Industrial control equipment remote management method and system

Abstract

The invention discloses an industrial control equipment remote management method and system, and the method employs a wireless communication technology, such as a 5G remote communication technology, to connect a local network environment with remote industrial control equipment through a VPN tunnel, achieves the debugging and testing of the industrial control equipment in a far-end complex environment by a researcher, and achieves the remote management of the industrial control equipment. The technical bottleneck of remote debugging and testing of an industrial control laboratory is broken through, and efficient, safe and low-cost remote industrial control equipment management is realized. And remote power-off restart can be further supported. According to the embodiment of the invention, the technical bottleneck of remote debugging and testing of the industrial control laboratory is solved, and efficient, safe and low-cost remote industrial control equipment management is realized.

Description

Technical Field

[0001] This application relates to, but is not limited to, industrial control security technology, and particularly to a method and system for remotely managing industrial control devices. Background Art

[0002] Industrial control security laboratories are usually responsible for the management, daily debugging, and testing of industrial control devices by professional industrial control security researchers. For local devices, the industrial control security laboratory conducts daily management through the internal network. For remotely located industrial control devices with Internet connection capabilities, a virtual private network (VPN) technology is used to establish an encrypted tunnel to achieve remote connectivity and access. However, for remotely located industrial control devices without Internet connection capabilities, technicians need to travel to the device site for close-range debugging and testing. Although this management mode basically meets the daily needs of the laboratory, there are still certain limitations in aspects such as remote maintenance, batch device management, and dynamic network adaptability. Summary of the Invention

[0003] This application provides a method and system for remotely managing industrial control devices, which can achieve efficient, secure, and low-cost remote management of industrial control devices.

[0004] An embodiment of the present invention provides a system for remotely managing industrial control devices, including: a local control device end and an industrial control device end located in a different place; wherein, the local control device end may include: a central control management module, a first wireless communication module; the industrial control device end at least includes: a second wireless communication module, an industrial control internal network module;

[0005] The central control management module is configured to send data to a target industrial control device among one or more remotely located industrial control devices through the first wireless communication module; receive feedback data for subsequent analysis and evaluation;

[0006] The first wireless communication module establishes a virtual private network (VPN) tunnel with the second wireless communication module based on a wireless network, and is configured to send instructions from the central control management module to the target industrial control device at the industrial control device end through the VPN tunnel; receive feedback data from the industrial control device end through the VPN tunnel and transfer it to the central control management module;

[0007] The second wireless communication module is configured to receive instructions from the local control device end through the VPN tunnel and transfer them to the target industrial control device in the industrial control internal network module; send the feedback data from the industrial control internal network module to the local control device end;

[0008] The industrial control internal network module includes one or more industrial control devices, and the target industrial control device in the industrial control devices is configured to receive instructions and perform corresponding operations, and feedback data to the local control device end through the VPN tunnel.

[0009] In an exemplary instance, the first wireless communication module and the second wireless communication module are 5G communication modules.

[0010] In an exemplary instance, the industrial control intranet module includes one or more industrial control devices located in different places, and an IP transfer device; wherein,

[0011] The IP transfer device is used to connect multiple industrial control subnets and perform network forwarding between the IP transfer device and the industrial control subnets;

[0012] Different industrial control devices are respectively connected to different industrial control subnets.

[0013] In an exemplary instance, the IP transfer device uses the iptables tool to process IP forwarding requirements, and different network interfaces are assigned the network segments of different industrial control subnets to respectively connect to the industrial control devices of different industrial control subnets. The set of all industrial control subnets constitutes an industrial bus.

[0014] In an exemplary instance, the remote industrial control device includes: a programmable logic controller PLC, a distributed control system DCS, an industrial camera, an industrial robot, and a sensor.

[0015] In an exemplary instance, the industrial control device end further includes: a power control module, and the power control module includes a power supply device and a power control device, wherein,

[0016] The power control device is connected to the IP transfer device of the industrial control intranet module;

[0017] The central control management module is further configured to drive the power control device to perform actions by remotely sending instructions, cut off or connect the power supply device of any industrial control device, so as to realize a hard restart of the industrial control device.

