Extensible gateway intervention method for industrial control system integration

Abstract

The invention discloses an extensible gateway intervention method for industrial control system integration, which relates to the technical field of computers, and comprises the following steps: deploying a unified management control center in a gateway platform; all accessed heterogeneous systems are arranged on one platform for monitoring, configuration and management through a unified management control center, routing rules, security policies and business processes are configured in a unified manner, each manufacturer system is accessed and managed as a complete logic entity through the architecture of a system adaptive plug-in, and the plug-in not only encapsulates a protocol, but also can be used as a whole logic entity. The gateway has a system semantic understanding capability, seamless cooperation of a business process level is realized, data unvarnished transmission is not only completed, and a plug-in design is adopted, so that when a new manufacturer system is accessed, only corresponding independent plug-ins need to be developed and deployed, a gateway core or other existing plug-ins do not need to be modified, a unified security defense line does not need to be constructed, and the security of the system is greatly improved. And a multi-level security mechanism from system authentication, access authorization, data encryption to operation auditing is provided.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a scalable gateway access method for industrial control system integration. Background Technology

[0002] In existing technologies, common industrial control systems and enterprise management systems often suffer from heterogeneous communication protocols and inconsistent data models. For example, lower-level control devices typically use industrial buses or proprietary protocols such as Modbus, PROFIBUS, and CAN, while upper-level systems often use OPC, Web Services, or database interaction methods. This diverse range of communication methods necessitates extensive protocol conversions and interface development for system interconnection, increasing integration complexity and easily leading to data delays, redundancy, or even data loss, making it difficult to guarantee real-time performance and consistency.

[0003] Furthermore, industrial systems have extremely high requirements for security and reliability. Existing gateways, lacking a unified security authentication and access control mechanism when handling cross-system communication, are prone to data leaks and system intrusion risks. How can we build a scalable and flexibly configurable gateway architecture to achieve efficient integration of various industrial control and management systems while ensuring security and high availability? Existing industrial system integration largely relies on adaptation methods for single protocols or single devices, with control systems from different manufacturers often forming their own closed ecosystems. Due to the lack of unified standards among manufacturers, there are differences in interfaces, data formats, and operating logic. Traditional integration methods require a lot of customized development, resulting in poor scalability, high maintenance costs, and difficulty in rapid deployment in scenarios with multiple manufacturers.

[0004] To address the aforementioned technical shortcomings, a solution is proposed. Summary of the Invention

[0005] The purpose of this invention is to propose a scalable gateway access method for industrial system integration based on a scalable gateway, so as to realize unified access, centralized management and collaborative operation of cross-manufacturer and cross-platform systems, thereby improving the informatization, automation and intelligence level of industrial enterprises.

[0006] To achieve the above objectives, the present invention adopts the following technical solution: a scalable gateway access method for industrial control system integration, comprising the following steps: Step 1: Deploy a unified management and control center in the gateway platform. The unified management center provides system-level management functions such as system registration, identity authentication, and data modeling. Build a plug-in runtime environment in the gateway platform. The plug-in runtime environment is used to load and run one or more system adaptation plug-ins. Step 2: Develop and deploy corresponding system adaptation plugins for each manufacturer's system to be integrated. Each plugin encapsulates the specific interface specifications and operating logic of the manufacturer's system. The plugins are dynamically loaded into the management and control center through the plugin manager to complete plugin registration and lifecycle management. Step 3: Based on the preset business logic and security policies, configure request forwarding routing rules across vendor systems through the routing controller, and use the dynamic filter binding mechanism to dynamically associate the filter functions implemented in the plugin with the corresponding routing rules to achieve request-level authentication, interception and data transformation; Step 4: Receive service requests from external and internal systems through the gateway platform. Based on the target system identifier, routing rules, and bound filters in the request, perform authentication, permission checks, protocol conversion, and data forwarding. Finally, distribute the request to the target vendor's system and return the processing result, thus realizing collaborative operation and business interaction across vendor systems.

