Hierarchical safety analysis method and device for interlocking system

Abstract

The embodiment of the invention provides a hierarchical safety analysis method and device for an interlocking system. The method comprises the following steps: obtaining function requirements of functions of the interlocking system, and performing function fault mode analysis on the functions based on the function requirements; obtaining a data stream associated with the function, and performing data stream penetration fault mode analysis on the data stream associated with the function in combination with a function fault mode analysis result; obtaining an operation scene of the function application, and performing operation scene fault mode analysis on the operation scene of the function application in combination with the data stream penetration fault mode analysis result; obtaining potential boundary factors of the interlocking system, and performing boundary factor fault mode analysis on the potential boundary factors of the interlocking system in combination with an operation scene fault mode analysis result; and generating a safety demand of the function according to the analysis result. In this way, analysis difficulty can be reduced and analysis depth can be improved based on stratified analysis.

Description

Technical Field

[0001] This disclosure relates to the field of rail transit technology, and in particular to a layered safety analysis method and apparatus for interlocking systems. Background Technology

[0002] The Computer Interlocking (CI) system is the core system for implementing the main logic control functions of the Communication Based Train Control System (CBTC). It receives control commands from the Automatic Train Supervision (ATS), collects peripheral device status information, and, after rigorous logical calculations, performs safety protection functions such as power-on unlocking, route processing, route unlocking, signal control, turnout control, and section control. It drives peripheral devices such as turnouts and sends data stream information to the Zone Controller (ZC) to achieve safe, reliable, and efficient operation of CBTC-level trains. When communication between the CI and ZC is lost, and CBTC operation cannot be maintained, the CI can safely control the on / off state of signals to ensure the normal operation of the line. The relationship between the CI and other systems can be described as follows: Figure 1 As shown.

[0003] Currently, security analysis in CI typically employs Failure Mode, Effects and Criticality Analysis (FMECA). Specifically, this involves drawing a functional block diagram based on functional requirements; then, based on the functional block diagram, establishing a list of failure modes, analyzing the causes of each failure mode, and the potential severity of each failure mode's consequences; finally, proposing design improvement measures and mitigation measures, and analyzing residual risks. However, this method has the following drawbacks: Given that this method requires integration with functionality, interfaces, and scenarios, the analysis must consider multiple factors from the outset, posing a significant challenge to analysts. If analysts are unfamiliar with the functionality or overlook application scenarios, the analysis may result in missing failure modes or insufficient depth of analysis. Summary of the Invention

[0004] In a first aspect, embodiments of this disclosure provide a layered security analysis method for interlocking systems, the method comprising:

[0005] Obtain the functional requirements of the interlocking system, and perform functional failure mode analysis on the functions based on the functional requirements;

[0006] Acquire the data stream associated with the function, and combine it with the results of the function failure mode analysis to perform data stream flow failure mode analysis on the data stream associated with the function;

[0007] Obtain the operational scenarios of functional applications, and combine the data flow through the failure mode analysis results to conduct operational scenario failure mode analysis on the operational scenarios of functional applications.

[0008] Obtain potential boundary factors of the interlocking system, and combine the failure mode analysis results of the operation scenario to conduct boundary factor failure mode analysis on the potential boundary factors of the interlocking system;

[0009] Based on the results of functional failure mode analysis, data flow failure mode analysis, operational scenario failure mode analysis, and boundary factor failure mode analysis, safety requirements for the functions are generated.

[0010] Among the possible implementations of the first aspect, functional failure mode analysis is performed on the function based on functional requirements, including:

[0011] Based on functional requirements, the logical processing steps of the function are sorted out using functional block diagrams or mind maps. The sorted logical processing steps are then divided into sub-functions, and the logical processing steps corresponding to each sub-function are determined. Fault mode analysis is then performed using the FMECA method on each sub-function's corresponding logical processing steps as a whole.

