CN117784743A - A trusted DCS control system and method - Google Patents

Abstract

The invention discloses a trusted DCS control system and a method, comprising an upper computer, a switch and a lower computer, wherein the upper computer comprises a trusted operation station, and the lower computer comprises a trusted controller, a clock module, a system bus interface, an external bus interface, a firmware storage unit and a power module for providing electric energy; the trusted controller comprises a trusted CPU, an FPGA, a program storage unit, a configuration storage unit and a trusted module; the system and the method can ensure that the safety of an intranet is improved, and the protection capability is excellent.

Description

A trusted DCS control system and method

Technical field

The invention belongs to the field of automatic control, relates to a control system and a method, and specifically relates to a trusted DCS control system and method.

Background technique

At present, the core equipment of power infrastructure - thermal power DCS control system faces severe security risks. In order to meet the requirements of industrial real-time, most DCS control systems do not consider the inherent security characteristics of the system during design, resulting in the system being in an unprotected state during operation and weak security protection capabilities. Based on the requirements of continuous production of industrial control systems, it is difficult to update the system in real time, and traditional patch-type anti-virus and detection methods are difficult to ensure the long-term security and stability of the system. The traditional boundary protection methods of domestically produced DCS control systems can only achieve internal and external network security isolation, horizontally guarantee the security of the system, cannot guarantee the security of the internal network, and cannot achieve a deep protection effect. Once the boundaries such as firewalls are breached, the entire control system will lose its protection capabilities and other problems. The current protection methods cannot fundamentally solve the inherent security problems of the DCS control system, and cannot respond to new virus attacks in a timely manner, resulting in the system being unable to effectively protect, which brings great hidden dangers to power safety production.

Summary of the invention

The purpose of the present invention is to overcome the shortcomings of the above-mentioned prior art and provide a trusted DCS control system and method, which can improve the security of the intranet and have excellent protection capabilities.

In order to achieve the above objectives, the trusted DCS control system of the present invention includes a host computer, a switch and a slave computer, wherein the host computer includes a trusted operating station, and the slave computer includes a trusted controller, a clock module, a system Bus interface, external bus interface, firmware storage unit and power module for providing power; trusted controller includes trusted CPU, FPGA, program storage unit, configuration storage unit and trusted module;

The trusted operating station is connected to the switch, the switch is connected to the FPGA via the external bus interface, the trusted CPU is connected to the FPGA, the trusted module, the clock module, the program storage unit, the configuration storage unit and the firmware storage unit, and the FPGA is connected to connected to the system bus interface.

The trusted module uses a TPM chip.

The host computer also includes a trusted server, and the trusted server is connected to the switch.

The configuration storage unit is non-volatile random access memory.

The trusted DCS control method of the present invention comprises the following steps:

After the power module supplies power, the trusted module uses the trusted CPU to perform trustworthy measurement on the system firmware in the firmware storage unit. When the system firmware trustworthy standard passes, the system will start and load normally. If the system firmware trustworthy standard does not pass, then the system will start and load normally. Cut off the power supply to the peripheral interface chip to prevent incorrect instructions from being issued, causing malfunction of the equipment;

After the system is started and loaded normally, the trusted module uses the trusted CPU to perform trustworthy measurement on the application in the program storage unit. When the application's trustworthy measure passes, the trusted controller starts normally. Otherwise, the trusted controller starts normally. The controller cannot start normally, and the power module cuts off the power supply to the interface chip that communicates with the outside.

After the trusted controller is started normally, the following steps are also included:

FPGA program loading and register configuration are performed through the data bus.

After the FPGA program is loaded normally, the system bus interface is initialized, communicates with the externally measured IO module through the system bus interface, collects the measurement data sent by the IO module, and issues the data analysis results and device parameters.

After the FPGA program is loaded normally, the external bus interface is initialized and connected to the trusted operation station and the trusted server through the switch.

After the trusted operation station starts normally, the operator configures and delivers trusted control parameters in real time through the trusted operation station to realize communication between the trusted operation station and the lower computer.

The present invention has the following beneficial effects:

During specific operations, the trusted DCS control system and method of the present invention do not use traditional software security measures, but use trusted CPUs, trusted modules and trusted operating stations to realize hardware reliability from the full link of the system. Trust, avoiding traditional patching anti-virus and detection methods. At the same time, the trusted controller complements the controlled power module when performing measurements. When the trustworthiness does not pass, the power module automatically cuts off the power to the external communication interface. , prevent the issuance of false trigger signals, effectively ensure the complete trustworthiness of the trusted controller, improve the security of the intranet, and have excellent protection capabilities.

