Method, device, equipment and medium for evaluating safety integrity level of oil and gas storage and transportation information physical system

Abstract

The invention discloses an oil and gas storage and transportation information physical system safety integrity grade evaluation method, device and equipment and a medium, and relates to the field of oil and gas storage and transportation, and the method comprises the steps: employing a Cyber-HAZOP identification method to construct a corresponding information physical risk guide word for an oil and gas station; according to the guide word, identifying a network threat and a risk of a physical process; taking the risk as a top event of a Cyber-Bow-tie model, and adopting a set Cyber-HAZOP-Bow-tie mapping rule to establish a risk cross-domain evolution model based on the Cyber-Bow-tie so as to construct a cross-domain causal chain; in combination with a set Cyber-Bow-tie-LOPA mapping rule, an information physics cross-domain risk quantitative evaluation model is established; and based on the quantitative evaluation model and in combination with the CVSS score, determining the safety integrity level of the oil and gas station. Therefore, the method can adapt to the characteristics of strong coupling and multi-dimensional risk propagation of information physics in an oil and gas storage and transportation system, achieves the comprehensive analysis of an information physics risk coupling path, and remarkably improves the reliability of safety integrity level evaluation of the information physics system.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of oil and gas storage and transportation, and in particular to an oil and gas storage and transportation information physical system safety integrity level evaluation method, device, equipment and medium. BACKGROUND

[0002] Industrial control system is the nerve center of oil and gas storage and transportation field, which is coupled by basic process control system, data acquisition and monitoring system and safety instrument system, etc., to form a multi-protection system covering perception layer, control layer and decision layer. The system needs to prevent physical entity damage, process parameter instability and network intrusion attacks and other multidimensional risks at the same time, and the high pressure flammable characteristics of oil and gas medium make the risk easy to conduct across domains through control signal anomaly, safety interlock failure and data protocol vulnerability, etc. The risk of information domain and control domain penetrates into the physical domain, becoming a major hidden danger of safety production.

[0003] The current risk including network security is coupled with traditional high-risk scenarios, making the prevention and control strategy with functional safety as the core face challenges, mainly due to strong coupling of information-physical structure, complex risk evolution, multi-domain data, various causes, and long cross-domain cascade propagation chain. The traditional way is to simplify the attack process by directed symbolic graph, which is difficult to describe the information-physical risk coupling, and the risk assessment simply adds the threat probability, and the safety integrity level evaluation simply combines the information and functional safety results, ignoring the complex coupling effect of network threats on functional safety. SUMMARY

[0004] The purpose of the present application is to provide an oil and gas storage and transportation information physical system safety integrity level evaluation method, device, equipment and medium, which can adapt to the characteristics of strong coupling of information and physics and multidimensional risk propagation in oil and gas storage and transportation system, realize information-physical risk coupling analysis, and improve reliability.

[0005] In order to solve the above technical problems, the present application provides an oil and gas storage and transportation information physical system safety integrity level evaluation method, comprising: The method of Cyber-HAZOP identification is used to construct the corresponding information-physical risk guide words for oil and gas stations; According to the information-physical risk guide words, the coupling relationship between information network threats and physical process risks is established through logic gates, and the risks of network threats and physical processes are identified according to the coupling relationship combined with the method of Cyber-HAZOP identification; The identified risks are used as top events of Cyber-Bow-tie model, and a Cyber-Bow-tie-based risk cross-domain evolution model is built by using the set Cyber-HAZOP-Bow-tie mapping rules to construct cross-domain causal chain; According to the cross-domain causal chain, a Cyber-LOPA information physical risk quantitative evaluation model is established by using a set Cyber-Bow-tie-LOPA mapping rule; Based on the Cyber-LOPA information physical risk quantitative evaluation model and in combination with a CVSS score, a safety integrity level of the oil and gas station is determined.

[0006] To solve the above technical problems, the present application further provides an oil and gas storage and transportation information physical system safety integrity level evaluation device, comprising: A guide word construction module is configured to construct corresponding information physical risk guide words for the oil and gas station by using a Cyber-HAZOP identification method. A coupling risk identification module is configured to establish a coupling relationship between information network threats and physical process risks by a logic gate according to the information physical risk guide words, and identify network threats and physical process risks according to the coupling relationship and the Cyber-HAZOP identification method. A causal chain construction module is configured to take the identified risks as top events of a Cyber-Bow-tie model, and build a Cyber-Bow-tie-based risk cross-domain evolution model by using a set Cyber-HAZOP-Bow-tie mapping rule, so as to construct a cross-domain causal chain. An evaluation model establishment module is configured to establish a Cyber-LOPA information physical risk quantitative evaluation model according to the cross-domain causal chain and by using a set Cyber-Bow-tie-LOPA mapping rule. A level determination module is configured to determine a safety integrity level of the oil and gas station based on the Cyber-LOPA information physical risk quantitative evaluation model and in combination with a CVSS score.

[0007] To solve the above technical problems, the present application further provides an electronic device, comprising: A memory is configured to store a computer program. A processor is configured to execute the computer program to implement the steps of the above oil and gas storage and transportation information physical system safety integrity level evaluation method.

[0008] To solve the above technical problems, the present application further provides a computer readable storage medium, wherein the computer readable storage medium stores a computer program, and the computer program is executed by a processor to implement the steps of the above oil and gas storage and transportation information physical system safety integrity level evaluation method.