[0018] The embodiment of the present application further provides a method for remotely managing an industrial control device, including:

[0019] The local control device sends data to a target industrial control device among one or more industrial control devices located in different places through a VPN tunnel based on a wireless network;

[0020] The target industrial control device receives the instruction and executes the corresponding operation, and feeds back data to the local control device through the VPN tunnel based on the wireless network.

[0021] In an exemplary instance, the local control device sends data to a target industrial control device among one or more industrial control devices located in different places through a VPN tunnel based on a wireless network, including:

[0022] The local control device sends debugging instructions or test data to the target industrial control device through the VPN tunnel of the 5G network;

[0023] It further includes: receiving, through the VPN tunnel of the 5G network, the debugging results or test data fed back from the target industrial control device.

[0024] In an exemplary instance, for the case where the local control device sends debugging instructions to a target industrial control device in a different location through the VPN tunnel of the 5G network, it includes:

[0025] The upper computer PC at the industrial control security laboratory end where the local control device is located accesses the target industrial control device in a different location through the VPN tunnel established by the 5G communication module; connects to the target industrial control device through SCADA or PLC programming software and sends instructions to verify the real-time operating status of the target industrial control device;

[0026] For the case where the local control device sends test data to a target industrial control device in a different location through the VPN tunnel of the 5G network, it includes:

[0027] The upper computer PC at the industrial control security laboratory end where the local control device is located accesses the target industrial control device through the VPN tunnel established by the 5G communication module to verify whether there are corresponding vulnerabilities in the target industrial control device.

[0028] In an exemplary instance, the instructions sent further include: control instructions;

[0029] The method further includes: the upper computer PC at the industrial control security laboratory end where the local control device is located runs control software and sends a power control instruction; the instruction is transmitted through the VPN tunnel of the 5G communication module to a power control module in a different location; the power control module receives the instruction and switches on and off according to the instruction to achieve the restart of the target industrial control device.

[0030] The industrial control device remote management method and system provided by the embodiments of the present application use remote communication technology based on wireless communication technology such as 5G through a VPN tunnel to connect the local network environment and remote industrial control devices, realizing the debugging and testing work of researchers on industrial control devices in a remote complex environment, breaking through the technical bottleneck of remote debugging and testing in industrial control laboratories, and realizing efficient, safe, and low-cost remote management of industrial control devices. Moreover, it can further support remote power-off restart. It solves the technical bottleneck of remote debugging and testing in industrial control laboratories and realizes efficient, safe, and low-cost remote management of industrial control devices.

[0031] Other features and advantages of the present invention will be set forth in the following description, and in part will be obvious from the description, or may be learned by practice of the present invention. The objectives and other advantages of the present invention may be realized and attained by the structure particularly pointed out in the specification, claims as well as the drawings. Description of the Drawings

[0032] The drawings are used to provide a further understanding of the technical solutions of the present application, and constitute a part of the specification. Together with the embodiments of the present application, they are used to explain the technical solutions of the present application, and do not constitute a limitation to the technical solutions of the present application.

[0033] Figure 1 It is a schematic flowchart of the method for remotely managing industrial control devices in the embodiments of the present application;

[0034] Figure 2 It is a schematic diagram of the composition architecture of the industrial control device remote management system in the embodiments of the present application;

[0035] Figure 3 It is a schematic diagram of the composition architecture of the embodiments of the industrial control device remote management system in the embodiments of the present application. Detailed Embodiments

[0036] To make the objectives, technical solutions and advantages of the present application clearer and more understandable, the embodiments of the present application will be described in detail below with reference to the drawings. It should be noted that, without conflict, the embodiments in the present application and the features in the embodiments may be combined arbitrarily with each other.