[0012] In some feasible implementations of the first aspect, data flow through-failure mode analysis is performed on the functionally related data flow, based on the results of functional failure mode analysis, including:

[0013] Based on the results of functional failure mode analysis, the function is treated as a black box. Starting from the beginning of the data flow associated with the function and ending at the end of the data flow associated with the function, along the data flow path, the behavior of each data flow node under various potential abnormal conditions is identified based on the feature information of each data flow node under its corresponding input dimension, processing dimension, and output dimension. The failure modes of each data flow node are then analyzed accordingly.

[0014] Among the feasible approaches in the first aspect, operational scenario failure mode analysis is conducted by combining the results of data flow-through failure mode analysis, including:

[0015] Based on the data flow failure mode analysis results, the data flow associated with functions is treated as a black box. The operational scenarios of functional applications are classified according to the operational time classification rules and / or the operational physical area location classification rules. The corresponding strategy is selected based on the operational scenario type to perform failure mode analysis on the operational scenario. Among them, the operational time classification rule is based on the operational time; the operational physical area location classification rule is based on the operational physical area location.

[0016] In some feasible approaches to the first aspect, based on the results of operational scenario failure mode analysis, boundary factor failure mode analysis is performed on the potential boundary factors of the interlocking system, including:

[0017] Based on the failure mode analysis results of the operational scenarios, the operational scenarios of functional applications are treated as black boxes. Potential boundary factors of the interlocking system are classified according to environmental factor classification rules and / or non-operational expected factor classification rules. Based on the boundary factor type, the corresponding strategy is selected to conduct failure mode analysis on the boundary factors. Among them, the environmental factor classification rule is based on irresistible environmental factors; the non-operational expected factor classification rule is based on non-operational expected factors that the interlocking system cannot protect against.

[0018] Among the possible implementations of the first aspect, obtaining the data stream associated with the function includes:

[0019] Obtain other functions and external interfaces associated with the function, and organize the data flow associated with the function based on these other functions and external interfaces.

[0020] Among some possible implementations of the first aspect, the method also includes:

[0021] Based on the security requirements of the function, generate the necessary improvements to the function, and use these improvements to enhance the function.

[0022] Secondly, embodiments of this disclosure provide a layered security analysis device for interlocking systems, the device comprising:

[0023] The functional failure mode analysis module is used to obtain the functional requirements of the interlocking system and perform functional failure mode analysis on the functions based on the functional requirements.

[0024] The data flow through-failure mode analysis module is used to acquire data flows associated with functions and, in conjunction with the results of function failure mode analysis, perform data flow through-failure mode analysis on the data flows associated with functions.

[0025] The Operational Scenario Failure Mode Analysis module is used to obtain the operational scenarios of functional applications and, in conjunction with the data flow through the failure mode analysis results, to perform operational scenario failure mode analysis on the operational scenarios of functional applications.

[0026] The boundary factor failure mode analysis module is used to obtain potential boundary factors of the interlocking system and, in combination with the failure mode analysis results of the operation scenario, perform boundary factor failure mode analysis on the potential boundary factors of the interlocking system.

[0027] The security requirements generation module is used to generate security requirements for functions based on the results of functional failure mode analysis, data flow failure mode analysis, operational scenario failure mode analysis, and boundary factor failure mode analysis.

[0028] Thirdly, embodiments of this disclosure provide an electronic device comprising: at least one processor; and a memory communicatively connected to the at least one processor; the memory storing instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the method described above.

[0029] Fourthly, embodiments of this disclosure provide a non-transitory computer-readable storage medium storing computer instructions for causing a computer to perform the methods described above.

[0030] In the embodiments of this disclosure, security analysis can be broken down into simple single-layer analyses at the functional level, data flow level, operational scenario level, and boundary factor level, thereby reducing the difficulty of analysis and increasing the depth of analysis.

