Method and system for recovering protected file of trusted DCS system, and electronic device, storage medium and computer program product

Abstract

The present application belongs to the technical field of data processing of a trusted DCS system. Disclosed are a method and system for recovering a protected file of a trusted DCS system, and an electronic device, a storage medium and a computer program product. The method comprises: periodically determining whether a protected file in a trusted backup configuration file in a trusted DCS system has been tampered with; when it is determined that the protected file has been tampered with, recording information of a process using the tampered protected file, and terminating the process using the tampered protected file; completely deleting the tampered protected file; replacing the tampered protected file with a backup protected file, which corresponds to the tampered protected file, at a location of the tampered protected file; and then on the basis of the information of the process using the tampered protected file, recovering the terminated process using the tampered protected file. By means of the present application, after protected files in a trusted DCS system have been tampered with, the protected files that are lost or damaged can be recovered in a timely manner, so as to ensure the stability of production operation.

Description

A method and system for recovering protected files from a trusted DCS system, as well as electronic devices, storage media, and computer program products.

[0001] Cross-reference of related applications

[0002] This application claims priority to Chinese Patent Application No. 202510063140.1, filed on January 15, 2025, entitled "A Method and Apparatus for Recovering Protected Files of a Trusted DCS System", the entire contents of which are incorporated herein by reference. Technical Field

[0003] This application belongs to the field of data processing technology of trusted DCS systems, specifically relating to a method and system for recovering protected files in a trusted DCS system, electronic equipment, storage media, and computer program products. Background Technology

[0004] Trusted DCS systems play a crucial role in industrial production, monitoring and controlling the production process to ensure normal equipment operation and production efficiency. Protection files within a trusted DCS system are vital for its normal operation and production decisions. Loss or corruption of these files (i.e., tampering) can lead to production interruptions, data loss or leakage, resulting in significant losses and risks, and impacting production stability. However, current technology cannot promptly recover lost or corrupted protection files within a trusted DCS system, further affecting production stability. Summary of the Invention

[0005] To address the problems existing in the prior art, the purpose of this application is to provide a method and system for recovering protected files in a trusted DCS system, as well as electronic devices, storage media, and computer program products. This application can promptly recover protected files that have been lost or damaged after being tampered with in a trusted DCS system, thereby ensuring the stability of production operations.

[0006] To achieve the above objectives, the technical solution adopted in this application is as follows:

[0007] A method for recovering protected files in a trusted DCS system includes the following steps:

[0008] Periodically check whether the protected files in the trusted backup configuration file of the trusted DCS system have been tampered with;

[0009] When it is determined that a protected file has been tampered with, the information of the process using the tampered protected file is recorded, and the process using the tampered protected file is closed.

[0010] When a process that uses a protected file that has been tampered with closes, the tampered protected file will be completely deleted.

[0011] Once the tampered protected file is completely deleted, replace it with the backup protected file corresponding to the tampered protected file at the location of the tampered protected file.

[0012] Once the backup protection file corresponding to the tampered protection file is replaced at the location of the tampered protection file, the closed processes using the tampered protection file are restored based on the information of the processes using the tampered protection file.

[0013] Optionally, the process of periodically checking whether the protected files in the trusted backup configuration file of the trusted DCS system have been tampered with includes:

[0014] Periodically calculate the SM3 value of the protected file in the trusted backup configuration file to obtain the SM3 calculated value of the protected file.

[0015] The SM3 calculated value of the protected file is compared with the SM3 value of the protected file stored in the established database. If the SM3 calculated value of the protected file is inconsistent with the SM3 value of the protected file in the database, it is considered that the protected file has been tampered with.

[0016] Optionally, when it is determined that a protected file has been tampered with, the process of recording information about the process using the tampered protected file and closing the process using the tampered protected file includes:

[0017] Examine the tampered protected files to determine if any processes in the trusted DCS system are using the tampered protected files. If a process is using the tampered protected files, record the information of the process using the tampered protected files.

[0018] After recording the information of the process using the tampered protected file, the system invokes the process shutdown command of the platform system where the trusted DCS system is located to shut down the process using the tampered protected file.

[0019] Optionally, the protected files that have been tampered with will be completely deleted, including:

[0020] The deletion command of the trusted DCS system platform will completely delete the tampered protected file.