Description of drawings

Figure 1 is a schematic structural diagram of the present invention.

Among them, 1 is a trusted operating station, 2 is a trusted server, 3 is a switch, 4 is a trusted CPU, 5 is an FPGA, 6 is a system bus interface, 7 is an external bus interface, 8 is a clock module, and 9 is a trusted module, 10 is the power module, 11 is the firmware storage unit, 12 is the configuration storage unit, and 13 is the program storage unit.

Detailed ways

In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only These are part of the embodiments of the present invention, not all of them, and are not intended to limit the scope of the disclosure of the present invention. Furthermore, in the following description, descriptions of well-known structures and techniques are omitted to avoid unnecessarily obscuring the concepts disclosed in the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts should fall within the scope of protection of the present invention.

A schematic structural diagram according to a disclosed embodiment of the present invention is shown in the accompanying drawings. The drawings are not drawn to scale, with certain details exaggerated and may have been omitted for purposes of clarity. The shapes of the various regions and layers shown in the figures and the relative sizes and positional relationships between them are only exemplary. In practice, there may be deviations due to manufacturing tolerances or technical limitations, and those skilled in the art will base their judgment on actual situations. Additional regions/layers with different shapes, sizes, and relative positions can be designed as needed.

Referring to FIG1 , the trusted DCS control system of the present invention includes a host computer, a switch 3 and a slave computer;

The host computer includes a trusted operation station 1 and a trusted server 2, and the lower computer includes a trusted controller, a clock module 8, a system bus interface 6, an external bus interface 7, a firmware storage unit 11, and a power supply module 10 for providing electric energy; the trusted controller includes a trusted CPU 4, an FPGA 5, a program storage unit 13, a configuration storage unit 12, and a trusted module 9;

Among them, the trusted operating station 1 is connected to the switch 3, the switch 3 is connected to the FPGA 5 via the external bus interface 7, the trusted CPU 4 is connected to the FPGA 5, the trusted module 9, the clock module 8, the program storage unit 13, and the configuration storage unit 12 is connected to the firmware storage unit 11, and the FPGA 5 is connected to the system bus interface 6.

In this embodiment, the trusted module 9 uses a TPM chip.

Based on the above trusted DCS control system, the trusted DCS control system method of the present invention includes the following steps:

1) After the power supply module 10 supplies power, the trusted module 9 uses the trusted CPU 4 to perform trustworthiness on the system firmware in the firmware storage unit 11. When the system firmware trustworthiness passes, the system starts and loads normally, and the system firmware is trustworthy. If the measurement fails, the power module 10 cuts off the power supply.

2) After the system is started and loaded normally, the trusted module 9 uses the trusted CPU 4 to perform trustworthiness on the application program in the program storage unit 13. When the trustworthiness of the application program is correct, the trusted controller starts normally. Otherwise, Then the trusted controller cannot start normally, and the power module 10 cuts off the power supply.

3) After the trusted controller starts normally, program loading and register configuration of FPGA5 are performed through the data bus (PCIE, LPC, network port).

4) After the FPGA5 program loads normally, initialize the system bus interface 6, communicate with the external measured IO module through the system bus interface 6, collect the measurement data sent by the IO module, analyze the data and issue the parameters of the device.

After the FPGA5 program is loaded normally, the external bus interface 7 is initialized and connected to the trusted operating station 1 and the trusted server 2 through the switch 3. After the trusted operating station 1 starts normally, the operator performs trusted operations in real time through the trusted operating station 1. Control parameter configuration and distribution to achieve communication between the trusted operation station 1 and the lower computer.

5) The trusted controller transmits the collected lower computer data to the trusted server 2 through the switch 3 for data storage.

6) The operator uses the trusted operation station 1 and the switch 3 to retrieve and view the historical data stored in the trusted server 2.

The configuration storage unit 12 is a non-volatile random access memory NVRAM, which is used to store the configuration file issued by the trusted operating station 1 for automatic real-time retrieval within the trusted CPU 4 .

The power module 10 supplies power to the lower computer. After the initial power-on, if the trustworthiness of the trusted CPU 4 and the trusted module 9 cannot pass, the power supply is cut off.

The clock module 8 is used to provide clocks for the trusted CPU 4 , FPGA 5 and data bus.

It should be noted that the present invention has the following characteristics:

The present invention does not adopt traditional software security means, but adopts trusted CPU 4, trusted module 9, trusted operation station 1 and trusted server 2 to realize hardware trust from the whole link of the system, avoids traditional patch-type anti-virus and detection means, realizes security functions such as "trusted verification" of Information Security Technology 2.0, meets the requirements of confidentiality evaluation for trusted computing, increases the system's inherent active defense capabilities, improves the overall security and reliability of the system, and is easy to maintain in the later stage, facilitating large-scale promotion and application.

