Remote management of multi-brand system based on host computer of microsoft system and management method

Abstract

The application belongs to the technical field of industrial automation control, and particularly relates to a Microsoft operating system host computer remote management multi-brand PLC system and a management method, which comprises an engineer station, a PLC editing software and an onion head client are installed in the engineer station, the onion head client is integrated with a TAP virtual network card driver; a Microsoft operating system host computer, which is deployed in a field network where PLCs are located, is installed with a user state packet forwarding program, and does not need to be installed with any underlying driver program, and the program is referred to as an onion head gateway; an onion head console, which is used for administrator configuration of PLC device information and engineer access permission strategy; and the Microsoft system host computer remote management multi-brand system realizes the multi-brand PLC remote authorized access of the Microsoft operating system host computer without driver through a strategy pre-distribution mechanism, a virtual network card interception technology and a Tun2socks technology.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of industrial automation control, and particularly relates to a Microsoft operating system host computer remote management multi-brand PLC system and a management method. BACKGROUND

[0002] In the current industrial environment, PLC devices are widely distributed in factories around the world as the core of production line control. The traditional remote management scheme has the following defects:

[0003] 1. Driver dependency problem, multi-brand PLC (such as Siemens, HuiChuan) uses heterogeneous discovery protocol (two-layer DCP / three-layer CodeSys), which needs to install TAP / Npcap driver on the host computer of the Microsoft operating system to realize broadcast forwarding.

[0004] 2. Lack of permission control, the broadcast discovery mechanism allows engineers to access all PLCs in the local area network, and cannot realize device-level authorization, for example, the welding robot PLC and the detection PLC in the same automobile production line need to be isolated and authorized.

[0005] 3. Management conflict, multiple engineers simultaneously remotely operate a PLC, which may cause configuration errors and device damage.

[0006] 4. System stability challenge, installing drivers on the host computer of the Microsoft system affects the stability of the host computer. Driver compatibility failures may cause system crashes, blue screens, and affect production. SUMMARY

[0007] In order to overcome the deficiencies of the prior art, the application provides a Microsoft operating system host computer remote management multi-brand PLC system and a management method to solve the problem of multi-brand PLC authorized management.

[0008] One embodiment of the application provides a Microsoft system host computer remote management multi-brand system, which comprises:

[0009] An engineer station is installed with PLC editing software and an onion head client, and the onion head client integrates a TAP virtual network card driver;

[0010] A host computer of the Microsoft operating system is deployed in the field network where the PLC is located, and is installed with an onion head gateway, the onion head gateway is a user-mode packet forwarding program, and does not need to install any underlying driver;

[0011] An onion head console is used for administrator to configure PLC device information and electrical engineer access permission policy;

[0012] The remote management of multi-brand systems based on the host computer of the Microsoft system realizes the remote authorization access of the multi-brand PLC of the host computer of the Microsoft system without driving through the user login, the pre-distribution mechanism of the user-based strategy, the virtual network card interception technology and the Tun2socks technology.

[0013] In one embodiment, the onion head client is configured to:

[0014] The engineer logs in the onion head client, synchronizes the policy data from the console, and the user-based strategy contains the PLC information authorized by the engineer;

[0015] The TAP virtual network card driver intercepts the broadcast discovery message sent by the PLC editing software.

[0016] In one embodiment, the TAP virtual network card driver is configured to:

[0017] According to the authorized PLC information in the strategy, a simulated reply packet is dynamically constructed, and the reply packet only contains the authorized device information;

[0018] The IP address of the virtual network card is set to the IP address of the onion head gateway;

[0019] The broadcast discovery message is not actually sent to the remote PLC network.

[0020] In one embodiment, for the DCP protocol of the Siemens PLC:

[0021] The TAP virtual network card driver directly generates a reply message conforming to the DCP protocol format, containing the IP address, MAC address, device name, device model, vendor ID, etc. of the PLC;

[0022] The device list displayed by the PLC editing software only contains the PLC authorized by the strategy.

