Trusted DCS Host Computer Data Report Generation Method and Related Devices

Abstract

The present invention discloses a method for generating a data report of a trusted DCS host computer and related devices, relating to the technical field of data report generation. Information for generating a report is selected; report attributes are generated according to the information for generating the report; data is obtained from a trusted DCS host computer database according to the report attributes; the obtained data is encrypted to obtain encrypted data, and the encrypted data is decrypted through the report attributes and the encrypted data to obtain decrypted data; an initial report is generated according to the decrypted data; a report digital signature is generated based on the initial report, and the report digital signature is added to the initial report to generate a final report. The present invention can improve the functional security protection ability of the trusted DCS report, and further improve the usability and efficiency of the report function.

Description

Technical Field

[0001] The present invention relates to the technical field of data report generation, and particularly relates to a method for generating a data report of a trusted DCS host computer and related devices. Background Art

[0002] Power safety is an important cornerstone for ensuring security and stability. Most of the existing power generation control systems did not consider security features at the beginning of their design. Relying on traditional additional deployment of security protection tools, patch-based anti-virus and detection means, there are problems such as difficult tool updates and complex maintenance, and it is difficult to ensure the security of industrial control systems in the long term. The development of a trusted distributed control system (DCS) realizes the full-chain essential security coverage of "static startup - dynamic operation - real-time trust" for power generation control equipment based on trusted computing, blocks the behavior of attacking the power generation system through the network, and effectively resists existing social engineering attacks.

[0003] As an important part of the trusted DCS, the host computer integrates applications such as alarms, reports, databases, interface displays, and planned curves for system decentralized control and centralized management. For traditional DCS report production, data is generally transmitted from the client to the server, and the core data of the system is transmitted in plain text in the system, resulting in a risk that the system data is easily hijacked and leaked; at the same time, for the report function, on-site operation and maintenance personnel usually directly export data from the selected measurement points in the database based on experience, without strict authority grading and data verification, resulting in a huge workload for operation and maintenance personnel and a further increase in the risk of data leakage. Summary of the Invention

[0004] The purpose of the present invention is to provide a method for generating a data report of a trusted DCS host computer and related devices to overcome the defects of the existing technology. The present invention can improve the security protection ability of the trusted DCS report function, and at the same time further improve the usability and efficiency of the report function.

[0005] To achieve the above object, the present invention adopts the following technical solutions:

[0006] A method for generating a data report of a trusted DCS host computer includes the following steps:

[0007] Select the information for generating the report;

[0008] Generate report attributes according to the information for generating the report;

[0009] Obtain data from the trusted DCS host computer database according to the report attributes;

[0010] Encrypt the obtained data to obtain encrypted data, and decrypt the encrypted data through the report attributes and the encrypted data to obtain decrypted data;

[0011] Generate an initial report based on the decrypted data;

[0012] Generate a report digital signature based on the initial report, add the report digital signature to the initial report, and generate a final report.

[0013] Furthermore, the information for generating the report includes: the name of the report, the measurement points shown in the report, the step size shown in the report, the time granularity shown in the report, and whether a template is selected for the report.

[0014] Furthermore, the report attributes include basic attributes, measurement point attributes, generation attributes, and template attributes;

[0015] The basic attributes include name, generation time, number of rows and columns, type, format, user permissions, start and end times of measurement point information, and measurement point display step size;

[0016] The measurement point attributes include the number of measurement points, the names of the measurement points, and the measurement point index numbers;

[0017] The generation attributes include whether it is the main node, data type, and trusted status;

[0018] The template attributes include whether a template is selected and the type of the selected template.

[0019] Furthermore, in the process of generating report attributes according to the information for generating the report, if a template is selected for the report, the template attributes are added to the report attributes; otherwise, the template attributes are empty.

[0020] Furthermore, after generating the final report, it also includes opening the final report, extracting the report digital signature, comparing it with the pre-stored report digital signature, and marking the final report as trusted after confirmation.