[0031] It should be understood that the description in the Summary of the Invention is not intended to limit the key or essential features of the embodiments of this disclosure, nor is it intended to restrict the scope of this disclosure. Other features of this disclosure will become readily apparent from the following description. Attached Figure Description

[0032] The above and other features, advantages, and aspects of the embodiments of this disclosure will become more apparent from the accompanying drawings and the following detailed description. The drawings are provided for a better understanding of the invention and are not intended to limit the scope of this disclosure. In the drawings, the same or similar reference numerals denote the same or similar elements, wherein:

[0033] Figure 1 A schematic diagram illustrating the relationship between a CI and various systems provided in an embodiment of this disclosure is shown.

[0034] Figure 2 A flowchart illustrating a layered security analysis method for interlocking systems provided by an embodiment of this disclosure is shown;

[0035] Figure 3 A schematic diagram illustrating an application example of a layered security analysis method for interlocking systems provided by an embodiment of this disclosure is shown.

[0036] Figure 4A schematic diagram of the data flow for a site-wide blocking / unblocking function provided by an embodiment of this disclosure is shown;

[0037] Figure 5 A structural diagram of a layered safety analysis device for an interlocking system provided by an embodiment of the present disclosure is shown;

[0038] Figure 6 A structural diagram of an exemplary electronic device capable of implementing embodiments of the present disclosure is shown. Detailed Implementation

[0039] To make the objectives, technical solutions, and advantages of the embodiments of this disclosure clearer, the technical solutions of the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this disclosure, and not all embodiments. Based on the embodiments of this disclosure, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this disclosure.

[0040] Furthermore, the term "and / or" in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Additionally, the character " / " in this article generally indicates that the preceding and following related objects have an "or" relationship.

[0041] To address the problems in the background art, embodiments of this disclosure provide a layered security analysis method, apparatus, device, and storage medium for interlocking systems. Specifically, the method involves: acquiring the functional requirements of the interlocking system's functions; performing functional failure mode analysis (FDM) on these functions; acquiring data streams associated with the functions; performing data flow penetration failure mode analysis on these data streams based on the FDM results; acquiring the operational scenarios of the functional applications; performing operational scenario failure mode analysis on these operational scenarios based on the data flow penetration failure mode analysis results; acquiring potential boundary factors of the interlocking system; and performing boundary factor failure mode analysis on these potential boundary factors based on the operational scenario failure mode analysis results. Finally, based on the above analysis results, security requirements for the functions are generated.

[0042] In this way, security analysis can be broken down into simple single-layer analyses at the functional level, data flow level, operational scenario level, and boundary factor level, thereby reducing the difficulty of analysis and increasing the depth of analysis.

[0043] The following detailed description, with reference to the accompanying drawings and specific embodiments, illustrates a hierarchical security analysis method, apparatus, device, and storage medium for interlocking systems provided by the present disclosure.

[0044] Figure 2 A flowchart illustrating a layered security analysis method for interlocking systems provided by embodiments of this disclosure is shown, such as... Figure 2 As shown, method 200 may include the following steps:

[0045] S210: Obtain the functional requirements of the interlocking system and perform functional failure mode analysis based on the functional requirements.

[0046] In some embodiments, functional failure mode analysis can be specifically described as follows:

[0047] Based on functional requirements, the logical processing steps of the function are visualized and organized using functional block diagrams or mind maps, including input, output, and logical flow. The organized logical processing steps are divided according to the sub-functions of the function, and the logical processing steps corresponding to each sub-function are determined. Fault mode analysis is performed using the FMECA method on each sub-function's corresponding logical processing steps as a whole, which can significantly improve the efficiency of functional fault mode analysis.

[0048] It is important to note that the output stage and logical flow stage of the function are the focus of the analysis here. For the output stage, failure modes such as no output, output error, missing output, output delay, and output premature may be analyzed, so it is necessary to propose a requirement for designing rigorous functional logic.

[0049] S220: Acquire the data stream associated with the function, and combine the results of the function failure mode analysis to perform data stream flow failure mode analysis on the data stream associated with the function.

[0050] In some embodiments, other functions and external interfaces associated with the function can be obtained, and the data flow associated with the function can be accurately and clearly organized based on the other functions and external interfaces associated with the function.