[0023] In one embodiment, for the CodeSys protocol of the Hictron PLC:

[0024] The onion head client forwards the UDP broadcast message received by the virtual network card to the onion head gateway;

[0025] The onion head gateway sends a unicast discovery message to the actual PLC and returns the response to the virtual network card.

[0026] In one embodiment, when the PLC editing software connects the PLC through the IP address:

[0027] All TCP / UDP unicast communications are directed to the virtual network card;

[0028] The onion head client forwards the data to the onion head gateway on the host computer through the P2P tunnel.

[0029] In one embodiment, the user mode packet forwarding program:

[0030] Running in a driverless environment, communicating with PLC through standard Socket interface;

[0031] Forwarding instructions from the engineer station to the actual PLC and returning response data.

[0032] In one embodiment, the policy data includes fields:

[0033] PLC name, brand, model, DeviceID, VendorID, IP address and access permission identification.

[0034] In one embodiment, the policy synchronization mechanism includes:

[0035] Long connection real-time notification update;

[0036] Periodic pull policy data.

[0037] Also including a multi-brand PLC remote management method of any of the above embodiments, comprising the steps of:

[0038] The administrator configures PLC information and engineer authorization policy on the console;

[0039] The engineer station synchronizes the policy and intercepts the broadcast request, and generates a simulated response;

[0040] The local mapping of PLC editing software and unicast communication is realized through a virtual network card;

[0041] The user mode forwarding program completes the transparent transmission of on-site network and remote data.

[0042] Compared with the prior art, the embodiments of the present application have the following beneficial effects:

[0043] 1. By deploying the TAP virtual network card driver only on the engineer station in the non-production environment, the upper computer side of the Microsoft operating system only runs the user mode forwarding program (based on standard Socket communication), and the upper computer does not install the driver, which can completely avoid the compatibility conflict between the driver and the Microsoft system.

[0044] 2. The virtual network card intercepts the broadcast request on the engineer station and directly constructs a return packet (such as a Siemens DCP protocol return packet or a HuiChuan CodeSys protocol relay), and the upper computer of the Microsoft operating system does not need to process the bottom layer protocol forwarding, which completely eliminates the production accidents caused by driver failure.

[0045] 3. The administrator configures the policy in the console (including PLC brand, IP address, DeviceID and other fields), only the authorized device information is issued to the engineer station, and the simulation reply packet generated by the virtual network card only contains the PLC list accessible by the engineer, realizing "what you see is what you control".

[0046] 4. The PLC information obtained by the PLC editing software through the virtual network card is the result of policy filtering, and other devices in the actual network cannot be detected, effectively preventing unauthorized scanning.

[0047] 5. The system analyzes the discovery protocols (such as DCP, CodeSys) of different brands of PLCs, realizes a unified interception and response mechanism at the virtual network card layer, and provides a framework foundation for future compatibility with emerging PLC brands.

[0048] 6. The engineer can connect the PLC through the IP address mapped by the virtual network card without going to the site, and the unicast communication is directly transmitted to the device through the P2P tunnel and the host computer forwarding program of the Microsoft operating system, greatly shortening the fault response cycle.

[0049] 7. Avoid system maintenance costs caused by driver installation, and reduce resource investment for physical access to the production line, providing a feasible path for cross-country multi-base collaborative management. BRIEF DESCRIPTION OF DRAWINGS

[0050] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiment or prior art description. Obviously, the drawings in the following description only some embodiments of the present application, and for those skilled in the art, other drawings can be obtained without creative labor on the basis of the structure shown in the drawings.

[0051] Fig. 1 The Siemens PLC conventional connection flowchart of the present application;

[0052] Fig. 2 The Siemens PLC remote connection flowchart of the present application;

[0053] Fig. 3 The Siemens PLC remote connection flowchart of the present application; DETAILED DESCRIPTION

[0054] In order to make the personnel in the technical field better understand the present application, the following will combine the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only some embodiments of the present application, not all. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0055] The terms "first", "second", etc. in the description, claims, and drawings of the present application, and the above, are used to distinguish different objects, and are not used to describe a particular order. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, device, product, or end including a series of steps or units is not limited to the listed steps or units, but can optionally include steps or units not listed, or can optionally include other steps or units inherent to the process, method, product, or end.

