KR102170160B1 - Apparatus and method for unidirectional data transmission based on opc-ua - Google Patents

Abstract

Disclosed is an OPC-UA based one-way data transmission apparatus and method. One-way data transmission apparatus for transmitting data from an OPC-UA server to an OPC-UA client according to the present invention receives information of a management target node from the OPC-UA server, and corresponds to a management target node by the OPC-UA server. A transmission proxy for receiving real-time data and historical data corresponding to the management target node by requesting the data to be managed, and the management target node information from the transmission proxy to establish an OPC-UA server proxy, and the transmission Receives the real-time data and the historical data from a proxy, and updates the real-time data and the historical data for the management target node using the established OPC-UA server proxy, and the OPC-UA client It includes a receiving proxy for transmitting data corresponding to the request of the OPC-UA client.

Description

OPC-UA based one-way data transmission device and method {APPARATUS AND METHOD FOR UNIDIRECTIONAL DATA TRANSMISSION BASED ON OPC-UA}

The present invention relates to a one-way data transmission and reception technology between an OPC-UA server and a client in a one-way data transmission environment, and in particular, OPC-UA data for safely transmitting OPC-UA server data in a safe area to an OPC-UA client in a non-secure area. It relates to one-way transmission technology.

Network separation technology is a technology that separates an internal network (business network) and an external network (internet network) to prevent leakage of important data due to external hacking and security incidents. If the network separation technology is applied, a safe environment can be created in terms of security, but work efficiency is degraded because data exchange between the two networks becomes impossible. Therefore, it is necessary to introduce network linkage technology as a means to ensure business continuity.

As a safe control network interworking technique, there is a one-way network connection technology through physical connection line blocking. The physical one-way security gateway is a dedicated hardware-based data transmission system that physically blocks one side of each transmission/reception line so that information is transmitted only in one direction between two systems requiring information transmission.

The physical one-way security gateway is located between the two network areas, and information from areas with high security levels (safe areas) such as the control network is transferred to the outside (non-secure areas), while at the same time physically blocking information from non-secure areas By doing so, it is possible to maintain the security of the safe area.

In order to introduce a one-way security gateway to a network environment that uses a two-way protocol such as the existing TCP, there are many limitations such as maintenance of session information and support for operation of the application layer. Today's technology development tends to solve these problems, but most of them are focusing on blocking physical penetration paths, improving the reliability of data transmission, and increasing the number of supported protocols.For field application, various restrictions such as change of existing network information are additionally required. exist.

That is, there is a case where the unidirectional data transmission device is located in the middle of the existing networks, and the existing network information is lost and is modulated with information of the unidirectional data transmission device. However, since this method requires modification of the existing network information, a method of performing one-way data transfer while maintaining the existing network information is required.

On the other hand, as a representative environment to which the unidirectional data transmission device is applied, there is a control network operated in a major infrastructure. Most of the control networks are in the form of monitoring the data of the separated closed network in the external network, and are performed through the control protocol of various application layers suitable for the control network.

As various control communication protocols according to various control system suppliers are used, the OPC (OLE for Process Control) standard, which is an industry standard for interoperability between interfaces of different suppliers, was designed. OPC UA (OLE for Process Control Unified Architecture) is an industrial data communication standard standardized to IEC62541 by the IEC TC57 group. It integrates the functions of Classic OPC (OPC DA, OPC HDA, OPC A&E) and provides additional services. The limitations of OPC UA can be used as an independent platform, adopts Internet standard and IP-based protocol, and basically operates in the form of server and client.

The OPC UA server collects and stores information through an integrated interface with field devices such as PLC, IED, and RTU inside the control network operated in the form of a separate closed network. And the OPC UA client monitors the information according to the OPC UA communication standard.

Therefore, in order to provide a one-way data transmission method according to the OPC UA communication standard, a comprehensive proxy implementation suitable for the data characteristics transmitted between the OPC UA server and the OPC UA client must be implemented. In addition, it is necessary to develop a technology to effectively transmit OPC UA-based safe area data to non-safe areas without changing the existing settings or operations between the actual OPC UA client and the OPC UA server.

