System and method for remotely managing multiple brands based on Microsoft system upper computer

Abstract

The invention belongs to the technical field of industrial automation control, and particularly relates to a system and a method for remotely managing a multi-brand PLC (Programmable Logic Controller) by an upper computer of a Microsoft operating system, and the system comprises an engineer station which is provided with PLC editing software and an onion client which is integrated with a TAP virtual network card driver; the host computer of the Microsoft operating system is deployed in a field network where the PLC is located, is provided with a user mode packet forwarding program, and does not need to install any bottom layer driving program, and the program is called as an onion gateway; the onion console is used for an administrator to configure PLC equipment information and an engineer access authority strategy; according to the host computer remote management multi-brand system based on the Microsoft system, through a strategy pre-distribution mechanism, a virtual network card interception technology and a Tun2sockets technology, host computer undriven multi-brand PLC remote authorization access of a Microsoft operating system is realized.

Description

Technical Field

[0001] The present invention belongs to the technical field of industrial automation control, and in particular relates to a system and method for remotely managing a multi-brand PLC system using a Microsoft operating system host computer. Background Art

[0002] In today's industrial environment, PLC devices, as the core of production line control, are widely distributed in factory workshops around the world. Traditional remote management solutions have the following drawbacks: 1. Driver dependency issue: Many brands of PLCs (such as Siemens and Inovance) use heterogeneous discovery protocols (Layer 2 DCP / Layer 3 CodeSys). Drivers such as TAP / Npcap need to be installed on the host computer of the Microsoft operating system to implement broadcast forwarding.

[0003] 2. Lack of permission control. The broadcast discovery mechanism allows engineers to access all PLCs in the local area network, making device-level authorization impossible. For example, the welding robot PLC and the inspection PLC in the same automobile production line need to be isolated and authorized.

[0004] 3. Management conflicts: Multiple engineers operating a PLC remotely at the same time may cause configuration errors and equipment damage.

[0005] 4. System stability challenges: Installing drivers on a Microsoft-based host computer can affect the stability of the host computer. Driver compatibility issues can cause system freezes and blue screens, impacting production. Summary of the Invention

[0006] In order to overcome the deficiencies of the prior art, the present invention provides a Microsoft operating system host computer remotely managing a multi-brand PLC system and management method to solve the problem of authorized management of multi-brand PLCs.

[0007] One embodiment of the present invention provides a multi-brand system remotely managed by a host computer based on a Microsoft system, including: The engineer station is installed with PLC editing software and an Onion client, which integrates a TAP virtual network card driver; The host computer of Microsoft operating system is deployed in the field network where the PLC is located. It is equipped with Onion Gateway, which is a user-mode packet forwarding program and does not require any underlying driver to be installed. Onion console, used by administrators to configure PLC device information and access permission policies for electrical engineers; The multi-brand remote management system based on the Microsoft system host computer realizes the remote authorized access of multi-brand PLCs without drivers of the Microsoft operating system host computer through user login, user-based policy pre-distribution mechanism, virtual network card interception technology and Tun2socks technology.

[0008] In one embodiment, the onion client is configured to: The engineer logs in to the Onion client and synchronizes policy data from the console. The user-based policy contains the PLC information that the engineer is authorized to use. The broadcast discovery message sent by the PLC editing software is intercepted by the TAP virtual network card driver.

[0009] In one embodiment, the TAP virtual network card driver is configured as follows: Dynamically construct a simulation response packet based on the PLC information authorized in the policy, and the response packet only contains authorized device information; Set the IP address of the virtual network card to the IP address of the Onion gateway; The broadcast discovery message is not actually sent to the remote PLC network.

[0010] In one embodiment, for the DCP protocol of Siemens PLC: The TAP virtual network card driver directly generates a reply message that complies with the DCP protocol format, including the PLC's IP address, MAC address, device name, device model, vendor ID, etc. The device list displayed by the PLC editing software only contains PLCs authorized by the policy.

[0011] In one embodiment, for the CodeSys protocol of Inovance PLC: The Onion client forwards the UDP broadcast message received by the virtual network card to the Onion gateway; The onion gateway sends a unicast discovery message to the actual PLC and returns the response to the virtual network card.

[0012] In one embodiment, when the PLC editing software connects to the PLC via the IP address: All TCP / UDP unicast communications are directed to the virtual network card; The Onion client forwards data to the Onion gateway on the host computer through the P2P tunnel.

[0013] In one embodiment, the user-mode packet forwarding program: Runs in a driverless environment and communicates with PLC through a standard Socket interface; Forwards the instructions from the engineering station to the actual PLC and sends the response data back.

[0014] In one embodiment, the policy data includes the following fields: PLC name, brand, model, DeviceID, VendorID, IP address, and access permission identifier.

