Method, system and device for industrial control equipment to quickly access SECS network and storage medium

Abstract

The invention discloses a method, system and device for an industrial control device to quickly access an SECS network and a storage medium, and belongs to the technical field of communication, the method for quickly accessing the SECS network comprises the following specific steps: I, deploying an SECS-HUB gateway of the SECS network, and configuring device protocol analysis parameters in the SECS-HUB gateway; iI, establishing communication connection between the SECS-HUB gateway and the EAP end, and performing encryption protection on each data channel; according to the invention, the equipment is accessed to the EAP network without development configuration, the access cost and difficulty are reduced, the equipment integration efficiency is improved, the flexibility and expandability of a factory automation system are enhanced, the security in a data transmission process is ensured, the damage of network attack to a production system is prevented, and the production efficiency is improved. And safe and stable operation of factory production and safety of data assets are ensured.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a method, system, device and storage medium for quickly accessing industrial control equipment to a SECS network. Background Art

[0002] In semiconductor FA factories, the SECS control network is crucial for efficient communication and collaboration between devices. However, many common electrical devices on-site, such as those using PLCs for logic control, have native communication protocols that are incompatible with the SECS protocol. Each new device must undergo protocol adaptation before it is added to the factory floor. Traditional access methods are not only cumbersome, costly, and inefficient, but also face significant challenges in network data security, as different equipment manufacturers have varying standards for device network data security. With the development of the Industrial Internet, the boundaries between factory networks and external networks are blurring, making the SECS control network vulnerable to cyberattacks. For example, hackers could intrude on the connection between a device and the SECS network to steal production data and tamper with device control commands, leading to serious consequences such as production interruptions, product quality impairments, and the leakage of trade secrets. Furthermore, the lack of effective security mechanisms during the access process for common devices can introduce malware or be subject to man-in-the-middle attacks, further jeopardizing the secure and stable operation of the entire factory network. Summary of the Invention

[0003] The purpose of the present invention is to solve the defects in the prior art and to propose a method, system, device and storage medium for quickly connecting industrial control equipment to a SECS network.

[0004] In order to achieve the above object, the present invention adopts the following technical solutions:

[0005] A method for quickly connecting industrial control equipment to the SECS network. The specific steps for this method are as follows:

[0006] Ⅰ. Deploy the SECS-HUB gateway of the SECS network and configure the device protocol parsing parameters in the SECS-HUB gateway;

[0007] II. Establish the communication connection between SECS-HUB gateway and EAP end, and encrypt and protect each data channel;

[0008] III. Add a summary signature to the data of each industrial control device and attach the signature information. After completing the configuration, start the SECS network and monitor each industrial control device in real time;

[0009] IV. Regularly maintain and update the configuration, software version and security parameters of the SECS-HUB gateway.

[0010] As a further solution of the present invention, the specific steps of deploying the SECS-HUB gateway of the SECS network in step I are as follows:

[0011] S1.1: Select a host computer, edge computing node, or factory server based on the actual application scenario as the SECS-HUB gateway deployment platform, and select the corresponding operating system and architecture based on the requirements;

[0012] S1.2: Prepare the corresponding device communication interface according to the communication mode of each connected industrial control device. Then upload the SECS-HUB gateway software installation package to the selected platform and decompress it. Then execute the installation script or run the installation program. After the installation is complete, set the startup item or service resident process, and then install the log module.

[0013] S1.3: Set the communication parameters of each industrial control device through the configuration file or graphical interface, then configure the SECS connection parameters between the SECS-HUB gateway and the factory EAP system, and load and activate the mapping relationship between the SECS-HUB gateway and the factory EAP system;

[0014] S1.4: After all parameters of the SECS-HUB gateway are configured, start the SECS-HUB gateway service and run the test. At the same time, use the operation log to record the SECS-HUB gateway operation information in real time, and set up an abnormal automatic restart or alarm notification mechanism.

[0015] As a further solution of the present invention, the specific steps of configuring the device protocol parsing parameters in the SECS-HUB gateway described in step I are as follows:

[0016] S2.1: Create a dedicated communication configuration template for each industrial control device in the SECS-HUB gateway, extract the target data points according to the manual or communication document of each industrial control device, and declare them in the configuration;

[0017] S2.2: Set the collection method, polling period, data collection threshold, and disconnection retry and collection failure response strategies for each data point of the industrial control device. Then, select the standard SECS message type and define the message item structure. Then, assign a device data point to each SECS network message item and specify the mapping rules.

