Trusted controller credible alarm multiplexing method, system and device and storage medium

Abstract

The invention discloses a credible alarm multiplexing method, system and device for a credible controller and a storage medium, and relates to the technical field of credible protection of a power system, and the credible alarm multiplexing method comprises the steps: regularly obtaining the credible state of the controller according to a set period; comparing and judging whether the current credible state of the controller is changed or not according to the credible states of the controller acquired in adjacent periods; according to a comparison and judgment result, if the credible state of the current controller changes, credible state change information of the controller is added to an alarm queue in an application process of the credible controller, and a credible alarm mark is set; and the trusted controller periodically scans the alarm queue and broadcasts and uploads all alarm information in the alarm queue. The credible alarm and the original application process alarm process of the credible controller are multiplexed, the alarm information related to the credible state of the controller can be found and processed in time on the basis of maintaining the stability of the original credible controller, and the method has flexibility and expandability.

Description

Technical Field

[0001] The present invention relates to the technical field of trusted protection of power systems, and in particular to a trusted alarm multiplexing method, system, device and storage medium for a trusted controller. Background Art

[0002] With the rapid development and popularization of Internet technology, network security issues have become increasingly prominent. Malicious attacks such as computer viruses, Trojans, and hackers not only occur frequently, but also become increasingly complex and hidden, posing a huge challenge to the stable operation of power systems. As an emerging security protection method, the trusted protection system has higher security and reliability. Therefore, the application of the trusted protection system in the power system can better ensure the safe and stable operation of the power system.

[0003] In actual applications, a single, independent processing method is usually adopted for alarm processing of trusted controllers, that is, each alarm type has its own processing flow and mechanism. Although this method can process specific alarm types, it lacks a unified management and reuse mechanism, resulting in low alarm processing efficiency, and may affect the original alarms of the trusted controller, and is difficult to adapt to complex and changing system environments. Summary of the invention

[0004] The purpose of the present invention is to address the problems in the above-mentioned prior art and provide a trusted alarm multiplexing method, system, device and storage medium for a trusted controller, which can timely discover and process alarm information related to the trusted status of the controller while maintaining the stability of the original trusted controller, reuse the original alarms in the trusted controller, and have flexibility and scalability.

[0005] In order to achieve the above object, the present invention has the following technical solutions: In a first aspect, a trusted alarm multiplexing method of a trusted controller is provided, comprising: Obtain the controller's trusted status regularly according to the set cycle; According to the controller trust status obtained in the adjacent cycles, compare and determine whether the current controller trust status has changed; According to the comparison result, if the current controller trusted state changes, the controller trusted state change information is added to the alarm queue in the trusted controller application process, and a trusted alarm flag is set; The trusted controller periodically scans the alarm queue and broadcasts all the alarm information in the alarm queue.

[0006] As a preferred solution, in the step of regularly acquiring the trusted state of the controller according to a set period, the trusted state is read from the trusted process of the controller through a set interface.

[0007] As a preferred scheme, in the step of comparing and judging whether the current controller trusted state has changed based on the controller trusted state obtained in adjacent cycles, the current controller trusted state is compared with the controller trusted state of the previous cycle. If the current controller trusted state has not changed, continue to obtain the controller trusted state of the next cycle to perform the same comparison and judgment.

[0008] As a preferred solution, the adding of the controller trusted state change information to the alarm queue in the trusted controller application process includes: Different alarm types are established according to the controller trust state change information. If the controller trust state changes from trusted to untrusted, it is an action alarm; if the controller trust state changes from untrusted to trusted, it is a recovery alarm.

[0009] As a preferred solution, when adding the controller trusted state change information to the alarm queue in the trusted controller application process, if the current alarm queue is full, stop adding action alarms or reset alarms derived from the controller trusted state change information until there is free space in the alarm queue.

[0010] As a preferred solution, when adding the controller trusted state change information to the alarm queue in the trusted controller application process, the application process alarm in the alarm queue is processed first, and then the action alarm or reset alarm derived from the controller trusted state change information is processed.