[0037] In a typical configuration of the present application, the computing device includes one or more processors (CPUs), an input / output interface, a network interface, and a memory.

[0038] The memory may include non-permanent memory in the computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of, for example, read-only memory (ROM) or flash memory (flash RAM). The memory is an example of the computer-readable medium.

[0039] A computer-readable medium includes permanent and non-permanent, removable and non-removable media that can implement information storage by any method or technology. The information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette tapes, magnetic tape disk storage or other magnetic storage devices, or any other non-transitory medium that can be used to store information that can be accessed by a computing device. As defined herein, a computer-readable medium does not include transitory media such as modulated data signals and carrier waves.

[0040] The steps illustrated in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. And, although a logical order is illustrated in the flowchart, in some cases, the steps shown or described can be executed in a different order than herein.

[0041] A device based on VPN technology and a method for remotely maintaining a programmable logic controller (PLC) generally include: configuring a VPN remote network including a computer network, a VPN router, and a VPN network; monitoring the operating state of the PLC based on the VPN remote network to obtain PLC operating state data; storing the PLC operating state data using a data repository constructed by configuration software; and remotely maintaining the PLC for abnormal data in the PLC operating state data. This device based on VPN technology and the method for remotely maintaining a PLC effectively improve the efficiency of PLC maintenance by using the device based on VPN technology to remotely debug and upload / download programs to / from the remote PLC controller.

[0042] However, due to the fixed application network environment, the above - mentioned solution is only applicable to local researchers accessing devices in a remote fixed network, and cannot achieve the debugging and testing work of local personnel on devices in a remote complex and unfamiliar environment or a non - fixed network environment. That is to say, the above - mentioned solution is mainly applicable to a remote fixed network environment and cannot meet the device debugging requirements in a dynamic IP, complex public network, or unfamiliar non - fixed network environment. On the other hand, due to the complex network environment, diverse topological structures, strict permission management in the industrial control laboratory device cluster, and different industrial control devices belonging to different brands and models, with widely different network configuration methods and network requirements among them, it is difficult to group them into the same subnet for unified management by a single host computer, and it is also difficult to randomly add or remove devices after the network configuration is completed. Therefore, it is very difficult to manage them remotely; the existing solutions are only applicable to remotely managing single or multiple PLC devices of the same brand and model and cannot solve the above problems. On the other hand, when many brands and models of industrial control devices are installed and debugged in the early stage, it is inevitable to repeatedly perform power - off and restart operations to adapt to new configurations; when performing security tests, it is also often necessary to power off and restart the devices multiple times to recover from the denial - of - service state. The related technologies highly rely on on - site personnel to manually control the power on and off of the devices and cannot meet the remote power - off and restart requirements of the industrial control laboratory.

[0043] That is to say, the existing remote management methods for industrial control devices still have certain limitations in aspects such as adapting to the network environment, cluster management, and remote hardware control. To solve the technical bottleneck of remote debugging and testing in the industrial control laboratory and achieve efficient, safe, and low - cost remote management of industrial control devices, Figure 1 is a schematic flowchart of the remote management method for industrial control devices in the embodiments of this application. As Figure 1 shown, it may include:

[0044] Step 100: The local control device sends data to the target industrial control device among one or more remote industrial control devices through a VPN tunnel based on a wireless network.

[0045] In an exemplary instance, the data may include, for example, debugging instructions and test data.

[0046] In an exemplary instance, before step 100, it may further include:

[0047] Establish a connection between the local control device and one or more remote industrial control devices through a VPN tunnel based on a wireless network.