[0007] Furthermore, the unified management center provides system-level management functions for system registration, identity authentication, and data modeling, specifically including: Assign a globally unique system identifier to each connected vendor system, and set a role-based access control policy for each vendor system. The policy defines the resources that the vendor system can access and the operations that can be performed. Establish a unified data model and control model to shield data format and protocol differences between systems from different vendors; based on the unified data model, translate and adapt data interactions and business calls from multiple registered vendors, and control them through standardized interfaces and gateway platforms provided by the unified management center. Establish a unified control instruction model, and output a standardized set of operation instructions and parameter formats from the control instruction model.

[0008] Furthermore, develop and deploy corresponding system adapter plugins for each manufacturer's system to be integrated. The specific deployment process is as follows: The plugin exists as a standalone executable package, containing protocol drivers for communicating with the target manufacturer's system; The plugin includes a data mapper for bidirectional conversion between the target system's native data format and a unified data model; The plugin includes a service adapter, which encapsulates the target system's native service interfaces into standardized service interfaces that can be recognized by the gateway platform.

[0009] Furthermore, plugins are dynamically loaded into the management control center through the plugin manager to complete plugin registration and lifecycle management. The specific process is as follows: System adapter plugin packages developed for industrial control systems from different manufacturers are placed in a predefined plugin directory; the plugin manager periodically or in response to events scans the plugin directory to discover newly added, updated, or deleted plugin packages; For discovered plugin packages, the plugin manager reads its embedded metadata description file. The metadata includes at least the plugin identifier, version number, core framework version it depends on, and declared external service interfaces. It verifies the plugin signature to ensure the source is trustworthy and checks its compatibility with the current core framework version. After verification, the plugin manager allocates an independent runtime environment or class loader to each plugin, loads the bytecode file in the plugin package, completes the instantiation of the plugin, registers the instantiated plugin to the plugin registry center, and records its current status, health, resource usage and the service endpoint information it provides; at the same time, the plugin manager calls the plugin's initialization interface to enable it to complete the internal state preparation.

[0010] Furthermore, the plugin manager in step two specifically includes the following: Plugin registry: Used to maintain the metadata, health status, and server endpoint information of all loaded plugins; Plugin directory service: Used to store and manage the physical storage path and version information of plugin package files; Dependency resolver: Used to check and resolve version dependencies between plugins and between plugins and the core framework when loading plugins.

[0011] Furthermore, by utilizing a dynamic filter binding mechanism, the filter functionality implemented in the plugin is dynamically associated with the corresponding routing rules. The specific process is as follows: Under the plugin management center of the gateway platform, each system's adaptation plugin implements one or more filter functions; each filter function is registered in the plugin registry center and abstracted into a standard processor unit that can be called by the gateway core. Filter function types include authentication, traffic shaping, data format conversion, request / response message rewriting, and log recording. It can dynamically associate registered filter functions with one or more routing rules to form a filter chain. The binding configuration supports dynamically adding, removing, and adjusting filters in the filter chain and their execution order while the gateway platform is running, without restarting the gateway service. When the gateway platform receives an inbound request, the routing controller traverses the routing rule base and finds the first successfully matched routing rule based on the matching conditions. Based on the filter chain identifier associated with the successfully matched routing rule, the processor unit corresponding to each filter function in the chain is invoked in sequence; each processor unit performs a predetermined operation on the request or its response, wherein at least one operation involves access control based on security policy and data protocol conversion based on business logic; After the filter chain is successfully executed, the gateway will forward the potentially modified request to the target manufacturer's system specified by the routing rule; after receiving the response from the target system, it can be processed again through the reverse of the filter chain, and finally the response will be returned to the request initiator.

[0012] Furthermore, the gateway platform receives service requests initiated by external and internal systems, and the specific process is as follows: The gateway platform receives service requests from both external clients and internally integrated systems. It parses the requests to extract key elements, which include at least the target manufacturer's system identifier and operation instructions. The route controller matches key elements with a pre-configured routing rule base to determine the target routing rule serving the request and its dynamically bound filter chain, generating a routing decision context; Based on the routing decision context, multiple filter functions integrated in the filter chain are executed sequentially. The verified and adapted requests are distributed to the target manufacturer's system via the gateway communication module. After receiving the original response returned by the target system, the response data is processed again by the corresponding filter in the filter chain to convert it into the format expected by the request initiator. Finally, the processing result is returned, completing a closed loop of business interaction across the manufacturer's system.