[0011] As a preferred solution, the trusted controller periodically scans the alarm queue and broadcasts all the alarm information in the alarm queue, including: The trusted controller application process scans the alarm queue according to the set period. When it finds that there is alarm information to be processed in the alarm queue, the trusted controller application process broadcasts the alarm information in the order in which the alarm information is added; During the broadcasting and uploading of alarm information, the trusted controller application process does not distinguish between application process alarms and action alarms or reset alarms derived from the trusted state change information of the controller, and reports and processes them uniformly; The maximum number of alarm information sent by the trusted controller application process in each cycle is preset. When the maximum number of alarm information sent in each cycle is reached, the alarm information sending operation is suspended and the processing is continued in the next cycle.

[0012] In a second aspect, a trusted alarm multiplexing system of a trusted controller is provided, including: A controller trusted state acquisition module is used to regularly acquire the trusted state of the controller according to a set period; A controller trusted state change judgment module is used to compare and judge whether the current controller trusted state has changed based on the controller trusted state obtained in adjacent cycles; The controller trusted state change alarm adding module is used to add the controller trusted state change information to the alarm queue in the trusted controller application process and set a trusted alarm mark according to the comparison judgment result if the current controller trusted state changes; The alarm information broadcast and upload module is used for the trusted controller to periodically scan the alarm queue and broadcast and upload all the alarm information in the alarm queue.

[0013] According to a third aspect, an electronic device is provided, including: A memory storing at least one instruction; and a processor executing the instruction stored in the memory to implement the trusted alarm multiplexing method of the trusted controller.

[0014] In a fourth aspect, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the trusted alarm multiplexing method of the trusted controller is implemented.

[0015] Compared with the prior art, the present invention has at least the following beneficial effects: When the trusted state of the current controller changes, the controller trusted state change information is added to the alarm queue in the trusted controller application process, and a trusted alarm mark is set. The trusted controller is used to periodically scan the alarm queue, and all the alarm information in the alarm queue is broadcasted. The present invention reuses the trusted alarm with the original application process alarm flow of the trusted controller, thereby realizing efficient processing of the trusted alarm. The trusted alarm reuse method of the present invention can not only timely discover and process the alarm information related to the trusted state of the controller, improve the reliability and response speed of the system, but also maintain the stability of the original system. By setting the processing priority of the alarm information, it is ensured that the impact of the addition of the trusted alarm function on the original system of the trusted controller is reduced. At the same time, because the original alarm method in the trusted controller is reused, the host computer does not need to distinguish when receiving the alarm information, which enhances the flexibility and scalability of the system and can be applied to the needs of different scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0017] Figure 1A flow chart of a trusted alarm multiplexing method for a trusted controller according to an embodiment of the present invention; Figure 2 A structural block diagram of a trusted alarm multiplexing system for a trusted controller according to an embodiment of the present invention. DETAILED DESCRIPTION

[0018] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, ordinary technicians in this field can also obtain other embodiments without making creative work.

[0019] The existing technology usually adopts a single and independent processing method for alarm processing of trusted controllers, that is, each alarm type has its own processing flow and mechanism. This method has many problems, such as low efficiency, possible impact on the original alarm system, and difficulty in adapting to complex environments. Therefore, it can no longer adapt to various malicious attacks that occur frequently. In order to achieve trusted protection of power systems, the alarm processing efficiency and quality of trusted controllers can be significantly improved by establishing a unified alarm management platform, realizing the standardization and reuse of alarm processing processes, introducing intelligent alarm processing mechanisms, enhancing the flexibility and scalability of alarm processing, ensuring that the impact on the original system is minimized, and adapting to complex and changing system environments.

[0020] (1) Establish a unified alarm management platform and integrate all alarm types into the platform to achieve centralized monitoring and management of alarms. Through this platform, alarms can be uniformly classified, graded, and prioritized to facilitate rapid response and processing.

[0021] (2) Standardize and reuse the alarm processing process.

[0022] (3) Use machine learning and other technologies to analyze and predict alarm data, automatically identify and process common alarm patterns, optimize the alarm processing process through intelligent algorithms, reduce manual intervention, and improve processing speed and accuracy.

[0023] (4) Enhance the flexibility and scalability of alarm processing.