[0051] In some embodiments, data flow through failure mode analysis can be specifically described as follows:

[0052] Since the functions of an interlocking system are not independent but interconnected through data flows, forming an external representation, it's necessary to treat the function as a black box, building upon the thorough functional failure mode analysis (FMM) results. Starting from the beginning of the data flow associated with the function and ending at its end, the system traces the data flow path and identifies the behavior of each data flow node under various potential abnormal conditions based on its characteristic information in its corresponding input, processing, and output dimensions. This allows for the analysis of the failure modes of each data flow node. This black-box approach effectively focuses on identifying potential failure modes within the data flow, significantly improving the efficiency and accuracy of FMM analysis.

[0053] It is important to note that this analysis may identify various failure modes, such as no input, input errors, missing input, input delay, premature input, data errors, and human error. Specific measures need to be developed for each failure mode, including software implementation requirements and guidance for personnel.

[0054] S230: Obtain the operational scenarios of functional applications, and combine the data flow through the failure mode analysis results to perform operational scenario failure mode analysis on the operational scenarios of functional applications.

[0055] In some embodiments, the operational scenario failure mode analysis can be specifically described as follows:

[0056] Since functions cannot exist independently and ultimately need to be applied to operational scenarios, after completing the aforementioned failure mode analysis, it is necessary to analyze the functions within operational scenarios. Specifically, combining the data flow analysis results, the data flows associated with the functions are treated as black boxes. The operational scenarios in which the functions are applied are categorized according to operational time classification rules and / or operational physical location classification rules. Based on the operational scenario type, corresponding strategies are selected to conduct failure mode analysis on the operational scenarios. In this way, operational scenario-level failure modes can be systematically identified, improving the comprehensiveness and relevance of the analysis and ensuring that the risks of the functions in actual operational scenarios are effectively covered.

[0057] It is worth noting that the classification rule for operating time is based on operating time, specifically categorized as: operational preparation, mainline operation, and operational completion. Further, each major category needs to be subdivided into subcategories. For example, the subcategories of operational preparation include: preparing operational plans, loading operational plans, train wake-up, track inspection, and train departure. The classification rule for the physical location of operating areas is based on the location of the operating area, specifically categorized as: depot / parking lot, mainline platform, test track, and station intervals.

[0058] S240: Obtain potential boundary factors of the interlocking system, and perform boundary factor failure mode analysis on the potential boundary factors of the interlocking system in combination with the failure mode analysis results of the operation scenario.

[0059] In some embodiments, boundary factor failure mode analysis can be specifically described as follows:

[0060] Since the assumptions and constraints used in the interlocking system in the operational scenario should also be analyzed as its protection boundary, after the above failure mode analysis is completed, it is necessary to combine the failure mode analysis results of the operational scenario, treat the operational scenario of the functional application as a black box, classify the potential boundary factors of the interlocking system according to the classification rules of environmental factors and / or the classification rules of non-operational expected factors, select the corresponding strategy based on the boundary factor type to conduct failure mode analysis on the boundary factors, and then comprehensively identify the boundary failure risk of the interlocking system to improve the integrity of safety protection.

[0061] It is worth noting that the classification rule for environmental factors is based on unavoidable environmental factors, specifically classified as: extreme weather or natural disasters such as earthquakes and blizzards.

[0062] The classification rule for non-operational anticipated factors is based on non-operational anticipated factors that the interlocking system cannot protect against. Specifically, these can be classified as: unexpected movement, drivers being unable to continue driving with reference to traffic signals after entering the route, etc.

[0063] S250 generates safety requirements for functions based on the results of functional failure mode analysis, data flow failure mode analysis, operational scenario failure mode analysis, and boundary factor failure mode analysis.

[0064] In some embodiments, the results of functional failure mode analysis, data flow failure mode analysis, operational scenario failure mode analysis, and boundary factor failure mode analysis are organized and categorized to generate functional safety requirements. Furthermore, based on these safety requirements, necessary improvement measures can be generated for the function, and these measures can be used to improve the function, thereby enhancing its safety and reducing potential failures.