[0013] Furthermore, the system adaptation plugins in step one include at least one of the following types: Industrial protocol adapter plug-in, used to connect to devices or systems that support Modbus, PROFIBUS, OPC UA, and MQTT protocols; Enterprise application adapter plugins are used for data exchange with ERP, MES, and SCADA systems; The security enhancement plugin provides proprietary encryption algorithms, intrusion detection, and access control logic.

[0014] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are: This scalable gateway integration method for industrial control system integration places all connected heterogeneous systems on a single platform for monitoring, configuration, and management through a unified management and control center. It allows for intuitive viewing of system status, service link health, and traffic data, as well as unified configuration of routing rules, security policies, and business processes. Through a system-adaptive plug-in architecture, each vendor's system is treated as a complete logical entity for access and management. The plug-in not only encapsulates protocols but also the system's business interfaces, data models, and interaction logic, giving the gateway system semantic understanding capabilities. This enables upper-layer applications to call functions from different systems in a unified and standardized manner, achieving seamless collaboration at the business process level, rather than simply passing data. The plug-in design means that when connecting to a new vendor's system, only the corresponding independent plug-in needs to be developed and deployed, without modifying the gateway core or other existing plug-ins. This builds a unified security defense, providing a multi-layered security mechanism from system authentication, access authorization, and data encryption to operation auditing. Attached Figure Description

[0015] Figure 1 A schematic diagram of the overall system structure of the present invention is shown; Figure 2 A schematic diagram of the overall structure of the gateway execution steps of the present invention is shown. Detailed Implementation

[0016] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0017] Example 1: like Figure 1-2 As shown, a scalable gateway integration method for industrial control system integration is characterized by comprising the following steps: Step 1: Deploy a unified management and control center in the gateway platform. The unified management center provides system-level management functions such as system registration, identity authentication, and data modeling. Build a plug-in runtime environment in the gateway platform. The plug-in runtime environment is used to load and run one or more system adaptation plug-ins. Step 2: Develop and deploy corresponding system adaptation plugins for each manufacturer's system to be integrated. Each plugin encapsulates the specific interface specifications and operating logic of the manufacturer's system. The plugins are dynamically loaded into the management and control center through the plugin manager to complete plugin registration and lifecycle management. Step 3: Based on the preset business logic and security policies, configure request forwarding routing rules across vendor systems through the routing controller, and use the dynamic filter binding mechanism to dynamically associate the filter functions implemented in the plugin with the corresponding routing rules to achieve request-level authentication, interception and data transformation; Step 4: Receive service requests from external and internal systems through the gateway platform. Based on the target system identifier, routing rules, and bound filters in the request, perform authentication, permission checks, protocol conversion, and data forwarding. Finally, distribute the request to the target vendor's system and return the processing result, thus realizing collaborative operation and business interaction across vendor systems.

[0018] The unified management center provides system-level management functions for system registration, identity authentication, and data modeling, specifically including: Assign a globally unique system identifier to each connected vendor system, and set a role-based access control policy for each vendor system. The policy defines the resources that the vendor system can access and the operations that can be performed. Establish a unified data model and control model to shield data format and protocol differences between systems from different vendors; based on the unified data model, translate and adapt data interactions and business calls from multiple registered vendors, and control them through standardized interfaces and gateway platforms provided by the unified management center. Establish a unified control instruction model, and output a standardized set of operation instructions and parameter formats from the control instruction model.

[0019] For each vendor's system to be integrated, develop and deploy corresponding system adapter plugins. The specific deployment process is as follows: The plugin exists as a standalone executable package, containing protocol drivers for communicating with the target manufacturer's system; The plugin includes a data mapper for bidirectional conversion between the target system's native data format and a unified data model; The plugin includes a service adapter, which encapsulates the target system's native service interfaces into standardized service interfaces that can be recognized by the gateway platform.