[0024] (5) When designing the alarm processing process, fully consider the compatibility with the original alarm system to avoid interference with the original system. Through testing and optimization, ensure that the new alarm processing mechanism will not have a negative impact on the performance and stability of the trusted controller. Ensure that the impact of alarm processing on the original system is minimized.

[0025] (6) Adapt to the complex and ever-changing system environment, monitor and analyze changes in the system environment in real time, and dynamically adjust the alarm processing strategy. Establish a feedback mechanism to continuously optimize and improve the alarm processing process based on the processing results.

[0026] (7) Monitor and record the alarm processing process in real time to ensure the transparency and traceability of the processing flow. Conduct audits and assessments regularly to identify potential problems and make timely repairs and improvements.

[0027] Based on this, see Figure 1 The embodiment of the present invention provides a trusted alarm multiplexing method of a trusted controller, comprising: Obtain the controller's trusted status regularly according to the set cycle; According to the controller trust status obtained in the adjacent cycles, compare and determine whether the current controller trust status has changed; According to the comparison result, if the current controller trusted state changes, the controller trusted state change information is added to the alarm queue in the trusted controller application process, and a trusted alarm flag is set; The trusted controller periodically scans the alarm queue and broadcasts all the alarm information in the alarm queue.

[0028] In a possible implementation manner, in the step of periodically acquiring the trusted state of the controller according to a set period, the trusted state is read from the trusted process of the controller through a set specific interface.

[0029] Furthermore, when reading the trusted state from the controller trusted process through the set specific interface, first, the specific interface needs to be clearly defined so that the controller trusted process can understand and respond. The definition includes the name, parameters, return value, etc. of the interface. Select the appropriate interface type according to the type of controller and the implementation method of the trusted process. Ensure that the selected interface is compatible with the communication protocol and format of the controller trusted process. Secondly, ensure that you have the permission to access the interface required by the controller trusted process. If the interface requires authentication, you must provide the correct authentication information (such as user name, password, token, etc.) to access the interface. According to the interface definition, construct and send an appropriate request to obtain the trusted state. Receive the response returned by the controller trusted process and parse the received data using an appropriate parser. At the same time, verify the integrity and accuracy of the data to ensure its credibility. Finally, log the entire process of reading the trusted state, including request time, request parameters, response data, etc. This helps with subsequent analysis and debugging, as well as ensuring the traceability of the system.

[0030] In a possible implementation, in the step of comparing and determining whether the current controller trusted state has changed based on the controller trusted state obtained in adjacent cycles, the current controller trusted state is compared with the controller trusted state of the previous cycle. If the current controller trusted state has not changed, the controller trusted state of the next cycle is obtained to perform the same comparison and judgment, and the controller trusted state of the next cycle is compared with the current controller trusted state, and so on.

[0031] In one possible implementation, when the controller trusted state change information is added to the alarm queue in the trusted controller application process, different alarm types are established according to the controller trusted state change information. If the controller trusted state changes from trusted to untrusted, it is an action alarm; if the controller trusted state changes from untrusted to trusted, it is a recovery alarm.

[0032] The alarm queue plays an important role in the trusted controller application process. It is mainly used to collect alarm information from various parts of the system or application, and queue the collected alarm information according to certain rules for orderly processing. According to the priority and importance of the alarm information, the relevant personnel or system are notified in time, and the corresponding response measures are triggered.

[0033] The implementation of the alarm queue usually includes the following aspects: Use memory queues (such as FIFO queues, priority queues, etc.) or persistent storage (such as databases, file systems, etc.) to store alarm information. Deliver alarm information from collection points to alarm queues through messaging mechanisms (such as message queues, event buses, etc.). Write processing logic to parse alarm information and respond according to preset rules and policies.

