Industrial control system safety vulnerability analysis method and system oriented to petroleum refining scene

Abstract

The invention belongs to the field of safety engineering, and discloses a petroleum refining scene-oriented industrial control system safety vulnerability analysis method and system, and the method comprises the steps: firstly determining a system target task, a key function and an interaction object, and determining unacceptable loss, harm and safety constraint; then, dividing control structure hierarchies of the system, determining information such as control behaviors and feedback, establishing a function control structure model, and determining four types of unsafe control behaviors; then cause analysis is carried out, various loss scenes are generated, and cause factors are analyzed from the aspects of a process model, a system environment, communication defects, a functional structure and functional dependency; and finally, for each unsafe control behavior, merging cause factors in all loss scenes, performing manual inspection and classification, and determining key safety vulnerability. According to the method, comprehensive safety vulnerability analysis can be carried out on the industrial control system in a petroleum refining scene, and a reference basis is provided for evaluating the safety risk of the system and formulating safety reinforcement measures.

Description

Technical Field

[0001] The present invention belongs to but is not limited to the field of safety engineering technology in petroleum refining industrial production, and in particular relates to a method and system for analyzing the security vulnerability of an industrial control system in a petroleum refining scenario. Background Art

[0002] Oil refining units are basic industrial facilities that are responsible for the processing, separation and conversion of crude oil, and ultimately produce various types of petroleum products. The safe and stable operation of oil refining depends on highly integrated industrial control systems, which are responsible for real-time monitoring and adjustment of key parameters in the production process. In recent years, there have been many cyber attacks on oil refining units, especially industrial control systems, around the world, causing huge economic losses and endangering national security. All cyber attacks need to exploit the security vulnerabilities of the industrial control system itself, so a comprehensive and in-depth security vulnerability analysis will help design security reinforcement plans, improve security protection capabilities, and reduce the network security risks of industrial control systems.

[0003] Most of the current vulnerability analysis methods for industrial control systems come from the field of information technology (IT), and usually focus on security vulnerabilities caused by network protocol vulnerabilities, software vulnerabilities, authentication mechanism defects, etc., and rarely involve security vulnerabilities caused by the interaction of control components. The invention patent (CN201810437213.9) proposes a vulnerability inspection method for industrial control systems. By configuring a threat discovery detection system to receive client instructions and call test cases, a large amount of data is sent to the device under test for threat detection, availability detection and compatibility detection, and finally the vulnerability of the system is mined. The invention still conducts vulnerability analysis around defects at the network protocol and software levels, and lacks consideration for security vulnerabilities caused by the interaction of control components. The methods widely used in the field of traditional hazard analysis, such as fault tree, failure mode and effect analysis (FMEA) method, hazard and operability analysis (HAZOP) method, etc., although involving the interaction between some components or units, are essentially static analysis, and it is difficult to guide the security vulnerability analysis in dynamic interaction scenarios. Moreover, these methods need to be combined with risk assessment when applied to security vulnerability analysis, which not only increases the difficulty of analysis, but also introduces artificial uncertainty. The invention patent (CN202310087731.3) discloses a vulnerability assessment method for industrial control systems. By constructing a minimum inspection unit for vulnerability assessment, manually configuring the evaluation function, statistical function, weight parameters, etc. of each inspection unit, and finally calculating the overall score and weight to calculate the score and evaluate the vulnerability of the industrial control system. This method is essentially a static risk assessment technology, and introduces artificial uncertainty in the evaluation indicators and weight settings. The final analysis results are difficult to effectively guide actual security reinforcement work.

[0004] In view of the above analysis, the technical problems that need to be solved urgently in the prior art are:

[0005] The methods widely used in the field of traditional hazard analysis are essentially static analysis, which makes it difficult to guide security vulnerability analysis in dynamic interaction scenarios. Moreover, these methods need to be combined with risk assessment when applied to security vulnerability analysis, which not only increases the difficulty of analysis but also introduces human uncertainty. Summary of the invention

[0006] In view of the problems existing in the prior art, the present invention provides a method and system for security vulnerability analysis of industrial control systems in a petroleum refining scenario.

[0007] The present invention is implemented as follows: a method for analyzing the security vulnerability of an industrial control system in a petroleum refining scenario, characterized in that the method for analyzing the security vulnerability of an industrial control system in a petroleum refining scenario specifically comprises:

[0008] S1: Determine the target tasks, key functions and interaction objects of the petroleum refining system, and determine the unacceptable losses, hazards and safety constraints at the system level;

[0009] S2: Divide the control structure hierarchy of the system and collect control components, including configuration information of controllers, sensors and actuators, and corresponding controlled variable representations; determine the control behavior, feedback, input and output information between each control component, and establish a functional control structure model;

[0010] S3: Analyze the control behaviors in the functional control structure model and identify unsafe control behaviors (UCAs) that may cause hazards;

[0011] S4, generate loss scenarios for unsafe control actions (UCA), conduct causal analysis, and analyze the causal factors that lead to UCA from five dimensions: process model defects, system environment defects, communication defects, structural defects, and functional dependency defects;

[0012] S5: For each unsafe control action UCA, merge the causal factors under all loss scenarios, classify them according to five dimensions, and derive their security vulnerabilities respectively.

[0013] Furthermore, in S1, the target task is the main purpose or expected result of the system, which defines the basic tasks that the system needs to complete and the effect that the system ultimately needs to achieve;

[0014] Key functions refer to the core functions that the system must have in order to achieve the target tasks. They are the main functional modules or components that the system relies on to complete the target tasks;

[0015] The interaction objects are all the participants involved in the process of realizing key functions, including personnel and devices, which together constitute the functional control structure of the system;

[0016] System-level unacceptable losses refer to conditions that are completely unacceptable from the perspective of the target mission, which will cause great economic losses to the system or pose a serious threat to the environment and personnel safety;

[0017] Hazards refer to any event or condition in the system that may cause unacceptable losses, which may have a significant impact on the safety, personnel, environment or economy of the system. Usually these hazards can be controlled, but if effective control measures are not taken, they may lead to catastrophic consequences.