[0020] The plugin manager dynamically loads plugins into the management control center, completing plugin registration and lifecycle management. The specific process is as follows: System adapter plugin packages developed for industrial control systems from different manufacturers are placed in a predefined plugin directory; the plugin manager periodically or in response to events scans the plugin directory to discover newly added, updated, or deleted plugin packages; For discovered plugin packages, the plugin manager reads its embedded metadata description file. The metadata includes at least the plugin identifier, version number, core framework version it depends on, and declared external service interfaces. It verifies the plugin signature to ensure the source is trustworthy and checks its compatibility with the current core framework version. After verification, the plugin manager allocates an independent runtime environment or class loader to each plugin, loads the bytecode file in the plugin package, completes the instantiation of the plugin, registers the instantiated plugin to the plugin registry center, and records its current status, health, resource usage and the service endpoint information it provides; at the same time, the plugin manager calls the plugin's initialization interface to enable it to complete the internal state preparation.

[0021] The plugin manager in step two specifically includes the following: Plugin registry: Used to maintain the metadata, health status, and server endpoint information of all loaded plugins; Plugin directory service: Used to store and manage the physical storage path and version information of plugin package files; Dependency resolver: Used to check and resolve version dependencies between plugins and between plugins and the core framework when loading plugins.

[0022] By using a dynamic filter binding mechanism, the filter functionality implemented in the plugin is dynamically associated with the corresponding routing rules. The specific process is as follows: Under the plugin management center of the gateway platform, each system's adaptation plugin implements one or more filter functions; each filter function is registered in the plugin registry center and abstracted into a standard processor unit that can be called by the gateway core. Filter function types include authentication, traffic shaping, data format conversion, request / response message rewriting, and log recording. It can dynamically associate registered filter functions with one or more routing rules to form a filter chain. The binding configuration supports dynamically adding, removing, and adjusting filters in the filter chain and their execution order while the gateway platform is running, without restarting the gateway service. When the gateway platform receives an inbound request, the routing controller traverses the routing rule base and finds the first successfully matched routing rule based on the matching conditions. Based on the filter chain identifier associated with the successfully matched routing rule, the processor unit corresponding to each filter function in the chain is invoked in sequence; each processor unit performs a predetermined operation on the request or its response, wherein at least one operation involves access control based on security policy and data protocol conversion based on business logic; After the filter chain is successfully executed, the gateway will forward the potentially modified request to the target manufacturer's system specified by the routing rule; after receiving the response from the target system, it can be processed again through the reverse of the filter chain, and finally the response will be returned to the request initiator.

[0023] The gateway platform receives service requests from external and internal systems. The specific process is as follows: The gateway platform receives service requests from both external clients and internally integrated systems. It parses the requests to extract key elements, which include at least the target manufacturer's system identifier and operation instructions. The route controller matches key elements with a pre-configured routing rule base to determine the target routing rule serving the request and its dynamically bound filter chain, generating a routing decision context; Based on the routing decision context, execute multiple filter functions integrated in the filter chain sequentially, including at least the following: Authentication and permission check: Invoke the authentication and authorization filter to verify the legitimacy of the request initiator's identity based on the credentials or token carried in the request, and verify whether the requester has the right to execute the operation instructions on the target system according to the security policy library; Protocol Conversion and Data Processing: The protocol adaptation filter is invoked, and based on predefined mapping rules, the requested transport protocol and data payload are converted from the gateway's internal standard format to the specific protocol format and data structure required by the target vendor's system. After verification and adaptation, the request is distributed to the target manufacturer's system via the gateway communication module. After receiving the original response from the target system, it is processed again by the corresponding filter in the filter chain to convert the response data into the format expected by the request initiator. Finally, the processing result is returned, completing a closed loop of business interaction across manufacturers' systems.

[0024] The system adaptation plugins in step one include at least one of the following types: Industrial protocol adapter plug-in, used to connect to devices or systems that support Modbus, PROFIBUS, OPC UA, and MQTT protocols; Enterprise application adapter plugins are used for data exchange with ERP, MES, and SCADA systems; The security enhancement plugin provides proprietary encryption algorithms, intrusion detection, and access control logic.