[0056] Reference herein to "an embodiment" means that a particular feature, structure, or characteristic described in connection with the embodiment can be included in at least one embodiment of the application. The appearance of the phrase in various places in the specification does not necessarily all refer to the same embodiment, nor is it necessarily mutually exclusive of other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0057] As Figs. 1-3 shown, one embodiment of the present application provides remote management of multi-brand systems based on a Microsoft host computer, including:

[0058] An engineer station is installed with PLC editing software and an onion head client, and the onion head client integrates a TAP virtual network card driver;

[0059] A Microsoft operating system host computer is deployed in a field network where the PLC is located, and is installed with an onion head gateway, which is a user-mode packet forwarding program and does not require installation of any underlying driver;

[0060] An onion head console is used to configure PLC device information and electrical engineer access permission policies;

[0061] The multi-brand PLC remote authorization access of the Microsoft operating system host computer without driver is realized through user login, a user-based policy pre-distribution mechanism, virtual network card interception technology, and Tun2socks technology.

[0062] In this embodiment, the Microsoft operating system host computer completely eliminates the dependence on underlying drivers such as TAP / Npcap, realizes communication through a user-mode packet forwarding program (based on a Socket interface), eliminates production accident hazards such as blue screen and crash of the Microsoft system, realizes device-level authorization through a console policy pre-distribution mechanism (including PLC brand / IP / DeviceID fields), enables engineers to only access authorized devices, and uniformly processes heterogeneous protocols such as Siemens DCP (Layer 2) and Hicrane CodeSys (Layer 3) through a virtual network card interception layer, without the need for customized drivers.

[0063] In one embodiment, the onion head client is configured to:

[0064] Synchronize policy data from the console, the user-based policy including PLC information that the engineer is authorized for;

[0065] Intercept broadcast discovery packets sent by the PLC editing software through a TAP virtual network card driver.

[0066] In this embodiment, the onion head client is configured to use long connection notification + regular policy pulling to ensure that the engineer obtains the latest authorized device list in real time, and the virtual network card intercepts broadcast requests to avoid detection of the actual network topology by the PLC editing software, thereby eliminating unauthorized access risks at the protocol layer.

[0067] It should be noted that the TAP virtual network card driver operation realizes precise device simulation and dynamically generates a response packet containing only authorized PLC information (such as IP / MAC addresses in a Siemens DCP response packet), so that the PLC editing software "sees what it controls", the virtual network card IP is bound to the PLC address (such as 192.168.5.10), and the unicast communication of the PLC editing software is redirected to the local virtual interface, laying a foundation for subsequent P2P transparent transmission.

[0068] In one embodiment, the TAP virtual network card driver is configured to:

[0069] Dynamically construct a simulated response packet according to the authorized PLC information in the policy, the response packet containing only authorized device information;

[0070] Set the IP address of the virtual network card to the IP address of the onion head gateway;

[0071] The broadcast discovery packet is not actually sent to the remote PLC network;

[0072] In one embodiment, for the DCP protocol of a Siemens PLC:

[0073] The TAP virtual network card driver directly generates a reply packet in accordance with the DCP protocol format, containing the IP and MAC addresses of the PLC;

[0074] The device list displayed by the PLC editing software contains only the PLCs authorized by the policy.

[0075] In this embodiment, for the Siemens DCP protocol processing, the TAP driver directly constructs a response packet (containing IP / MAC addresses) in accordance with the PN-DCP standard, without actually broadcasting to the PLC network, and the PLC editing software displays a single authorized device (such as a welding robot PLC), eliminating the risk of misoperation caused by multiple device interference.

[0076] In one embodiment, for the CodeSys protocol of HUISHUAN PLC:

[0077] The UDP broadcast message received by the virtual network card is forwarded to the onion head gateway by the onion head client;

[0078] The onion head gateway sends a unicast discovery message to the actual PLC and returns the response to the virtual network card.