[0048] In an embodiment, establishing a connection between the local control device and one or more remote industrial control devices through a VPN tunnel based on a wireless network may include:

[0049] For the industrial control security laboratory side where the local control device is located, it is necessary to configure the local control device so that the local control device has the ability to manage, debug, and test remote industrial control devices, which may include: installing industrial control device management software (such as SCADA monitoring system, PLC programming software, etc.) in the upper computer PC; connecting to the enterprise VPN server and configuring it to establish an encrypted tunnel to provide security for remote connections; installing the open-source router operating system (OpenWrt) on the 5G industrial customer premises equipment (CPE), configuring the industrial gateway, connecting to the operator's 5G network, and accessing the VPN tunnel to allow the upper computer PC to access the remote industrial control network through the VPN. Among them, OpenWrt is an open-source router operating system based on Linux, which is widely used for the firmware of custom routers, wireless access points, and other embedded devices. It supports many network protocols, applications, and security functions and can be freely customized.

[0050] For the remote industrial control device side in different locations, it is necessary to enable the remote industrial control device to access the 5G network and achieve stable remote communication, which may include: configuring a 5G industrial CPE at the remote end to connect to the operator's 5G network; establishing a secure connection with the local end through the VPN tunnel; installing the IP packet filtering tool (iptables) on the soft router industrial control computer (such as an IP transfer device), configuring NAT and port forwarding, dividing different subnets according to the type of industrial control device, and mapping ports; connecting the remote industrial control devices (such as PLC, DCS, industrial cameras, robots, etc.) to the IP transfer device, and the automation engineer configures the communication parameters (such as IP address, port, protocol, etc.) of the industrial control device. Among them, iptables is a tool used to configure and manage the Linux kernel firewall, allowing users to control packet filtering and network address translation (NAT). Iptables is based on the Linux kernel's Netfilter framework and is mainly used for filtering, forwarding, and processing network traffic.

[0051] In an exemplary example, step 100 may include:

[0052] The local control device sends debugging instructions or test data to the target industrial control device in different locations through the VPN tunnel of the 5G network; at the same time, it receives the debugging results or test data feedback from the target industrial control device through the VPN tunnel of the 5G network.

[0053] In an embodiment, for the case where the local control device sends debugging instructions to the target industrial control device in different locations through the VPN tunnel of the 5G network, step 100 may include:

[0054] The host computer PC at the industrial control security laboratory end where the local control device is located accesses the target industrial control device in a different location through the VPN tunnel established by the 5G communication module; connects to the target industrial control device (such as PLC, DCS, etc.) through SCADA or PLC programming software and sends instructions to verify the real-time operation status of the target industrial control device. After the engineer modifies the program of the target industrial control device in the host computer PC, it is transmitted to the target industrial control device in a different location through the VPN; uses debugging tools (such as the debugging function of PLC programming software) to monitor the execution of the program in real time, such as performing breakpoint debugging, variable viewing, and status monitoring, etc. In this way, the engineer can modify the logic or parameters in the program according to the real-time feedback, upload it to the remote target industrial control device, and then continue to verify the running effect of the program through the debugging tool to ensure its stability and correctness.

[0055] In one embodiment, for the case where the local control device sends test data to the target industrial control device in a different location through the VPN tunnel of the 5G network, step 100 may include:

[0056] The host computer PC at the industrial control security laboratory end where the local control device is located accesses the target industrial control device in a different location through the VPN tunnel established by the 5G communication module to verify whether there are corresponding vulnerabilities in the target industrial control device. In one embodiment, different types of industrial control security tests such as password cracking, fuzz testing, unauthorized issues, and device firmware extraction are carried out by sending specially designed data packets to the target industrial control device, and it can be tested and verified whether there are relevant industrial control vulnerabilities in the target industrial control device.

[0057] Step 101: The target industrial control device receives the instruction and executes the corresponding operation, and based on the wireless network, feeds back data to the local control device through the VPN tunnel.

[0058] In one exemplary instance, the operations corresponding to the instruction may include, for example, program running, parameter adjustment, status monitoring, etc. The target industrial control device generates feedback data and transmits it back to the local control device through the VPN tunnel based on the wireless network.