[0025] This solution breaks through the traditional approach that is limited to protocol conversion, achieving interconnectivity between systems from different manufacturers. It adopts a plug-in design, which can quickly connect to new manufacturers' systems, reducing integration and maintenance costs. Through a centralized management platform, enterprises can perform unified operation and maintenance and business scheduling for multiple manufacturers' systems, providing system-level authentication and access control to ensure the security and stability of the cross-manufacturer integration process. In summary, this application can effectively solve the problems of difficult interconnection of multi-manufacturer systems, poor scalability, and complex maintenance in the prior art, and provides a new technical path for industrial enterprises to achieve efficient, intelligent, and secure system integration.

[0026] The size of the interval and threshold is set to facilitate comparison. The size of the threshold depends on the amount of sample data and the number of bases set by those skilled in the art for each set of sample data; as long as it does not affect the ratio between the parameter and the quantized value.

[0027] The above formulas are all dimensionless calculations. The formulas are derived from software simulations based on a large amount of collected data to obtain the most recent real-world results. The preset parameters in the formulas are set by those skilled in the art according to the actual situation. In the two embodiments provided in this application, it should be understood that the disclosed apparatus and system can be implemented in other ways; for example, the apparatus embodiments described above are merely illustrative, and the division of modules is merely a logical functional division. In actual implementation, there may be other division methods, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed; furthermore, the coupling or direct coupling or communication connection between the shown or discussed mutuals can be through some interfaces, and the indirect coupling or communication connection between the apparatus or modules can be electrical, mechanical or other forms. The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A scalable gateway access method for industrial control system integration, characterized in that, Includes the following steps: Step 1: Deploy a unified management and control center in the gateway platform. The unified management center provides system-level management functions such as system registration, identity authentication, and data modeling. Build a plug-in runtime environment in the gateway platform. The plug-in runtime environment is used to load and run one or more system adaptation plug-ins. Step 2: Develop and deploy corresponding system adaptation plugins for each manufacturer's system to be integrated. Each plugin encapsulates the specific interface specifications and operating logic of the manufacturer's system. The plugins are dynamically loaded into the management and control center through the plugin manager to complete plugin registration and lifecycle management. Step 3: Based on the preset business logic and security policies, configure request forwarding routing rules across vendor systems through the routing controller, and use the dynamic filter binding mechanism to dynamically associate the filter functions implemented in the plugin with the corresponding routing rules to achieve request-level authentication, interception and data transformation; Step 4: Receive service requests from external and internal systems through the gateway platform. Based on the target system identifier, routing rules, and bound filters in the request, perform authentication, permission checks, protocol conversion, and data forwarding. Finally, distribute the request to the target vendor's system and return the processing result, thus realizing collaborative operation and business interaction across vendor systems.

2. The scalable gateway access method for industrial control system integration according to claim 1, characterized in that, The unified management center provides system-level management functions for system registration, identity authentication, and data modeling, specifically including: Assign a globally unique system identifier to each connected vendor system, and set a role-based access control policy for each vendor system. The policy defines the resources that the vendor system can access and the operations that can be performed. Establish a unified data model and control model to shield data format and protocol differences between systems from different vendors; based on the unified data model, translate and adapt data interactions and business calls from multiple registered vendors, and control them through standardized interfaces and gateway platforms provided by the unified management center. Establish a unified control instruction model, and output a standardized set of operation instructions and parameter formats from the control instruction model.

3. The scalable gateway access method for industrial control system integration according to claim 1, characterized in that, For each vendor's system to be integrated, develop and deploy corresponding system adapter plugins. The specific deployment process is as follows: The plugin exists as a standalone executable package, containing protocol drivers for communicating with the target manufacturer's system; The plugin includes a data mapper for bidirectional conversion between the target system's native data format and a unified data model; The plugin includes a service adapter, which encapsulates the target system's native service interfaces into standardized service interfaces that can be recognized by the gateway platform.