Korean Patent Registration No. 10-1562312, announced on October 21, 2015 (Name: gateway device for physical one-way communication performing data retransmission as a single device and data transmission method using the same)

An object of the present invention is to efficiently transmit OPC UA-based data to an unsafe area while fundamentally blocking external intrusions into a safe area, which is a separated and closed network.

In addition, it is an object of the present invention to ensure transmission reliability for historical data that may be lost without changing separate settings for the existing OPC UA server and OPC UA client.

In addition, it is an object of the present invention to ensure transmission reliability, so that OPC UA-based one-way data can be efficiently transferred from a safe area to a non-secure area.

In addition, an object of the present invention is to enable effective monitoring while protecting the OPC UA server in the main infrastructure.

One-way data transmission apparatus for transmitting data of an OPC-UA server to an OPC-UA client according to the present invention for achieving the above object receives information of a management target node from the OPC-UA server, and the OPC-UA server A transmission proxy that requests data corresponding to the management target node and receives real-time data and historical data corresponding to the management target node, and an OPC-UA server proxy by receiving information of the management target node from the transmission proxy. Construct, receive the real-time data and the historical data from the transmission proxy, and update the real-time data and the historical data for the management target node using the established OPC-UA server proxy, And a receiving proxy for transmitting data corresponding to the request of the OPC-UA client to the OPC-UA client.

In this case, the real-time data may include at least one of OPC DA data, OPC alarm data, and OPC event data, and may be data automatically generated when data of the management target node changes.

In this case, the historical data may be data received from the OPC-UA server to correspond to the periodic transmission request of the transmission proxy.

At this time, the transmission proxy transmits a request for transmission of the historical data corresponding to a request period and a request range to the OPC-UA server, and receives the historical data corresponding to the transmission request from the OPC-UA server. can do.

At this time, the transmission proxy, for each time corresponding to the request period, based on the current time, for a time corresponding to the request range, the transmission request of the historical data requesting the transmission of the OPC- Can be sent to the UA server.

In this case, the reception proxy may rebuild the OPC-UA server proxy when at least one of the transmission proxy and the reception proxy is restarted.

In this case, the receiving proxy may store construction information corresponding to the OPC-UA server proxy when constructing the OPC-UA server proxy.

At this time, the receiving proxy checks the setting information related to the establishment of the OPC-UA server proxy, and if there is information on the previously established node, rebuilds the OPC-UA server proxy based on the establishment information, If the previously established node information does not exist, the OPC-UA server may be rebuilt by receiving the node information from the transmission proxy.

In this case, the receiving proxy may rebuild the OPC-UA server proxy when the transmission proxy is restarted, and selectively rebuild the OPC-UA server proxy when only the receiving proxy is restarted.

In this case, when the receiving proxy receives information on a new node from the transmission proxy, the OPC-UA server proxy may be rebuilt based on the information on the new node.

In addition, a one-way data transmission method performed by an OPC-UA-based one-way data transmission device for transmitting data from an OPC-UA server to an OPC-UA client according to an embodiment of the present invention is a management target from the OPC-UA server. Receiving node information to establish an OPC-UA server proxy, requesting and receiving real-time data from the OPC-UA server, updating the real-time data, and requesting historical data from the OPC-UA server Receiving, updating the historical data, and transmitting data including at least one of the real-time data and the historical data to the OPC-UA client to correspond to the request of the OPC-UA client. Include.

At this time, the OPC-UA-based one-way data transmission device includes a transmission proxy for accessing the OPC-UA server to receive information on the management target node, and the OPC-UA server for the data received from the OPC-UA server. It may include a receiving proxy that sends to the client.

In this case, the real-time data may include at least one of OPC DA data, OPC alarm data, and OPC event data, and may be data automatically generated when data of the management target node changes.