[0021] Optionally, after a tampered protected file is completely deleted, the backup protected file corresponding to the tampered protected file is replaced in the location of the tampered protected file, including:

[0022] Read the encrypted backup protection file corresponding to the tampered protection file;

[0023] Decrypt the encrypted backup protection file to obtain the decrypted backup protection file;

[0024] The SM3 value of the decrypted backup protection file is compared with the SM3 value of the backup protection file in the database. When the SM3 value of the decrypted backup protection file is equal to the SM3 value of the backup protection file in the database, the decrypted backup protection file is replaced in the location of the tampered protection file.

[0025] Optionally, the method for restoring protected files of the aforementioned trusted DCS system in this application also includes a backup process for the protected files:

[0026] Write the path of the protected file to be protected into the trusted backup configuration file;

[0027] After the trusted DCS system starts up, it checks whether a trusted backup configuration file exists in the configuration file path of the trusted DCS system.

[0028] If a trusted backup configuration file exists in the configuration file path, the trusted backup configuration file is read to obtain the information in the trusted backup configuration file; the SM3 value of the protected file is calculated and stored in the database;

[0029] Based on the information in the trusted backup configuration file, the configuration information of each protected file is read, and a globally unique object identifier is generated. The object identifier and the configuration information of the protected file are stored in the database. The protected file is then encrypted using a trusted chip to obtain the backup protected file.

[0030] Save the backup protection file, and store the filename and path of the backup protection file in the database.

[0031] This application also provides a system for recovering protected files in a trusted DCS system, used to implement the method for recovering protected files in the trusted DCS system described above, including:

[0032] Judgment module: Used to periodically determine whether the protected files in the trusted backup configuration file of the trusted DCS system have been tampered with;

[0033] Execution module: When it is determined that a protected file has been tampered with, it records the information of the process using the tampered protected file and closes the process using the tampered protected file.

[0034] Deletion module: Used to completely delete the tampered protected file after the process using the tampered protected file is closed;

[0035] Replacement module: When a tampered protected file is completely deleted, it replaces the original protected file with the backup protected file corresponding to the tampered protected file at the location of the tampered protected file.

[0036] Recovery module: When the backup protection file corresponding to the tampered protection file is replaced at the location of the tampered protection file, the recovery module restores the closed processes that use the tampered protection file based on the information of the processes that use the tampered protection file.

[0037] This application also provides an electronic device, including:

[0038] One or more processors;

[0039] A storage device on which one or more programs are stored;

[0040] When the one or more programs are executed by the one or more processors, the one or more processors implement the method for restoring protected files of the trusted DCS system as described above in this application.

[0041] This application also provides a storage medium storing a computer program thereon, wherein the computer program, when executed by a processor, implements the method for restoring protected files of the trusted DCS system described above.

[0042] This application also provides a computer program product comprising computer instructions, characterized in that the computer instructions instruct a computer to execute the method for restoring protected files of a trusted DCS system as described above.

[0043] This application has the following beneficial effects:

[0044] The method for restoring protection files in the trusted DCS system proposed in this application can quickly restore abnormal protection files. It can rapidly restore complete protection files when they are damaged or maliciously tampered with, reducing the impact on the trusted DCS system. At the same time, this application can handle other processes that are using abnormal protection files, preventing the protection files from being occupied and causing recovery failure.

[0045] Optionally, when replacing the tampered protection file with the backup protection file at the location of the tampered protection file, this application compares the SM3 value of the decrypted backup protection file with the SM3 value of the backup protection file in the database, ensuring that the restored protection file has not been tampered with and ensuring the security of the trusted DCS system.

[0046] Optionally, the backup process of the protected file provided in this application uses a trusted chip to encrypt the protected file during backup, ensuring the integrity and confidentiality of the protected file, preventing malicious modification of the backup protected file, effectively dealing with various unexpected situations, and ensuring the security and reliability of system data. Attached Figure Description

[0047] Figure 1 is a flowchart of the method for restoring protected files in the trusted DCS system of this application. Detailed Implementation

[0048] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0049] Example 1

[0050] The method for restoring protected files in the trusted DCS system of this embodiment includes the following steps:

[0051] S1, the file protection process in the trusted DCS system periodically calculates the SM3 value of the protected files in the trusted backup configuration files according to the measurement time interval of each trusted backup configuration file, and obtains the SM3 calculated value of the protected file; the SM3 calculated value of the protected file is compared with the SM3 value of the protected file stored in the database. If the SM3 calculated value of the protected file is consistent with the SM3 value of the protected file in the database, it is considered that the protected file has not been tampered with; when the SM3 calculated value of the protected file is inconsistent with the SM3 value of the protected file in the database, it is considered that the protected file has been tampered with, and the tampered protected file is considered an abnormal protected file.