[0015] In one embodiment, the policy synchronization mechanism includes: Real-time notification updates for long connections; Pull policy data regularly.

[0016] Also included is a multi-brand PLC remote management method of any system in the above embodiment, comprising the steps of: The administrator configures PLC information and engineer authorization policies on the console; The engineering station synchronizes the strategy and intercepts the broadcast request, generating a simulated response; Local mapping of PLC editing software and unicast communication is achieved through a virtual network card; The user-mode forwarding program completes the transparent transmission of on-site network and remote data.

[0017] Compared with the prior art, the embodiments of the present invention have the following beneficial effects: 1. By deploying the TAP virtual network card driver only on engineer stations in non-production environments, the host computer side of the Microsoft operating system only runs the user-mode forwarding program (based on standard Socket communication) and the host computer does not install the driver. This can completely avoid compatibility conflicts between the driver and the Microsoft system.

[0018] 2. The virtual network card intercepts broadcast requests at the engineering station and directly constructs response packets (such as Siemens DCP protocol response packets or Inovance CodeSys protocol relays). The Microsoft operating system host computer does not need to handle the underlying protocol forwarding, thus eliminating production accidents caused by driver failures from the root.

[0019] 3. The administrator configures policies (including fields such as PLC brand, IP address, and Device ID) in the console and only sends authorized device information to the engineer station. The simulated response packet generated by the virtual network card only contains a list of PLCs accessible to the engineer, achieving "what you see is what you control."

[0020] 4. The PLC information obtained by the PLC editing software through the virtual network card is the result of policy filtering and cannot detect other devices in the actual network, effectively preventing unauthorized scanning.

[0021] 5. The system parses the discovery protocols of different brands of PLCs (such as DCP and CodeSys) to implement a unified interception and response mechanism at the virtual network card layer, providing an architectural foundation for future compatibility with emerging PLC brands.

[0022] 6. Engineers can connect to the PLC through the IP address mapped by the virtual network card without arriving at the site. Unicast communication reaches the device directly through the P2P tunnel and the host forwarding program of the Microsoft operating system, significantly shortening the fault response cycle.

[0023] 7. Avoid system maintenance costs caused by driver installation, while reducing resource investment in physical access to production lines, providing a feasible path for multi-national multi-base collaborative management. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the structures shown in these drawings without paying any creative work.

[0025] Figure 1 This is a conventional connection flow chart of the Siemens PLC of the present invention; Figure 2 This is a flow chart of the Siemens PLC remote connection of the present invention; Figure 3 This is the remote connection flow chart of Huichuan PLC of the present invention. DETAILED DESCRIPTION

[0026] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0027] The terms "first," "second," and so on, in the description and claims of the present invention and the accompanying drawings are used to distinguish between different items, not to describe a specific order. Furthermore, the terms "including," "having," and any variations thereof, are intended to cover non-exclusive inclusions. For example, a process, method, apparatus, product, or end comprising a series of steps or elements is not limited to the listed steps or elements but may optionally include steps or elements not listed therein, or may optionally include other steps or elements inherent to such process, method, product, or end.

[0028] References herein to "embodiments" mean that a particular feature, structure, or characteristic described in connection with the embodiments may be included in at least one embodiment of the present invention. The appearance of this phrase in various places in the specification does not necessarily refer to the same embodiment, nor does it constitute a separate or alternative embodiment that is mutually exclusive of other embodiments. It is understood, both explicitly and implicitly, by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0029] like Figure 1-Figure 3As shown, one embodiment of the present invention provides a remote management multi-brand system based on a Microsoft system host computer, including: The engineer station is installed with PLC editing software and an Onion client, which integrates a TAP virtual network card driver; The host computer of Microsoft operating system is deployed in the field network where the PLC is located. It is equipped with Onion Gateway, which is a user-mode packet forwarding program and does not require any underlying driver to be installed. Onion console, used by administrators to configure PLC device information and access permission policies for electrical engineers; The multi-brand remote management system based on the Microsoft system host computer realizes the remote authorized access of multi-brand PLCs without drivers of the Microsoft operating system host computer through user login, user-based policy pre-distribution mechanism, virtual network card interception technology and Tun2socks technology.

[0030] In this embodiment, the host computer of the Microsoft operating system completely removes the dependence on underlying drivers such as TAP / Npcap, and realizes communication through the user-mode packet forwarding program (based on the Socket interface), eliminating the hidden dangers of production accidents such as blue screen and crash of the Microsoft system. The console policy pre-distribution mechanism (including fields such as PLC brand / IP / DeviceID) realizes device-level authorization, and engineers can only access authorized devices. The virtual network card interception layer uniformly handles heterogeneous protocols such as Siemens DCP (Layer 2) and Inovance CodeSys (Layer 3), without the need for customized drivers.