In this case, the historical data may be data received from the OPC-UA server to correspond to a periodic request for transmission of the historical data.

At this time, the updating of the historical data includes: transmitting, by the transmission proxy, a transmission request of the historical data corresponding to a request period and a request range to the OPC-UA server, and the transmission proxy is the OPC- It may include the step of receiving the historical data corresponding to the transmission request from the UA server.

In this case, the step of transmitting the request for transmission of the historical data to the OPC-UA server includes, by the transmission proxy, the history for a time corresponding to the request range based on the current time at each time corresponding to the request period. The historical data transmission request requesting the transmission of the curl data may be transmitted to the OPC-UA server.

In this case, when at least one of the transmission proxy and the reception proxy is restarted, the step of rebuilding the OPC-UA server proxy may be further included.

In this case, when establishing the OPC-UA server proxy, the receiving proxy may further include storing construction information corresponding to the OPC-UA server proxy.

In this case, the step of rebuilding the OPC-UA server proxy includes: the receiving proxy confirms setting information related to the establishment of the OPC-UA server proxy, and if information on the previously established node exists, the establishment information is Rebuilding the OPC-UA server proxy on the basis, and rebuilding the OPC-UA server by receiving the node information from the sending proxy when the previously established node information does not exist. I can.

In this case, the step of rebuilding the OPC-UA server proxy may include rebuilding the OPC-UA server proxy when the transmission proxy is restarted, and selectively the OPC-UA server proxy when only the receiving proxy is restarted. Can be rebuilt.

According to the present invention, it is possible to efficiently transmit OPC UA-based data to a non-safe area while fundamentally blocking external intrusion into a safe area, which is a separated and closed network.

In addition, according to the present invention, it is possible to ensure the reliability of transmission of historical data that may be lost without changing separate settings for the existing OPC UA server and OPC UA client.

In addition, according to the present invention, transmission reliability is guaranteed, and OPC UA-based one-way data can be efficiently transferred from the safe area to the non-secure area.

In addition, according to the present invention, the OPC UA server in the main infrastructure can be monitored effectively while protecting it.

1 is a diagram schematically illustrating an environment to which an OPC-UA-based unidirectional data transmission apparatus according to an embodiment of the present invention is applied.
2 is a block diagram showing the configuration of an OPC-UA-based one-way data transmission apparatus according to an embodiment of the present invention.
3 is a flowchart illustrating an OPC-UA-based one-way data transmission method according to an embodiment of the present invention.
4 is a flowchart illustrating a process of building an OPC-UA server proxy in step S310 of FIG. 3.
5 is a flowchart illustrating a process of updating historical data in step S330 of FIG. 3.
6 is an exemplary view showing historical data of an OPC-UA server according to an embodiment of the present invention.
7 is an exemplary diagram showing historical data received by a reception proxy in FIG. 5.
8 is a flow chart illustrating a process of transmitting unidirectional data in a unidirectional data transmission environment according to an embodiment of the present invention.
9 is a block diagram showing a computer system according to an embodiment of the present invention.

In the present invention, various modifications may be made and various embodiments may be provided, and specific embodiments will be illustrated in the drawings and described in detail.

However, this is not intended to limit the present invention to a specific embodiment, it is to be understood to include all changes, equivalents, and substitutes included in the spirit and scope of the present invention.

The terms used in the present application are only used to describe specific embodiments, and are not intended to limit the present invention. Singular expressions include plural expressions unless the context clearly indicates otherwise. In the present application, terms such as "comprise" or "have" are intended to designate the presence of features, numbers, steps, actions, components, parts, or combinations thereof described in the specification, but one or more other features. It is to be understood that the presence or addition of elements or numbers, steps, actions, components, parts, or combinations thereof, does not preclude in advance.

Unless otherwise defined, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which the present invention belongs. Terms as defined in a commonly used dictionary should be interpreted as having a meaning consistent with the meaning in the context of the related technology, and should not be interpreted as an ideal or excessively formal meaning unless explicitly defined in the present application. Does not.