4. The scalable gateway access method for industrial control system integration according to claim 1, characterized in that, The plugin manager dynamically loads plugins into the management control center, completing plugin registration and lifecycle management. The specific process is as follows: System adapter plugin packages developed for industrial control systems from different manufacturers are placed in a predefined plugin directory; the plugin manager periodically or in response to events scans the plugin directory to discover newly added, updated, or deleted plugin packages; For discovered plugin packages, the plugin manager reads its embedded metadata description file. The metadata includes at least the plugin identifier, version number, core framework version it depends on, and declared external service interfaces. It verifies the plugin signature to ensure the source is trustworthy and checks its compatibility with the current core framework version. After verification, the plugin manager allocates an independent runtime environment or class loader to each plugin, loads the bytecode file in the plugin package, completes the instantiation of the plugin, registers the instantiated plugin to the plugin registry center, and records its current status, health, resource usage and the service endpoint information it provides; at the same time, the plugin manager calls the plugin's initialization interface to enable it to complete the internal state preparation.

5. The scalable gateway access method for industrial control system integration according to claim 1, characterized in that, The plugin manager in step two specifically includes the following: Plugin registry: Used to maintain the metadata, health status, and server endpoint information of all loaded plugins; Plugin directory service: Used to store and manage the physical storage path and version information of plugin package files; Dependency resolver: Used to check and resolve version dependencies between plugins and between plugins and the core framework when loading plugins.

6. The scalable gateway access method for industrial control system integration according to claim 1, characterized in that, By using a dynamic filter binding mechanism, the filter functionality implemented in the plugin is dynamically associated with the corresponding routing rules. The specific process is as follows: Under the plugin management center of the gateway platform, each system's adaptation plugin implements one or more filter functions; each filter function is registered in the plugin registry center and abstracted into a standard processor unit that can be called by the gateway core. Filter function types include authentication, traffic shaping, data format conversion, request / response message rewriting, and log recording. It can dynamically associate registered filter functions with one or more routing rules to form a filter chain. The binding configuration supports dynamically adding, removing, and adjusting filters in the filter chain and their execution order while the gateway platform is running, without restarting the gateway service. When the gateway platform receives an inbound request, the routing controller traverses the routing rule base and finds the first successfully matched routing rule based on the matching conditions. Based on the filter chain identifier associated with the successfully matched routing rule, the processor unit corresponding to each filter function in the chain is invoked in sequence; each processor unit performs a predetermined operation on the request or its response, wherein at least one operation involves access control based on security policy and data protocol conversion based on business logic; After the filter chain is successfully executed, the gateway will forward the potentially modified request to the target manufacturer's system specified by the routing rule; after receiving the response from the target system, it can be processed again through the reverse of the filter chain, and finally the response will be returned to the request initiator.

7. The scalable gateway access method for industrial control system integration according to claim 1, characterized in that, The gateway platform receives service requests from external and internal systems. The specific process is as follows: The gateway platform receives service requests from both external clients and internally integrated systems. It parses the requests to extract key elements, which include at least the target manufacturer's system identifier and operation instructions. The route controller matches key elements with a pre-configured routing rule base to determine the target routing rule serving the request and its dynamically bound filter chain, generating a routing decision context; Based on the routing decision context, multiple filter functions integrated in the filter chain are executed sequentially. The verified and adapted requests are distributed to the target manufacturer's system via the gateway communication module. After receiving the original response returned by the target system, the response data is processed again by the corresponding filter in the filter chain to convert it into the format expected by the request initiator. Finally, the processing result is returned, completing a closed loop of business interaction across the manufacturer's system.

8. The scalable gateway access method for industrial control system integration according to claim 1, characterized in that, The system adaptation plugins in step one include at least one of the following types: Industrial protocol adapter plug-in, used to connect to devices or systems that support Modbus, PROFIBUS, OPC UA, and MQTT protocols; Enterprise application adapter plugins are used for data exchange with ERP, MES, and SCADA systems; The security enhancement plugin provides proprietary encryption algorithms, intrusion detection, and access control logic.

Images