[0034] In order to ensure the efficient operation of the alarm queue, it is necessary to monitor the operation status of the alarm queue in real time. When the queue length exceeds the threshold or the processing speed decreases, the alarm is triggered in time. Load balancing is achieved between multiple alarm queues to disperse the processing pressure and improve the overall processing efficiency. When the alarm queue fails, the problem can be quickly located and restored to ensure the timely processing of alarm information. According to the actual needs of the system and the characteristics of the alarm information, it is necessary to continuously optimize the processing strategy and rules of the alarm queue. In the trusted controller, the alarm queue is usually closely integrated with trusted verification, security monitoring and other functions. When the controller detects trusted verification failure, security events or other abnormal situations, it will send this information as alarm information to the alarm queue. The alarm queue will queue and process this information according to the preset rules and strategies, and trigger corresponding response measures, such as sending alarm notifications, starting security policies, etc. Through reasonable implementation methods and management optimization, the processing efficiency and accuracy of the alarm queue can be improved, providing a strong guarantee for the reliable operation of the system.

[0035] Furthermore, when the embodiment of the present invention adds the controller trusted state change information to the alarm queue in the trusted controller application process, if the current alarm queue is full, it stops adding the action alarm or reset alarm derived from the controller trusted state change information until there is a vacant position in the alarm queue. At the same time, in order to reduce the impact of the trusted alarm on the original application process of the trusted controller, when the embodiment of the present invention adds the controller trusted state change information to the alarm queue in the trusted controller application process, it gives priority to processing the application process alarm in the alarm queue, and then processes the action alarm or reset alarm derived from the controller trusted state change information. This design ensures the priority and efficiency of alarm processing.

[0036] In a possible implementation, the trusted controller described in the embodiment of the present invention periodically scans the alarm queue and broadcasts all the alarm information in the alarm queue, including: the trusted controller application process scans the alarm queue according to a set period, and when it is found that there is alarm information to be processed in the alarm queue, the trusted controller application process broadcasts the alarm information in the order in which the alarm information is added; in the process of broadcasting and uploading the alarm information, the trusted controller application process does not distinguish between application process alarms and action alarms or reset alarms derived from the controller's trusted state change information, and reports and processes them in a unified manner.

[0037] In addition, in order to ensure the stability and efficiency of the system, the trusted alarm multiplexing method of the trusted controller in an embodiment of the present invention pre-sets the maximum number of alarm information sent by the trusted controller application process in each cycle. When the maximum number of alarm information sent per cycle is reached, the operation of sending alarm information is suspended and waits for the next cycle to continue processing.

[0038] See also Figure 2 The embodiment of the present invention further provides a trusted controller trusted alarm multiplexing system, including: A controller trusted state acquisition module is used to regularly acquire the trusted state of the controller according to a set period; A controller trusted state change judgment module is used to compare and judge whether the current controller trusted state has changed based on the controller trusted state obtained in adjacent cycles; The controller trusted state change alarm adding module is used to add the controller trusted state change information to the alarm queue in the trusted controller application process and set a trusted alarm mark according to the comparison judgment result if the current controller trusted state changes; The alarm information broadcast and upload module is used for the trusted controller to periodically scan the alarm queue and broadcast and upload all the alarm information in the alarm queue.

[0039] An embodiment of the present invention further provides an electronic device, including: A memory storing at least one instruction; and a processor executing the instruction stored in the memory to implement the trusted alarm multiplexing method of the trusted controller.

[0040] The embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the trusted alarm multiplexing method of the trusted controller is implemented.

[0041] Exemplarily, the instructions stored in the memory may be divided into one or more modules / units, which are stored in a computer-readable storage medium and executed by the processor to complete the trusted alarm multiplexing method of the trusted controller described in the embodiment of the present invention. The one or more modules / units may be a series of computer-readable instruction segments capable of completing a specific function, which are used to describe the execution process of the computer program in the server.

[0042] The electronic device may be a computing device such as a smart phone, a notebook, a PDA, and a cloud server. The electronic device may include, but is not limited to, a processor and a memory. Those skilled in the art will appreciate that the electronic device may also include more or fewer components, or a combination of certain components, or different components, for example, the electronic device may also include an input / output device, a network access device, a bus, etc.

[0043] The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0044] The memory may be an internal storage unit of the server, such as a hard disk or memory of the server. The memory may also be an external storage device of the server, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the server. Furthermore, the memory may include both an internal storage unit of the server and an external storage device. The memory is used to store the computer-readable instructions and other programs and data required by the server. The memory may also be used to temporarily store data that has been output or is to be output.