Reasonably allocate the internal storage of the trusted control to achieve the rationality of the trustworthiness, and adjust the status of the trusted controller in real time through different memory storage strategies.

When the trusted controller performs measurements, it strictly complements the power supply module 10 to implement the hard logic that if the trustworthy measurement fails, the power supply system of the power supply module 10 will automatically cut off, effectively ensuring the complete trustworthiness of the trusted controller.

The trusted controller includes a trusted CPU4, an FPGA5, a program storage unit 13, a configuration storage unit 12, and a trusted module 9. When the system detects that there is a trusted module 9 on the board, when it is powered on, the trusted module 9 The security measurement of the firmware in the storage unit 11 realizes the detection and loading of the trusted program when it is started. When the measurement is correct through the TPM chip, the trusted controller starts normally. Otherwise, the program in the trusted controller is considered to have been illegal. If tampered, the trusted controller will not be able to start normally, and the operator can be reminded to check and replace it. At the same time, when the national DCS trusted controller is running normally, key program modules are dynamically measured. The TPM security measurement chip is used to achieve real-time program measurement. When there is a problem with the signature verification during real-time measurement, the trusted control The controller will report the measurement results to a trusted management platform for decision-making. The trusted controller will execute different strategies according to different working conditions stored in the flash to protect the operating units and avoid traditional patching and upgrade methods. , to facilitate product promotion and maintenance.

It should be noted that the present invention performs dynamic trustworthiness verification in the key execution links of the application program, issues an alarm after detecting that its trustworthiness has been damaged, and forms an audit record of the verification results and sends them to the trustworthy security management platform.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims (9)

1. The trusted DCS control system is characterized by comprising an upper computer, a switch (3) and a lower computer, wherein the upper computer comprises a trusted operation station (1), and the lower computer comprises a trusted controller, a clock module (8), a system bus interface (6), an external bus interface (7), a firmware storage unit (11) and a power module (10) for providing electric energy; the trusted controller comprises a trusted CPU (4), an FPGA (5), a program storage unit (13), a configuration storage unit (12) and a trusted module (9);

the trusted operation station (1) is connected with the switch (3), the switch (3) is connected with the FPGA (5) through an external bus interface (7), the trusted CPU (4) is connected with the FPGA (5), the trusted module (9), the clock module (8), the program storage unit (13), the configuration storage unit (12) and the firmware storage unit (11), and the FPGA (5) is connected with the system bus interface (6).

2. The trusted DCS control system of claim 1, wherein the trusted module (9) employs a TPM chip.

3. The trusted DCS control system of claim 1, wherein the host computer further comprises a trusted server (2), the trusted server (2) being connected to the switch (3).

4. The trusted DCS control system of claim 1, wherein the configuration storage unit (12) is a non-volatile random access memory.

5. A trusted DCS control method, based on the trusted DCS control system of claim 1, comprising the steps of:

after the power module (10) supplies power, the trusted module (9) utilizes the trusted CPU (4) to perform trusted measurement on system firmware in the firmware storage unit (11), when the trusted measurement of the system firmware passes, the system is normally started and loaded, and when the trusted measurement of the system firmware does not pass, the power module (10) cuts off the power supply to the peripheral interface chip;

after the system is normally started and loaded, the trusted module (9) utilizes the trusted CPU (4) to perform trusted measurement on the application program in the program storage unit (13), when the trusted measurement of the application program is passed, the trusted controller is normally started, otherwise, the trusted controller cannot be normally started, and meanwhile, the power supply to the peripheral interface chip is cut off.

6. The trusted DCS control method of claim 5, wherein said trusted controller further comprises, after normal start-up:

and loading programs and configuring registers of the FPGA (5) through a data bus.

7. The method for controlling the trusted DCS according to claim 6, wherein after the FPGA (5) program is loaded normally, a system bus interface (6) is initialized, the system bus interface (6) is communicated with an IO module for external measurement, measurement data sent by the IO module are collected, and analysis results of the measurement data and parameters of equipment are issued.

8. The method for controlling the trusted DCS according to claim 6, wherein after the FPGA (5) is normally loaded, an external bus interface (7) is initialized, and the external bus interface is respectively connected with the trusted operating station (1) and the trusted server (2) through the switch (3).

9. The trusted DCS control method of claim 6, wherein after the trusted operator station (1) is normally started, the operator performs the parameter configuration and issuing of the trusted control in real time through the trusted operator station (1).