Digital asset full-life-cycle management method and system of DCS (Distributed Control System)

Abstract

The invention discloses a digital asset full-life-cycle management method and system of a DCS (Distributed Control System), and the method comprises the steps: firstly, carrying out the accurate definition of digital assets, protection levels and the like of the DCS of a nuclear power station in a mode of combining system definition and manual definition, improving the protection effectiveness, and avoiding the unnecessary overhead of the system caused by over-protection; through the use of an implicit identity card and a strict verification mechanism, the reliability of digital asset protection is ensured, the correct protection of digital assets is ensured, and the data security of the system is improved; and finally, through combined use of active protection, manual protection, local-domain protection and cross-domain protection, completeness of the digital assets in the full life cycle and diversity of protection means are ensured, so that full-life-cycle protection of the digital assets of the DCS system is realized, and great economic value is brought to operation of the DCS system.

Description

Technical Field

[0001] The present application relates to the field of information security protection technology in the nuclear power field, and specifically to a method and system for full life cycle management of digital assets of a DCS system, which is mainly applied to the digital assets of a DCS system of a nuclear power plant, including the management of the generation, storage, display, use, transmission and other aspects of the digital assets throughout their life cycle. Background Art

[0002] The security issues of digital instrumentation and control systems in nuclear power plants have received more and more attention and importance. Security attacks pose a direct threat to the safe operation of nuclear power plant DCS systems. Among various security attacks, digital assets have become the main target of attacks. In nuclear power plant DCS systems, digital assets refer to computer equipment information, file information, host nodes and other data resources generated and used in various stages such as system design, research and development, debugging and verification, V&V, operation and maintenance. Its life cycle includes the life cycle of digital assets from generation, storage, transmission, consumption, destruction and other life links.

[0003] In the design of most existing nuclear power plant DCS systems, the basic focus is on the realization of functional safety, and data security is often not considered or rarely considered. When designing the system, the security protection of digital assets faces a series of problems and challenges. For example, the definition of digital assets is inaccurate, a certain classification and grading definition brings additional unnecessary expenses to protection, and the protection stage is not perfect, resulting in a large number of omissions in the protection function. In the actual operation of the system, there are many blind spots and security risks.

[0004] As one of the pillar industries of the national economy, the nuclear power industry has a large number of high-value digital assets in its DCS system. Clearly and accurately defining digital assets, comprehensively covering the life cycle of digital assets, and conducting all-round and full-process effective management of digital assets will greatly improve the reliability and security of digital assets from a system level, which has very important social significance and economic value.

[0005] In summary, from the analysis of the actual design and operation process of the DCS system in nuclear power plants, based on the current requirements and standards for data security of digital instrumentation and control systems, combined with the characteristics of the DCS system's digital assets of various types, varying degrees of importance, and complex asset life cycles, it is extremely important to develop a digital security protection technology that can clearly and accurately define digital assets and manage the entire life cycle of digital assets for the design and operation of nuclear power plant DCS systems. Summary of the invention

[0006] In order to achieve data security protection for the entire life cycle of digital assets in the DCS system of a nuclear power plant, this application proposes a method and system for managing the entire life cycle of digital assets in a DCS system. This application defines digital assets by combining system definition and manual definition, and introduces the combination of digital asset protection processing and business into the nuclear power field, thereby improving the effectiveness of key asset protection in the nuclear power DCS system; introduces digital asset implicit ID cards as labels, and adopts secure encryption technology to ensure the feasibility of full life cycle protection; and develops a universal underlying protection processing driver module to ensure consistency in its behavior when protecting assets of different levels and types.