[0052] S2, when the protected file is tampered with, the file protection recovery mechanism is immediately started; in this step, when the protected file is tampered with, the file protection process can also generate an alarm and report it to the alarm window of the trusted DCS system, and remind the user through a pop-up window.

[0053] S3, after the file protection mechanism is activated, the file protection process uses a viewing command to check for abnormal protected files, determining if any processes in the trusted DCS system are using these files. If so, the process's information is recorded, and the file protection process calls the process shutdown command of the trusted DCS system's platform to terminate the process using the abnormal protected file. In this step, the trusted DCS system's platform can be a Linux, Windows, or Mac system. When the trusted DCS system's platform is Linux, the file protection process uses the `lsof` command to check for abnormal protected files, and uses the Linux system's `kill` command to terminate the process using the abnormal protected file. Furthermore, in the above scheme, the information of the abnormal protected file process includes the process name, PID number, and startup parameters.

[0054] S4. When the process using the abnormal protected file is closed, the file protection process calls the delete command of the platform system where the trusted DCS system is located to completely delete the abnormal protected file. In this step, when the platform system where the trusted DCS system is located is a Linux system, the file protection process calls the delete command rm of the Linux system to completely delete the abnormal protected file.

[0055] S5. After the tampered protected file is completely deleted, the file protection process reads the OID and the encrypted backup protected file corresponding to the abnormal protected file from the database. The file protection process then calls the trusted chip to decrypt the backup protected file, obtaining the decrypted backup protected file. Next, it compares the SM3 value of the decrypted backup protected file with the SM3 value of the backup protected file in the database. When the SM3 value of the decrypted backup protected file is equal to the SM3 value of the backup protected file in the database, the decrypted backup protected file is replaced in the location of the abnormal protected file.

[0056] S5, after the decrypted backup protection file is replaced at the location of the abnormal protection file, the file protection process restores the process that used the abnormal protection file and was closed in S3.

[0057] The backup process for protected files in the above-mentioned solution of this application includes the following steps:

[0058] Step 1: Write the path of the file to be protected into the trusted backup configuration file (e.g., trust_backup.josn); the trusted backup configuration file contains protection parameters, including: the path of the protected file, whether to issue an alarm, the measurement time interval, and whether to block.

[0059] Step 2: After the trusted DCS system starts up, the file protection process first checks whether a trusted backup configuration file exists in the configuration file path of the trusted DCS system (such as / etc / trust_config / ). If a trusted backup configuration file exists, the file protection process reads the trusted backup configuration file to obtain the information in the trusted backup configuration file. Based on the information in the trusted backup configuration file, the file protection process reads the configuration information of each protected file, generates a globally unique OID (i.e., object identifier), and stores the OID and the configuration information of the protected file in the database.

[0060] While the file protection process is reading the trusted backup configuration file, it starts multi-threading to protect the SM3 value of the file, calculates the SM3 value of the file, and stores the SM3 value of the file in the database.

[0061] Step 3: The file protection process starts multi-threaded encryption backup, encrypts the protected file using a trusted chip, saves the encrypted protected file, and saves the file name and path of the encrypted protected file in the database.

[0062] As can be seen from the above scheme, this application utilizes the characteristics of a trusted DCS system to achieve secure storage and reliable recovery of protected files. This method not only effectively prevents the risk of protected files being lost or damaged, but also ensures the integrity and confidentiality of the protected files. By employing encryption technology to protect the security of backup protected files, various unexpected situations can be effectively addressed, ensuring data security and reliability. Furthermore, this application also provides a function for quickly recovering protected files, enabling rapid restoration of the integrity of protected files in the event of loss, damage, or malicious tampering, reducing the impact of trusted DCS system failures on work.