[0059] In one exemplary instance, the instruction sent in step 100 may further include: a control instruction. In one embodiment, the host computer PC at the industrial control security laboratory end where the local control device is located runs control software and sends a power control instruction; the instruction is transmitted to the power control module in a different location through the VPN tunnel of the 5G communication module; the transistor-type PLC of the power control module receives the instruction and switches on and off according to the instruction through the relay to realize the restart of the target industrial control device in a different location. Further, the key equipment for controlling the power supply uses an uninterruptible power supply (UPS, Uninterruptible Power Supply) for power supply to prevent control failure caused by accidental power failure.

[0060] In the embodiment of the present application, the industrial control device remote management method uses a remote communication technology based on wireless communication technology such as 5G to connect the local network environment and the remote industrial control device through a VPN tunnel, realizing the debugging and testing work of the industrial control device in the complex remote environment by researchers, and further supporting remote power-off restart. The embodiment of the present application solves the technical bottleneck of remote debugging and testing in the industrial control laboratory, and realizes efficient, safe and low-cost remote management of industrial control devices.

[0061] Figure 2 It is a schematic diagram of the composition architecture of the industrial control device remote management system in the embodiment of the present application. As Figure 2 shown, it may include: a local control device end and an industrial control device end in a different location. Among them, the local control device end may include: a central control management module and a first wireless communication module; the industrial control device end at least includes: a second wireless communication module and an industrial control internal network module.

[0062] The central control management module is used to send data to the target industrial control device in one or more industrial control devices in different locations through the first wireless communication module; receive feedback data for subsequent analysis and evaluation;

[0063] The first wireless communication module establishes a VPN tunnel with the second wireless communication module based on the wireless network, and is used to send the instructions from the central control management module to the target industrial control device at the industrial control device end through the VPN tunnel; receive the feedback data from the industrial control device end through the VPN tunnel and transfer it to the central control management module;

[0064] The second wireless communication module is used to receive the instructions from the local control device end through the VPN tunnel and transfer them to the target industrial control device in the industrial control internal network module; send the feedback data from the industrial control internal network module to the local control device end;

[0065] The industrial control internal network module includes one or more industrial control devices. The target industrial control device in the industrial control device is used to receive instructions and execute corresponding operations, and feedback data to the local control device end through the VPN tunnel.

[0066] In an exemplary instance, the central control management module is a PC central control end for researchers to conduct research, management, maintenance and debugging on industrial control devices, and is configured in the local industrial control laboratory internal network environment. Through the central control management module, the upper computer software and projects of industrial control devices can be run, control programs can be written, modified, compiled and downloaded, the remote SCADA monitoring system can be run, various data services can be stored and managed, and the remote vulnerability testing environment, etc. The central control management module can be used for debugging and testing the target industrial control device in the industrial control internal network module.

[0067] In an exemplary instance, the first wireless communication module and the second wireless communication module can be 5G communication modules. In one embodiment, an OpenWrt system can be installed in a 5G industrial CPE, an industrial gateway and an industrial firewall can be configured, a 5G Internet of Things card can be inserted, and a carrier 5G network can be connected, and an enterprise VPN service can be configured to implement the functions of a 5G communication device. In the embodiment of the present application, the 5G communication module is a module responsible for processing remote communication processes. Different from the traditional engineering project management process in which technicians must communicate with devices in a wired manner through physical cables such as Ethernet and USB offline, the 5G communication module provided in the embodiment of the present application transmits communication data between the host computer and the industrial control device through a 5G network, thereby realizing remote real-time debugging of industrial control devices located in different places. In one embodiment, the 5G communication module configures 5G communication devices locally and remotely, such as Figure 2 the first wireless communication module and the second wireless communication module in it, connect to the carrier 5G network, and build a connection tunnel through an enterprise VPN server. Through the embodiment of the present application, a data transmission channel between two nodes of the communication module is realized. The 5G communication device at the local control device end receives the instructions and data packets transmitted by the central control management module, and serves as an internal network exit to connect to the Internet, and is transmitted to the 5G communication device at the industrial control device end in a different place through a VPN tunnel, and then the instructions and data are transmitted into the industrial control internal network module, and vice versa. The embodiment of the present application uses a wireless network such as a 5G network device, connects the network of the local industrial control laboratory to the remote industrial control device through an enterprise VPN service and a carrier 5G network, and realizes remote 5G connection of the industrial control device while ensuring security.