[0065] In the embodiments of this disclosure, security analysis can be broken down into simple single-layer analyses at the functional level, data flow level, operational scenario level, and boundary factor level, thereby reducing the difficulty of analysis and increasing the depth of analysis.

[0066] In other words, the security analysis work here is broken down into, for example... Figure 3The functional failure mode analysis, data flow failure mode analysis, operational scenario failure mode analysis, and boundary factor failure mode analysis shown are all focused on only one dimension for each layer of failure mode analysis, achieving in-depth single-dimensional analysis, and finally realizing full-dimensional analysis through layer-by-layer analysis.

[0067] To facilitate a further understanding of the layered security analysis method 200 provided in the embodiments of this disclosure, the above steps will be described in detail below using the site-wide blocking / unblocking function as an example, as shown below:

[0068] 1. Functional Failure Mode Analysis

[0069] After initial power-on, the sub-functions of the station-wide lockout / unlock function of the interlocking system are as follows: After initial power-on, the centralized equipment area is locked and power-on locked; the lockout and locking must be maintained before the station-wide lockout / unlock command is executed; after the station-wide lockout / unlock command is executed, the station-wide unlock command is automatically executed, followed by the power-on unlock command, completing the station-wide lockout / unlock. Based on the functional requirements of the station-wide lockout / unlock function, the logical processing steps of the function are outlined using a functional block diagram or mind map. These logical processing steps are then divided according to the sub-functions of the station-wide lockout / unlock function, and the logical processing steps corresponding to each sub-function are determined. FEMCA (Fault Mode Analysis) is then used to analyze the fault modes of each sub-function's corresponding logical processing steps as a whole. Specifically, the following situations exist:

[0070] (1) After power-on, if the controlled area is not sealed off and the operation is not confirmed, the route can be triggered and the turnout can be driven to rotate. Trains are at risk of entering dangerous areas, speeding, and being squeezed out of turnouts.

[0071] (2) If the site-wide lockdown / unlocking order is not executed, the interlocking system cannot maintain its lockdown and closure. This carries the same risk as in scenario 1.

[0072] (3) After the site is unblocked, the site is not successfully unblocked and cannot be operated, so there is no security risk.

[0073] (4) After the site-wide block is lifted, the unblocking does not apply to this control zone, resulting in other control zones being unblocked without confirmation. The risks to other control zones are the same as those in the first scenario.

[0074] Based on the above risks, analyze the causes of the failures, and then generate safety requirements based on the causes.

[0075] This step requires a focus on the rigor of the functional logic implementation and the development of security requirements to address any logical vulnerabilities.

[0076] 2. Data Flow Through-Fault Mode Analysis

[0077] Functional failure mode analysis focuses on the function itself, while data flow-through failure mode analysis requires treating the function as a black box, shifting the analyst's focus to the input and output stages of this "black box." It's necessary to clearly define each stage of the data flow involved in the function's implementation. For example, a data flow diagram for a site-wide blocking / unblocking function could be as follows: Figure 4 As shown. Based on Figure 4 It can be seen that the data flow for normal use of the site-wide blocking / unblocking function is from ① to ⑨. Starting from the data flow's starting point ① and ending at its ending point ⑨, along the data flow path, based on the characteristic information of each data flow node under its corresponding input, processing, and output dimensions, the behavior of each data flow node under various potential abnormal conditions is identified, and the failure modes of each data flow node are analyzed accordingly. For example, the abnormal causes of each data flow node mainly focus on hazards such as delay, data loss, corruption, and out-of-order delivery. Threats to communication interfaces can be mitigated to some extent by using security protocols.

[0078] Besides the faults that the protocol can protect against, the fault modes that need to be analyzed in this step include: data being sent when it shouldn't have happened, data being sent prematurely, data being sent late, and incorrect data being sent by other devices. For these fault causes, the interface data in the software logic needs to be validated, and appropriate handling should be performed, such as packet loss or parsing, upon receiving abnormal data. Faults that cannot be resolved by software can be mitigated through other means, such as using a secure network.