[0021] Furthermore, both the initial report and the final report are system files based on the xml file format.

[0022] Furthermore, the generation process of the initial report is as follows:

[0023] Call the xml file generation interface of the trusted DCS host computer;

[0024] Generate an xml file from the decrypted data according to the xml file requirements;

[0025] The trusted DCS host computer automatically generates an initial report based on the generated xml file.

[0026] The trusted DCS host computer data report generation system includes:

[0027] Information input module: used to select the information for generating the report;

[0028] Report property module: used to generate report properties according to the information for generating the report;

[0029] Database module: used to obtain data from the trusted DCS host computer database according to the report properties;

[0030] Trusted module: used to encrypt the obtained data to obtain encrypted data, and decrypt the encrypted data through the report properties and the encrypted data to obtain decrypted data;

[0031] Initial report generation module: used to generate an initial report according to the decrypted data;

[0032] Final report generation module: used to generate a report digital signature based on the initial report, add the report digital signature to the initial report, and generate a final report.

[0033] A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of the trusted DCS host computer data report generation method are implemented.

[0034] A computer storage medium stores a computer program. When the computer program is executed by a processor, the steps of the trusted DCS host computer data report generation method are implemented.

[0035] Compared with the prior art, the present invention has the following beneficial technical effects:

[0036] The present invention encrypts the data required for report generation through the trusted DCS, thereby avoiding the direct transmission of data in plaintext in the system and solving the risk of data leakage after being maliciously hijacked; at the same time, based on the trusted function, a report digital signature of the report file can be generated, which can measure the integrity and accuracy of the report file.

[0037] Furthermore, the present invention fully considers the work requirements of operation and maintenance personnel, adopts a parameterized and templated production process, reduces the work intensity and workload of operation and maintenance personnel in making reports, and reduces the requirements for the database technology of operation and maintenance personnel.

[0038] Furthermore, by comparing the report digital signatures, it can be determined whether the report file has been maliciously tampered with, thereby improving the accuracy of the report and further enhancing data security. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] The accompanying drawings in the specification are used to provide a further understanding of the present invention, and constitute a part of the present invention. The illustrative embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation to the present invention.

[0040] Figure 1 This is a schematic flow chart of the method for generating the data report of the trusted DCS host computer according to the present invention;

[0041] Figure 2 This is a schematic structural diagram of the system for generating the data report of the trusted DCS host computer according to the present invention. Specific embodiments

[0042] In order to enable those skilled in the art of the present technology to better understand the solution of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

[0043] It should be noted that the terms "first", "second", etc. in the description and claims of the present invention and the above drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that such data used in appropriate cases can be interchanged so that the embodiments of the present invention described herein can be implemented in an order different from those illustrated or described herein. In addition, the terms "comprising" and "having" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0044] Embodiment 1

[0045] See Figure 1 , the present invention provides a method for generating a data report of a trusted DCS host computer, including the following steps:

[0046] Select the information for generating the report;

[0047] Generate report attributes according to the information for generating the report;

[0048] Obtain data from the trusted DCS host computer database according to the report attributes;

[0049] Encrypt the obtained data to obtain encrypted data, and decrypt the encrypted data through the report attributes and the encrypted data to obtain decrypted data;

[0050] Generate an initial report according to the decrypted data;

[0051] Generate a report digital signature based on the initial report, and add the report digital signature to the initial report to generate a final report.

[0052] The present invention uses a trusted DCS to encrypt and protect the data required for report generation, effectively eliminating the exposure risk of clear text data in the system transmission link and preventing the problem of sensitive information leakage caused by illegal interception of data during transmission; at the same time, relying on the trusted function to generate a report digital signature with cryptographic characteristics, it can double-verify the integrity and accuracy of the report file, ensuring the trustworthiness and controllability of the entire process from data generation to use.