[0007] On the one hand, the present application is implemented through the following technical solutions:

[0008] A digital asset full life cycle management method for a DCS system, the digital asset full life cycle management method comprising:

[0009] The digital assets and levels of the DCS system of the nuclear power plant are defined by combining system definition and manual definition;

[0010] Establish an implicit ID card for the digital assets of the nuclear power plant DCS system, bind the implicit ID card to the assets one-to-one, and form a lifelong unique identification code for the digital assets;

[0011] In the process of protecting digital assets in the DCS system of nuclear power plants, the asset data and their ID cards are processed using national secret algorithms;

[0012] In the process of protecting digital assets in the DCS system of nuclear power plants, multiple verification mechanisms are used for digital assets;

[0013] In the process of protecting digital assets in the DCS system of nuclear power plants, a combination of active protection and manual protection is adopted;

[0014] In the process of protecting digital assets of DCS system in nuclear power plants, a combination of cross-domain protection and local domain protection is adopted;

[0015] In the process of digital asset protection of the DCS system in nuclear power plants, complete log data recording and auditing of the entire life cycle of digital assets are provided.

[0016] In some implementations, the digital assets and levels of the DCS system of a nuclear power plant are defined by combining system definition and manual definition, specifically including:

[0017] Combined with the business characteristics of the nuclear power plant DCS system, the key assets of the system are sorted out and the assets are marked;

[0018] According to the asset identification, set the corresponding protection level;

[0019] Provide a visual interactive interface for users to flexibly configure the digital assets that need to be protected according to actual needs;

[0020] The digital asset data configured by the user is verified by using pre-built verification and system asset priority.

[0021] In some embodiments, the implicit ID card is established for the digital asset of the nuclear power plant DCS system, and the implicit ID card is bound to the asset one-to-one to form a lifelong unique identification code of the digital asset, specifically including:

[0022] Determine the attribute data of the digital asset;

[0023] In combination with the attribute data of the digital asset, an implicit ID card is generated in the form of a configuration file; a verification code is generated for the implicit ID card, and the verification code is stored in a random position of the ID card, and the position is recorded in a specific position of the ID card;

[0024] The implicit ID card is encrypted using a dynamic key according to the national secret algorithm;

[0025] The implicit ID card retains the same full life cycle as the corresponding digital asset, and exists and is destroyed together.

[0026] In some implementations, the asset data and its ID card are processed using a national secret algorithm, specifically including:

[0027] The digital asset ID card is encrypted using the national secret algorithm;

[0028] The original data of digital assets is encrypted using the national secret algorithm;

[0029] The digital asset ID card is decrypted using the national secret algorithm;

[0030] The original data of digital assets is decrypted using the national secret algorithm.

[0031] In some implementations, the multiple verification mechanisms for digital assets include:

[0032] Provide an entry for manually starting verification at any stage of the life cycle and provide feedback on the verification results;

[0033] When a digital asset undergoes a phase change, the system verification is initiated to automatically verify the asset data and provide feedback on the verification results.

[0034] In some implementations, the specific verification process includes:

[0035] Decrypt the ID card file of the digital asset based on the dynamic key;

[0036] Read the verification code storage location from the fixed location of the decrypted file;

[0037] Read the checksum position from the decrypted file;

[0038] Generate a verification code for the ID card according to specific rules;

[0039] Compare the generated verification code with the read verification code. If the comparison fails, it means that the ID card has been tampered with, an alarm is given to the user and subsequent operations are terminated. If the comparison succeeds, it means that the ID card is valid and subsequent verification is performed;

[0040] Decrypt the original data of digital assets according to the dynamic key;

[0041] Generate an ID card from the original data according to specific rules;

[0042] Verify the consistency between the generated ID card and the decrypted ID card. If the verification passes, it means the original data is valid and subsequent operations can be performed. If the verification fails, it means the original data has been tampered with, feedback is given to the user and subsequent operations are terminated.

[0043] In some embodiments, the method of combining active protection and manual protection specifically includes:

[0044] In the process of digital asset protection, different protection strategies are applied to assets according to their level;

[0045] An active protection strategy is adopted for high-level assets; wherein the protection phase of the active protection strategy is the time node of entry and output of each phase; the protection mode of the active protection strategy is that the system automatically starts, and its priority exceeds other functions;

[0046] A manual protection strategy is adopted for low-level assets; the protection time point of the manual protection strategy is manually enabled by the user at any stage of the entire life cycle of the digital asset; the protection method of the manual protection strategy is that the user manually enables the configuration function for protection.