[0079] 3. Failure Mode Analysis in Operational Scenarios

[0080] The functionality cannot be used independently; it is ultimately applied within operational scenarios. After conducting the aforementioned failure mode analysis, the functionality needs to be placed within these application scenarios for further failure mode analysis. Combining the data flow-through failure mode analysis results, the data flow is treated as a black box. The operational scenarios for the site-wide blocking / unblocking functionality are categorized according to operational time classification rules, specifically: equipment startup before line operation, during line operation, and during periods requiring restart after a crash. Subsequently, based on the operational scenario type, corresponding strategies are selected to conduct failure mode analysis on the operational scenarios. Specifically, the following situations exist:

[0081] During the normal operation of the line, both during startup and the period before it is about to be decommissioned, the on-site influencing factors are simple and the failure scenarios are few.

[0082] When a line crashes and restarts during operation, there are various combinations of events, such as whether emergency shutdown, temporary speed limit, rain / snow mode, train impoundment, master lock, ITE disconnection, or section / turnout closure were set before the crash.

[0083] Therefore, analyzing operational scenarios increases the consideration of many failure modes, especially unexpected situations. Conducting security analysis at this level separately will significantly reduce the likelihood of missing scenarios.

[0084] 4. Boundary Factor Failure Mode Analysis

[0085] Following the aforementioned failure mode analysis, boundary factor failure mode analysis is required. Specifically, based on the results of the operational scenario failure mode analysis, the operational scenario of the functional application is treated as a black box. Potential boundary factors of the interlocking system are classified according to environmental factor classification rules and / or non-operational expected factor classification rules. Based on the boundary factor type, corresponding strategies are selected to conduct failure mode analysis on the boundary factors. The classified boundary factors include unavoidable environmental factors (such as earthquakes, blizzards, and other extreme weather or natural disasters) and non-operational expected factors that the interlocking system cannot protect against (such as a train from outside the control zone entering a control zone that is not powered on and unlocked, the driver not following signal indicator signals, or a switch ahead of the train being turned without operational requirements, leading to derailment, etc.).

[0086] Therefore, it is evident that through the above layer-by-layer analysis, the harm caused by the function will be fully identified.

[0087] 5. Security Requirements Generation

[0088] The results of functional failure mode analysis, data flow failure mode analysis, operational scenario failure mode analysis, and boundary factor failure mode analysis are organized and categorized to generate functional safety requirements.

[0089] In summary, based on the embodiments of this disclosure, hierarchical analysis can break down safety analysis into simple single-layer analyses, reducing the complexity of the analysis; classifying various analytical factors not only reduces confusion in the analysis process but also avoids omissions of hazards, resulting in a more comprehensive analysis; and it improves the ability to address interlocking system fault analysis that is limited to the functional dimension. This expands the scope of analysts from focusing on single functional analyses to real-world application scenarios, filling in the gaps in the entire chain of fault factors from requirements to product implementation and then to actual application, thereby promoting the implementation of functions that better meet user needs.

[0090] It should be noted that, for the sake of simplicity, the above-described method embodiments are all presented as a series of actions. However, those skilled in the art should understand that this disclosure is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this disclosure. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are optional embodiments, and the actions and modules involved are not necessarily essential to this disclosure.

[0091] The above is an introduction to the method embodiments. The following describes the solution described in this disclosure further through device embodiments.

[0092] Figure 5 A structural diagram of a layered safety analysis device for an interlocking system provided by an embodiment of this disclosure is shown, such as... Figure 5 As shown, the device 500 may include:

[0093] The Functional Failure Mode Analysis Module 510 is used to obtain the functional requirements of the interlocking system and perform functional failure mode analysis on the functions based on the functional requirements.

[0094] The data flow through-fault mode analysis module 520 is used to acquire data flows associated with functions and, in conjunction with the results of function fault mode analysis, perform data flow through-fault mode analysis on the data flows associated with functions.