[0018] Safety constraints refer to restrictive requirements that must be followed during the design and operation process to ensure that the system can operate safely and stably. These safety constraints can come from laws, industry standards, technical specifications, or can be derived by reverse analysis of hazards. For each identified hazard, a corresponding safety constraint must be established to prevent these hazards from causing unacceptable losses at the system level.

[0019] Furthermore, the control structure level of the system is divided into a low control level, a middle control level and a high control level;

[0020] The low control level is responsible for specific, real-time operations, including control of sensors and actuators; the middle control level is responsible for monitoring and coordinating low-level controls, including scheduling, optimization control, or status monitoring during production; the high control level is responsible for the macro-planning and decision-making of the entire system, involving the realization of decision-making and target tasks.

[0021] Furthermore, the control component includes configuration information of the controller, sensor and actuator, and corresponding controlled variable representation; the controller is responsible for calculating the deviation between the information fed back by the sensor and the set target, and outputting a control signal to adjust the actuator. The configuration information that needs to be collected includes control strategy, control target, control algorithm parameters, input and output signals, and configuration bit number;

[0022] The function of the sensor is to measure the controlled variable and convert the measurement result into an electrical signal or a digital signal for analysis by the controller. The configuration information that needs to be collected includes the measured variable, measurement range, measurement accuracy, output signal type, and configuration bit number;

[0023] The actuator receives the instructions from the controller and performs corresponding physical actions to change the system state. The configuration information that needs to be collected includes the control object, execution mode, response time, input signal type, output range, and configuration bit number;

[0024] Each controlled variable is measured by a specific sensor and fed back to the controller through the signal provided by its sensor. The controller generates a control signal based on the difference between the set value and the feedback value of the controlled variable, and then adjusts the actuator to keep the controlled variable within the desired range.

[0025] Furthermore, the control behavior, feedback, input and output information between each control component are determined to establish a functional control structure model. The control behavior describes how the control component processes the input information and generates the corresponding output, which is usually described using a mathematical model or a control algorithm, such as PID control, fuzzy control, etc. The feedback mechanism ensures that the system can adjust the input according to the output results during operation to achieve the purpose of self-correction; the input refers to the information obtained from other components or the external environment, and the output is the control instruction or feedback information of the component.

[0026] Furthermore, in S3, the unsafe control behavior identification method in the petroleum refining scenario includes:

[0027] 3.1 Determine the main functions, security responsibilities, and related control behaviors of each interactive object;

[0028] 3.2 Develop a process model for each interactive object to determine the process model variables and their corresponding states, and keep the controlled variables within the safety parameter range;

[0029] 3.3 Determine the process model variables and corresponding states of all interacting objects, list the combinations of these variables, and identify four types of unsafe control actions (UCA) based on the standards established by STPA, including (i) providing control actions; (ii) not providing control actions; (iii) providing control actions too early, too late, or out of order; and (iv) stopping control actions too early or lasting too long.

[0030] Furthermore, in S4, the loss scenario generation method and cause analysis method for a petroleum refining unit include:

[0031] 4.1 Generate loss scenarios for the four types of unsafe control actions (UCA) and divide them into two categories: (i) situations that lead to unsafe control actions (UCA); (ii) situations where the control actions are incorrectly or incompletely executed;

[0032] 4.2 According to the loss scenario classification, determine the causal factors involved and design the functional control structure for causal analysis;

[0033] 4.3 Conduct causal analysis on the generated loss scenarios from five dimensions, including process model defects, system environment defects, communication defects, structural defects, and functional dependency defects;

[0034] Furthermore, in S5, the security vulnerability derivation method for a petroleum refining device includes:

[0035] 5.1 Check whether the loss scenario of each unsafe control action UCA is comprehensive and has no omissions;

[0036] 5.2 Combine the causal factors of all loss scenarios under each unsafe control action UCA, eliminate repeated, similar or redundant causal factors, and classify them according to the five dimensions of process model defects, system environment defects, communication defects, structural defects and functional dependency defects, and derive their security vulnerabilities respectively;

[0037] 5.3 Derivation of safety vulnerabilities for all causal factors under the same unsafe control action UCA is performed and combined according to different defect types;

[0038] 5.4 Summarize all security vulnerabilities, eliminate duplicate or redundant results, and obtain the complete security vulnerability analysis results of the system.

[0039] Another object of the present invention is to provide an industrial control system security vulnerability analysis system for petroleum refining scenarios, the system specifically comprising:

[0040] Definition module, used to determine the system's target tasks, key functions and interaction objects, unacceptable system-level losses, hazards and safety constraints;

[0041] The control structure hierarchical division module is used to collect control components, determine the control behavior, feedback, input and output information between each control component, and establish a functional control structure model;

[0042] Unsafe control behavior identification module, used to analyze the control behaviors in the functional control structure model and identify unsafe control behaviors (UCAs) that may cause harm;

[0043] The loss scenario generation method and causal analysis module are used to generate loss scenarios for unsafe control actions (UCAs), conduct causal analysis, and analyze the causal factors that lead to the occurrence of UCAs;

[0044] The security vulnerability derivation module is used to combine the causal factors of all loss scenarios for each unsafe control behavior UCA, classify them according to five dimensions, and derive their security vulnerabilities respectively.

[0045] In combination with the above technical solutions and the technical problems solved, the advantages and positive effects of the technical solutions to be protected by the present invention are as follows:

[0046] First, the existing technical problems solved by the present invention in industrial applications:

[0047] 1. System safety analysis in oil refining scenarios lacks systematicity

[0048] Existing technologies for security vulnerability analysis of industrial control systems are mostly limited to single devices or local functions, lacking a systematic and global perspective, and unable to fully identify potential security risks. In the oil refining scenario, the complex multi-level control structure and interactive behavior further increase the difficulty of vulnerability identification, resulting in insufficient investigation of security risks and unpredictable hazards.