Hereinafter, preferred embodiments of the present invention will be described in more detail with reference to the accompanying drawings. In describing the present invention, in order to facilitate an overall understanding, the same reference numerals are used for the same elements in the drawings, and duplicate descriptions for the same elements are omitted.

1 is a diagram schematically showing an environment of a one-way data transmission/reception system to which an OPC-UA-based one-way data transmission apparatus according to an embodiment of the present invention is applied.

1, in the one-way data transmission/reception system, the OPC-UA server 100 located in the safe area monitors and manages real-time data and historical data. In addition, the OPC-UA server 100 transmits real-time data and historical data to the OPC-UA client 300 through the one-way data transmission device 200.

The one-way data transmission device 200 arranges a proxy of an OPC-UA server and an OPC-UA client corresponding to the transmitting side and the receiving side, and transmits the data of the OPC-UA server 100 to the OPC-UA client 300. I can.

The data of the OPC-UA server 100 may include real-time data and historical data, and the real-time data may include at least one of OPC DA (Data Access) data, OPC alarm data, and OPC event data. In addition, historical data (HDA) may mean data received from the OPC-UA server 100 to correspond to a periodic transmission request of a transmission proxy.

Hereinafter, the configuration of an OPC-UA-based one-way data transmission apparatus according to an embodiment of the present invention will be described in more detail with reference to FIG. 2.

2 is a block diagram showing the configuration of an OPC-UA-based one-way data transmission apparatus according to an embodiment of the present invention.

As shown in FIG. 2, the OPC-UA-based one-way data transmission apparatus 200 includes a send proxy 210 and a receive proxy 220.

The transmission proxy 210 receives information on the management target node from the OPC-UA server 100 and requests data corresponding to the management target node to the OPC-UA server 100. In addition, the transmission proxy 210 may receive real-time data and historical data corresponding to the management target node from the OPC-UA server 100.

For convenience of explanation, it has been described that the transmission proxy 210 requests data from the OPC-UA server 100, but the transmission proxy 210 provides the process of requesting real-time data to the OPC-UA server 100 and historical data. The requested process can be separated and performed as a separate process.

In particular, the transmission proxy 210 transmits a request for transmission of historical data corresponding to the request period and the request range to the OPC-UA server 100, and the historical data corresponding to the transmission request from the OPC-UA server 100 Can receive.

The transmission proxy 210 may request transmission of historical data for a time corresponding to the request range based on the current time at each time corresponding to the request period. For example, assuming that the current time is 4 p.m. and the request range is 3 hours, the transmission proxy 210 sends the OPC-UA server 100 to the OPC-UA server 100 for 3 hours from 1 p.m. to 4 p.m. Can request transmission of

Next, the reception proxy 220 receives information on the management target node from the transmission proxy 210 to establish an OPC-UA server proxy, and receives real-time data and historical data from the transmission proxy 210. In addition, the reception proxy 220 may update real-time data and historical data for a managed node using the established OPC-UA server proxy. Further, the reception proxy 220 may transmit data corresponding to the request of the OPC-UA client 300 to the OPC-UA client 300.

Here, the real-time data may include at least one of OPC DA data, OPC alarm data, and OPC event data, and may be automatically generated when data of a management target node changes. In addition, the historical data may mean data received from the OPC-UA server 100 to correspond to the periodic transmission request of the transmission proxy 210.

The reception proxy 220 may store construction information corresponding to the OPC-UA server proxy when constructing the OPC-UA server proxy. In addition, when at least one of the transmission proxy 210 and the reception proxy is restarted, the reception proxy 220 may rebuild the OPC-UA server proxy. At this time, the receiving proxy 220 may check the setting information related to the establishment of the OPC-UA server proxy, and if there is information on the previously established node, the OPC-UA server proxy may be rebuilt based on the establishment information.