[0009] From the above technical scheme can be seen, the oil and gas storage and transportation information physical system safety integrity level evaluation method provided by the application, including: using the method of Cyber-HAZOP identification to build the corresponding information physical risk guidance word for the oil and gas station;According to the information physical risk guidance word, the coupling relationship between information network threat and physical process risk is established through the logic gate, and according to the coupling relationship, the Cyber-HAZOP identification method is used to identify the network threat and the risk of physical process;The identified risk is used as the top event of Cyber-Bow-tie model, and the Cyber-Bow-tie risk cross-domain evolution model is built based on the set Cyber-HAZOP-Bow-tie mapping rule, to build the cross-domain causal chain;According to the cross-domain causal chain, the Cyber-Bow-tie-LOPA mapping rule is set up, and the Cyber-LOPA information physical risk quantitative evaluation model is established;Based on the Cyber-LOPA information physical risk quantitative evaluation model and combined with CVSS score, the safety integrity level of oil and gas station is determined.

[0010] The beneficial effects of the application are that the above-mentioned oil and gas storage and transportation information physical system safety integrity level evaluation method provided by the application realizes information and physical risk identification through information physical risk identification method, realizes cross-domain causal chain modeling by using the set Cyber-HAZOP-Bow-tie mapping method, and can accurately capture the essential characteristics of information physical strong coupling in oil and gas storage and transportation system;On the basis of cross-domain causal chain, the Cyber-LOPA information physical risk quantitative evaluation model is built through the set Cyber-Bow-tie-LOPA mapping rule, which effectively solves the complexity problem of multidimensional risk propagation, and realizes the comprehensive analysis of information physical risk coupling path. At the same time, combined with the quantitative analysis process of CVSS score, not only the risk source identification and event correlation analysis are more scientific, but also the dynamic process of network security vulnerability to physical security risk transmission is more clearly revealed, which deeply confirms the significant influence of network security problem on safety integrity level. In addition, the method builds cross-domain causal chain based on the actual system structure of oil and gas station, can identify the individualized risk points of different stations, provides more targeted risk control basis for the operator, helps the oil and gas station to build more accurate and comprehensive security protection system, significantly improves the reliability and practicality of information physical system safety integrity level evaluation, and builds a technical defense line for protecting the stable operation of oil and gas storage and transportation system.

[0011] In addition, the present application also provides an oil and gas storage and transportation information physical system safety integrity level evaluation device, an electronic device and a computer readable storage medium corresponding to the oil and gas storage and transportation information physical system safety integrity level evaluation method, which have the same or corresponding technical features as the above-mentioned oil and gas storage and transportation information physical system safety integrity level evaluation method, and the effects are the same as above. BRIEF DESCRIPTION OF DRAWINGS

[0012] In order to more clearly illustrate the embodiments of the present application, the drawings needed in the embodiments will be briefly introduced as follows. Obviously, the drawings described below are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor on the basis of these drawings.

[0013] Figure 1 The flowchart of the oil and gas storage and transportation information physical system safety integrity level evaluation method provided by the embodiments of the present application is shown in the figure. Figure 2 The structural schematic diagram of the oil and gas storage and transportation information physical system safety integrity level evaluation device provided by the embodiments of the present application is shown in the figure. DETAILED DESCRIPTION

[0014] Traditional emerging risks including network security and traditional oil and gas production high-risk scenes are coupled, and the safety prevention and control strategy with functional safety as the core is facing severe challenges. The main reason is that the information-physical structure is complex and strongly coupled, the risk evolution process is complex, the risk data is multi-domain, the risk cause is complex, the fault mode is diverse, the cross-domain cascade is long and the propagation chain is long. After using a specific vulnerability, network threats may cause unexpected security incidents. In order to promote the integration of information and physical security, risk assessment should cover various causes (safety hazards and network attacks) that lead to major risk scenes (fire, explosion, poisoning, etc.), and the role of safety barriers should be considered to identify more physical dangerous scenes and provide more detailed risk analysis. The current research usually simplifies the attack process by directed symbolic graph, which is difficult to describe the information-physical risk coupling. The information-physical system risk assessment cannot simply add the threat probability and the basic event probability, and similarly, the information-physical system safety integrity level cannot simply mix the information security integrity evaluation and the functional safety integrity evaluation result, because the network threat will still act on the functional safety integrity, and due to the information-physical interaction, its influence is complex and coupled. In order to solve the above problems, the present application provides an oil and gas storage and transportation information physical system safety integrity level evaluation method.

[0015] With reference to the accompanying drawings, the technical solutions in the embodiments of the present application will be described clearly and completely. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all the other embodiments obtained by a person of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0016] It should be noted that, in the description of the present application, the terms "comprise", "contain" or any other variants thereof are intended to cover non-exclusive inclusion, so that the process, method, article or equipment comprising a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such process, method, article or equipment. The terms "first", "second" and the like in the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence.

[0017] In order for those skilled in the art to better understand the technical solutions of the present application, the present application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0018] In combination with the specific application environment architecture or specific hardware architecture on which the oil and gas storage and transportation information physical system safety integrity level evaluation method depends for execution, the specific application environment architecture or specific hardware architecture is described here.

[0019] The embodiments of the present application provide an oil and gas storage and transportation information physical system safety integrity level evaluation method, which is described in detail in combination with the execution process of the oil and gas storage and transportation information physical system safety integrity level evaluation method. Figure 1 The flowchart of the oil and gas storage and transportation information physical system safety integrity level evaluation method provided by the embodiments of the present application is shown in Figure 1 The method comprises: S101, the method of Cyber-HAZOP identification is used to construct corresponding information physical risk guidance words for the oil and gas station.