[0049] 2. Insufficient analysis of unsafe control actions (UCAs)

[0050] Traditional safety analysis methods are difficult to effectively identify hidden unsafe control behaviors (UCAs) in the system, especially the potential risks in the multi-component and multi-path interaction process. Ignoring UCAs may lead to the failure of key control tasks, causing equipment damage or safety accidents.

[0051] 3. The dimensions of cause analysis are limited and there is a lack of a detailed classification framework

[0052] Existing methods for causal analysis of safety hazards are mostly based on a single factor, such as equipment failure or communication failure, and fail to comprehensively analyze the causes of UCA from multiple dimensions (such as process model defects, communication defects, functional dependency defects, etc.), which limits the depth and accuracy of the analysis.

[0053] 4. Security vulnerability classification and derivation are not accurate enough

[0054] Due to the lack of a unified classification framework, existing analysis techniques often rely on experience to classify and derive vulnerabilities, and are unable to provide effective solutions to specific security issues. This limits the practical application of security analysis results in risk assessment and system optimization.

[0055] Significant technical progress of the technical solution of the present invention

[0056] 1. Provide a systematic safety analysis method

[0057] This paper constructs a functional control structure model to comprehensively analyze the hierarchical structure and interactive behavior of industrial control systems in oil refining scenarios. By dividing control components and their behavior paths, the control signal flow and feedback mechanism are accurately described, and potential safety hazards are systematically identified at the system level. This systematic approach fills the gap in global analysis in existing technologies.

[0058] 2. Accurately identify unsafe control actions (UCAs)

[0059] The present invention combines control behavior analysis and functional control structure model to comprehensively identify unsafe control behaviors (UCA) that may cause harm in oil refining scenarios, including control signal loss, errors, delays, etc. By specifically analyzing the impact of UCA on system tasks, the depth and accuracy of safety analysis are significantly improved.

[0060] 3. Multi-dimensional cause analysis

[0061] For each UCA, the present invention conducts causal analysis from five dimensions, including:

[0062] 1. Process model defects: Identify the deviation in the controller’s understanding of the current state and the target state.

[0063] 2. System environment defects: Consider the impact of external environment changes on system security.

[0064] 3. Communication defects: Analyze delays, packet loss or distortion in signal transmission.

[0065] 4. Structural flaws: Detect vulnerabilities in hardware and software design.

[0066] 5. Functional dependency defects: Evaluate the impact of other module failures on the current control task.

[0067] This multidimensional analytical framework significantly improves the comprehensiveness and targeted understanding of the causal factors.

[0068] 4. Classification and vulnerability derivation

[0069] The present invention combines and classifies the causal factors in all loss scenarios, and derives the security vulnerability of the system from the above five dimensions. By establishing a standardized vulnerability classification system, the present invention provides a more accurate vulnerability assessment method, making the analysis results more operational.

[0070] Value in industrial applications:

[0071] 1. Improve the safety and reliability of oil refining systems

[0072] The present invention provides targeted improvement suggestions by systematically identifying and classifying security vulnerabilities, significantly reducing safety risks in the oil refining process and ensuring the reliable operation of industrial control systems.

[0073] 2. Optimize safety management and risk control

[0074] The comprehensive safety analysis method provided by the present invention can assist enterprises in optimizing their safety management systems, improving risk prediction and early warning capabilities, and providing technical support for establishing a sound industrial safety assurance system.

[0075] 3. Reduce economic losses and environmental risks

[0076] By effectively identifying unsafe control actions (UCAs) and their causal factors, the present invention helps prevent equipment failures, production interruptions and environmental pollution incidents caused by safety hazards, and reduces corporate economic losses and environmental risks.

[0077] 4. Improve the efficiency and standardization of safety analysis

[0078] Compared with the traditional analysis method that relies on experience, the present invention provides a standardized and systematic analysis process, which significantly improves the efficiency of safety analysis and provides a reliable tool for promoting safety technology in the petroleum refining industry.

[0079] Through the above technological advances, the present invention provides an effective solution for the security analysis and improvement of industrial control systems in petroleum refining scenarios, which is of great significance to promoting the development of security technology for industrial control systems.

[0080] Second, the expected benefits and commercial value of the technical solution of the present invention after transformation: it can provide a security vulnerability analysis solution for industrial control systems used by domestic oil refining enterprises and similar large-scale chemical production enterprises, reducing the significant harm and losses caused by the exploitation of security vulnerabilities by network attacks. At the same time, referring to the HAZOP analysis widely used by current chemical production enterprises in terms of safety compliance, the quotation for a single analysis is usually 150,000 to 500,000, and there are currently more than 200 chemical production plants in China with a million-ton level. Considering that the technical solution proposed by the present invention has reached the level of HAZOP analysis in terms of practicality and is more comprehensive, it can be used as an alternative analysis solution, so it has great commercial value.

[0081] The technical solution of the present invention fills the technical gap in the industry at home and abroad: the security vulnerability analysis of industrial control systems at home and abroad comes from the field of information technology (IT), usually focusing on defects in network protocols, software, authentication mechanisms, etc., and almost does not consider the security vulnerabilities caused by the interaction between control components. The technical solution proposed by the present invention is based on the dynamic interaction behavior of control components, uses STPA technology to model the functional control structure, and derives security vulnerabilities based on the identification of unsafe control behaviors, thus filling the technical gap.