[0068] In an exemplary instance, the industrial control internal network module can include one or more industrial control devices in different places, and IP transfer devices. Among them, the IP transfer device (usually a soft router device configured by an industrial control computer) is used to connect multiple industrial control subnets and perform network forwarding between the IP transfer device and the industrial control subnets; different industrial control devices are respectively connected to different industrial control subnets.

[0069] The remote management of industrial control devices in the embodiment of the present application is a more extensive industrial control device management. In one embodiment, the remote industrial control devices can include, but are not limited to, PLCs, and also include devices such as distributed control systems (DCS), industrial cameras, industrial robots, sensors, etc.

[0070] In one embodiment, an IP transfer device uses the iptables tool to handle IP forwarding requirements. Different industrial control subnet segments are assigned to different network interfaces of the device, which are respectively connected to industrial control devices in different industrial control subnets. The set of all industrial control subnets constitutes an industrial bus. The IP transfer device is selected according to the number of industrial control devices and the subnet structure. The industrial control devices, on the other hand, configure the network parameters of their respective subnets according to their own network characteristics and remote environments. This module receives the instructions and data transmitted by the 5G communication module, completes the actions and returns the response data. For example, an IP transfer device (soft router) has multiple network interfaces (network ports), and each network port can be connected to an independent industrial control subnet. For example: network port 1 → 192.168.1.x (PLC device), network port 2 → 192.168.2.x (DCS device), network port 3 → 192.168.3.x (industrial camera), network port 4 → 192.168.4.x (industrial robot). These industrial control subnets together form an industrial bus, that is, the set of the entire industrial network. When the 5G communication module receives a remote instruction (from the local central control management module), it will transmit the data packet to the IP transfer device. The iptables tool will forward the instruction data packet to the corresponding industrial control device (such as PLC, DCS, etc.) according to the IP address and port rules. After receiving the instruction, the industrial control device performs corresponding operations (such as running a program, controlling mechanical equipment, etc.) and generates feedback data. The feedback data passes through the same path and finally returns to the local central control management module through the 5G communication module for engineers to view and analyze. In the embodiment of this application, when each industrial control device (such as PLC, DCS, etc.) accesses the network, it will configure its IP according to its own network characteristics and remote environment, such as configuring the correct IP address, subnet mask, and gateway address to ensure that it can communicate with the remote control end through the IP transfer device. The iptables rules of the IP transfer device also need to be adapted to these devices to ensure that the data can be correctly routed. The embodiment of this application provides a subnet environment that is convenient for application and expansion for the remote industrial control device cluster, realizing the remote real-time management of the industrial control device cluster network by a single local host computer.

[0071] Furthermore, the central control management module can also control the circuit on / off of the power control module through communication. All the instructions and data sent by the central control management module are transmitted through the first wireless communication module, and the feedback data sent back from the industrial control device end is received in real time.

[0072] In an exemplary instance, the industrial control device side may further include: a power control module, which may include a power supply device and a power control device. Among them, the power control device is connected to the IP transfer device of the industrial control intranet module. The central control management module can drive the power control device to act by remotely sending instructions, cutting off or connecting the power circuit of any industrial control device to achieve a hard restart of the industrial control device. The power control module receives the communication instructions transferred by the industrial control intranet module and completes the action. The embodiment of the present application realizes a reliable and flexible remote power control device, and can flexibly perform power on / off control operations on remote devices in a local industrial control laboratory.

[0073] Combined with Figure 2 、 Figure 3 As shown, when performing industrial control device debugging and testing work, engineers and security researchers can send device control instructions or test data through the host computer of the central control management module. The 5G communication module transmits the instructions to the remote industrial control intranet module, and after IP forwarding, they reach each industrial control device, execute the instruction actions, and return the response data of the industrial control device.