[0063] Furthermore, embodiments of this application also provide a system for implementing the method for restoring protected files of the trusted DCS system described above, the system comprising:

[0064] Judgment module: Used to periodically determine whether the protected files in the trusted backup configuration file of the trusted DCS system have been tampered with;

[0065] Execution module: When it is determined that a protected file has been tampered with, it records the information of the process using the tampered protected file and closes the process using the tampered protected file.

[0066] Deletion module: Used to completely delete the tampered protected file after the process using the tampered protected file is closed;

[0067] Replacement module: When a tampered protected file is completely deleted, it replaces the original protected file with the backup protected file corresponding to the tampered protected file at the location of the tampered protected file.

[0068] Recovery module: When the backup protection file corresponding to the tampered protection file is replaced at the location of the tampered protection file, the recovery module restores the closed processes that use the tampered protection file based on the information of the processes that use the tampered protection file.

[0069] The process by which the judgment module periodically judges whether the protected file in the trusted backup configuration file of the trusted DCS system has been tampered with includes:

[0070] Based on the measurement time interval of each trusted backup configuration file, the SM3 value of the protected file in the trusted backup configuration file is calculated periodically to obtain the SM3 calculated value of the protected file. The SM3 calculated value of the protected file is compared with the SM3 value of the protected file stored in the database. If the SM3 calculated value of the protected file is consistent with the SM3 value of the protected file in the database, it is considered that the protected file has not been tampered with. When the SM3 calculated value of the protected file is inconsistent with the SM3 value of the protected file in the database, it is considered that the protected file has been tampered with.

[0071] The process by which the replacement module replaces the backup protection file corresponding to the tampered protection file with the location of the tampered protection file includes:

[0072] The system reads the OID and the encrypted backup protection file corresponding to the abnormal protection file from the database, and calls the trusted chip to decrypt the backup protection file to obtain the decrypted backup protection file. Then, it compares the SM3 value of the decrypted backup protection file with the SM3 value of the backup protection file in the database. When the SM3 value of the decrypted backup protection file is equal to the SM3 value of the backup protection file in the database, the decrypted backup protection file is replaced in the position of the abnormal protection file.

[0073] This application also provides a system for implementing the above-described backup process for protected files, the system comprising:

[0074] Write unit: Used to write the path of the protected file to be protected into the trusted backup configuration file;

[0075] Detection unit: Used to detect whether a trusted backup configuration file exists in the configuration file path of the trusted DCS system after the trusted DCS system is started;

[0076] Calculation unit: When a trusted backup configuration file exists in the configuration file path, it reads the trusted backup configuration file, obtains the information in the trusted backup configuration file, calculates the SM3 value of the protected file, and stores the SM3 value of the protected file in the database;

[0077] Generation and encryption unit: Used to read the configuration information of each protected file according to the information in the trusted backup configuration file, generate a globally unique object identifier, store the object identifier and the configuration information of the protected file in the database; encrypt the protected file using a trusted chip to obtain the backup protected file;

[0078] Storage unit: Used to save backup protection files, storing the filenames and paths of the backup protection files in the database.

[0079] This application also provides a computer program product, which includes computer instructions that instruct a computer to execute a method for restoring protected files of the trusted DCS system.

[0080] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means that implement the functions specified in one or more flowcharts and / or one or more block diagrams.

[0081] These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, such that the instructions, which execute on the computer or other programmable apparatus, provide steps for implementing the functions specified in one or more flowcharts and / or one or more block diagrams.

[0082] This application may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application may take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, readable storage media, optical storage, etc.) containing computer-usable program code.

[0083] Obviously, the described embodiments are only some, not all, of the embodiments in this application. All other embodiments obtained by those skilled in the art based on the embodiments in this application without inventive effort should fall within the scope of protection of this application.

[0084] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application and not to limit them. Although this application has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of this application. Any modifications or equivalent substitutions that do not depart from the spirit and scope of this application should be covered within the protection scope of the claims of this application.

Claims

1. A method for recovering protected files in a trusted DCS system, characterized in that, The process includes the following: Periodically check whether the protected files in the trusted backup configuration file of the trusted DCS system have been tampered with; When it is determined that a protected file has been tampered with, the information of the process using the tampered protected file is recorded, and the process using the tampered protected file is closed. When a process that uses a protected file that has been tampered with closes, the tampered protected file will be completely deleted. Once the tampered protected file is completely deleted, replace it with the backup protected file corresponding to the tampered protected file at the location of the tampered protected file. Once the backup protection file corresponding to the tampered protection file is replaced at the location of the tampered protection file, the closed processes using the tampered protection file are restored based on the information of the processes using the tampered protection file.