[0082] The technical solution of the present invention solves the technical problems that people have been eager to solve but have never been successful: 1) The existing technology is limited to a single device or local function for the security vulnerability analysis of industrial control systems, such as network protocols, software vulnerabilities or authentication mechanism defects, lacking a systematic and global perspective, and unable to fully identify potential security risks. In fact, even if all devices pass security authentication and vulnerability detection, when facing denial of service (DoS) attacks, current industrial control systems often cannot effectively defend and respond in time, and this is precisely due to insufficient consideration of security vulnerabilities at the communication level (such as IP address exposure, insufficient communication bandwidth, and inability to effectively distinguish and process invalid data packets, etc.); 2) After obtaining clear unsafe control behaviors, which dimensions should be used for causal analysis is another problem that plagues the industry. Traditional methods are limited to control component failures or communication failures, so the security vulnerabilities that can be analyzed are limited. The present invention considers defects in multiple dimensions in the causal analysis, including process model defects, system environment defects, communication defects, structural defects, and functional dependency defects, which expands the depth and breadth of the analysis and can more effectively guide security reinforcement work.

[0083] The technical solution of the present invention overcomes technical bias: the current vulnerability analysis of industrial control systems generally comes from vulnerability analysis in the field of information technology (IT), and commonly used methods include fuzz testing, symbolic execution, and static code analysis, which usually do not use technologies in the field of risk analysis. STPA is a representative method in the field of risk analysis, and the present invention applies it to security vulnerability analysis, aiming to comprehensively analyze the security vulnerabilities of the system from the system level, especially the security vulnerabilities caused by the interaction of control components that have been neglected for a long time. BRIEF DESCRIPTION OF THE DRAWINGS

[0084] Figure 1 It is a flow chart of a security vulnerability analysis method for an industrial control system in a petroleum refining scenario provided by an embodiment of the present invention;

[0085] Figure 2 is a schematic diagram of the control structure hierarchy of the reaction regeneration system provided by an embodiment of the present invention;

[0086] Figure 3 is a schematic diagram of a functional control structure model of a reaction regeneration system provided by an embodiment of the present invention;

[0087] Figure 4 is a schematic diagram of the classification and causal factors of loss scenarios provided by an embodiment of the present invention;

[0088] Figure 5 1 is a schematic diagram of a functional control structure of a protection device control unit for cause analysis provided by an embodiment of the present invention;

[0089] Figure 6 This is a module diagram of an industrial control system security vulnerability analysis system for a petroleum refining scenario provided by an embodiment of the present invention;

[0090] Figure 7 is a schematic diagram of temperature monitoring results of a refinery system provided by an embodiment of the present invention;

[0091] Figure 8 is a schematic diagram of monitoring results of network communication rate provided by an embodiment of the present invention;

[0092] Fig. 9 is a schematic diagram of monitoring results of container pressure and safety valve opening provided by an embodiment of the present invention;

[0093] Fig.10 is a schematic diagram of temperature monitoring results of multiple sensors provided by an embodiment of the present invention; DETAILED DESCRIPTION

[0094] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0095] The embodiment of the present invention provides a method for analyzing the security vulnerability of an industrial control system in a petroleum refining scenario. Here, the most common reaction regeneration system in a petroleum refining system that is prone to cause dangerous accidents is used as an example for security vulnerability analysis. The process is as follows: Figure 1 As shown, including:

[0096] S1, determine the system's target tasks, key functions and interactive objects, and determine the system-level unacceptable losses, hazards and safety constraints;

[0097] Specifically, the target task is the main purpose or expected result of the system, which defines the basic tasks that the system needs to complete and the effect that the system ultimately needs to achieve. Deviations in the understanding of the target task will directly affect the accuracy of vulnerability analysis;

[0098] Key functions refer to the core functions that the system must have in order to achieve the target tasks. They are the main functional modules or components that the system relies on to complete the target tasks;

[0099] The interaction objects are all the participants involved in the process of realizing key functions, including personnel and devices, which together constitute the functional control structure of the system;

[0100] Table 1 takes the reaction regeneration system as an example and shows the target tasks, key functions and main interaction objects.

[0101] Table 1 Target tasks, key functions and main interaction objects of the reaction regeneration system

[0102]

[0103]

[0104] System-level unacceptable losses refer to conditions that are completely unacceptable from the perspective of the target mission, which will cause great economic losses to the system or pose a serious threat to the environment and personnel safety;

[0105] Hazards refer to any event or condition in the system that may cause unacceptable losses, which may have a significant impact on the safety, personnel, environment or economy of the system. Usually these hazards can be controlled, but if effective control measures are not taken, they may lead to catastrophic consequences.

[0106] Safety constraints refer to restrictive requirements that must be followed during the design and operation process to ensure that the system can operate safely and stably. These safety constraints usually come from regulations, industry standards, and technical specifications, and can also be derived by reverse analysis of hazards. For each identified hazard, a corresponding safety constraint must be established to prevent these hazards from causing unacceptable losses at the system level.

[0107] For the reaction regeneration system, examples of unacceptable losses, hazards and safety constraints at the system level are shown in Table 2.

[0108] Table 2 Examples of unacceptable system-level losses, hazards and safety constraints for reaction regeneration systems

[0109]

[0110] S2, divide the control structure of the system into hierarchical levels, collect control components, including configuration information of controllers, sensors and actuators, and corresponding controlled variable representations; determine the control behavior, feedback, input and output information between each control component, and establish a functional control structure model, including:

[0111] Taking the reaction regeneration system as an example, its control structure hierarchy is as follows Figure 2As shown. The reaction regeneration system control unit can be divided into four parts: protection device control unit, auxiliary control unit, reaction process control unit, and regeneration process control unit. The protection device control unit belongs to the SIS, ensuring that the system will not enter a dangerous state due to failure or deviation, and is responsible for the safety of the entire system; the auxiliary control unit ensures the efficient operation of the reaction and regeneration process, including the feeding of steam, cooling water or compressed air, etc., to meet the material and environmental requirements of the reaction process; the reaction process control unit and the regeneration process control unit are responsible for real-time adjustment of the controlled variables to maximize efficiency and product yield, while avoiding dangerous situations such as overpressure or uncontrolled reactions.

