maliciously tampered with, thereby improving the accuracy of the report and further enhancing data security. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The drawings in the specification are used to provide further understanding of the present invention and constitute a part of the present invention. The schematic embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0019] Figure 1 It is a flow chart of a method for generating a data report of a trusted DCS host computer according to the present invention; Figure 2 This is a schematic diagram of the structure of the trusted DCS host computer data report generation system of the present invention. DETAILED DESCRIPTION

[0020] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0021] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0022] Embodiment 1 See also Figure 1 The present invention provides a method for generating a data report of a trusted DCS host computer, comprising the following steps: Select the information to generate the report; Generate report attributes based on the information of the generated report; According to the report attributes, data is obtained from the trusted DCS host computer database; Encrypt the acquired data to obtain encrypted data, and decrypt the encrypted data through report attributes and the encrypted data to obtain decrypted data; Generate initial reports based on decrypted data; Generate a report digital signature based on the initial report, add the report digital signature to the initial report, and generate a final report.

[0023] The present invention adopts a trusted DCS to encrypt and protect the data required for report generation, effectively eliminating the risk of exposure of plain text data in the system transmission link, and preventing the leakage of sensitive information caused by illegal interception of data during transmission; at the same time, relying on the trusted function to generate a report digital signature with cryptographic characteristics, it can double-verify the integrity and accuracy of the report file, ensuring that the entire process from data generation to use is trusted and controllable.

[0024] Embodiment 2 The present invention provides a method for generating a data report of a trusted DCS host computer, comprising the following steps: Select the information for generating the report, including: the name of the report, the measurement points displayed in the report, the step length displayed in the report, the time granularity displayed in the report, and whether to use a template for the report; Generate report attributes according to the information of the generated report, including basic attributes, measuring point attributes, generated attributes and template attributes; wherein the basic attributes include name, generation time, number of rows and columns, type, format, user authority, start and end time of measuring point information and measuring point display step; the measuring point attributes include the number of measuring points, measuring point name and measuring point index number; the generated attributes include whether it is a main node, data type and trusted status; the template attributes include whether to select a template and the selected template type; During report generation, if a report uses a template, the template attributes are added to the report attributes, otherwise the template attributes are empty.

[0025] According to the report attributes, data is obtained from the trusted DCS host computer database; Encrypt the acquired data to obtain encrypted data, and decrypt the encrypted data through report attributes and the encrypted data to obtain decrypted data; The present invention implements a secure state conversion process through encryption and decryption, and dynamically provides protection during the life cycle of data.

[0026] Generate an initial report based on the decrypted data. The initial report is a system file based on the XML file format. The generation process of the initial report is as follows: Call the XML file generation interface of the trusted DCS host computer; Generate an XML file from the decrypted data according to the XML file requirements; The trusted DCS host computer automatically generates an initial report based on the generated XML file.

[0027] Generate a report digital signature for the initial report, add the report digital signature to the initial report, and generate a final report; Open the final report, extract the report digital signature, and compare it with the pre-stored report digital signature. After confirmation, the final report is trusted.

[0028] Embodiment 3 See also Figure 2 The present invention provides a trusted DCS host computer data report generation system, including an information input module, a report attribute module, a database module, a trusted module, an initial report generation module and a final report generation module; wherein: Information input module: used to select information for generating reports; Specifically, for the input of information for reports, users can select the measuring points for which reports need to be generated in this information input module; set the time range for data display; set the report template; set the report name; set the step size for data display; set the time granularity for data display, such as: year, quarter, month, week, day, hour, minute.

[0029] Report attribute module: used to generate report attributes based on the information of generated reports; Specifically, the report attributes include basic attributes, measurement point attributes, generation attributes and template attributes; wherein the basic attributes include name, generation time, number of rows and columns, type, format, user authority, start and end time of measurement point information and measurement point display step; the measurement point attributes include the number of measurement points, measurement point name and measurement point index number; the generation attributes include whether it is a main node, data type and trusted status; the template attributes include whether to select a template and the selected template type; During report generation, if a report uses a template, the template attributes are added to the report attributes, otherwise the template attributes are empty.

[0030] Database module: used to obtain data from the trusted DCS host computer database according to report attributes; Specifically, the trusted DCS host computer database is used to store data required for the operation of the trusted DCS.

[0031] Trusted module: used to encrypt the acquired data to obtain encrypted data, and decrypt the encrypted data through report attributes and encrypted data to obtain decrypted data.

[0032] Initial report generation module: used to generate initial reports based on decrypted data; Specifically, the initial report generation process is as follows: Call the XML file generation interface of the trusted DCS host computer; Generate an XML file from the decrypted data according to the XML file requirements; The trusted DCS host computer automatically generates an initial report based on the generated XML file.

[0033] Final report generation module: used to generate a report digital signature based on the initial report, add the report digital signature to the initial report, and generate a final report. Both the final report and the initial report are system files based on the XML file format.

[0034] During the operation of the trusted DCS host computer data report generation system, the final report is generated through the cooperation of various modules, including the following steps: 1) The user selects the information for generating the report in the information input module, including: the name of the report, the measurement points displayed in the report, the step length displayed in the report, the time granularity displayed in the report, and whether the report uses a template; 2) Call the report attribute model to generate report attributes according to the information for generating the report entered in step 1). If it is a template called by the user, the template attributes are added to the report attributes, otherwise the template attributes are empty; Report attributes include basic attributes, measurement point attributes, generation attributes, and template attributes; their specific contents are shown in Table 1: Table 1 Specific contents of report attributes

[0035] Among them, the data types in the basic attributes involve DCS application scenarios, specifically involving sites, equipment, and users; In the basic attributes, user permissions are divided into five levels, from 1 to 5, where 5 is the highest level and matches the current user permissions; The data types in the generated attributes are historical data, real-time data, and time series data; The template types in the template properties include year, month, and day system template types, as well as special template types set by the user.