[0053] Embodiment 2

[0054] The present invention provides a method for generating a data report of a trusted DCS host computer, including the following steps:

[0055] Select the information for generating the report, including: the name of the report, the measuring points displayed in the report, the step length of the report display, the time granularity of the report display, and whether to select a template for the report;

[0056] Generate report attributes according to the information for generating the report, including basic attributes, measuring point attributes, generation attributes, and template attributes; among them, the basic attributes include name, generation time, number of rows and columns, type, format, user permissions, start and end times of measuring point information, and measuring point display step length; the measuring point attributes include the number of measuring points, the names of the measuring points, and the measuring point index numbers; the generation attributes include whether it is the main node, data type, and trusted status; the template attributes include whether to select a template and the selected template type;

[0057] During the process of generating the report, if the report selects a template, add the template attributes to the report attributes, otherwise the template attributes are empty.

[0058] Obtain data from the trusted DCS host computer database according to the report attributes;

[0059] Encrypt the obtained data to obtain encrypted data, and decrypt the encrypted data through the report attributes and the encrypted data to obtain decrypted data;

[0060] The present invention realizes a secure state conversion process through encryption and decryption, and dynamically provides protection during the life cycle of the data.

[0061] Generate an initial report according to the decrypted data, and the initial report is a system file based on the xml file format; the generation process of the initial report is as follows:

[0062] Call the xml file generation interface of the trusted DCS host computer;

[0063] Generate an xml file with the decrypted data according to the requirements of the xml file;

[0064] The trusted DCS host computer automatically generates an initial report according to the generated xml file.

[0065] Generate a report digital signature for the initial report, add the report digital signature to the initial report, and generate a final report;

[0066] Open the final report, extract the report digital signature, and compare it with the pre-stored report digital signature. After confirmation, it indicates that the final report is in a trusted state.

[0067] Embodiment III

[0068] See Figure 2 , the present invention provides a trusted DCS host computer data report generation system, including an information input module, a report attribute module, a database module, a trusted module, an initial report generation module, and a final report generation module; where:

[0069] Information input module: used to select the information for generating the report;

[0070] Specifically, it is used for the input of the information for the report. The user can select the measuring points that need to generate the report in this information input module; set the time range for data display; set the report template; set the report name; set the step length for data display; set the time granularity for data display, such as: year, quarter, month, week, day, hour, minute.

[0071] Report attribute module: used to generate report attributes according to the information for generating the report;

[0072] Specifically, the report attributes include basic attributes, measuring point attributes, generation attributes, and template attributes; among them, the basic attributes include name, generation time, number of rows and columns, type, format, user permissions, start and end times of measuring point information, and measuring point display step length; the measuring point attributes include the number of measuring points, measuring point names, and measuring point index numbers; the generation attributes include whether it is a master node, data type, and trusted state; the template attributes include whether to select a template and the selected template type;

[0073] During the process of generating the report, if a template is selected for the report, the template attributes are added to the report attributes, otherwise the template attributes are empty.

[0074] Database module: used to obtain data from the trusted DCS host computer database according to the report attributes;

[0075] Specifically, the trusted DCS host computer database is used to store the data required for the operation of the trusted DCS.

[0076] Trusted module: used to encrypt the obtained data to obtain encrypted data, and decrypt the encrypted data through the report attributes and the encrypted data to obtain decrypted data.

[0077] Initial Report Generation Module: used to generate an initial report based on the decrypted data;

[0078] Specifically, the process of generating the initial report is as follows:

[0079] Call the xml file generation interface of the trusted DCS host computer;

[0080] Generate an xml file based on the decrypted data according to the requirements of the xml file;

[0081] The trusted DCS host computer automatically generates an initial report based on the generated xml file.

[0082] Final Report Generation Module: used to generate a report digital signature based on the initial report, add the report digital signature to the initial report, and generate a final report. Both the final report and the initial report are system files based on the xml file format.