[0112] Specifically, the control structure level of a system refers to the control components in a complex system that are organized into different hierarchical structures according to different functions and management levels. Among them, the control components at each level assume different functions and coordinate the relationship between the various control components, so as to achieve the system's goals and tasks and ensure the efficient operation and stability of the system. It is usually divided into low-level control, middle-level control and high-level control. Among them, low-level control is responsible for specific, real-time operations, such as sensor and actuator control, which directly interact with the physical system to adjust specific operating variables; middle-level control is responsible for monitoring and coordinating low-level control, which usually involves decision-making on multiple low-level controls. For example, scheduling, optimization control or state monitoring in the production process; high-level control is responsible for the macro planning and decision-making of the entire system, involving decision-making and the realization of target tasks.

[0113] In order to further improve the control structure, especially the information of the low-level control structure, it is necessary to collect the control components, including the configuration information of the controller, sensor and actuator, and the corresponding controlled variable representation. Among them, the controller is responsible for calculating the deviation between the information fed back by the sensor and the set target, and outputting the control signal to adjust the actuator; the role of the sensor is to measure the controlled variable and convert the measurement result into an electrical signal or digital signal for the controller to analyze; the actuator receives the instructions of the controller and performs the corresponding physical action to change the system state. For the reaction regeneration system, the types and examples of the configuration information of the controller, sensor and actuator are shown in Table 3.

[0114] Table 3 Types and examples of configuration information of controllers, sensors and actuators of the reaction regeneration system

[0115]

[0116]

[0117] Each controlled variable is measured by a specific sensor and fed back to the controller through the signal provided by its sensor. The controller generates a control signal based on the difference between the set value and the feedback value of the controlled variable, and then adjusts the actuator to keep the controlled variable within the desired range.

[0118] Then, it is necessary to determine the control behavior, feedback, input and output information between each control component in order to establish a functional control structure model. Among them, the control behavior describes how the control component processes the input information and generates the corresponding output, which is usually described by a mathematical model or control algorithm, such as PID control, fuzzy control, etc.; the feedback mechanism ensures that the system can adjust the input according to the output results during operation to achieve the purpose of self-correction; the input refers to the information obtained from other components or the external environment, and the output is the control instruction or feedback information of the component. Taking the reaction regeneration system as an example, its functional control structure model is as follows Figure 3 shown.

[0119] S3, analyze the control behaviors in the functional control structure model, identify the control behaviors that may cause harm according to the STPA criteria, and identify four types of unsafe control behaviors (UCA), including:

[0120] Determine the main functions, safety responsibilities, and related control behaviors of each interactive object. For the reaction regeneration system, the main functions, safety responsibilities, and related control behaviors of its key interactive objects are shown in Table 4.

[0121] Table 4 Main functions, safety responsibilities and examples of related control behaviors of key interaction objects in the reaction and regeneration system

[0122]

[0123]

[0124] At the same time, a process model needs to be developed for each interactive object to determine the process model variables and the corresponding states and keep the controlled variables within the safety parameter range. These process models provide information for the controller's decision by examining the impact of environmental factors on the controlled process state. Table 5 shows the process model variables and their states of the protection device control, which is one of the important interactive objects of the reaction regeneration system.

[0126] Table 5 Example of process model variables and their states controlled by protection devices

[0127]

[0128] After determining the process model variables and corresponding states of all interactive objects, various combinations of these variables can be listed, and it is possible to evaluate whether the control operations performed under these combinations constitute a danger. In this process, it is necessary to combine the standards established by STPA to determine four types of unsafe control actions (UCAs). These standards include: (1) providing control actions; (2) not providing control actions; (3) providing control actions too early, too late, or out of order; (4) control actions stopping too early or lasting too long. As an illustration, the present invention takes the key interactive object "protection device control unit" of the reaction regeneration system as an example, and takes one of the related control behaviors "opening / closing the emergency steam valve" to generate four types of unsafe control actions (UCAs), as shown in Table 6.

[0129] Table 6 Examples of unsafe control behaviors of protection device control units

[0130]

[0131]

[0132] S4, generate loss scenarios for unsafe control actions (UCA), conduct causal analysis, and analyze the causal factors that lead to UCA from five dimensions: process model defects, system environment defects, communication defects, structural defects, and functional dependency defects, including;

[0133] Loss scenarios are generated for the four types of unsafe control actions (UCA). The loss scenarios involved in this invention are mainly divided into two categories: (1) Situations that lead to unsafe control actions (UCA), which are usually caused by unsafe controller behavior or insufficient feedback information. (2) Situations where control actions are incorrectly or incompletely executed, which are usually caused by problems in the control path or control process. The classification and causal factors of these loss scenarios are as follows: Figure 4 shown.

[0134] According to the loss scenario classification and causal factors, the "Industrial Control System Cybersecurity Guide (NIST SP 800-82)" issued by the National Institute of Standards and Technology of the United States and the international standard IEC61511 for process industry safety instrument systems are consulted to determine the causal factors involved and create a functional control structure for causal analysis. The present invention takes the protection device control unit in the reaction regeneration system as the object and designs its functional control structure for causal analysis, such as Figure 5 The loss scenarios in the figure include “no feedback or information received”, “inadequate feedback received”, “control actions not performed” and “control actions performed inappropriately”.

[0135] Then, the generated loss scenarios are analyzed for their causes, and each loss scenario is analyzed from five dimensions, including process model defects, system environment defects, communication defects, structural defects, and functional dependency defects. The present invention takes the protection device control unit in the reaction regeneration system as the object, and conducts a cause analysis around the loss scenario "failure to open the emergency steam valve when emergency steam release is required, resulting in excessive pressure in the system, which may cause equipment damage or explosion risk" with the unsafe control behavior "failure to receive feedback information" as an example, and the results are shown in Table 7.