[0036] 3) According to the report attributes obtained in step 2), the database module is called to obtain data from the trusted DCS host computer database; specifically, data matching is performed in the trusted DCS host computer database according to the measurement point attributes in the report attributes to obtain the acquired data; The calling database module obtains data from the trusted DCS host computer database, specifically by matching the measuring point attributes in the database and querying to obtain the measuring point data as the obtained data; 4) Call the trusted module to encrypt the data obtained in step 3) to obtain encrypted data, and decrypt the encrypted data through the report attributes and the encrypted data to obtain decrypted data; The method of calling the trusted module to encrypt the acquired data specifically involves calling the trusted module with the acquired data, and encrypting the acquired data based on the encryption algorithm in the trusted module to prevent the real data from being transmitted in plain text in the system; and decrypting the encrypted data specifically involves using the decryption algorithm in the trusted module to decrypt the previously obtained encrypted data to obtain decrypted data.

[0037] 5) Call the initial report generation module to generate the initial report through the decrypted data in step 4), including: a. Call the XML file generation interface of the trusted DCS host computer; b. Generate an XML file with report attributes and acquired data according to the XML file requirements; c. The XML file function of the trusted DCS host computer automatically generates an initial report based on the generated XML file.

[0038] 6) Call the final report generation module, generate a report digital signature based on the initial report, add the report digital signature to the initial report, and generate the final report; Generate a report digital signature based on the initial report, specifically based on the trusted module, use the hash algorithm in the trusted module to measure the entire initial report, generate the report digital signature, and then add it to the initial report as the main node of the initial report to generate the final report. At the same time, call the database module to store the generated report digital signature in the trusted DCS host computer database.

[0039] 7) Open the final report, extract the report digital signature, call the database module to retrieve the pre-stored report digital signature for comparison, and after confirmation, the final report is in a credible state.

[0040] Embodiment 4 A computer device comprises a memory, a processor and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of the method for generating a data report of a trusted DCS host computer are implemented.

[0041] Embodiment 5 A computer storage medium stores a computer program, which, when executed by a processor, implements the steps of the method for generating a data report of a trusted DCS host computer.

[0042] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, optical storage, etc.) containing computer-usable program code.

[0043] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0044] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0045] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0046] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit its protection scope. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the field should understand that after reading the present invention, those skilled in the art can still make various changes, modifications or equivalent substitutions to the specific implementation methods of the invention, but these changes, modifications or equivalent substitutions are all within the protection scope of the invention.

Claims

1. A method for generating a data report of a trusted DCS host computer, characterized in that: The following steps are involved: Select the information to generate the report; Generate report attributes based on the information of the generated report; According to the report attributes, data is obtained from the trusted DCS host computer database; Encrypt the acquired data to obtain encrypted data, and decrypt the encrypted data through report attributes and the encrypted data to obtain decrypted data; Generate initial reports based on decrypted data; Generate a report digital signature based on the initial report, add the report digital signature to the initial report, and generate a final report.

2. The method for generating a data report of a trusted DCS host computer according to claim 1, characterized in that: The information for generating a report includes: the name of the report, the measuring points displayed in the report, the step length displayed in the report, the time granularity displayed in the report, and whether the report uses a template.

3. The method for generating a data report of a trusted DCS host computer according to claim 2, characterized in that: The report attributes include basic attributes, measurement point attributes, generation attributes and template attributes; The basic attributes include name, generation time, number of rows and columns, type, format, user authority, start and end time of measurement point information, and measurement point display step length; The measuring point attributes include the number of measuring points, the measuring point names and the measuring point index numbers; The generated attributes include whether it is a master node, data type, and trust status; The template attributes include whether to select a template and the type of template selected.

4. The method for generating a data report of a trusted DCS host computer according to claim 3 is characterized in that: In the process of generating report attributes according to the information of generating the report, if the report selects a template, the template attributes are added to the report attributes, otherwise the template attributes are empty.

5. The method for generating data reports of a trusted DCS host computer according to claim 1, characterized in that: After the final report is generated, the method further includes opening the final report, extracting the report digital signature, comparing it with the pre-stored report digital signature, and marking the final report as a trusted state after confirming that it is correct.

6. The method for generating a data report of a trusted DCS host computer according to claim 1, characterized in that: The initial report and the final report are both system files based on the XML file format.

7. The method for generating a data report of a trusted DCS host computer according to claim 6 is characterized in that: The generation process of the initial report is as follows: Call the XML file generation interface of the trusted DCS host computer; Generate an XML file from the decrypted data according to the XML file requirements; The trusted DCS host computer automatically generates an initial report based on the generated XML file.

8. Trusted DCS host computer data report generation system, characterized by: include: Information input module: used to select information for generating reports; Report attribute module: used to generate report attributes based on the information of generated reports; Database module: used to obtain data from the trusted DCS host computer database according to report attributes; Trusted module: used to encrypt the acquired data to obtain encrypted data, and decrypt the encrypted data through report attributes and encrypted data to obtain decrypted data; Initial report generation module: used to generate initial reports based on decrypted data; Final report generation module: used to generate a report digital signature based on the initial report, add the report digital signature to the initial report, and generate the final report.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method for generating a data report of a trusted DCS host computer as claimed in any one of claims 1 to 7 are implemented.

10. A computer storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the method for generating a data report of a trusted DCS host computer as claimed in any one of claims 1 to 7 are implemented.

Images