[0018] S2.3: After the configuration is completed, save the configuration files corresponding to each industrial control device, verify the structure and logic of the configuration files, and then start the SECS-HUB gateway to establish communication connections with each industrial control device.

[0019] As a further solution of the present invention, the specific steps of encrypting and protecting each data channel in step II are as follows:

[0020] S3.1: SECS-HUB gateway uses SSL / TLS encryption channels based on TCP / IP communication protocols to connect to various industrial control devices and EAP systems, and deploys certificate files and private key files on the SECS-HUB gateway.

[0021] S3.2: Use ECDH or DH algorithm to negotiate keys between the SECS-HUB gateway, each industrial control device, and the EAP system. Each generates a public-private key pair, generates a shared session key through public key exchange, and then independently encrypts the application layer SECS message body.

[0022] A system for rapidly connecting industrial control equipment to the SECS network, including a communication interface module, a protocol adapter module, a data acquisition module, a structure mapping module, a protocol communication module, a link encryption module, a data decryption module, a signature verification module, a management setting module, a monitoring management module, and a policy control module;

[0023] The communication interface module is used to establish physical and logical connections with various industrial control devices on site;

[0024] The protocol adaptation module is used to perform protocol analysis on the data of each industrial control device;

[0025] The data acquisition module is used to collect and process various data transmitted by various industrial control devices;

[0026] The structure mapping module is used to map the collected device data into a data structure that complies with the SECS standard;

[0027] The protocol communication module is used to communicate with the EAP system and various industrial control devices using the SECS standard protocol;

[0028] The link encryption module is used to perform link-level encryption based on the SSL / TLS protocol;

[0029] The data decryption module is used to perform symmetrical or asymmetrical encryption on the transmitted data;

[0030] The signature verification module is used to generate and verify the digital signature of the SECS data content;

[0031] The management setting module is used for overall system configuration, device parameter setting and protocol rule management;

[0032] The monitoring and management module is used to perform real-time status monitoring and abnormal log recording during the operation of the SECS network;

[0033] The policy control module is used to provide permission management and policy configuration support for SECS network access.

[0034] As a further solution of the present invention, the signature verification module generates a digital signature for the SECS data content, and the specific steps of verification are as follows:

[0035] S4.1: While maintaining the original SECS protocol format of each transmitted data, use the digest algorithm to calculate the hash value of the entire SECS data body, then sign the hash value with the key to generate signature information, and then append a new data field to the last parameter object of the original transmitted data;

[0036] S4.2: After receiving the transmitted data, the EAP system extracts the last Type A data and recalculates the digest signature of the data using the public key. If the signature verification fails, it can trigger various security response mechanisms such as data discard, error logging, and alarm.

[0037] Equipment for industrial control equipment to quickly access the SECS network, including serial communication transceiver chips, Ethernet interface chips, main control processors, flash memory chips, memory, security encryption chips, timers, digital-to-analog conversion modules, clock chips, and power management modules;

[0038] The serial communication transceiver chip is used to perform level conversion and data transmission and reception with the serial communication interface of the industrial control equipment;

[0039] The Ethernet interface chip is used to provide Ethernet access functions for the network physical layer and the data link layer;

[0040] The main control processor is responsible for protocol analysis, data mapping, logic control and system scheduling;

[0041] The flash memory chip is used to store device firmware, protocol mapping configuration files, system logs and security certificate data;

[0042] The memory is used to provide data cache and processing space for the main control processor;

[0043] The security encryption chip is used for data encryption and decryption, key management and summary signature;

[0044] The timer is used to periodically detect abnormalities and automatically reset;

[0045] The digital-to-analog conversion module is used to collect analog or digital signals from industrial control equipment and perform data format conversion;

[0046] The clock chip is used for data timestamp marking, log recording and event synchronization;

[0047] The power management module is used to provide a stable operating voltage.

[0048] The storage medium of the industrial control equipment quickly accesses the SECS network, and the storage medium stores data collected by the system of the industrial control equipment quickly accessing the SECS network.

[0049] Compared with the prior art, the present invention has the following beneficial effects:

[0050] The method for quickly connecting industrial control equipment to the SECS network deploys the SECS-HUB gateway program through multiple methods such as host computer agent, edge computing device forwarding, and server-side forwarding. One end interacts with the production equipment through the device protocol, and the other end interacts with the factory EAP through the SECS protocol, realizing development-free configuration of equipment to access the EAP network, reducing access costs and difficulty, improving equipment integration efficiency, and enhancing the flexibility and scalability of the factory automation system. In the process of two-way data communication, data summary signature verification, data compression, and data full encryption are performed to ensure the security of the data transmission process, prevent network attacks from damaging the production system, and ensure the safe and stable operation of factory production and the security of data assets. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] The accompanying drawings are used to provide further understanding of the present invention and constitute a part of the specification. They are used to explain the present invention together with the embodiments of the present invention and do not constitute a limitation of the present invention.