[0136] Table 7 Examples of loss scenarios and cause analysis results

[0137]

[0138] S5, for each unsafe control action UCA, merge the causal factors under all loss scenarios, conduct manual inspection and classification, and derive security vulnerabilities in different dimensions, including;

[0139] Check whether the loss scenario of each unsafe control behavior UCA is comprehensive and has no omissions. This process can be discussed with plant engineers and operators, or refer to the Hazard and Operability Analysis (HAZOP) report of the petroleum refining unit. After that, merge the causal factors of all loss scenarios under each unsafe control behavior UCA, eliminate repeated, similar or redundant causal factors, and classify them according to the five dimensions of process model defects, system environment defects, communication defects, structural defects and functional dependency defects, and derive their security vulnerabilities respectively. The present invention uses the relevant causal factors of "process model defects" in Table 7 to demonstrate how to derive its corresponding security vulnerabilities, as shown in Table 8.

[0140] Table 8 Security vulnerability derivation example

[0141]

[0142]

[0143] Finally, the safety vulnerability is derived for all causal factors under the same unsafe control behavior UCA and merged according to different defect types. The present invention takes the protection device control unit in the reaction regeneration system as the object, and conducts a safety vulnerability analysis around the causal factors of the unsafe control behavior "failure to open the emergency steam valve when emergency steam release is required, resulting in excessive pressure in the system, which may cause equipment damage or explosion risk". The analysis results are summarized in Table 9.

[0144] Table 9 Example of security vulnerability analysis results of protection device control unit

[0145]

[0146] According to the above process, loss scenario generation and cause analysis can be performed for other unsafe control behaviors UCA respectively to derive their respective safety vulnerabilities. Finally, all safety vulnerabilities are summarized and repeated or redundant results are eliminated to obtain the complete safety vulnerability analysis results of the reaction regeneration system. For other subsystems of the petroleum refining unit, such as the fractionation system, absorption stabilization system, energy recovery system, etc., the safety vulnerability analysis can also be performed according to the above process.

[0147] If the system structure and equipment of the oil refining unit are changed during the later maintenance, the functional control structure and unsafe control behavior UCA need to be updated in order to generate new loss scenarios and identify new safety vulnerabilities that may cause harm.

[0148] In the oil refining scenario, the first step is to clarify the target tasks, key functions and interaction objects of the industrial control system. This includes the specific tasks and interaction logic that each module in the system needs to implement, and it is also necessary to define unacceptable losses and hazards. Safety constraints are used to limit system behavior to ensure that failure of key functions or unacceptable losses are avoided under various working conditions. For example, by analyzing the interaction between the controller and the actuator, clear safety thresholds and functional limitations are defined, laying the foundation for subsequent safety analysis.

[0149] By dividing the hierarchical structure of the industrial control system, collecting all control components (such as controllers, sensors, actuators) and their configuration information, a complete structural model of the control behavior is established. The model includes:

[0150] The flow of control behavior (mapping of control signals and feedback paths).

[0151] Representation of controlled variables (such as temperature, pressure, flow and other key variables).

[0152] This functional control structure model not only describes the physical connection of the system, but also shows the control logic and interaction relationship. The model is established to identify potential risk points in the control path and loopholes in the control signal transmission, providing data support for subsequent analysis.

[0153] Using the functional control structure model, analyze the "unsafe control actions (UCA)" that may lead to system failure or danger, including:

[0154] Lack of control behavior: such as the actuator failing to receive the control signal in time.

[0155] Control signal error: The controller sends an incorrect instruction resulting in unexpected operation.

[0156] Control signal delay: Feedback information does not arrive in time, resulting in operations that exceed safety thresholds.

[0157] For each UCA, combined with its possible loss scenario, the causal factors are analyzed from the following five dimensions:

[0158] (1) Process model defects: The controller has an incorrect understanding of the current state or target state.

[0159] (2) System environment defects: Environmental changes cannot be effectively adapted by the control system.

[0160] (3) Communication defect: The control signal is lost or distorted during transmission.

[0161] (4) Structural defects: There are logical loopholes in the system's hardware or software design.

[0162] (5) Functional dependency defect: other dependent sub-functions or modules fail.

[0163] According to the identified UCA and the causal factors of its loss scenario, each factor is classified and analyzed, and the specific security vulnerabilities are derived by combining the five-dimensional characteristics of the system. Each vulnerability corresponds to one or more UCAs. Through multi-dimensional combined analysis, the impact range, key triggering conditions and potential consequences of the vulnerability can be revealed. Finally, by classifying vulnerability characteristics, the system can provide direct security strategies for design improvement and risk avoidance. This process not only improves the understanding of the source of vulnerability, but also provides a scientific basis for the formulation of targeted protection measures.

[0164] like Figure 6 As shown, an industrial control system security vulnerability analysis system for a petroleum refining scenario provided by an embodiment of the present invention specifically includes:

[0165] Definition module, used to determine the system's target tasks, key functions and interaction objects, unacceptable system-level losses, hazards and safety constraints;

[0166] The control structure hierarchical division module is used to collect control components, determine the control behavior, feedback, input and output information between each control component, and establish a functional control structure model;

[0167] Unsafe control behavior identification module, used to analyze the control behaviors in the functional control structure model and identify unsafe control behaviors (UCAs) that may cause harm;

[0168] The loss scenario generation method and causal analysis module are used to generate loss scenarios for unsafe control actions (UCAs), conduct causal analysis, and analyze the causal factors that lead to the occurrence of UCAs;

[0169] The security vulnerability derivation module is used to combine the causal factors of all loss scenarios for each unsafe control behavior UCA, classify them according to five dimensions, and derive their security vulnerabilities respectively.