[0020] It should be noted that the oil and gas station is a place responsible for key operations such as oil and gas storage, processing, boosting, metering, receiving and sending in the oil and gas industry chain, and is a node connecting oil and gas exploration and development, transportation, and sales. The oil and gas station can include stations in the upstream development link, stations in the midstream transportation link, and stations in the downstream storage and sales link. When step S101 is executed, for the oil and gas station (i.e., the target to be evaluated), the Cyber-HAZOP identification method can be used to construct the corresponding information-physical risk guidance word. The construction of this guidance word needs to be closely combined with the actual system characteristics of the oil and gas station to be evaluated, covering the core elements of its information network architecture (such as monitoring systems, data transmission networks, etc.) and physical process (such as oil and gas storage, transportation, and boosting links).

[0021] S102, according to the information-physical risk guidance word, the coupling relationship between the information network threat and the physical process risk is established through the logical gate, and the Cyber-HAZOP identification method is used to identify the network threat and the risk of the physical process according to the coupling relationship.

[0022] In implementation, after the construction of the information-physical risk guidance word is completed, the present application uses the information-physical risk guidance word as the core guide to carry out the identification of the coupling risk of the network threat and the physical process. The information-physical risk guidance word has previously clearly identified the key interaction points, core device association logic, and potential risk scenarios of the information layer and the physical layer of the station to be evaluated, providing accurate basis for risk identification.

[0023] S103, the identified risk is set as the top event of the Cyber-Bow-tie model, and a Cyber-Bow-tie-based risk cross-domain evolution model is built according to the set Cyber-HAZOP-Bow-tie mapping rule to construct a cross-domain causal chain.

[0024] In implementation, after the risk identification of the network threat and the physical process is completed, the present application can set these identified risks as the top event of the Cyber-Bow-tie model, i.e., the core risk event of the model analysis. Then, according to the pre-set Cyber-HAZOP-Bow-tie mapping rule, a Cyber-Bow-tie-based risk cross-domain evolution model is built to construct a cross-domain causal chain, realize the visualization and structured construction of the causal transmission chain of the risk between different fields, and help to clearly trace the source, development path, and potential impact of the risk.

[0025] S104, according to the cross-domain causal chain, a Cyber-Bow-tie-LOPA mapping rule is set to establish a Cyber-LOPA information-physical risk quantitative evaluation model.

[0026] In implementation, based on the constructed risk cross-domain causal chain, the present application uses the mapping rules of the preset Cyber-Bow-tie model and LOPA to associate the elements such as the cause of risk, protective measures and consequences with the quantitative analysis logic, and then establishes a Cyber-LOPA quantitative evaluation model specially for the information physical system, so as to realize the quantitative analysis of the risk occurrence possibility, the consequence severity and the effectiveness of the existing protective measures.

[0027] In S105, the safety integrity level of the oil and gas station is determined based on the Cyber-LOPA information physical risk quantitative evaluation model and in combination with the CVSS score.

[0028] In implementation, when determining the safety integrity level (SIL) of the oil and gas station, the present application quantitatively analyzes the risk through the Cyber-LOPA information physical risk quantitative evaluation model, and at the same time, standardizes the assessment of the severity of network vulnerabilities in combination with the CVSS (Common Vulnerability Scoring System) score. By integrating the risk transmission logic presented by the cross-domain causal chain, the risk quantitative results output by the quantitative evaluation model and the vulnerability risk level reflected by the CVSS score, a comprehensive evaluation basis is formed, and finally the safety integrity level of the oil and gas station is accurately determined.

[0029] In the above-mentioned safety integrity level evaluation method of the oil and gas storage and transportation information physical system provided by the embodiment of the present application, the information and physical risk identification is realized through the information physical risk identification method, the mapping method of the preset Cyber-HAZOP-Bow-tie is adopted, the cross-domain causal chain modeling is realized, and the essential characteristics of the information physical strong coupling in the oil and gas storage and transportation system can be accurately captured. On the basis of the cross-domain causal chain, the Cyber-LOPA information physical risk quantitative evaluation model is built through the preset Cyber-Bow-tie-LOPA mapping rule, the complexity problem of multi-dimensional risk propagation is effectively solved, and the comprehensive analysis of the information physical risk coupling path is realized. At the same time, in combination with the quantitative analysis process of the CVSS score, the risk source identification and the event correlation analysis are more scientific, and the dynamic process of the network security vulnerability to the physical security risk transmission is clearly revealed, which deeply confirms the significant influence of the network security problem on the safety integrity level. In addition, the cross-domain causal chain is constructed based on the actual system structure of the oil and gas station, the individualized risk points of different stations can be targetedly identified, more targeted risk control basis is provided for the operator, a more accurate and comprehensive safety protection system is constructed for the oil and gas station, and the reliability and practicability of the safety integrity level evaluation of the information physical system are significantly improved, which builds a technical defense line for protecting the stable operation of the oil and gas storage and transportation system.

[0030] It should be noted that firstly, since in the risk identification of information physical system, considering that the deviation is no longer only caused by process and equipment failure, but also possibly caused by network threat, the present application can be based on the combination of STRIDE model and HAZOP (Hazard and Operability Study), to construct the mapping from network threat to perception, execution and network parameter deviation, to more comprehensively analyze the potential causes of accidents or events under network threat, which can consider the risk space propagation factor, and detailedly analyze the process of attack bypassing security control logic, triggering conditional event, security protection layer being bypassed / failure, triggering accident. Secondly, in the establishment of cross-domain risk evolution calculation model, considering the risk coupling of information physical system, the present application proposes Cyber-Bowtie to extend the traditional Bowtie model, to construct the causal chain from initiating event (Initiating Event, IE) to consequence (Consequence), and to integrate network threat. The Cyber-Bowtie modeling theory is introduced to analyze the internal causal relationship between network threat and physical break-in, and to predict the possible impact. Then, the failure probability of protection layer and the network threat probability are allocated, the frequency level and risk level are calculated by using the extended LOPA method, and the results are compared with the acceptable risk probability to complete the SIL rating. Finally, the SIS safety integrity level requirement is verified and updated.