[0031] In one embodiment, the onion client is configured to: Synchronize policy data from the console, wherein the user-based policy includes information about the PLCs to which the engineer is authorized; The broadcast discovery message sent by the PLC editing software is intercepted by the TAP virtual network card driver.

[0032] In this embodiment, the Onion client is configured to adopt a long connection notification + periodic pull strategy to ensure that engineers obtain the latest authorized device list in real time. The virtual network card intercepts broadcast requests to prevent the PLC editing software from detecting the actual network topology, eliminating the risk of unauthorized access from the protocol layer.

[0033] It should be noted that the TAP virtual network card driver operation realizes precise device simulation and dynamically generates reply packets containing only authorized PLC information (such as the IP / MAC address in the Siemens DCP response packet), allowing the PLC editing software to "see what you control". The virtual network card IP is bound to the PLC address (such as 192.168.5.10), redirecting the unicast communication of the PLC editing software to the local virtual interface, laying the foundation for subsequent P2P transparent transmission.

[0034] In one embodiment, the TAP virtual network card driver is configured as follows: Dynamically construct a simulation response packet based on the PLC information authorized in the policy, and the response packet only contains authorized device information; Set the IP address of the virtual network card to the IP address of the Onion gateway; The broadcast discovery message is not actually sent to the remote PLC network; In one embodiment, for the DCP protocol of Siemens PLC: The TAP virtual network card driver directly generates a reply message that complies with the DCP protocol format, including the PLC's IP and MAC addresses; The device list displayed by the PLC editing software only contains PLCs authorized by the policy.

[0035] In this embodiment, the Siemens DCP protocol is processed, and the TAP driver directly constructs a response packet (including IP / MAC address) that complies with the PN-DCP standard without actually broadcasting it to the PLC network. The PLC editing software displays a single authorized device (such as a welding robot PLC), eliminating the risk of misoperation caused by interference from multiple devices.

[0036] In one embodiment, for the CodeSys protocol of Inovance PLC: The Onion client forwards the UDP broadcast message received by the virtual network card to the Onion gateway; The onion gateway sends a unicast discovery message to the actual PLC and returns the response to the virtual network card.

[0037] In this embodiment, the Onion Gateway relays UDP broadcasts (port 1740) as unicast requests, resolving the incompatibility issue between the CodeSys protocol and the Layer 2 network. This allows for PLC access in an Internet environment (such as multinational factory maintenance) through the gateway, breaking through the LAN limitations of traditional solutions.

[0038] In one embodiment, when the PLC editing software connects to the PLC via the IP address: All TCP / UDP unicast communications are directed to the virtual network card; The Onion client forwards data to the user-mode packet forwarding program of the host computer of the Microsoft operating system through a P2P tunnel.

[0039] In one embodiment, the user-mode packet forwarding program: Runs in a driverless environment and communicates with PLC through a standard Socket interface; Forwards the instructions from the engineering station to the actual PLC and sends the response data back.

[0040] In this embodiment, the system runs completely in user mode to avoid operating system crashes (such as operating system blue screen, freeze, etc.) caused by kernel-mode drivers. The binary transparent transmission mechanism based on Socket ensures that PLC instructions (such as Siemens S7 protocol) reach the target device without tampering.

[0041] In one embodiment, the policy data includes the following fields: PLC name, brand, model, DeviceID, VendorID, IP address, and access permission identifier.

[0042] In this embodiment, the fine authorization dimension is: Field: DeviceID, the authorization function is to bind specific PLC hardware (to prevent device replacement); Field: AccessLevel, authorization role is the path selection method in the multi-transit server scenario; The VendorID field identifies the PLC brand (Siemens = 0x002A / Inovance = 0x0451), driving the virtual network card to generate a response according to the protocol.

[0043] In one embodiment, the policy synchronization mechanism includes: Real-time notification updates for long connections; Pull policy data regularly.

[0044] In this embodiment, persistent connection push ensures that changes to engineer permissions are synchronized instantly (e.g., they take effect within 1 second after an administrator disables access), and policies are periodically pulled and cached locally, so that the most recent authorization status is maintained even when the network is interrupted.

[0045] One embodiment of the present invention provides a multi-brand PLC remote management method, comprising the steps of: The administrator configures PLC information and engineer authorization policies on the console; The engineering station synchronizes the strategy and intercepts the broadcast request, generating a simulated response; Local mapping of PLC editing software and unicast communication is achieved through a virtual network card; The user-mode forwarding program completes the transparent transmission of on-site network and remote data.

[0046] In this embodiment, a standardized process is formed from policy configuration to instruction transmission to adapt to the remote maintenance needs of complex production lines such as automobiles, chemicals, and electronics.