[0047] In some implementations, the method of combining cross-domain protection with local domain protection specifically includes:

[0048] The local domain protection mentioned above refers to the protection of digital assets locally; the local domain protection process mentioned above includes the generation, duplication, copying, pasting, use and destruction of digital assets;

[0049] The cross-domain protection refers to the protection of digital assets during the non-local circulation process; the cross-domain protection circulation mode includes network transmission and media transmission.

[0050] In some implementations, the complete log data recording and auditing of the digital asset life cycle specifically includes:

[0051] The underlying protection driver module generates logs, which are uploaded to the security server and written into the database.

[0052] Access the database to display and view logs by operating the visual interactive interface.

[0053] On the other hand, the present application also proposes a digital asset lifecycle management system for a DCS system, which is implemented based on the above-mentioned digital asset lifecycle management method, and includes:

[0054] A visual interactive interface, which is used to display all digital assets in the nuclear power plant DCS system defined by combining system definition and manual definition; edit and manage the protected digital assets through the visual interactive interface; configure and modify the protection strategy of each asset through the visual interactive interface to form a protection strategy file; manage the strategy data through the visual interactive interface; and send the protection strategy file to the underlying protection driver module through the visual interactive interface;

[0055] And, a bottom-level protection driver module, wherein the bottom-level protection driver module is used to parse the protection strategy file, start the bottom-level driver, and execute the protection function.

[0056] The present application proposes a method and system for managing the digital assets of a DCS system throughout its life cycle. Firstly, a combination of system definition and manual definition is used to accurately define the digital assets and protection levels of the DCS system of a nuclear power plant, thereby improving the effectiveness of protection and avoiding unnecessary overhead to the system caused by over-protection. By using an implicit ID card and a strict verification mechanism, the reliability of digital asset protection is ensured, the correct protection of digital assets is ensured, and the data security of the system is improved. Finally, by combining active protection with manual protection, and local domain protection with cross-domain protection, the integrity of the digital assets throughout their life cycle and the diversity of protection means are ensured, thereby realizing the full life cycle protection of the digital assets of the DCS system and bringing great economic value to the operation of the DCS system.

[0057] The digital asset full life cycle management method and system of a DCS system proposed in this application have been successfully applied to a nuclear safety-level DCS system project. By providing digital asset full life cycle protection related software, the security protection of the DCS system digital assets is achieved, the operation quality of the DCS system is improved, the efficiency of the system operation is guaranteed, and the economic value of the system operation is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] The drawings described herein are used to provide a further understanding of the embodiments of the present application, constitute a part of the present application, and do not constitute a limitation on the embodiments of the present application. In the drawings:

[0059] Figure 1 This is a business process diagram of the entire life cycle of digital assets in an embodiment of the present application;

[0060] Figure 2 This is a flowchart of the digital asset local domain protection of the embodiment of the present application;

[0061] Figure 3 This is a flowchart of cross-domain protection of digital assets in an embodiment of the present application;

[0062] Figure 4 This is a flow chart of digital asset protection log management according to an embodiment of the present application;

[0063] Figure 5 A schematic diagram of the digital asset definition effect of an embodiment of the present application;

[0064] Figure 6 This is a schematic diagram of the effect of issuing a protection strategy file according to an embodiment of the present application;

[0065] Figure 7 This is a schematic diagram of the effect of the local domain protection operation in an embodiment of the present application;

[0066] Figure 8 This is a schematic diagram of the cross-domain protection operation effect of an embodiment of the present application. DETAILED DESCRIPTION

[0067] In order to make the objectives, technical solutions and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with examples and drawings. The illustrative implementation scheme of the present application and its description are only used to explain the present application and are not intended to limit the present application.

[0068] Example:

[0069] Based on the definition and requirements of data security in the Data Security Law, combined with the characteristics of the DCS system of nuclear power plants, which has a wide variety of digital assets, different levels of importance, and a complex asset life cycle, and in response to the requirements of users in the DCS system applications of nuclear power plants for data security and correctness, this embodiment proposes a DCS system digital asset full life cycle management method to achieve data security protection for the entire life cycle of DCS digital assets in nuclear power plants.