[0031] Further, in the specific implementation, in the oil and gas storage and transportation information physical system safety integrity level evaluation method provided by the embodiment of the present application, the method of Cyber-HAZOP identification is adopted in step S101 to construct the corresponding information physical risk guide words for the oil and gas station, which can specifically include: based on the combination of STRIDE model and Cyber-HAZOP identification method, the corresponding information physical risk guide words are constructed for the oil and gas station; the information physical risk guide words take multi-domain parameters as the carrier, including perception parameters, execution parameters, network parameters and corresponding deviations.

[0032] In practice, HAZOP analysis is a process to identify hazards and operability problems in detail, including identifying possible design intent deviations, analyzing possible causes of these deviations, and evaluating the consequences of these deviations. However, the deviations are no longer only derived from process and equipment failures, but also from network threats. The STRIDE model is a framework for threat modeling, which includes six security threats: Spoofing (S), Tampering (T), Repudiation (R), Information Disclosure (I), Denial of Service (D), and Elevation of Privilege (E). Among them, identity spoofing, information disclosure, and repudiation belong to the information layer part of the cross-domain attack chain, while tampering, denial of service, and privilege escalation introduce new deviations and cause factors for the process, which are difficult to guide risk identification under the original framework. Therefore, Cyber-HAZOP is proposed, which combines traditional HAZOP and STRIDE methods, extends the guide words, network threat mapping, and their meanings (Table 1), and identifies the risks of network threats coupled with physical processes.

[0033] Table 1 Cyber-HAZOP guide words, network threat mapping, and their meanings

[0034]

[0035] Based on the parameters and guide words, a Cyber-HAZOP analysis parameter and guide word matrix can be formed, including perception parameters, execution parameters, network parameters, and corresponding deviations, as shown in Table 2:

[0036] Table 2 Cyber-HAZOP analysis parameter and guide word matrix

[0037]

[0038] Cyber-HAZOP sets the set of cyber-physical system risk events as , and defines the risk coupling function as: ; (1) where represents the set of physical failures, including sensor abnormalities and actuator failures, with a probability of based on reliability data (such as failure probability PFD in IEC 61508). represents the set of network attacks, including protocol vulnerability exploitation and data tampering, with a probability of based on the exploitability in CVSS scoring. Each risk event may be caused by physical failure and network attacks together.

[0039] Further, in specific implementation, in the oil and gas storage and transportation information physical system security integrity level evaluation method provided by the embodiments of the present application, step S102 establishes the coupling relationship between the information network threat and the physical process risk according to the information physical risk guide word through the logic gate, and identifies the network threat and the risk of the physical process according to the coupling relationship in combination with the Cyber-HAZOP identification method. Specifically, it can include: using the information physical risk guide word, establishing the mapping relationship between the network threat and the sensing parameter, the execution parameter, the network parameter and the corresponding deviation through the logic gate, to obtain the coupling relationship between the information network threat and the physical process risk; according to the coupling relationship, the network threat and the risk of the physical process are identified in the manner of Cyber-HAZOP identification.

[0040] In implementation, the mapping relationship between the network threat and the sensing parameter, the execution parameter, the network parameter and the deviation is established through the information physical risk guide word to obtain the coupling relationship between the information network threat and the physical process risk, which converts the abstract network threat into the concrete risk association directly associated with the physical process parameter, and provides a clear analysis basis for risk identification. On this basis, in the manner of Cyber-HAZOP identification, through the structured risk review logic, the risk coupling path between the information layer and the physical layer (such as the interlocking failure caused by the tampering of the liquid level sensor) can be accurately captured. In this way, the omission of the network threat causing the physical risk is avoided, and the pertinence and comprehensiveness of the coupled risk identification are improved, which provides a more accurate and more suitable risk basis for the subsequent security integrity level evaluation for the information physical strong coupling characteristics of the oil and gas station.

[0041] Further, in specific implementation, in the oil and gas storage and transportation information physical system safety integrity level evaluation method provided by the embodiment of the application, step S103 takes the identified risk as a top event of a Cyber-Bow-tie model, adopts a set Cyber-HAZOP-Bow-tie mapping rule, builds a Cyber-Bow-tie-based risk cross-domain evolution model to construct a cross-domain causal chain, and specifically can include: taking a key deviation in the identified risk as a top event of the Cyber-Bow-tie model; wherein a root of the key deviation is taken as a threat on one side of the Cyber-Bow-tie model, and an impact generated by Cyber-HAZOP analysis is mapped to a consequence on the other side of the Cyber-Bow-tie model; network security risk sources and physical security risk sources are identified, and the identified network security risk sources and physical security risk sources are mapped to initiating events; network events, physical events, and mutual relations between the network events and the physical events are divided into conflict, conditional dependence, superposition, and mutual independence by using the Cyber-Bow-tie model to describe the associativity of information physical events, a cross-domain causal chain from the initiating events to the consequences is constructed based on a tree model and logic language, and network threat elements are integrated.