[0047] The device embodiments described above are merely illustrative, wherein the modules described as separate components may or may not be physically separate, and the components shown as modules may or may not be physical modules, i.e., they may be located in one place or distributed across multiple network modules. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Those skilled in the art can understand and implement the present invention without inventive effort.

[0048] Through the detailed description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus the necessary general hardware platform, or of course, by means of hardware. Based on this understanding, the above technical solution, in essence, or the portion that contributes to the prior art, can be embodied in the form of a software product. The computer software product can be stored in a computer-readable storage medium, including a read-only memory (ROM), a random access memory (RAM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), a one-time programmable read-only memory (OTPROM), an electronically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, magnetic disk storage, magnetic tape storage, or any other computer-readable medium capable of carrying or storing data.

[0049] Finally, it should be noted that the Microsoft operating system host computer remote management of multi-brand PLC systems and management methods disclosed in the embodiments of the present invention are only preferred embodiments of the present invention, and are only used to illustrate the technical solutions of the present invention, rather than to limit them. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments can still be modified, or some of the technical features therein can be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. Remote management of multi-brand systems based on Microsoft system host computer, characterized by: include: The engineer station is installed with PLC editing software and an Onion client, which integrates a TAP virtual network card driver; The host computer of Microsoft operating system is deployed in the field network where the PLC is located. It is equipped with Onion Gateway, which is a user-mode packet forwarding program and does not require any underlying driver to be installed. Onion console, used by administrators to configure PLC device information and access permission policies for electrical engineers; The multi-brand remote management system based on the Microsoft system host computer realizes the remote authorized access of multi-brand PLCs without drivers of the Microsoft operating system host computer through user login, user-based policy pre-distribution mechanism, virtual network card interception technology and Tun2socks technology.

2. The multi-brand remote management system based on a Microsoft system host computer according to claim 1 is characterized in that: The Onion client has been logged in and configured to synchronize policy data from the console, and the user-based policy includes the PLC information that the logged-in engineer is authorized to use; The TAP virtual network card driver intercepts and constructs a reply packet to respond to the Layer 2 broadcast discovery message sent by the PLC editing software.

3. The multi-brand remote management system based on a Microsoft system host computer according to claim 2 is characterized in that: The TAP virtual network card driver is configured to: dynamically construct a reply packet for the broadcast discovery message based on the PLC brand and model information authorized in the policy, and the reply packet only contains the device information authorized by the user logging into Onion Head; set the IP address of the virtual network card to the IP address of the Onion Head gateway; the broadcast discovery message is not actually sent to the remote PLC network.

4. The multi-brand remote management system based on a Microsoft system host computer according to claim 3 is characterized in that: For Siemens PLC DCP protocol: The TAP virtual network card driver directly generates a reply message that complies with the DCP protocol format, including the PLC's IP address, MAC address, device name, device model, and vendor ID; The device list displayed by the PLC editing software only contains PLCs authorized by the policy.

5. The multi-brand remote management system based on a Microsoft system host computer according to claim 3 is characterized in that: For the CodeSys protocol of Inovance PLC: The Onion client forwards the UDP broadcast message received by the virtual network card to the Onion gateway through Tun2socks technology; The onion gateway sends a unicast discovery message to the actual PLC, and re-encapsulates the response message and returns it to the onion client virtual network card of the engineer station.

6. The multi-brand remote management system based on a Microsoft system host computer according to claim 1 is characterized in that: When the PLC editing software connects to the PLC via the IP address: All TCP / UDP unicast communications are directed to the Onion client's virtual network card; The Onion client forwards data to the Onion gateway on the host computer of the Microsoft operating system through a P2P tunnel.

7. The multi-brand remote management system based on a Microsoft system host computer according to claim 6 is characterized in that: The user-mode packet forwarding program: Runs in a driverless environment and communicates with PLC through a standard Socket interface; Forwards the instructions from the engineering station to the actual PLC and sends the response data back.

8. The multi-brand remote management system based on a Microsoft system host computer according to claim 2 is characterized in that: The policy data contains the following fields: PLC name, brand, model, DeviceID, VendorID, IP address, and access permission identifier.

9. The multi-brand remote management system based on a Microsoft system host computer according to claim 1, characterized in that: The policy synchronization mechanism includes: Real-time notification updates for long connections; Pull policy data regularly.

10. A management method for remotely managing a multi-brand system based on a Microsoft system host computer according to any one of claims 1 to 9, characterized in that: Including steps: The administrator configures PLC information and engineer authorization policies on the console; The engineer logs in to the Tor client on the engineer station to synchronize policies and intercept broadcast requests, generating simulated responses. Local mapping of unicast communication between PLC editing software and PLC devices is achieved through virtual network card and onion gateway; The user-mode forwarding program completes the transparent transmission of on-site network and remote data.

Images