[0095] The Operation Scenario Fault Mode Analysis Module 530 is used to obtain the operation scenarios of functional applications and, in combination with the data flow through the fault mode analysis results, perform operation scenario fault mode analysis on the operation scenarios of functional applications.

[0096] The boundary factor failure mode analysis module 540 is used to obtain potential boundary factors of the interlocking system and, in combination with the failure mode analysis results of the operation scenario, perform boundary factor failure mode analysis on the potential boundary factors of the interlocking system.

[0097] The safety requirements generation module 550 is used to generate safety requirements for functions based on the results of functional failure mode analysis, data flow failure mode analysis, operational scenario failure mode analysis, and boundary factor failure mode analysis.

[0098] Understandable, Figure 5 Each module / unit in the illustrated device 500 has the ability to implement Figure 2 The functions of each step in method 200 shown, and their corresponding technical effects, will not be elaborated here for the sake of brevity.

[0099] Figure 6 A structural diagram of an exemplary electronic device capable of implementing embodiments of the present disclosure is shown. Electronic device 600 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. Electronic device 600 may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0100] like Figure 6 As shown, the electronic device 600 may include a computing unit 601, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 602 or a computer program loaded from a storage unit 608 into a random access memory (RAM) 603. The RAM 603 may also store various programs and data required for the operation of the electronic device 600. The computing unit 601, ROM 602, and RAM 603 are interconnected via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0101] Multiple components in electronic device 600 are connected to I / O interface 605, including: input unit 606, such as keyboard, mouse, etc.; output unit 607, such as various types of displays, speakers, etc.; storage unit 608, such as disk, optical disk, etc.; and communication unit 609, such as network card, modem, wireless transceiver, etc. Communication unit 609 allows electronic device 600 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0102] The computing unit 601 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 601 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 601 performs the various methods and processes described above, such as method 200. For example, in some embodiments, method 200 may be implemented as a computer program product, including a computer program tangibly contained in a computer-readable medium, such as storage unit 608. In some embodiments, part or all of the computer program may be loaded and / or installed on device 600 via ROM 602 and / or communication unit 609. When the computer program is loaded into RAM 603 and executed by the computing unit 601, one or more steps of method 200 described above may be performed. Alternatively, in other embodiments, the computing unit 601 may be configured to perform method 200 by any other suitable means (e.g., by means of firmware).

[0103] The various embodiments described above can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), system-on-a-chip (SoCs), payload programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0104] The program code used to implement the methods of this disclosure may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0105] In the context of this disclosure, a computer-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. A computer-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of computer-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0106] It should be noted that this disclosure also provides a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to cause a computer to execute method 200 and achieve the corresponding technical effects achieved by the embodiments of this disclosure in executing the method. For the sake of brevity, further details are omitted here.

[0107] In addition, this disclosure also provides a computer program product including a computer program that implements method 200 when executed by a processor.

[0108] To provide interaction with a user, the embodiments described above can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0109] The embodiments described above can be implemented in computing systems that include backend components (e.g., as a data server), or computing systems that include middleware components (e.g., an application server), or computing systems that include frontend components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with the implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication (e.g., a communication network) of any form or medium. Examples of communication networks include local area networks (LANs), wide area networks (WANs), and the Internet.

[0110] Computer systems can include clients and servers. Clients and servers are generally located far apart and typically interact via communication networks. Client-server relationships are created by computer programs running on the respective computers and having a client-server relationship with each other. Servers can be cloud servers, servers in distributed systems, or servers incorporating blockchain technology.

[0111] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this disclosure can be achieved, and this is not limited herein.