On the other hand, if the previously established node information does not exist, the receiving proxy 220 may receive the node information from the transmitting proxy 210 and rebuild the OPC-UA server proxy.

In addition, the receiving proxy 220 rebuilds the OPC-UA server proxy when the transmission proxy 210 is restarted, whereas when only the receiving proxy 220 is restarted, the OPC-UA server proxy is selectively rebuilt. can do. In addition, when the receiving proxy 220 receives information of a new node from the transmitting proxy 210, the OPC-UA server proxy may be rebuilt based on the information of the new node.

Hereinafter, an OPC-UA-based one-way data transmission method performed by an OPC-UA-based one-way data transmission apparatus according to an embodiment of the present invention will be described in more detail with reference to FIGS. 3 and 4.

3 is a flowchart illustrating an OPC-UA-based one-way data transmission method according to an embodiment of the present invention.

First, the OPC-UA-based one-way data transmission apparatus 200 constructs an OPC-UA server proxy (S310).

The transmission proxy 210 serves as an OPC-UA client proxy, and requests node information by accessing the OPC-UA server 100 in the safe area in the same manner as the OPC-UA client 300 in the non-secure area. Then, the node information is received from the OPC-UA server 100. Then, the transmission proxy 210 transmits the node information to the reception proxy 220 to establish an OPC-UA server proxy.

At this time, the OPC-UA server proxy uses the same IP address as the OPC-UA server in the safe area, so that the OPC-UA client 300 in the non-secure area directly accesses the OPC-UA server 100 in the safe area. It has substantially the same effect, and it is possible to access the OPC-UA server 100 without a separate setting change.

OPC-UA-based one-way data transmission in order to solve the synchronization problem with the OPC-UA server 100 in the safe area when the transmission proxy 210 or the reception proxy 220 is restarted due to system maintenance or the like The device 200 may perform the process of FIG. 4 to be described later. In this case, the process of FIG. 4 is basically applied to the receiving proxy 220 in which the OPC-UA server proxy is built, and the receiving proxy 220 receives information of a node managed by the OPC-UA server 100, and the same You can build an OPC-UA server proxy that performs a function.

4 is a flowchart illustrating a process of building an OPC-UA server proxy in step S310 of FIG. 3.

As shown in Fig. 4, the OPC-UA-based one-way data transmission apparatus 200 checks OPC-UA server proxy-related setting information (S410).

The OPC-UA server proxy is built in the reception proxy 220 of the OPC-UA-based one-way data transmission device 200, and the reception proxy 220 checks settings related to the establishment of the OPC-UA server proxy.

And the receiving proxy 220 determines whether the information of the previously stored node exists (S420), and if the information of the previously stored node exists (S420 YES), the OPC-UA-based one-way data transmission device 200 Step S440, which will be described later, is performed.

Basically, when the OPC-UA server proxy is built, the receiving proxy 220 stores corresponding construction information (node information) in a storage in the form of a file. In addition, if there is information of a previously stored node, an OPC-UA server proxy can be constructed based on the stored information.

On the other hand, if the previously stored node information does not exist (S420 NO), the OPC-UA-based one-way data transmission apparatus 200 receives the node information from the transmission proxy (S430). And the OPC-UA-based one-way data transmission device 200 builds an OPC-UA server proxy (S440).

If the previously stored node information does not exist, the reception proxy 220 may receive node information from the transmission proxy 210 to establish an OPC-UA server proxy, and the transmission proxy 210 is restarted. And S420 stage?悶【? When it is determined that information on the previously stored node exists, the receiving proxy 220 may establish an OPC-UA server proxy based on the information on the previously stored node.

Even if the receiving proxy 220 drives the OPC-UA server proxy based on the previously established information, when a new node information message related to server construction is received, the OPC-UA server proxy is established based on the received new node information message. Rebuild. In this case, it may mean that the sending proxy 210 is restarted, and the receiving proxy 220 rebuilds the OPC-UA server proxy with a new node information message to have the same configuration as the OPC-UA server, which is an actual safe area. Can provide.