2. The method for restoring protected files in a trusted DCS system according to claim 1, characterized in that, The process of periodically determining whether the protected files in the trusted backup configuration file of the trusted DCS system have been tampered with includes: Periodically calculate the SM3 value of the protected file in the trusted backup configuration file to obtain the SM3 calculated value of the protected file. The SM3 calculated value of the protected file is compared with the SM3 value of the protected file stored in the established database. If the SM3 calculated value of the protected file is inconsistent with the SM3 value of the protected file in the database, it is considered that the protected file has been tampered with.

3. The method for restoring protected files in a trusted DCS system according to claim 1, characterized in that, When it is determined that a protected file has been tampered with, the process of recording information about the process using the tampered protected file and closing the process using the tampered protected file includes: Examine the tampered protected files to determine if any processes in the trusted DCS system are using the tampered protected files. If a process is using the tampered protected files, record the information of the process using the tampered protected files. After recording the information of the process using the tampered protected file, the system invokes the process shutdown command of the platform system where the trusted DCS system is located to shut down the process using the tampered protected file.

4. The method for restoring protected files in a trusted DCS system according to claim 1, characterized in that, Completely delete the protected files that have been tampered with, including: The deletion command of the trusted DCS system platform will completely delete the tampered protected file.

5. The method for restoring protected files in a trusted DCS system according to claim 1, characterized in that, After a tampered protected file is completely deleted, the backup protected file corresponding to the tampered protected file is used to replace the original protected file in its place. This includes: Read the encrypted backup protection file corresponding to the tampered protection file; Decrypt the encrypted backup protection file to obtain the decrypted backup protection file; The SM3 value of the decrypted backup protection file is compared with the SM3 value of the backup protection file in the database. When the SM3 value of the decrypted backup protection file is equal to the SM3 value of the backup protection file in the database, the decrypted backup protection file is replaced in the location of the tampered protection file.

6. The method for restoring protected files in a trusted DCS system according to claim 1, characterized in that, It also includes the backup process for protecting files: Write the path of the protected file to be protected into the trusted backup configuration file; After the trusted DCS system starts up, it checks whether a trusted backup configuration file exists in the configuration file path of the trusted DCS system. If a trusted backup configuration file exists in the configuration file path, the trusted backup configuration file is read to obtain the information in the trusted backup configuration file; It also calculates the SM3 value of the protected file and stores the SM3 value of the protected file in the database; Based on the information in the trusted backup configuration file, the configuration information of each protected file is read, and a globally unique object identifier is generated. The object identifier and the configuration information of the protected file are then stored in the database. The protected file is encrypted using a trusted chip, resulting in a backup protected file; Save the backup protection file, and store the filename and path of the backup protection file in the database.

7. A system for recovering protected files in a trusted DCS system, characterized in that, include: Judgment module: Used to periodically determine whether the protected files in the trusted backup configuration file of the trusted DCS system have been tampered with; Execution module: When it is determined that a protected file has been tampered with, it records the information of the process using the tampered protected file and closes the process using the tampered protected file. Deletion module: Used to completely delete the tampered protected file after the process using the tampered protected file is closed; Replacement module: When a tampered protected file is completely deleted, it replaces the original protected file with the backup protected file corresponding to the tampered protected file at the location of the tampered protected file. Recovery module: When the backup protection file corresponding to the tampered protection file is replaced at the location of the tampered protection file, the recovery module restores the closed processes that use the tampered protection file based on the information of the processes that use the tampered protection file.

8. An electronic device, characterized in that, include: One or more processors; A storage device on which one or more programs are stored; When the one or more programs are executed by the one or more processors, the one or more processors implement the method for restoring protected files of a trusted DCS system as described in any one of claims 1 to 6.

9. A storage medium, characterized in that, It stores a computer program, wherein when the computer program is executed by a processor, it implements the method for restoring protected files of a trusted DCS system as described in any one of claims 1 to 6.

10. A computer program product, the computer program product comprising computer instructions, characterized in that, The computer instructions instruct the computer to execute the method for restoring protected files of the trusted DCS system as described in any one of claims 1-6.

Images