[0079] In this embodiment, the onion head gateway relays the UDP broadcast (port 1740) to a unicast request, solves the incompatibility problem of the CodeSys protocol with the layer 2 network, and realizes PLC access in an Internet environment (such as cross-country factory maintenance) through the gateway, breaking through the limitation of the traditional scheme in a local area network.

[0080] In one embodiment, when the PLC editing software connects the PLC through the IP address:

[0081] All TCP / UDP unicast communications are directed to the virtual network card;

[0082] The onion head client forwards the data to the user-mode packet forwarding program of the host computer of the Microsoft operating system through the P2P tunnel.

[0083] In one embodiment, the user-mode packet forwarding program:

[0084] Runs in a driverless environment and communicates with the PLC through a standard Socket interface;

[0085] Forwards the instructions from the engineer station to the actual PLC and returns the response data.

[0086] In this embodiment, it runs completely in the user mode, avoids the operating system crash (such as blue screen of death, dead machine, etc.) caused by the kernel mode driver, and ensures that the PLC instructions (such as Siemens S7 protocol) are not tampered with and reach the target device based on the binary transparent transmission mechanism of the Socket.

[0087] In one embodiment, the policy data contains the following fields:

[0088] PLC name, brand, model, DeviceID, VendorID, IP address, and access permission identifier.

[0089] In this embodiment, the fine authorization dimension: field: DeviceID, and the authorization function is to bind specific PLC hardware (to prevent device replacement);

[0090] Field: AccessLevel, and the authorization function is a path selection method in the multi-transit server scenario;

[0091] The VendorID field identifies the PLC brand (Siemens = 0x002A / Chuangxin = 0x0451), and the driver virtual network card generates a response according to the protocol.

[0092] In one embodiment, the policy synchronization mechanism comprises:

[0093] Long connection real-time notification update;

[0094] Periodic pulling of policy data.

[0095] In this embodiment, the long connection push ensures that the project authority changes are synchronized in real time (for example, the administrator disables access within 1 second, and the effect is achieved), and the policy cache is pulled to the local at regular intervals, and the latest authorized state is maintained when the network is interrupted.

[0096] One embodiment of the application provides a multi-brand PLC remote management method, comprising the steps of:

[0097] The administrator configures PLC information and engineer authorization policy in the console;

[0098] The engineer station synchronizes the policy and intercepts the broadcast request, and generates a simulated response;

[0099] The local mapping of PLC editing software and unicast communication is realized through a virtual network card;

[0100] The user state forwarding program completes the transparent transmission of on-site network and remote data.

[0101] In this embodiment, a standardized process is formed from policy configuration to instruction transparent transmission, which meets the remote maintenance needs of complex production lines such as automobiles, chemicals and electronics.

[0102] The device embodiments described above are only schematic, wherein the modules illustrated as separate components can or can not be physically separated, and the components illustrated as modules can or can not be physical modules, i.e., they can be located in one place or distributed on multiple network modules. Part or all of the modules can be selected to achieve the purpose of the embodiment according to actual needs. Those skilled in the art can understand and implement it without creative labor.

[0103] Those skilled in the art can clearly understand the implementation of the various embodiments by means of software and necessary general hardware platforms through the above specific description of the embodiments, and of course, the embodiments can also be implemented by hardware. Based on such understanding, the above technical solutions, essentially or in the sense of contribution to the prior art, can be embodied in the form of a software product. The computer software product can be stored in a computer readable storage medium, which includes a Read-Only Memory (ROM), a Random Access Memory (RAM), a Programmable Read-only Memory (PROM), an Erasable Programmable Read Only Memory (EPROM), a One-time Programmable Read-Only Memory (OTPROM), an Electrically-Erasable Programmable Read-Only Memory (EEPROM), a Compact Disc Read-Only Memory (CD-ROM), or other optical disk storage, a magnetic disk storage, a magnetic tape storage, or any other medium that can be used to carry or store data in a computer readable manner.