[0045] It should be noted that the information interaction, execution process and other contents between the above-mentioned module units are based on the same concept as the method embodiment. Their specific functions and technical effects can be found in the method embodiment part and will not be repeated here.

[0046] The technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0047] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the processes in the above-mentioned embodiment method, which can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may at least include: any entity or device that can carry the computer program code to the camera device / terminal device, recording medium, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electrical carrier signal, telecommunication signal and software distribution medium. For example, a USB flash drive, a mobile hard disk, a disk or an optical disk.

[0048] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0049] The embodiments described above are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. A trusted alarm multiplexing method for a trusted controller, characterized in that: include: Obtain the controller's trusted status regularly according to the set cycle; According to the controller trust status obtained in the adjacent cycles, compare and determine whether the current controller trust status has changed; According to the comparison result, if the current controller trusted state changes, the controller trusted state change information is added to the alarm queue in the trusted controller application process, and a trusted alarm flag is set; The trusted controller periodically scans the alarm queue and broadcasts all the alarm information in the alarm queue.

2. The trusted alarm multiplexing method of a trusted controller according to claim 1, characterized in that: In the step of regularly acquiring the trusted state of the controller according to a set period, the trusted state is read from the trusted process of the controller through a set interface.

3. The trusted alarm multiplexing method of a trusted controller according to claim 1, characterized in that: In the step of comparing and judging whether the current controller trusted state has changed based on the controller trusted state obtained in adjacent cycles, the current controller trusted state is compared with the controller trusted state of the previous cycle. If the current controller trusted state has not changed, the controller trusted state of the next cycle is obtained to perform the same comparison and judgment.

4. The trusted alarm multiplexing method of a trusted controller according to claim 1, characterized in that: The adding of the controller trusted state change information to the alarm queue in the trusted controller application process comprises: Different alarm types are established according to the controller trust state change information. If the controller trust state changes from trusted to untrusted, it is an action alarm; if the controller trust state changes from untrusted to trusted, it is a recovery alarm.

5. The trusted alarm multiplexing method of the trusted controller according to claim 4, characterized in that: When adding the controller trusted state change information to the alarm queue in the trusted controller application process, if the current alarm queue is full, stop adding the action alarm or reset alarm derived from the controller trusted state change information until there is free space in the alarm queue.

6. The trusted alarm multiplexing method of a trusted controller according to claim 4, characterized in that: When the controller trusted state change information is added to the alarm queue in the trusted controller application process, the application process alarm in the alarm queue is processed first, and then the action alarm or the reset alarm derived from the controller trusted state change information is processed.

7. The trusted alarm multiplexing method of a trusted controller according to claim 6, characterized in that: The trusted controller periodically scans the alarm queue and broadcasts all the alarm information in the alarm queue, including: The trusted controller application process scans the alarm queue according to the set period. When it finds that there is alarm information to be processed in the alarm queue, the trusted controller application process broadcasts the alarm information in the order in which the alarm information is added; During the broadcasting and uploading of alarm information, the trusted controller application process does not distinguish between application process alarms and action alarms or reset alarms derived from the trusted state change information of the controller, and reports and processes them uniformly; The maximum number of alarm information sent by the trusted controller application process in each cycle is preset. When the maximum number of alarm information sent in each cycle is reached, the alarm information sending operation is suspended and the processing is continued in the next cycle.

8. A trusted alarm multiplexing system for a trusted controller, characterized in that: include: A controller trusted state acquisition module is used to regularly acquire the trusted state of the controller according to a set period; A controller trusted state change judgment module is used to compare and judge whether the current controller trusted state has changed based on the controller trusted state obtained in adjacent cycles; The controller trusted state change alarm adding module is used to add the controller trusted state change information to the alarm queue in the trusted controller application process and set a trusted alarm mark according to the comparison judgment result if the current controller trusted state changes; The alarm information broadcast and upload module is used for the trusted controller to periodically scan the alarm queue and broadcast and upload all the alarm information in the alarm queue.

9. An electronic device, characterized in that: include: A memory storing at least one instruction; and The processor executes the instructions stored in the memory to implement the trusted alarm multiplexing method of the trusted controller according to any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the trusted alarm multiplexing method of a trusted controller according to any one of claims 1 to 7 is implemented.

Images