[0070] The digital asset full life cycle management method proposed in this embodiment specifically includes the following steps:

[0071] (1) A combination of system definition and manual definition is used to clearly and accurately define the levels and management strategies of the digital assets of the nuclear power plant DCS system.

[0072] (2) Introduce a digital asset implicit ID card, bind the ID card to the asset one-to-one, form a lifelong unique identification code for the digital asset, and ensure the uniqueness of the digital asset during the protection process.

[0073] (3) In the process of digital asset protection in the DCS system, the national secret algorithm is introduced to process asset data and ID cards, ensuring the unique visibility of digital asset identity information to this protection function.

[0074] (4) A strict multiple verification mechanism is adopted throughout the digital asset lifecycle to ensure the effectiveness of protection.

[0075] (5) A combination of active protection and manual protection is adopted to ensure the diversity and completeness of the protection objects and improve the system's adaptability to the environment.

[0076] (6) In the process of protecting digital assets in the DCS system, a combination of cross-domain protection and local domain protection is adopted to ensure the complementarity and completeness of the life cycle process in digital asset protection.

[0077] (7) The digital asset protection module records log events throughout the entire life cycle and provides a dedicated log management module to audit digital asset protection logs for subsequent asset protection event tracking.

[0078] This embodiment defines digital assets by combining system definition and manual definition, which improves the accuracy of system asset definition and identification; introduces the combination of digital asset protection processing and business into the nuclear power field, which improves the effectiveness of key asset protection in nuclear power DCS systems; introduces digital asset implicit ID cards as tags, and uses secure encryption technology to ensure the feasibility of full life cycle protection; develops a universal underlying protection processing driver module to ensure consistency of behavior when protecting assets of different levels and types. The digital asset full life cycle protection management application architecture built based on the above strategy is as follows: Figure 1 As shown in the figure, the application architecture mainly includes a visual interactive interface and an underlying protection driver module.

[0079] Among them, the visual interactive interface is used to display all assets in the DCS system defined by the above method. Through the visual interactive interface, the protected digital asset objects are added, deleted, modified, and checked to complete the editing and management of the protected objects. Before the action is executed, the authority determination is required, and only personnel with management authority can perform editing and management operations. Through the visual interactive interface, the protection strategy of each asset is configured and modified to determine whether it adopts automatic protection or manual protection, and its protection domain and other policy data, specifically including: selecting an asset in the form of a selection list; selecting a digital asset control mode (protection mode or debugging mode) in the form of a list; specifying the DCS system business software process and sub-process by input and selection; specifying the directory to be protected by input; giving prompt information when the input is incorrect, etc. Importing and other operations on policy data through the visual interactive interface realizes the management of policy data. Send the policy data to the underlying protection driver module through the visual interactive interface.

[0080] The underlying protection driver module parses the protection policy file, starts the underlying driver, executes the protection function, and during the protection process, uses the national secret algorithm to process the asset data and ID card, uses multiple verification mechanisms for the asset data, and combines active protection with manual protection, and combines cross-domain protection with local domain protection to record complete log data.

[0081] Furthermore, the specific application process of combining system definition and manual definition to define assets is as follows:

[0082] Combined with the business system, sort out the key and important assets of the business system, identify the core assets of the business system, and mark them with code S;

[0083] According to the asset identification, the assets with the code name S are defined as system-critical Class A assets, which correspond to the highest level of protection;

[0084] Provides a visual digital asset configuration interactive interface for users to flexibly configure assets that need to be protected according to actual needs, including configuration of asset information, asset level, protection strategy and other data;

[0085] The asset protection data configured by the user is verified by using pre-built verification and system asset priority to ensure that important digital assets related to the DCS system business of the nuclear power plant are optimally protected.

[0086] Furthermore, the establishment of an implicit ID card for digital assets is a key means to ensure effective protection of digital assets throughout their life cycle. The specific implementation process is as follows:

[0087] Determine the hardware information of the digital asset's path, asset attributes, protection level, startup time, and storage location.

[0088] In combination with the attribute data of the digital asset, an implicit ID card is generated in the form of a configuration file for the specific content of the digital asset; a verification code is generated for the implicit ID card, and the verification code is stored in a random position of the ID card, and the position is recorded in a specific position of the ID card.