[0042] In implementation, after HAZOP analysis, cross-domain risk coverage is verified by a Bow-tie model, which can make up for the blind spot of the traditional HAZOP method, and the importance of safety protection layers (safety barriers) in accident scene evolution and risk quantitative evaluation is considered in the Bow-tie and LOPA methods. Therefore, the Cyber-Bow-tie and Cyber-LOPA models are proposed to analyze physical defense breaking internal causality and quantification. Specifically, a key deviation (such as “high liquid level”) identified by Cyber-HAZOP is directly taken as a top event of the Bow-tie model, a root of the HAZOP deviation (such as “sensor failure”, “operation error”, and “data tampering”) is taken as a threat on the left side of the Bow-tie, and a final impact (such as “tank overflow to fire”) of the HAZOP analysis is mapped to a consequence on the right side of the Bow-tie.

[0043] After identifying and describing network security and physical security risk sources, the Cyber-Bow-tie expands the traditional Bow-tie model to construct a causal chain from the initiating events to the consequences and integrate network threats. Let a set of initiating events be , the occurrence probability of the initiating event is: ; (2) wherein the initiating event includes a physical failure and a network attack . A set of protection measures is such as redundancy design, intrusion detection system. Coupling of information and physical failures, Cyber-Bow-tie model is proposed to consider the correlation and dependency of information and physical events, which divides the network events, physical events and their interrelations into four types: conflict, conditional dependency, superposition and mutual independence, and describes them by a tree-based logic language.

[0044] The conflict means that if two events A, B are antagonistic or conflicting with respect to event C, one of which occurs due to the occurrence of C, and the other occurs when C does not occur, then A and B are in conflict. In the tree-based model, A and B have a shared child node C, which is connected to A or B through a NOT gate, and the occurrence (non-occurrence) of C will directly trigger A or B. The definition is as follows formula (3): ; (3) wherein, represents the output probability of the mth AND gate, represents the probability of the kth input event, and N is the total number of input events.

[0045] The conditional dependency means that if event B is conditionally dependent on event A, then event B can not occur only when event A does not occur, and the occurrence of A means the occurrence of B. In the tree-based model, B is set as the top event and A is set as the leaf, and each set containing A must be a cut set of B.

[0046] The superposition means that if events A and B lead to a common consequence, then events A and B are considered to superimpose on each other. In the tree-based model, events A and B will appear in the same cut set. Superposition usually occurs due to AND gate, in which A and B are directly or indirectly connected to the same AND gate. The definition is as follows formula (4): ; (4) wherein, represents the output probability of the mth AND gate, represents the probability of the kth input event, and N is the total number of input events.

[0047] The mutual independence means that if events A and B are mutually independent, and the occurrence of any one event will lead to a common consequence. In the tree-based model, events A and B will appear in different cut sets. Superposition usually occurs due to OR gate, in which A and B are directly or indirectly connected to the same OR gate. The definition is as follows formula (5): ; (5) wherein, an output probability representing the mth OR gate, a probability representing the kth input event, and N is the total number of input events.

[0048] Further, in specific implementation, in the oil and gas storage and transportation information physical system safety integrity level evaluation method provided by the embodiment of the application, the step S104 establishes the Cyber-LOPA information physical risk quantitative evaluation model according to the cross-domain causal chain and by using the set Cyber-Bow-tie-LOPA mapping rule, and specifically can include: according to the cross-domain causal chain, classifying the risk prevention and control measures of the Cyber-HAZOP into prevention measures for the conduction path of the threat to the top event and mitigation measures for the evolution link of the top event to the consequence; integrating the quantitative information of the Cyber-LOPA into the Bow-tie model; establishing the mapping rule from the deviation, threat, consequence and measure identified by the Cyber-HAZOP, to the quantitative information of the Cyber-LOPA, and to the Cyber-Bow-tie element; and establishing the Cyber-LOPA information physical risk quantitative evaluation model by using the established mapping rule.

[0049] In implementation, the measures proposed by the HAZOP are divided into two categories: prevention measures (to prevent the threat from reaching the top event) and mitigation measures (to reduce the loss from the top event to the consequence), and the LOPA information is integrated into the model, the mapping rule from the Cyber-HAZOP, Cyber-LOPA information to Cyber-Bow-tie element is formulated, and finally the Cyber-LOPA information physical risk quantitative evaluation model is established. In this way, by integrating the Cyber-HAZOP, Cyber-LOPA and Cyber-Bow-tie model, the blind area of the traditional HAZOP in cross-domain risk coverage is effectively made up, the structured presentation of the threat, consequence and protective measures by the Bow-tie and the quantitative analysis capability of the LOPA are combined, the correlation between the causal relationship and the safety barrier in the physical break-in scene is clearly established, the systematic closed loop from risk identification, causal analysis to quantitative evaluation is realized, not only the comprehensiveness and accuracy of risk analysis are improved, but also the controllability of the physical break-in risk is strengthened, and a more scientific decision basis for risk control is provided.

[0050] Further, in specific implementation, in the oil and gas storage and transportation information physical system safety integrity level evaluation method provided by the embodiment of the application, the step S105 determines the safety integrity level of the oil and gas station based on the Cyber-LOPA information physical risk quantitative evaluation model and in combination with the CVSS score, and specifically can include: obtaining the device vulnerability availability by using the CVSS score, mapping the device vulnerability availability to the correlation level, and determining the level of the device vulnerability availability; calculating the risk probability of each accident consequence based on the Cyber-LOPA information physical risk quantitative evaluation model; calculating the risk reduction factor (Risk Reduction Factor, RRF) according to the ratio between the calculated risk probability of each accident consequence and the scene consequence acceptable risk value; judging whether the safety instrumented function loop (Safety Instrumented Function Loop, SIF) of the oil and gas station needs to be increased according to the risk reduction factor; and if yes, determining the safety integrity level required by the safety instrumented function loop.