[0052] Figure 1 This is a flowchart of the method for quickly connecting industrial control equipment to the SECS network proposed by the present invention;

[0053] Figure 2 This is a system block diagram of the rapid access of industrial control equipment to the SECS network proposed by the present invention;

[0054] Figure 3 This is the SECS-HUB gateway deployment topology diagram of the system for rapid access of industrial control equipment to the SECS network proposed by the present invention;

[0055] Figure 4 The SECS-HUB gateway workflow of the system for rapid access of industrial control equipment to the SECS network proposed by the present invention;

[0056] Figure 5 This is a schematic diagram of data decryption in the system for rapid access of industrial control equipment to the SECS network proposed by the present invention. DETAILED DESCRIPTION

[0057] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments.

[0058] Example 1

[0059] Reference Figure 1 、 3 -4. This embodiment discloses a method for quickly connecting industrial control equipment to a SECS network. The specific steps of the method for quickly connecting to a SECS network are as follows:

[0060] Deploy the SECS-HUB gateway of the SECS network and configure device protocol parsing parameters in the SECS-HUB gateway.

[0061] Specifically, according to the actual application scenario, select the host computer, edge computing node or factory server as the SECS-HUB gateway deployment platform, and select the corresponding operating system and architecture according to the needs. According to the communication method of each connected industrial control device, prepare the corresponding device communication interface, then upload the SECS-HUB gateway software installation package to the selected platform and decompress it, and then execute the installation script or run the installation program. After the installation is complete, set the startup item or service resident process, and then install the log module. Set the communication parameters of each industrial control device through the configuration file or graphical interface, and then configure the SECS connection parameters between the SECS-HUB gateway and the factory EAP system. At the same time, load and activate the mapping relationship between the SECS-HUB gateway and the factory EAP system. After the configuration of various parameters of the SECS-HUB gateway is completed, start the SECS-HUB gateway service and run the test. At the same time, use the operation log to record the SECS-HUB gateway operation information in real time, and set an abnormal automatic restart or alarm notification mechanism.

[0062] Specifically, create a dedicated communication configuration template for each industrial control device in the SECS-HUB gateway, and extract the target data points according to the manual or communication document of each industrial control device and declare them in the configuration. Set the collection method, polling cycle, data collection threshold, and disconnection retry and collection failure response strategy for each data point of the industrial control device. Then select the standard SECS message type and define the message item structure. Then assign a device data point to each SECS network message item and specify the mapping rules. After the configuration is completed, save the configuration file corresponding to each industrial control device, verify the structure and logic of the configuration file, and then start the SECS-HUB gateway to establish a communication connection with each industrial control device.

[0063] Establish a communication connection between the SECS-HUB gateway and the EAP end, and encrypt and protect each data channel.

[0064] Specifically, the SECS-HUB gateway enables SSL / TLS encryption channels based on the TCP / IP communication protocol to connect with each industrial control device and EAP system respectively, and deploys certificate files and private key files on the SECS-HUB gateway. It uses ECDH or DH algorithm to negotiate keys between the SECS-HUB gateway and each industrial control device and EAP system, generates public and private key pairs for each, generates shared session keys through public key exchange, and then independently encrypts the application layer SECS message body.

[0065] Add a summary signature to the data of each industrial control device and attach signature information. After completing the configuration, start the SECS network and monitor each industrial control device in real time.

[0066] Regularly maintain and update the configuration, software version, and security parameters of the SECS-HUB gateway.

[0067] Example 2

[0068] Reference Figure 2-4 This embodiment discloses a system for quickly connecting industrial control equipment to a SECS network, including a communication interface module, a protocol adaptation module, a data acquisition module, a structure mapping module, a protocol communication module, a link encryption module, a data decryption module, a signature verification module, a management setting module, a monitoring management module, and a policy control module.

[0069] The communication interface module is used to establish physical and logical connections with various industrial control devices on site; the protocol adapter module is used to perform protocol analysis on the data of various industrial control devices; and the data acquisition module is used to collect and process various data transmitted by various industrial control devices.