[0074] Furthermore, when performing the power restart operation required for debugging and testing work, engineers and security researchers can issue device control instructions through the host computer of the central control management module. The 5G communication module transmits the instructions to the remote industrial control intranet module, and after IP forwarding, they reach the power control device in the power control module, thereby controlling the on / off of the power circuit of the target industrial control device in the industrial control intranet module, that is, remotely controlling the power of the industrial control device to achieve an automated restart. Furthermore, security researchers can also send periodic or regular power-off and restart instructions by writing and running scripts locally to perform automated security testing work.

[0075] In the industrial control device remote management system of the embodiment of the present application, a remote communication technology based on wireless communication technology such as 5G is used to connect the local network environment and remote industrial control devices through a VPN tunnel, realizing the debugging and testing work of researchers on industrial control devices in a remote complex environment, and can further support remote power-off and restart. The embodiment of the present application solves the technical bottleneck of remote debugging and testing in an industrial control laboratory and realizes efficient, safe, and low-cost remote industrial control device management.

[0076] The embodiments of this application achieve convenient remote connection. The remote industrial control devices in the enterprise industrial control laboratory do not need to be connected to a wired network. They only need to be connected to a carrier wireless network such as a 5G network to achieve remote secure connection. Moreover, the industrial control devices do not need to be independently configured for the local IP environment. The IP transfer device of the industrial control intranet module can perform centralized IP transfer, so as to achieve convenient communication with the upper computer in the industrial control network management module. The embodiments of this application achieve convenient unified management. Researchers can uniformly manage the devices in the remote industrial control intranet module according to business needs, freely increase or decrease the types, brands, and quantities of industrial control devices, and do not need to adjust the entire network configuration due to compatibility problems caused by newly adding or reducing industrial control devices. They can also arbitrarily expand the number of different remote modules, realizing the collaborative management of local area networks of industrial control devices in multiple places. The embodiments of this application facilitate the development of debugging and testing work. When the enterprise industrial control laboratory conducts remote debugging and testing work, for the frequent power-off and restart requirements of industrial control devices, there is no need to dispatch professional personnel to the site for physical interference. Only by sending remote instructions can the power on / off action be executed, thus facilitating the development of various tasks. The embodiments of this application are convenient to configure and low in cost. Engineers can use existing devices to configure each module, select low-cost PLCs and industrial control computers for self-configuration, and then build the entire network system without purchasing expensive special equipment for networking, saving the cost of remote management of industrial control devices.

[0077] In one embodiment, through this application, engineers and researchers located locally in the industrial control laboratory can remotely manage and operate industrial control devices in different locations, and complete the debugging work of industrial control devices: download configuration, update device parameters; remotely execute IO setting instructions to test the on / off of industrial control device points; download projects and test the logical execution of devices; disconnect the device power supply and reconnect to restart the device and apply updates. In addition, for the testing work of industrial control devices: send test data packets; verify whether there are corresponding vulnerabilities in industrial control devices; when the device enters the denial-of-service state, power off and restart.

[0078] Although the disclosed embodiments of this application are as above, the content described is only an embodiment for facilitating the understanding of this application and is not used to limit this application. Any person skilled in the art within the scope of this application can make any modifications and changes in the form and details of the implementation without departing from the spirit and scope disclosed by this application. However, the scope of patent protection of this application shall still be subject to the scope defined by the appended claims.