[0051] In implementation, network security and physical security events are essentially different, the possibility of a physical security event is usually determined by the probability of a hazard source appearing and the frequency of a fault occurring, and the possibility of a network threat event is jointly determined based on the vulnerability availability of a device in an industrial scene and the frequency of an attack exploiting the vulnerability. Therefore, the possibility of a network security event needs to be calculated including the rating of an attack scenario, and the vulnerability availability can be evaluated using CVSS, as shown in equation (6): ; (6) wherein, represents the vulnerability availability, AV represents the attack vector, AC represents the attack complexity, and AU represents the authentication. The availability severity level can be determined by mapping the vulnerability availability to its correlation level.

[0052] However, part of the network threats penetrate into the physical domain through the control system, which inevitably affects the evaluation of the safety integrity level. Therefore, according to the risk probability calculation formula of LOPA, in combination with network threat calculation, a Cyber-LOPA calculation method is formed, the information physical risk top event probability calculation can be rewritten as equation (7) by considering the risk evolution mechanism and the role of safety barriers in accidents: ; (7) wherein, is the top event occurrence frequency of a hazard scene; is the occurrence frequency of the i th initial event; is the occurrence frequency of the j th vulnerability availability; is the enabling condition probability of the i th initial event or the j th vulnerability; Failure probability of the nth prevention class protection layer for the i th initial event or the j th vulnerability.

[0053] Consequence occurrence probability is: ; (8) Wherein, is the frequency of the m th consequence occurrence; is the probability of the k th conditional modifier of the m th consequence occurrence; Failure probability of the nth prevention class protection layer for the i th initial event or the j th vulnerability.

[0054] After calculating the risk probability of each accident consequence, compare with the acceptable risk value of the consequence, evaluate the gap between the existing scene consequence risk and the acceptable risk. Calculate the required risk reduction factor RRF through formula (9), judge whether the scene risk meets the requirement of acceptable risk, whether the safety instrumented function (SIF) loop needs to be added and the required safety integrity level of the loop.

[0055] ; (9) Wherein, is the risk reduction factor; is the acceptable frequency of scene consequence risk.

[0056] Further, in specific implementation, in the oil and gas storage and transportation information physical system safety integrity level evaluation method provided by the embodiment of the present application, after determining the safety integrity level of the safety instrumented function loop, the method can further include: calculating the element subsystem average failure probability sum of the safety instrumented function loop according to the sum of the average failure probability required by the sensor unit, the average failure probability required by the logic controller unit and the average failure probability required by the actuator unit; verifying and updating the safety integrity level of the safety instrumented function loop according to the element subsystem average failure probability sum of the safety instrumented function loop.

[0057] In implementation, after determining the safety integrity level of the SIF loop, the safety integrity level of the loop with safety integrity level 1 and above needs to be verified, the SIF loop is usually composed of sensors (Sensors), logic solvers (Logic Solver) and final elements (Final Elements), the element subsystem average failure probability sum of the SIF loop is calculated through formula (10), the safety integrity level of the SIF loop is evaluated to see whether it can meet the required requirement, if not, the safety integrity level needs to be improved through modifying the safety instrumented system (SIS) structure, shortening the inspection period or improving the hardware reliability and other ways.

[0058] (10) wherein, is the average probability of failure on demand for the SIF circuit; is the average probability of failure on demand for the sensor unit; is the average probability of failure on demand for the logic controller unit; is the average probability of failure on demand for the actuator unit.

[0059] The method for verifying the safety integrity level includes a reliability block diagram method, a fault tree analysis method and a Markov model method. The fault tree analysis decomposes all paths of failure of the SIF circuit in a graphical manner according to the principle of Boolean logic, and can accurately calculate the failure probability of the circuit. Equation (11) is a calculation method of the average failure probability of the fault tree of the 1oo1 structure.

[0060] (11) wherein, is the dangerous failure rate; is the average failure recovery time; is the detection coverage rate; is the detection period; is the effective life; is the undetected dangerous failure rate.

[0061] It should be noted that the present application proposes a Cyber-HAZOP method, identifies the information-physical bilateral risk through the mapping of guide words, deviations and network threats, and maps the deviations to the proposed Cyber-Bowtie model, realizes the internal causal analysis of network threats and physical defense breaking, proposes a comprehensive evaluation framework based on the extended Bowtie and LOPA method, and integrates random faults, network attacks and their coupling effects into the safety barrier integrity level analysis, realizes the quantitative calculation of the random failure rate, the network attack vulnerability rate and the information-physical risk coupling relationship by combining reliability data and vulnerability library, improves the accuracy of the evaluation, and reveals the significant influence of the network security problem on the safety integrity level.

[0062] Through the description of the above embodiments, those skilled in the art can clearly understand that the method according to the above embodiments can be realized by means of software and the necessary general hardware platform, of course, it can also be realized by hardware, but in many cases, the former is a better embodiment.