[0170] Example 1: Security vulnerability analysis of temperature control module in refinery system

[0171] 1. System Overview

[0172] In the oil refining process, the temperature control module is used to adjust the temperature in the reactor to ensure that the chemical reaction is carried out within a safe range. The module includes a temperature sensor, a temperature controller, a cooling device and a heating device. The target task is to maintain the reaction temperature within the range of 550℃±10℃.

[0173] 2. Functional Control Structure Model

[0174] Controller: Receives feedback from the temperature sensor and sends heating or cooling instructions based on the set target temperature.

[0175] Sensor: monitors the reactor temperature in real time and transmits the data to the controller.

[0176] Actuator: Starts heating or cooling after receiving instructions from the controller.

[0177] 3.UCA Identification

[0178] 1. No control action is provided: The cooling device is not started, and the reaction temperature rises rapidly, exceeding the safety threshold.

[0179] 2. Providing control actions too late: The cooling device is started too late, and the reaction temperature at this time may have approached or exceeded the safety threshold, resulting in failure of the temperature regulation ability, drastic temperature fluctuations, and system out of control.

[0180] 3. Control behavior stops prematurely: The cooling device stops prematurely, resulting in insufficient cooling and exceeding the safety threshold.

[0181] 4. Cause Analysis

[0182] 1. Process model defects: The controller cannot correctly perceive the temperature change trend.

[0183] 2. Communication defect: Signal transmission between the temperature sensor and the controller is lost or delayed.

[0184] 3. Structural defect: mechanical failure of the cooling device's actuator.

[0185] 5. Vulnerability Derivation

[0186] Comprehensive analysis shows that the main vulnerabilities of the temperature control module lie in communication delays and process model errors. These problems may cause the temperature to exceed the safe range, thus endangering the safety of the equipment.

[0187] Example 2: Security vulnerability analysis of oil refining pressure control system

[0188] 1. System Overview

[0189] In the oil refining system, the pressure control system is used to regulate the pressure in the reactor to prevent the risk of explosion caused by excessive pressure. The module includes pressure sensor, controller, safety valve and exhaust system.

[0190] 2. Functional Control Structure Model

[0191] Controller: Sends a control signal to open or close the safety valve according to the pressure value fed back by the pressure sensor.

[0192] Sensor: monitors the pressure changes in the reactor in real time.

[0193] Actuator: Receives controller signals and adjusts the opening and closing status of the safety valve.

[0194] 3.UCA Identification

[0195] 1. No control behavior is provided: the safety valve cannot open normally, and the pressure continues to rise, causing the equipment to rupture.

[0196] 2. Provide control behavior: The safety valve is closed during the opening process, resulting in the inability to release the pressure in time.

[0197] 3. Premature cessation of control action: The safety valve is closed prematurely, causing the pressure to exceed the safety threshold.

[0198] 4. Cause Analysis

[0199] 1. Process model defect: The controller does not take into account normal pressure fluctuations when setting the pressure range.

[0200] 2. System environment defects: The ambient temperature is too high, causing the sensor to become inaccurate.

[0201] 3. Function-dependent defects: The exhaust system pipes are blocked, resulting in the inability to release pressure.

[0202] 5. Vulnerability Derivation

[0203] The analysis results show that the main vulnerability of the system lies in the process model defects of the controller and the system environment defects. Once problems occur in these links, it may cause overpressure accidents. It is necessary to focus on strengthening the monitoring and optimization of these two aspects.

[0204] These two examples accurately reveal the potential security vulnerabilities in the system by modeling the functional control structure, identifying UCA, and analyzing the causes of the temperature control and pressure control modules of the oil refining system. These analyses provide key data support for formulating improvement plans and improving system reliability.

[0205] 2. Relevant evidence of the technical effects obtained by the embodiments of the present invention.

[0206] Example 1: Security vulnerability analysis of temperature control module in refinery system

[0207] Figure 7 The temperature monitoring results of the refining system are shown. The time sampling interval is 100 seconds. It can be seen that the temperature gradually increases from 2100 seconds and exceeds the safety threshold of 560°C at around 2200 seconds. After that, the regulation of the temperature control module fails and the temperature continues to rise until it reaches the warning value of 650°C. At this time, the protection device controller starts to terminate the reaction. According to the vulnerability derivation results, the network communication rate monitoring data and the process model of the temperature control module are retrieved respectively. The monitoring results of the network communication rate are shown in Figure 2. Figure 8 As shown in Table 10, it can be seen that from about 1900 seconds, the communication rate slowly decreases from the set 15M / s. By 3000 seconds, the average communication rate has dropped to about 5M / s, which is a serious communication delay and no longer meets the data transmission rate requirements in industrial scenarios. In addition, the process model of the temperature control module is shown in Table 10. It can be seen that its process model variables do not include the network communication rate, so it is impossible to monitor and respond to communication delays in a timely manner, which is a process model defect.

[0208] Table 10 Process model variables and their states of the temperature control module of the refining system

[0209]

[0210] Example 2: Security vulnerability analysis of oil refining pressure control system

[0211] Fig. 9The monitoring results of the container pressure and safety valve opening of the refining system are shown. The time sampling interval is 100 seconds. It can be seen that from about 4000 seconds, the container pressure gradually increases, the regulation of the pressure control module fails, and reaches the safety threshold of 0.5Mpa at about 5000 seconds. At this time, the protection device controller starts to terminate the reaction. Correspondingly, the safety valve opening is normally maintained at 30%. From 4000 seconds, the valve opening gradually decreases and decreases to 10% at 4500 seconds. This is the direct cause of the pressure increase. According to the vulnerability derivation results, the process model of the pressure control module and the temperature monitoring results of multiple sensors are retrieved respectively. The process model of the pressure control module is shown in Table 11. It can be seen that its pressure state is divided into four situations: too low (<0.1Mpa), normal (0.1-0.25Mpa), too high (>0.25Mpa) and shutdown (0Mpa). This is a commonly used state range based on rule formulation. However, considering the volume of different containers, feed pressure fluctuations, etc., sufficient margin should be left in actual application, for example, the normal range should be set within 0.08-0.28Mpa to prevent the pressure value from fluctuating up and down by 0.1Mpa, which will cause the controller to frequently operate and apply unnecessary control signals to the safety valve. Fig.10 As shown, it can be seen that after the temperature exceeds 630°C, the reading of sensor #1, which is closer to the hot feed port, is significantly affected, and is different from the monitoring result of normal sensor #2. This is because the reading of sensor #1 is inaccurate due to the excessively high ambient temperature.