[0070] The structure mapping module is used to map the collected device data into a data structure that complies with the SECS standard; the protocol communication module is used to communicate with the EAP system and various industrial control devices using the SECS standard protocol.

[0071] The link encryption module is used to perform link-level encryption based on the SSL / TLS protocol; the data decryption module is used to perform symmetric or asymmetric encryption on the transmitted data; the signature verification module is used to generate and verify the digital signature of the SECS data content.

[0072] Specifically, under the premise of keeping the original SECS protocol format of each transmitted data unchanged, a digest algorithm is used to calculate the hash value of the entire SECS data body, and then the hash value is signed with a key to generate signature information. Then, a new data field is appended to the last parameter object of the original transmitted data. After receiving the transmitted data, the EAP system extracts the last A type data and recalculates the digest signature of the data using the public key. If the signature verification fails, it can trigger various security response mechanisms such as data discard, error logging, and alarm.

[0073] The management setting module is used for overall system configuration, device parameter setting and protocol rule management; the monitoring management module is used for real-time status monitoring and abnormal log recording during the operation of the SECS network;

[0074] The policy control module is used to provide permission management and policy configuration support for SECS network access.

[0075] Example 3.

[0076] Equipment for industrial control equipment to quickly access the SECS network includes serial communication transceiver chips, Ethernet interface chips, main control processors, flash memory chips, memory, security encryption chips, timers, digital-to-analog conversion modules, clock chips, and power management modules.

[0077] The serial communication transceiver chip is used to perform level conversion and data transmission and reception with the serial communication interface of industrial control equipment; the Ethernet interface chip is used to provide Ethernet access functions for the network physical layer and data link layer.

[0078] The main control processor is responsible for protocol parsing, data mapping, logic control and system scheduling; the flash memory chip is used to store device firmware, protocol mapping configuration files, system logs and security certificate data; the memory is used to provide data cache and processing space for the main control processor.

[0079] The security encryption chip is used for data encryption and decryption, key management, and summary signature; the timer is used to periodically detect anomalies and automatically reset; the digital-to-analog conversion module is used to collect analog or digital signals from industrial control equipment and perform data format conversion.

[0080] The clock chip is used for data timestamping, logging, and event synchronization; the power management module is used to provide a stable operating voltage. The storage medium that allows industrial control equipment to quickly access the SECS network stores data collected by the system.

[0081] Example 4.

[0082] The storage medium for industrial control equipment to quickly access the SECS network stores data collected by the system for industrial control equipment to quickly access the SECS network.

Claims

1. A method for rapidly connecting industrial control equipment to a SECS network, characterized in that: The specific steps of the method for quickly accessing the SECS network are as follows: Ⅰ. Deploy the SECS-HUB gateway of the SECS network and configure the device protocol parsing parameters in the SECS-HUB gateway; II. Establish the communication connection between SECS-HUB gateway and EAP end, and encrypt and protect each data channel; III. Add a summary signature to the data of each industrial control device and attach the signature information. After completing the configuration, start the SECS network and monitor each industrial control device in real time; IV. Regularly maintain and update the configuration, software version and security parameters of the SECS-HUB gateway.

2. The method for rapidly accessing an industrial control device to a SECS network according to claim 1, characterized in that: The specific steps for deploying the SECS-HUB gateway of the SECS network described in Step Ⅰ are as follows: S1.1: Select a host computer, edge computing node, or factory server based on the actual application scenario as the SECS-HUB gateway deployment platform, and select the corresponding operating system and architecture based on the requirements; S1.2: Prepare the corresponding device communication interface according to the communication mode of each connected industrial control device. Then upload the SECS-HUB gateway software installation package to the selected platform and decompress it. Then execute the installation script or run the installation program. After the installation is complete, set the startup item or service resident process, and then install the log module. S1.3: Set the communication parameters of each industrial control device through the configuration file or graphical interface, then configure the SECS connection parameters between the SECS-HUB gateway and the factory EAP system, and load and activate the mapping relationship between the SECS-HUB gateway and the factory EAP system; S1.4: After all parameters of the SECS-HUB gateway are configured, start the SECS-HUB gateway service and run the test. At the same time, use the operation log to record the SECS-HUB gateway operation information in real time, and set up an abnormal automatic restart or alarm notification mechanism.