[0063] The embodiment of the present application also provides an oil and gas storage and transportation information physical system safety integrity level evaluation device. Figure 2A structural schematic diagram of an oil and gas storage and transportation cyber-physical system safety integrity level evaluation device provided by an embodiment of the present application is shown in the figure. The embodiment is based on the angle of functional modules, as shown in the figure, and the device comprises: Figure 2 a guide word construction module 10 configured to construct corresponding information-physical risk guide words for an oil and gas station by using a Cyber-HAZOP identification method; a coupling risk identification module 11 configured to establish a coupling relationship between information network threats and physical process risks by using a logic gate according to the information-physical risk guide words, and identify the network threats and the physical process risks according to the coupling relationship and the Cyber-HAZOP identification method; a cause-and-effect chain construction module 12 configured to take the identified risks as top events of a Cyber-Bow-tie model, use a set Cyber-HAZOP-Bow-tie mapping rule to build a Cyber-Bow-tie-based risk cross-domain evolution model, and construct a cross-domain cause-and-effect chain; an evaluation model establishment module 13 configured to use a set Cyber-Bow-tie-LOPA mapping rule to establish a Cyber-LOPA information-physical risk quantitative evaluation model according to the cross-domain cause-and-effect chain; a level determination module 14 configured to determine the safety integrity level of the oil and gas station based on the Cyber-LOPA information-physical risk quantitative evaluation model and in combination with a CVSS score.

[0064] In the above-mentioned oil and gas storage and transportation cyber-physical system safety integrity level evaluation device provided by the embodiment of the present application, the essence characteristics of the information-physical strong coupling in the oil and gas storage and transportation system can be accurately captured through the interaction of the above-mentioned four modules, the complexity problem of multi-dimensional risk propagation can be effectively solved, the information-physical risk coupling path can be comprehensively analyzed, the risk source identification and event correlation analysis are more scientific, the dynamic process of the network security vulnerability to the physical security risk transmission is more clearly revealed, the significant influence of the network security problem on the safety integrity level is deeply verified, and the personalized risk points of different stations can be identified in a targeted manner, which provides a more targeted risk control basis for the operator, helps the oil and gas station to build a more accurate and comprehensive security protection system, significantly improves the reliability and practicality of the cyber-physical system safety integrity level evaluation, and builds a technical defense line for protecting the stable operation of the oil and gas storage and transportation system.

[0065] ​Since the embodiments of the oil and gas storage and transportation information physical system safety integrity level evaluation device part correspond to the embodiments of the oil and gas storage and transportation information physical system safety integrity level evaluation method part, the description of the features in the embodiments of the oil and gas storage and transportation information physical system safety integrity level evaluation device corresponding to the embodiments of the oil and gas storage and transportation information physical system safety integrity level evaluation method can be referred to the related description of the embodiments of the oil and gas storage and transportation information physical system safety integrity level evaluation method, which will not be repeated here. And has the same beneficial effects as the above-mentioned oil and gas storage and transportation information physical system safety integrity level evaluation method.

[0066] The embodiments of the present application also provide an electronic device, comprising a memory and a processor, the memory stores a computer program, and the processor is configured to run the computer program to perform the steps in any of the above-mentioned embodiments of the oil and gas storage and transportation information physical system safety integrity level evaluation method.

[0067] The embodiments of the present application also provide a computer readable storage medium, which stores a computer program, wherein the computer program is configured to perform the steps in any of the above-mentioned embodiments of the oil and gas storage and transportation information physical system safety integrity level evaluation method when running.

[0068] In an exemplary embodiment, the above-mentioned computer readable storage medium can include but is not limited to: a U disk, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk, and various media that can store computer programs.

[0069] The embodiments of the present application also provide a computer program product, which comprises a computer program, and the computer program is executed by a processor to realize the steps in any of the above-mentioned embodiments of the oil and gas storage and transportation information physical system safety integrity level evaluation method.

[0070] The embodiments of the present application also provide another computer program product, which comprises a non-volatile computer readable storage medium, and the non-volatile computer readable storage medium stores a computer program, and the computer program is executed by a processor to realize the steps in any of the above-mentioned embodiments of the oil and gas storage and transportation information physical system safety integrity level evaluation method.

[0071] Those skilled in the art will further realize that the mere concepts, teachings, and embodiments described herein are merely meant to provide an enabling description of the claimed invention and are not intended to limit the scope of the claimed invention to these embodiments. Accordingly, modifications and variations of the concepts, teachings, and embodiments described herein are considered to fall within the scope of the claimed invention, which is defined by the appended claims.

[0072] The oil and gas storage and transportation information physical system safety integrity level evaluation method, device, equipment and medium provided by the application are described in detail above. The principles and implementation modes of the application are described by applying specific examples in this paper. The above description of the embodiments is only applicable to help understand the method of the application and its core idea. It should be pointed out that for ordinary skilled in the art, without departing from the principles of the application, the application can be improved and modified in several ways, and these improvements and modifications also fall within the protection scope of the application.

Claims

1. An oil and gas storage and transportation cyber-physical system safety integrity level assessment method, characterized in that, The method comprises the following steps: Cyber-HAZOP identification method is used to build corresponding information physical risk guide words for oil and gas stations; According to the information physical risk guide words, the coupling relationship between information network threats and physical process risks is established through logical gates, and the Cyber-HAZOP identification method is used to identify network threats and physical process risks according to the coupling relationship; The identified risks are taken as top events of a Cyber-Bow-tie model, and a Cyber-Bow-tie-based risk cross-domain evolution model is built by using a set of Cyber-HAZOP-Bow-tie mapping rules, so as to build a cross-domain causal chain; According to the cross-domain causal chain, a Cyber-LOPA information physical risk quantitative evaluation model is established by using a set of Cyber-Bow-tie-LOPA mapping rules; Based on the Cyber-LOPA information physical risk quantitative evaluation model and in combination with CVSS scores, the safety integrity level of the oil and gas station is determined.