Claims

1. A remote management system for industrial control equipment, characterized in that: include: A local control device end and a remote industrial control device end; wherein the local control device end may include: a central control management module and a first wireless communication module; the industrial control device end at least includes: a second wireless communication module and an industrial control intranet module; The central control management module is used to send data to a target industrial control device in one or more remote industrial control devices through the first wireless communication module; receive feedback data for subsequent analysis and evaluation; The first wireless communication module establishes a virtual private network VPN tunnel with the second wireless communication module based on the wireless network, and is used to send the command from the central control management module to the target industrial control device at the industrial control device end through the VPN tunnel; receive feedback data from the industrial control device end through the VPN tunnel, and transmit it to the central control management module; The second wireless communication module is used to receive instructions from the local control device end through the VPN tunnel and transmit them to the target industrial control device in the industrial control intranet module; and send feedback data from the industrial control intranet module to the local control device end; The industrial control intranet module includes one or more industrial control devices. The target industrial control device in the industrial control device is used to receive instructions and execute corresponding operations, and feed back data to the local control device through the VPN tunnel.

2. The remote management system for industrial control equipment according to claim 1, wherein: The first wireless communication module and the second wireless communication module are 5G communication modules.

3. The remote management system for industrial control equipment according to claim 1, wherein: The industrial control intranet module includes one or more remote industrial control devices and IP switching equipment; wherein, IP switching equipment is used to connect multiple industrial control subnets and perform network forwarding between the IP switching equipment and the industrial control subnets; Different industrial control equipment is connected to different industrial control subnets.

4. The remote management system for industrial control equipment according to claim 1, wherein: The IP switching device uses the iptables tool to process IP forwarding requirements, and different network ports thereof are allocated with different network segments of the industrial control subnets, and are respectively connected to industrial control devices of different industrial control subnets. The collection of all industrial control subnets constitutes an industrial bus.

5. The remote management system for industrial control equipment according to claim 1, wherein: The remote industrial control equipment includes: programmable logic controller PLC, distributed control system DCS, industrial camera, industrial robot, and sensor.

6. The industrial control equipment remote management system according to claim 3, wherein the industrial control equipment terminal further comprises: The power control module includes a power supply device and a power control device, wherein: The power supply control device is connected to the IP switching device of the industrial control intranet module; The central control management module is also used to drive the power control device to act by remotely sending instructions, cut off or connect the power supply device of any industrial control equipment, thereby realizing a hard restart of the industrial control equipment.

7. A remote management method for industrial control equipment, characterized in that: include: Based on the wireless network, the local control device sends data to the target industrial control device in one or more remote industrial control devices through the VPN tunnel; The target industrial control device receives the instructions and performs corresponding operations, and feeds back data to the local control device through the VPN tunnel based on the wireless network.

8. The method for remote management of industrial control equipment according to claim 7, wherein: The local control device sends data to a target industrial control device in one or more remote industrial control devices through a VPN tunnel based on a wireless network, including: The local control device sends debugging instructions or test data to the target industrial control device through the VPN tunnel of the 5G network; It also includes: receiving debugging results or test data fed back from the target industrial control equipment through the VPN tunnel of the 5G network.

9. The method for remote management of industrial control equipment according to claim 8, wherein: The situation where the local control device sends a debugging instruction to a target industrial control device in a different location through a VPN tunnel of a 5G network includes: The host PC at the industrial control security laboratory where the local control device is located accesses the target industrial control device in a different location through a VPN tunnel established by the 5G communication module; connects to the target industrial control device through SCADA or PLC programming software and sends instructions to verify the real-time operating status of the target industrial control device; The situation where the local control device sends test data to the target industrial control device in a different location through the VPN tunnel of the 5G network includes: The host PC at the industrial control security laboratory where the local control device is located accesses the target industrial control device in a different location through a VPN tunnel established by the 5G communication module; sends test data to the target industrial control device to verify whether the target industrial control device has corresponding vulnerabilities.

10. According to any one of claims 7 to 9, the remote management method for industrial control equipment, the instruction sent further comprises: Control instructions; The method further comprises: a host computer PC at the industrial control safety laboratory end where the local control device is located runs control software and sends a power control instruction; The instruction is transmitted to a power control module in a different location through the VPN tunnel of the 5G communication module; the power control module receives the instruction and switches on and off according to the instruction to restart the target industrial control equipment.

Images