[0112] The specific embodiments described above do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. A layered security analysis method for an interlocking system, characterized by, The method comprises: obtaining a functional requirement of a function of an interlocking system, performing functional failure mode analysis on the function according to the functional requirement; obtaining a data flow associated with the function, and performing data flow penetration failure mode analysis on the data flow associated with the function in combination with the functional failure mode analysis result; obtaining an operation scene in which the function is applied, and performing operation scene failure mode analysis on the operation scene in which the function is applied in combination with the data flow penetration failure mode analysis result; obtaining a potential boundary factor of the interlocking system, and performing boundary factor failure mode analysis on the potential boundary factor of the interlocking system in combination with the operation scene failure mode analysis result; generating a safety requirement of the function according to the functional failure mode analysis result, the data flow penetration failure mode analysis result, the operation scene failure mode analysis result and the boundary factor failure mode analysis result.

2. The method of claim 1, wherein, The functional failure mode analysis on the function according to the functional requirement comprises: combining the logical processing links of the function through a functional block diagram or a mind map, dividing the combined logical processing links according to sub-functions of the function, determining the logical processing links corresponding to each sub-function, and performing failure mode analysis on each logical processing link corresponding to each sub-function as a whole by using the FMECA method.

3. The method of claim 1, wherein, The data flow penetration failure mode analysis on the data flow associated with the function in combination with the functional failure mode analysis result comprises: combining the function as a black box, starting from the beginning of the data flow associated with the function and ending at the end of the data flow associated with the function, sequentially identifying the behaviors of each data flow node under various potential abnormal conditions based on the feature information of each data flow node in the input dimension, processing dimension and output dimension corresponding to itself along the data flow path, and analyzing the failure modes of each data flow node.

4. The method of claim 1, wherein, The operation scene failure mode analysis on the operation scene in which the function is applied in combination with the data flow penetration failure mode analysis result comprises: combining the data flow associated with the function as a black box, classifying the operation scene in which the function is applied according to operation time classification rules and / or operation physical region location classification rules, and performing failure mode analysis on the operation scene based on the corresponding strategy selected according to the operation scene type; wherein the operation time classification rules are classified according to operation time; and the operation physical region location classification rules are classified according to operation physical region location.

5. The method of claim 1, wherein, The boundary factor failure mode analysis on the potential boundary factor of the interlocking system in combination with the operation scene failure mode analysis result comprises: According to the operation scene failure mode analysis result, the operation scene of the function is taken as a black box, the potential boundary factor of the interlocking system is classified according to the environmental factor classification rule and / or the non-operation expected factor classification rule, and the failure mode analysis of the boundary factor is performed based on the boundary factor type and the corresponding strategy.

6. The method of claim 1, wherein, The data flow associated with the function is obtained, including: Other functions and external interfaces associated with the function are obtained, and the data flow associated with the function is sorted according to the other functions and external interfaces associated with the function.

7. The method of claim 1, wherein, The method further includes: According to the safety requirement of the function, the improvement measure required by the function is generated, and the function is improved by using the improvement measure.

8. A layered security analysis apparatus for an interlocking system, characterized by, The device includes: A function failure mode analysis module is configured to obtain the function requirement of a function of an interlocking system, and perform function failure mode analysis on the function according to the function requirement; A data flow throughout failure mode analysis module is configured to obtain the data flow associated with the function, and perform data flow throughout failure mode analysis on the data flow associated with the function in combination with the function failure mode analysis result; An operation scene failure mode analysis module is configured to obtain the operation scene applied by the function, and perform operation scene failure mode analysis on the operation scene applied by the function in combination with the data flow throughout failure mode analysis result; A boundary factor failure mode analysis module is configured to obtain the potential boundary factor of the interlocking system, and perform boundary factor failure mode analysis on the potential boundary factor of the interlocking system in combination with the operation scene failure mode analysis result; A safety requirement generation module is configured to generate the safety requirement of the function according to the function failure mode analysis result, the data flow throughout failure mode analysis result, the operation scene failure mode analysis result, and the boundary factor failure mode analysis result.

9. An electronic device, comprising: The electronic device includes at least one processor and a memory connected with the at least one processor in communication; The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-7.

10. A non-transitory computer-readable storage medium having stored thereon computer instructions, wherein, The computer instructions are used to enable the computer to perform the method of any one of claims 1-7.

Images