2. The method for oil and gas storage and transportation cyber-physical system safety integrity level assessment according to claim 1, characterized in that, The method comprises the following steps: Based on the combination of STRIDE model and Cyber-HAZOP identification method, corresponding information physical risk guide words are built for oil and gas stations; the information physical risk guide words take multi-domain parameters as carriers, including perception parameters, execution parameters, network parameters and corresponding deviations.

3. The method for safety integrity level assessment of oil and gas storage and transportation cyber physical system according to claim 2, characterized in that, According to the information physical risk guide words, the coupling relationship between information network threats and physical process risks is established through logical gates, and the Cyber-HAZOP identification method is used to identify network threats and physical process risks according to the coupling relationship, which comprises the following steps: Using the information physical risk guide words, the mapping relationship between network threats and perception parameters, execution parameters, network parameters and corresponding deviations is established through logical gates, so as to obtain the coupling relationship between information network threats and physical process risks; According to the coupling relationship, the Cyber-HAZOP identification method is used to identify network threats and physical process risks.

4. The method for oil and gas storage and transportation cyber-physical system safety integrity level assessment according to claim 1, characterized in that, The identified risks are taken as top events of a Cyber-Bow-tie model, and a Cyber-Bow-tie-based risk cross-domain evolution model is built by using a set of Cyber-HAZOP-Bow-tie mapping rules, so as to build a cross-domain causal chain, which comprises the following steps: The key deviation in the identified risks is taken as a top event of a Cyber-Bow-tie model; wherein the root cause of the key deviation is taken as a threat on one side of the Cyber-Bow-tie model, and the impact generated by Cyber-HAZOP analysis is mapped to a consequence on the other side of the Cyber-Bow-tie model; Network security risk sources and physical security risk sources are identified, and the identified network security risk sources and physical security risk sources are mapped to start events; The Cyber-Bow-tie model is used to divide network events, physical events and the interrelation between network events and physical events into conflict, conditional dependence, superposition and mutual independence to describe the correlation of information physical events, a cross-domain causal chain from the start event to the consequence is constructed based on a tree model-based logic language, and network threat elements are integrated.

5. The method for oil and gas storage and transportation cyber-physical system safety integrity level assessment according to claim 1, characterized in that, According to the cross-domain causal chain, a Cyber-LOPA information physical risk quantitative evaluation model is established by using a set Cyber-Bow-tie-LOPA mapping rule, including: According to the cross-domain causal chain, the risk prevention and control measures of Cyber-HAZOP are classified into preventive measures for the conduction path of the threat to the top event and mitigation measures for the evolution link of the top event to the consequence; Quantitative information of Cyber-LOPA is integrated into the Bow-tie model; A mapping rule is established from the deviations, threats, consequences and measures identified by Cyber-HAZOP to the quantitative information of Cyber-LOPA and then to the Cyber-Bow-tie elements; The Cyber-LOPA information physical risk quantitative evaluation model is established by using the established mapping rule.

6. The method for oil and gas storage and transportation cyber-physical system safety integrity level assessment according to claim 1, characterized in that, Based on the Cyber-LOPA information physical risk quantitative evaluation model and in combination with the CVSS score, the safety integrity level of the oil and gas station is determined, including: The device vulnerability availability is obtained by using the CVSS score, the device vulnerability availability is mapped to a correlation level, and the level of the device vulnerability availability is determined; Based on the Cyber-LOPA information physical risk quantitative evaluation model, the risk probability of each accident consequence is calculated; According to the ratio between the calculated risk probability of each accident consequence and the acceptable risk value of the scene consequence, a risk reduction factor is calculated; According to the risk reduction factor, it is judged whether the safety instrument function loop of the oil and gas station needs to be increased, and if so, the required safety integrity level of the safety instrument function loop is determined.

7. The method for safety integrity level assessment of oil and gas storage and transportation cyber physical system according to claim 6, characterized in that, After determining the safety integrity level of the safety instrument function loop, further including: According to the sum of the average failure probability required by the sensor unit, the average failure probability required by the logic controller unit and the average failure probability required by the actuator unit, the total average failure probability of the element subsystem of the safety instrument function loop is calculated; According to the total average failure probability of the element subsystem of the safety instrument function loop, the safety integrity level of the safety instrument function loop is verified and updated.

8. An oil and gas storage and transportation cyber-physical system safety integrity level assessment apparatus, characterized by, Including: A guidance word construction module is configured to construct corresponding information physical risk guidance words for the oil and gas station by using the method of Cyber-HAZOP identification; A coupling risk identification module is configured to establish a coupling relationship between information network threats and physical process risks by using a logic gate according to the information physical risk guidance words, and identify the network threats and the physical process risks according to the coupling relationship and the method of Cyber-HAZOP identification. A cause-and-effect chain construction module is configured to identify the risk as a top event of a Cyber-Bow-tie model, adopt a set Cyber-HAZOP-Bow-tie mapping rule, build a Cyber-Bow-tie-based risk cross-domain evolution model, and construct a cross-domain cause-and-effect chain; An evaluation model establishment module is configured to adopt a set Cyber-Bow-tie-LOPA mapping rule, establish a Cyber-LOPA information-physical risk quantitative evaluation model according to the cross-domain cause-and-effect chain, and determine the safety integrity level of the oil and gas station. The method comprises the following steps:

9. An electronic device, comprising: A memory is configured to store a computer program; A processor is configured to execute the computer program to implement the steps of the safety integrity level evaluation method of the oil and gas storage and transportation information-physical system according to any one of claims 1 to 7. The computer readable storage medium stores a computer program, and the computer program is executed by the processor to implement the steps of the safety integrity level evaluation method of the oil and gas storage and transportation information-physical system according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, ​

Images