3. The method for rapidly accessing an industrial control device to a SECS network according to claim 2, characterized in that: The specific steps for configuring the device protocol parsing parameters in the SECS-HUB gateway described in Step Ⅰ are as follows: S2.1: Create a dedicated communication configuration template for each industrial control device in the SECS-HUB gateway, extract the target data points according to the manual or communication document of each industrial control device, and declare them in the configuration; S2.2: Set the collection method, polling period, data collection threshold, and disconnection retry and collection failure response strategies for each data point of the industrial control device. Then, select the standard SECS message type and define the message item structure. Then, assign a device data point to each SECS network message item and specify the mapping rules. S2.3: After the configuration is completed, save the configuration files corresponding to each industrial control device, verify the structure and logic of the configuration files, and then start the SECS-HUB gateway to establish communication connections with each industrial control device.

4. The method for rapidly accessing an industrial control device to a SECS network according to claim 3, characterized in that: The specific steps for encrypting and protecting each data channel in step II are as follows: S3.1: SECS-HUB gateway uses SSL / TLS encryption channels based on TCP / IP communication protocols to connect to various industrial control devices and EAP systems, and deploys certificate files and private key files on the SECS-HUB gateway. S3.2: Use ECDH or DH algorithm to negotiate keys between the SECS-HUB gateway, each industrial control device, and the EAP system. Each generates a public-private key pair, generates a shared session key through public key exchange, and then independently encrypts the application layer SECS message body.

5. A system for rapidly accessing an industrial control device to a SECS network, for implementing any of the methods for rapidly accessing an industrial control device to a SECS network as recited in claims 1-4, characterized in that: It includes communication interface module, protocol adaptation module, data acquisition module, structure mapping module, protocol communication module, link encryption module, data decryption module, signature verification module, management setting module, monitoring management module and policy control module; The communication interface module is used to establish physical and logical connections with various industrial control devices on site; The protocol adaptation module is used to perform protocol analysis on the data of each industrial control device; The data acquisition module is used to collect and process various data transmitted by various industrial control devices; The structure mapping module is used to map the collected device data into a data structure that complies with the SECS standard; The protocol communication module is used to communicate with the EAP system and various industrial control devices using the SECS standard protocol; The link encryption module is used to perform link-level encryption based on the SSL / TLS protocol; The data decryption module is used to perform symmetrical or asymmetrical encryption on the transmitted data; The signature verification module is used to generate and verify the digital signature of the SECS data content; The management setting module is used for overall system configuration, device parameter setting and protocol rule management; The monitoring and management module is used to perform real-time status monitoring and abnormal log recording during the operation of the SECS network; The policy control module is used to provide permission management and policy configuration support for SECS network access.

6. The system for rapidly accessing industrial control equipment to the SECS network according to claim 5 is characterized in that: The signature verification module generates a digital signature for the SECS data content, and the specific steps of verification are as follows: S4.1: While maintaining the original SECS protocol format of each transmitted data, use the digest algorithm to calculate the hash value of the entire SECS data body, then sign the hash value with the key to generate signature information, and then append a new data field to the last parameter object of the original transmitted data; S4.2: After receiving the transmitted data, the EAP system extracts the last Type A data and recalculates the digest signature of the data using the public key. If the signature verification fails, it can trigger various security response mechanisms such as data discard, error logging, and alarm.

7. A device for rapidly accessing an industrial control device to a SECS network, for implementing any of the methods for rapidly accessing an industrial control device to a SECS network as recited in claims 1-4, characterized in that: Including serial communication transceiver chip, Ethernet interface chip, main control processor, flash memory chip, memory, security encryption chip, timer, digital-to-analog conversion module, clock chip and power management module; The serial communication transceiver chip is used to perform level conversion and data transmission and reception with the serial communication interface of the industrial control equipment; The Ethernet interface chip is used to provide Ethernet access functions for the network physical layer and the data link layer; The main control processor is responsible for protocol analysis, data mapping, logic control and system scheduling; The flash memory chip is used to store device firmware, protocol mapping configuration files, system logs and security certificate data; The memory is used to provide data cache and processing space for the main control processor; The security encryption chip is used for data encryption and decryption, key management and summary signature; The timer is used to periodically detect abnormalities and automatically reset; The digital-to-analog conversion module is used to collect analog or digital signals from industrial control equipment and perform data format conversion; The clock chip is used for data timestamp marking, log recording and event synchronization; The power management module is used to provide a stable operating voltage.

8. The storage medium of the industrial control equipment that quickly accesses the SECS network is characterized by: The storage medium stores data collected by the system for quickly accessing the industrial control equipment to the SECS network as described in any one of claims 5-6.

Images