[0104] Finally, it should be noted that: the disclosed microcomputer remote management of multi-brand PLC system and management method of Microsoft operating system in the embodiments of the present application are only the preferred embodiments of the present application, and are used to illustrate the technical solutions of the present application, but not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: the technical solutions recorded in the foregoing embodiments can still be modified, or some technical features can be replaced by equivalents; and these modifications or replacements do not make the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A remote management system for multi-brand systems based on a host computer on a Microsoft system, characterized in that, The application relates to a remote management system for multi-brand PLCs based on a Microsoft system upper computer. The system comprises an engineer station provided with PLC editing software and an onion head client, wherein the onion head client is integrated with a TAP virtual network card driver; The upper computer of the Microsoft system is arranged in a field network of the PLC and is provided with an onion head gateway, wherein the onion head gateway is a user state packet forwarding program, and the user state forwarding program realizes the transparent transmission of the field network and remote data; An onion head console is used for an administrator to configure PLC device information and electrical engineer access permission strategies; The application realizes the driverless remote authorization access of the multi-brand PLCs by the upper computer of the Microsoft system based on user login, a user-based strategy pre-distribution mechanism, a virtual network card interception technology and a Tun2socks technology; The onion head client has been logged in and configured to synchronize strategy data from the console, and the user-based strategy contains the authorized PLC information of the logged-in engineer; The TAP virtual network card driver intercepts and constructs a response packet to a layer 2 broadcast discovery message sent by the PLC editing software; The TAP virtual network card driver is configured to dynamically construct a response packet of the broadcast discovery message according to the authorized PLC brand and model information in the strategy, wherein the response packet only contains the authorized device information of the user logged in the onion head; the IP address of the virtual network card is set as the IP address of the onion head gateway; and the broadcast discovery message is not actually sent to the remote PLC network.

2. The remote management of multi-brand system based on the host computer of Microsoft system according to claim 1, characterized in that, For the DCP protocol of the Siemens PLC: The TAP virtual network card driver directly generates a reply message conforming to the DCP protocol format, which contains the IP address, MAC address, device name, device model and VendorID of the PLC; The device list displayed by the PLC editing software only contains the strategy-authorized PLCs.

3. The remote management of multi-brand system based on the host computer of Microsoft system according to claim 1, characterized in that, For the CodeSys protocol of the HuiChuan PLC: The onion head client forwards the UDP broadcast message received by the virtual network card to the onion head gateway through the Tun2socks technology; The onion head gateway sends a unicast discovery message to the actual PLC and returns the response message to the virtual network card of the onion head client of the engineer station after re-encapsulating the response message.

4. The remote management of multi-brand system based on the host computer of Microsoft system according to claim 1, characterized in that, When the PLC editing software connects the PLC through an IP address: All TCP / UDP unicast communications are directed to the virtual network card of the onion head client; The onion head client forwards the data to the onion head gateway of the upper computer of the Microsoft system through a P2P tunnel.

5. The remote management of multi-brand system based on the host computer of Microsoft system according to claim 4, characterized in that, The user state packet forwarding program: runs in a driverless environment, communicates with the PLC through a standard Socket interface, forwards the instructions from the engineer station to the actual PLC and returns the response data. The strategy data contains the following fields:

6. The remote management of multi-brand system based on the host computer of Microsoft system according to claim 1, characterized in that, PLC name, brand, model, DeviceID, VendorID, IP address and access permission identification. The strategy synchronization mechanism comprises:

7. The remote management of multi-brand system based on the host computer of Microsoft system according to claim 1, characterized in that, long connection real-time notification update and regular strategy data pulling. The method comprises the following steps: an administrator configures PLC information and engineer authorization strategies in the console; 8. A management method for remotely managing a multi-brand system based on a host computer of a Microsoft system according to any one of claims 1 to 7, characterized by, an engineer logs in the onion head client on the engineer station, the onion head client synchronizes strategies and intercepts broadcast requests and generates simulated responses. ​ ​ Local mapping of unicast communication between PLC editing software and PLC device is realized through virtual network card and onion head gateway; The user mode forwarding program completes the transparent transmission of on-site network and remote data.

Images