That is, when the transmission proxy 210 is restarted, the OPC-UA server proxy of the receiving proxy 220 is unconditionally rebuilt, and when only the receiving proxy 220 is restarted, the previously stored construction information can be selectively utilized. have.

Referring back to FIG. 3, the OPC-UA-based one-way data transmission apparatus 200 performs real-time data update (S320). In addition, the OPC-UA-based one-way data transmission apparatus 200 updates historical data (S330).

The OPC-UA-based one-way data transmission apparatus 200 may perform real-time data and historical data update after establishing an OPC-UA server proxy. The transmission proxy 210 requests all real-time data and historical data from the OPC-UA server 100 in the safe area, and real-time data and history from the OPC-UA server 100 based on the previously received node information. Receive curl data.

In addition, the transmission proxy 210 transfers the received real-time data and historical data to the reception proxy 220, and the reception proxy 220 provides real-time data and history corresponding to the established management target node based on the received data. Curl data is constantly updated. In addition, the receiving proxy 220 may transmit data suitable for the request of the OPC-UA client 300 in the non-secure area to the OPC-UA client 300.

Here, real-time data is automatically generated whenever data of a management target node to be monitored changes, and transmitted to the OPC-UA-based one-way data transmission device 200. That is, the real-time data is transmitted to the transmission proxy 210 as the data of the node registered in the OPC-UA server 100 is changed, and is continuously updated data.

On the other hand, historical data is received from the OPC-UA server 100 in response to a periodic transmission request according to the settings of the transmission proxy 210. That is, the historical data is received by transmitting a historical transmission request corresponding to the request period (P) request range (T) to the OPC-UA server 100. Since historical data is continuously accumulated data, it is difficult to obtain the corresponding data if it is lost during transmission and reception.

That is, the historical data must ensure the reliability of the transmitted/received data, and for this purpose, the transmission proxy 210 adjusts the request period (P) and the request range (T), and repeatedly receives and transmits certain historical data. Techniques can be used.

Hereinafter, a process of updating historical data according to an embodiment of the present invention will be described in more detail with reference to FIGS. 5 to 7.

5 is a flowchart illustrating a process of updating historical data in step S330 of FIG. 3.

The transmission proxy 210 of the OPC-UA-based one-way data transmission device 200 requests historical data C ₀ to the OPC-UA server 100 (S510), and the OPC-UA server 100 transmits The historical data is transmitted to the proxy 210 (S515).

6 is an exemplary diagram showing historical data of an OPC-UA server according to an embodiment of the present invention, and FIG. 7 is an exemplary diagram illustrating historical data received by a reception proxy in FIG. 5.

6, when the OPC-UA server 100 receives a request for historical data C ₀ in step S510 and transmits the historical data to the transmission proxy 210 in step S515, OPC- The UA server 100 may transmit data 1 to 5 of the OPC-UA server data 610 up to the point at which the historical data is transmitted in step S515 to the transmission proxy 210.

In addition, the transmission proxy 210 receiving the historical data from the OPC-UA server 100 transmits the received historical data to the reception proxy 220 (S520). In addition, the reception proxy 220, which has received the historical data, updates the historical data (S525).

As shown in FIG. 7, in step S520, the reception proxy 220 receives historical data of data 1 to 5 from the transmission proxy 210, and performs a first historical data update 710 using the received data. can do. At this time, data 1 to 5 are new received data 810.

When the time corresponding to the preset request period (P) has elapsed after requesting the historical data in step S510, the transmission proxy 210 sends the historical data (C ₁ ,T) to the OPC-UA server 100 again. Request (S530).

And the OPC-UA server 100 transmits the historical data to the transmission proxy 210 (S535). The transmission proxy 210 receiving the historical data from the OPC-UA server 100 transmits the corresponding historical data to the reception proxy 220 (S540), and the reception proxy 220 performs an update of the historical data. It can be done (S545).