[0083] During the operation of the trusted DCS host computer data report generation system, a final report is generated through the cooperation of each module, including the following steps:

[0084] 1) The user selects the information for generating the report in the information input module, including: the name of the report, the measuring points shown in the report, the step size shown in the report, the time granularity shown in the report, and whether to select a template for the report;

[0085] 2) Call the report attribute model to generate report attributes based on the information for generating the report input in step 1). If it is a template called by the user, add the template attributes to the report attributes; otherwise, the template attributes are empty;

[0086] The report attributes include basic attributes, measuring point attributes, generation attributes, and template attributes; the specific content is shown in Table 1:

[0087] Table 1 Specific Content of Report Attributes

[0088]

[0089] Among them, the data type in the basic attributes involves the DCS application scenario, specifically involving the station, equipment, and user;

[0090] The user permissions in the basic attributes are divided into 5 levels, from 1 to 5, where 5 is the highest level, which matches the current user permissions;

[0091] The data type in the generation attributes is historical data, real-time data, and time-series data;

[0092] The template types in the template attributes include annual, monthly, and daily system template types, as well as special template types set by the user.

[0093] 3) According to the report properties obtained in step 2), call the database module to obtain data from the trusted DCS host computer database; specifically, perform data matching in the trusted DCS host computer database according to the measurement point properties in the report properties to obtain the acquired data;

[0094] The calling of the database module to obtain data from the trusted DCS host computer database is specifically to perform matching in the database through the measurement point properties, query and obtain the measurement point data as the acquired data;

[0095] 4) Call the trusted module to encrypt the data obtained in step 3) to obtain encrypted data, and decrypt the encrypted data through the report properties and the encrypted data to obtain decrypted data;

[0096] The calling of the trusted module to encrypt the acquired data is specifically to call the acquired data to the trusted module and implement the encryption of the acquired data based on the encryption algorithm in the trusted module to prevent the real data plaintext from being transmitted in the system; decrypting the encrypted data is specifically to use the decryption algorithm in the trusted module to decrypt the previously obtained encrypted data to obtain decrypted data.

[0097] 5) Call the initial report generation module to generate an initial report through the decrypted data in step 4), specifically including:

[0098] a. Call the xml file generation interface of the trusted DCS host computer;

[0099] b. Generate an xml file according to the xml file requirements by combining the report properties and the acquired data;

[0100] c. The xml file function of the trusted DCS host computer automatically generates an initial report according to the generated xml file.

[0101] 6) Call the final report generation module to generate a report digital signature based on the initial report, add the report digital signature to the initial report to generate a final report;

[0102] Generating a report digital signature based on the initial report is specifically based on the trusted module, using the hash algorithm in the trusted module to measure the entire initial report. After generating the report digital signature, it is used as the main node of the initial report and added to the initial report to generate a final report. At the same time, call the database module to store the generated report digital signature in the trusted DCS host computer database.

[0103] 7) Open the final report, extract the report digital signature, and then call the database module to retrieve the previously stored report digital signature for comparison. After confirmation, it indicates that the final report is in a trusted state.

[0104] Example 4

[0105] A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of the method for generating a data report of a trusted DCS host computer are implemented.

[0106] Example 5

[0107] A computer storage medium stores a computer program. When the computer program is executed by a processor, the steps of the method for generating a data report of a trusted DCS host computer are implemented.

[0108] Those skilled in the art should understand that the embodiments of the present invention can be provided as a method, a system, or a computer program product. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present invention can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, optical storage, etc.) containing computer-usable program code.

[0109] The present invention is described with reference to the flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and the combination of flows and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing devices to generate a machine, such that the instructions executed by the processor of the computer or other programmable data processing devices generate means for implementing the specified functions in one Figure 1 one flow or multiple flows and / or blocks Figure 1 one block or multiple blocks.

[0110] These computer program instructions can also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, such that the instructions stored in the computer-readable memory generate a manufactured article including instruction means that implement the specified functions in one Figure 1 one flow or multiple flows and / or blocks Figure 1 one block or multiple blocks.

[0111] These computer program instructions can also be loaded onto a computer or other programmable data processing device, such that a series of operation steps are executed on the computer or other programmable device to generate a computer-implemented process. Thus, the instructions executed on the computer or other programmable device provide means for implementing the specified functions in one Figure 1 one flow or multiple flows and / or blocksFigure 1 Steps of the functions specified in one or more boxes.