[0089] The implicit ID card is encrypted using a dynamic key according to the national secret algorithm.

[0090] This implicit ID card retains the same full life cycle as the protected digital assets, and exists and is destroyed together.

[0091] Furthermore, the application of the national secret algorithm in the protection of digital assets throughout their life cycle ensures the confidentiality of digital assets. The specific application process is as follows:

[0092] Application of national secret algorithm encryption to digital asset ID cards;

[0093] Application of national secret algorithm encryption to the original data of digital assets;

[0094] Decryption application for digital asset ID cards;

[0095] And, the decryption application of digital asset original data.

[0096] Furthermore, strict multiple verification mechanisms are implemented throughout the life cycle of digital assets to ensure the effectiveness of protection. The specific application process is as follows:

[0097] Provide an entry for manually starting verification at any stage of the life cycle and provide feedback on the verification results;

[0098] When a digital asset undergoes a phase change, the system verification is started, the data is automatically verified, and feedback is given on the verification results; the specific verification process is as follows:

[0099] Decrypt the ID card file of the digital asset based on the dynamic key;

[0100] Read the verification code storage location from the fixed location of the decrypted file;

[0101] Read the checksum position from the decrypted file;

[0102] Generate a verification code for the ID card according to specific rules (the same as the verification code generated when the ID card is generated);

[0103] Compare the two sets of verification codes (i.e. the generated verification code and the read verification code). If the comparison fails, it means that the ID card has been tampered with, an alarm is issued to the user and the operation is terminated. If the comparison succeeds, it means that the ID card is valid and subsequent verification is performed;

[0104] Decrypt the original data according to the dynamic key;

[0105] Generate an ID card from the original data according to specific rules (consistent with the ID card generated from the original data);

[0106] Verify the consistency of the two ID cards. If the verification passes, it means the data is valid and subsequent operations can be performed. If the verification fails, it means the original data has been tampered with, feedback is given to the user, and subsequent operations are terminated.

[0107] Furthermore, the combination of active protection and manual protection ensures the diversity and integrity of the protection objects. The specific application process is as follows:

[0108] When adding assets, users can rank assets based on business logic;

[0109] In the process of digital asset protection, different protection strategies are implemented for assets according to their level. Active protection strategies are adopted for high-level assets. The initiative is manifested in two aspects. First, the protection stage is the time node for entering and exiting each stage; second, the protection method is that the system starts automatically, which is not affected or disturbed by external factors, and its priority level exceeds other functions.

[0110] The manual protection strategy for low-level assets is passive in two aspects. The first is the protection time point, which is manually enabled by the user and exists at any stage of the digital asset life cycle; the second is the protection method, which is that the user manually enables the configuration function for protection. In this protection method, the user decides whether to perform protection based on the actual situation of the current function and the current system resource situation. This method provides the system with more flexibility and adaptability to scenarios.

[0111] Furthermore, a combination of cross-domain protection and local domain protection is adopted. The specific application process is as follows:

[0112] Local domain protection refers to the protection of digital assets locally. The process of local domain protection includes the generation, duplication, copying, pasting, use, and destruction of digital assets. Local domain protection is the main and key link in digital asset protection. The local domain protection flow chart is as follows: Figure 2 As shown, the data sent by the management interface is received, the data is parsed, the protection directory and permissions are parsed, and the database is queried whether the corresponding protection directory and permissions already exist. If so, the process ends; otherwise, a protection directory is added, the weight is set, and it is sent to the protection driver to write the record into the database.

[0113] Cross-domain protection refers to the protection of digital assets in non-local circulation processes; cross-domain protection circulation methods include network transmission and media transmission; cross-domain protection is a key link and difficult link in digital asset protection; the cross-domain protection flow chart is as follows Figure 3 As shown, start scanning / scheduled scanning, scan project files from data detected by other terminals, and determine whether there are project files after scanning. If not, end the process. Otherwise, parse the protection directory and permissions from the project files, and query whether the parsed protection directory and permissions already exist in the database. If not, end the process. Otherwise, add a protection directory, set permissions, send it to the protection driver, and write the record into the database.