[0212] Table 11 Process model variables and their states of the refining system pressure control module

[0213]

[0214]

[0215] It should be noted that the embodiments of the present invention can be implemented by hardware, software, or a combination of software and hardware. The hardware part can be implemented using dedicated logic; the software part can be stored in a memory and executed by an appropriate instruction execution system, such as a microprocessor or dedicated design hardware. It can be understood by a person of ordinary skill in the art that the above-mentioned devices and methods can be implemented using computer executable instructions and / or contained in a processor control code, such as a carrier medium such as a disk, CD or DVD-ROM, a programmable memory such as a read-only memory (firmware), or a data carrier such as an optical or electronic signal carrier. Such code is provided on the carrier medium. The device and its modules of the present invention can be implemented by hardware circuits such as very large-scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, etc., or programmable hardware devices such as field programmable gate arrays, programmable logic devices, etc., can also be implemented by software executed by various types of processors, and can also be implemented by a combination of the above-mentioned hardware circuits and software, such as firmware.

[0216] The above description is only a specific implementation mode of the present invention, but the protection scope of the present invention is not limited thereto. Any modifications, equivalent substitutions and improvements made by any technician familiar with the technical field within the technical scope disclosed by the present invention and within the spirit and principle of the present invention should be covered by the protection scope of the present invention.

Claims

1. A security vulnerability analysis method for industrial control systems in a petroleum refining scenario, characterized in that: The method specifically includes: S1: Determine the target tasks, key functions and interaction objects of the petroleum refining system, and determine the unacceptable losses, hazards and safety constraints at the system level; S2: Divide the control structure hierarchy of the system and collect control components, including configuration information of controllers, sensors and actuators, and corresponding controlled variable representations; determine the control behavior, feedback, input and output information between each control component, and establish a functional control structure model; S3: Analyze the control behaviors in the functional control structure model and identify unsafe control behaviors (UCAs) that may cause hazards; S4: Generate loss scenarios for unsafe control actions (UCA), conduct causal analysis, and analyze the causal factors that lead to UCA from five dimensions: process model defects, system environment defects, communication defects, structural defects, and functional dependency defects; S5: For each unsafe control action UCA, merge the causal factors under all loss scenarios, classify them according to five dimensions, and derive their security vulnerabilities respectively.

2. The industrial control system security vulnerability analysis method for petroleum refining scenarios as claimed in claim 1 is characterized in that: The safety constraints are derived by reverse analysis of the hazards. For each identified hazard, corresponding safety constraints must be established to prevent these hazards from causing unacceptable system-level losses. The unacceptable system-level losses refer to conditions that are completely unacceptable from the perspective of the objectives and tasks of the oil refinery. These conditions will cause great economic losses to the system or pose a serious threat to the environment and personnel safety.

3. The industrial control system security vulnerability analysis method for petroleum refining scenarios as claimed in claim 1 is characterized in that: The control structure level of the system is divided into a low control level, a middle control level and a high control level; The low control level is responsible for specific, real-time operations, including control of sensors and actuators; the middle control level is responsible for monitoring and coordinating low-level controls, including scheduling, optimization control, or status monitoring during production; the high control level is responsible for the macro-planning and decision-making of the entire system, involving the realization of decision-making and target tasks.

4. The industrial control system security vulnerability analysis method for petroleum refining scenarios as claimed in claim 1 is characterized in that: The controller configuration information that needs to be collected includes control strategy, control target, control algorithm parameters, input and output signals, and configuration bit number; the sensor configuration information that needs to be collected includes measurement variable, measurement range, measurement accuracy, output signal type, and configuration bit number; the actuator configuration information that needs to be collected includes control object, execution mode, response time, input signal type, output range, and configuration bit number.

5. The industrial control system security vulnerability analysis method for petroleum refining scenarios as claimed in claim 1 is characterized in that: The judgment criteria for the unsafe control behavior include providing control behavior, not providing control behavior, providing control behavior too early, too late or out of order, and stopping the control behavior too early or lasting too long.

6. The industrial control system security vulnerability analysis method for petroleum refining scenarios as claimed in claim 1 is characterized in that: The loss scenario types include situations that lead to unsafe control actions and situations where control actions are performed incorrectly or incompletely.

7. The industrial control system security vulnerability analysis method for petroleum refining scenarios as claimed in claim 1 is characterized in that: The causal analysis includes five aspects, namely, process model defects, system environment defects, communication defects, structural defects and functional dependency defects.

8. A security vulnerability analysis system for industrial control systems in a petroleum refining scenario based on claims 1-7, characterized in that: The system specifically includes: Definition module, used to determine the system's target tasks, key functions and interaction objects, unacceptable system-level losses, hazards and safety constraints; The control structure hierarchical division module is used to collect control components, determine the control behavior, feedback, input and output information between each control component, and establish a functional control structure model; Unsafe control behavior identification module, used to analyze the control behaviors in the functional control structure model and identify unsafe control behaviors (UCAs) that may cause harm; The loss scenario generation method and causal analysis module are used to generate loss scenarios for unsafe control actions (UCAs), conduct causal analysis, and analyze the causal factors that lead to the occurrence of UCAs; The security vulnerability derivation module is used to combine the causal factors of all loss scenarios for each unsafe control behavior UCA, classify them according to five dimensions, and derive their security vulnerabilities respectively.

Images