[0112] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than limit the scope of its protection. Although the present invention has been described in detail with reference to the above embodiments, those of ordinary skill in the art should understand that after reading the present invention, various changes, modifications or equivalent substitutions can still be made to the specific implementation manners of the invention, but these changes, modifications or equivalent substitutions are all within the protection scope of the invention.

Claims

1. A method for generating a data report of a trusted DCS host computer, characterized in that, It includes the following steps: Select the information for generating a report, where the information for generating a report includes: the name of the report, the measurement points shown in the report, the step length shown in the report, the time granularity shown in the report, and whether a template is selected for the report; Generate report attributes according to the information for generating a report; The report attributes include basic attributes, measurement point attributes, generation attributes, and template attributes; The basic attributes include name, generation time, number of rows and columns, type, format, user permissions, start and end times of measurement point information, and measurement point display step length; the user permissions are divided into 5 levels, from 1 to 5, where 5 is the highest level and matches the current user permissions; The measurement point attributes include the number of measurement points, the names of the measurement points, and the measurement point index numbers; The generation attributes include whether it is a master node, data type, and trust status; The template attributes include whether a template is selected and the type of the selected template; Obtain data from the trusted DCS host computer database according to the report attributes; Encrypt the obtained data to get encrypted data, and decrypt the encrypted data through the report attributes and the encrypted data to get decrypted data; Generate an initial report according to the decrypted data; Generate a report digital signature based on the initial report, add the report digital signature to the initial report, and generate a final report.

2. The method for generating a data report of a trusted DCS host computer according to claim 1, characterized in that In the process of generating report attributes according to the information for generating a report, if a template is selected for the report, the template attributes are added to the report attributes, otherwise the template attributes are empty.

3. The method for generating a data report of a trusted DCS host computer according to claim 1, wherein, After generating the final report, it further includes opening the final report, extracting the report digital signature, comparing it with the pre-stored report digital signature, and marking the final report as a trusted status after confirmation.

4. The method for generating a data report of a trusted DCS host computer according to claim 1, wherein Both the initial report and the final report are system files based on the xml file format.

5. The method for generating a data report of a trusted DCS host computer according to claim 4, characterized in that The generation process of the initial report is as follows: Call the xml file generation interface of the trusted DCS host computer; Generate an xml file according to the requirements of the xml file with the decrypted data; The trusted DCS host computer automatically generates an initial report according to the generated xml file.

6. The reliable DCS host computer data report generation system is characterized in that It includes: Information input module: used to select the information for generating a report, where the information for generating a report includes: the name of the report, the measurement points shown in the report, the step length shown in the report, the time granularity shown in the report, and whether a template is selected for the report; Report attribute module: used to generate report attributes according to the information for generating a report; The report attributes include basic attributes, measurement point attributes, generation attributes, and template attributes; The basic attributes include name, generation time, number of rows and columns, type, format, user permissions, start and end times of measurement point information, and measurement point display step length; the user permissions are divided into 5 levels, from 1 to 5, where 5 is the highest level and matches the current user permissions; The measurement point attributes include the number of measurement points, the names of the measurement points, and the measurement point index numbers; The generation attributes include whether it is a master node, data type, and trust status; The template attributes include whether a template is selected and the type of the selected template; Database module: used to obtain data from the trusted DCS host computer database according to the report attributes; Trusted module: used to encrypt the acquired data to obtain encrypted data, and decrypt the encrypted data through the report attributes and the encrypted data to obtain decrypted data; Initial report generation module: used to generate an initial report based on the decrypted data; Final report generation module: used to generate a report digital signature based on the initial report, add the report digital signature to the initial report, and generate a final report.

7. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the trusted DCS host computer data report generation method according to any one of claims 1 to 5.

8. A computer storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps of the trusted DCS host computer data report generation method according to any one of claims 1 to 5.

Images