[0114] Furthermore, the digital asset protection log management process is as follows: Figure 4 As shown, the specific implementation process is as follows:

[0115] The customized security terminal generates logs from the underlying protection driver module, which are uploaded to the security server and written into the database.

[0116] The log arrives at the security server and is written into the database;

[0117] When the viewing page is opened in the visual interactive interface, the server database is accessed through data communication to view the log.

[0118] The above management method proposed in this embodiment has been implemented in a certain security-level DCS system project. By providing digital asset full life cycle protection related software, the security protection of the DCS system digital assets throughout the life cycle is achieved. The specific implementation process is as follows:

[0119] The digital asset definition method in the above method is used to complete the definition and assignment of system assets in the business system;

[0120] Use the digital asset definition method in the above method to complete the manually defined protection asset objects in the business system;

[0121] The final list of asset protection objects and information is formed, and a visual interactive interface is used to display a schematic diagram of all assets in the system defined by the above method, including system-defined and manually defined digital assets, such as Figure 5 As shown;

[0122] Add, delete, modify and check protected digital assets through a visual interactive interface, and complete the editing and management of protected objects. Before executing this action, permission determination is required, and only personnel with management authority can execute this action;

[0123] Configure and modify the protection strategy of each asset through a visual interactive interface, determine whether it adopts automatic protection or manual protection, its protection domain and other policy data, and generate a protection strategy file; import policy data and other operations to achieve management of policy data;

[0124] The protection strategy file is sent to the underlying protection driver module. The effect of sending it is as follows: Figure 6 As shown;

[0125] The bottom-level protection driver module analyzes the protection strategy, starts the bottom-level driver, and executes the protection function;

[0126] Process the data according to the configuration strategy, and perform operations such as copying, pasting, modifying, and deleting in this domain. The effects are as follows: Figure 7 As shown;

[0127] Copying, pasting, modifying, deleting, and other operations on digital assets across domains has the following effects: Figure 8 shown.

[0128] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0129] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0130] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0131] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0132] The specific implementation methods described above further illustrate the purpose, technical solutions and beneficial effects of the present application in detail. It should be understood that the above description is only the specific implementation method of the present application and is not intended to limit the scope of protection of the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application.

Claims

1. A method for managing the digital assets of a DCS system throughout its life cycle, characterized in that: The digital asset full life cycle management method includes: The digital assets and levels of the DCS system of the nuclear power plant are defined by combining system definition and manual definition; Establish an implicit ID card for the digital assets of the nuclear power plant DCS system, bind the implicit ID card to the assets one-to-one, and form a lifelong unique identification code for the digital assets; In the process of protecting digital assets in the DCS system of nuclear power plants, the asset data and their ID cards are processed using national secret algorithms; In the process of protecting digital assets in the DCS system of nuclear power plants, multiple verification mechanisms are used for digital assets; In the process of protecting digital assets in the DCS system of nuclear power plants, a combination of active protection and manual protection is adopted; In the process of protecting digital assets of DCS system in nuclear power plants, a combination of cross-domain protection and local domain protection is adopted; In the process of digital asset protection of the DCS system in nuclear power plants, complete log data recording and auditing of the entire life cycle of digital assets are provided.

2. The method for managing the digital assets of a DCS system throughout its life cycle according to claim 1, characterized in that: The digital assets and levels of the DCS system of a nuclear power plant are defined by combining system definition and manual definition, including: Combined with the business characteristics of the nuclear power plant DCS system, the key assets of the system are sorted out and the assets are marked; According to the asset identification, set the corresponding protection level; Provide a visual interactive interface for users to flexibly configure the digital assets that need to be protected according to actual needs; The digital asset data configured by the user is verified by using pre-built verification and system asset priority.

3. The method for managing the digital assets of a DCS system throughout its life cycle according to claim 1, characterized in that: The aforementioned process of establishing an implicit ID card for the digital assets of the DCS system of a nuclear power plant, binding the implicit ID card to the assets one-to-one, and forming a lifelong unique identification code for the digital assets, specifically includes: Determine the attribute data of the digital asset; In combination with the attribute data of the digital asset, an implicit ID card is generated in the form of a configuration file; a verification code is generated for the implicit ID card, and the verification code is stored in a random position of the ID card, and the position is recorded in a specific position of the ID card; The implicit ID card is encrypted using a dynamic key according to the national secret algorithm; The implicit ID card retains the same full life cycle as the corresponding digital asset, and exists and is destroyed together.

4. The method for managing the digital assets of a DCS system throughout its life cycle according to claim 1, characterized in that: The asset data and their ID cards are processed using a national secret algorithm, specifically including: The digital asset ID card is encrypted using the national secret algorithm; The original data of digital assets is encrypted using the national secret algorithm; The digital asset ID card is decrypted using the national secret algorithm; The original data of digital assets is decrypted using the national secret algorithm.

5. The method for managing the digital assets of a DCS system throughout its life cycle according to claim 1, characterized in that: The multiple verification mechanisms for digital assets include: Provide an entry for manually starting verification at any stage of the life cycle and provide feedback on the verification results; When a digital asset undergoes a phase change, the system verification is initiated to automatically verify the asset data and provide feedback on the verification results.

6. A method for managing the digital assets of a DCS system throughout its life cycle according to claim 5, characterized in that: The specific verification process includes: Decrypt the ID card file of the digital asset based on the dynamic key; Read the verification code storage location from the fixed location of the decrypted file; Read the checksum position from the decrypted file; Generate a verification code for the ID card according to specific rules; Compare the generated verification code with the read verification code. If the comparison fails, it means that the ID card has been tampered with, an alarm is given to the user and subsequent operations are terminated. If the comparison succeeds, it means that the ID card is valid and subsequent verification is performed; Decrypt the original data of digital assets according to the dynamic key; Generate an ID card from the original data according to specific rules; Verify the consistency between the generated ID card and the decrypted ID card. If the verification passes, it means the original data is valid and subsequent operations can be performed. If the verification fails, it means the original data has been tampered with, feedback is given to the user and subsequent operations are terminated.

7. The method for managing the digital assets of a DCS system throughout its life cycle according to claim 1, characterized in that: The method of combining active protection and manual protection specifically includes: In the process of digital asset protection, different protection strategies are applied to assets according to their level; An active protection strategy is adopted for high-level assets; wherein the protection phase of the active protection strategy is the time node of entry and output of each phase; the protection mode of the active protection strategy is that the system automatically starts, and its priority exceeds other functions; A manual protection strategy is adopted for low-level assets; the protection time point of the manual protection strategy is manually enabled by the user at any stage of the entire life cycle of the digital asset; the protection method of the manual protection strategy is that the user manually enables the configuration function for protection.

8. The method for managing the digital assets of a DCS system throughout its life cycle according to claim 1, characterized in that: The method of combining cross-domain protection and local domain protection specifically includes: The local domain protection mentioned above refers to the protection of digital assets locally; the local domain protection process mentioned above includes the generation, duplication, copying, pasting, use and destruction of digital assets; The cross-domain protection refers to the protection of digital assets during the non-local circulation process; the cross-domain protection circulation mode includes network transmission and media transmission.

9. The method for managing the digital assets of a DCS system throughout its life cycle according to claim 1, characterized in that: The complete log data record and audit of the digital asset life cycle includes: The underlying protection driver module generates logs, which are uploaded to the security server and written into the database. Access the database to display and view logs by operating the visual interactive interface.

10. A digital asset full life cycle management system for a DCS system, characterized in that: The digital asset lifecycle management system is implemented based on the digital asset lifecycle management method according to any one of claims 1 to 9, including: A visual interactive interface, which is used to display all digital assets in the nuclear power plant DCS system defined by combining system definition and manual definition; edit and manage the protected digital assets through the visual interactive interface; configure and modify the protection strategy of each asset through the visual interactive interface to form a protection strategy file; manage the strategy data through the visual interactive interface; and send the protection strategy file to the underlying protection driver module through the visual interactive interface; And, a bottom-level protection driver module, wherein the bottom-level protection driver module is used to parse the protection strategy file, start the bottom-level driver, and execute the protection function.

Images