In FIG. 6, when the transmission proxy 210 requests historical data (C ₁ ,T) to the OPC-UA server 100 in step S530, the OPC-UA server 100 requests the range of the request based on step S530 ( Data 2 to 8, which are historical data in T), may be transmitted to the transmission proxy 210.

In addition, as shown in FIG. 7, the reception proxy 220 receives historical data of data 2 to 8 from the transmission proxy 210 and performs a second historical data update 720. In FIG. 7, data 1 is previously received data 820, data 2 to 4 is redundant received data 830, and data 5 to 8 is new received data 810.

When the time corresponding to the request period (P) elapses after requesting the historical data in step S530, the transmission proxy 210 requests the historical data (S550), the process of receiving the historical data from the OPC-UA server (S555), a process of transmitting the received historical data to the reception proxy 220 (S560), and the reception proxy 220 that has received the historical data from the transmission proxy 210 performs an update of the historical data. The performing process (S565) may be performed.

The OPC-UA server 100 receiving a request for historical data from the transmission proxy 210 in step S550 transmits data 6 to 12, which are data within the request range T, from the time when the request is received. ).

In addition, the transmission proxy 210 transfers data 6 to 12 to the reception proxy 220, and the reception proxy 220 may perform a third historical data update 730 as shown in FIG. 7. Here, data 1 to 5 are previously received data 820, data 6 to 8 are redundant received data 830, and data 9 to 12 are new received data 810.

Thereafter, the transmission proxy 210 performs a process of requesting historical data to the OPC-UA server 100 (S570), and requests historical data corresponding to the request range (T) at a certain request period (P). And receive.

In step S570, the time (C _i ) for requesting historical data refers to the current time for requesting the transmission of historical data, and the request period (C _i-1 ) from the time (C _i-1 ) for requesting historical data in the immediately preceding period. It can mean the time that P) has elapsed.

That is, the transmission proxy 210 requests the OPC-UA server 100 in the safe area to transmit historical data every P time, which is a request period, and designates the current time (C _i ) and the request range (T) when requested. By doing so, it is possible to receive historical data corresponding to the previous T time based on the current time C _i .

Finally, the OPC-UA-based one-way data transmission device 200 transmits data to the OPC-UA client (S340).

The reception proxy 220 of the OPC-UA-based one-way data transmission device 200 may receive a data request from the OPC-UA client 300 and transmit data suitable for the request to the OPC-UA client 300.

In FIG. 7, the reception proxy 220 additionally receives duplicated data as shown in data 2 to 4 and data 6 to 8. The OPC-UA-based one-way data transmission device 200 can set and apply the request period (P) and the request range (T) according to the network environment and the importance of the data, through which one-way data transmission of historical data Reliability can be improved.

Hereinafter, a unidirectional data transmission method of a unidirectional data transmission/reception system according to an embodiment of the present invention will be described in more detail with reference to FIG. 8.

8 is a flow chart illustrating a process of transmitting unidirectional data in a unidirectional data transmission environment according to an embodiment of the present invention.

As shown in FIG. 8, the one-way data transmission process performed by the OPC-UA server 100, the one-way data transmission device 200, and the OPC-UA client 300 in a one-way data transmission environment is an OPC-UA server proxy. Construction process (S810 to S840 steps), real-time data update process (S850 to S880 steps), historical data update process (S890 to S920 steps), and the process of transmitting data to the client (S930 step) a total of four processes It can be classified as

In addition, the OPC-UA server 100 in the safe area may transmit the OPC-UA server data to the OPC-UA client 300 in the non-safe area through the process of FIG. 8.

First, the one-way data transmission apparatus 200 establishes a connection with the OPC-UA server 100 (S810), and receives node information from the OPC-UA server 100 (S820).

In the one-way data transmission device 200, the OPC-UA client proxy, which is the transmission proxy 210, connects to the OPC-UA server 100 in the safe area in the same manner as the OPC-UA client in the non-secure area, Request, and receive node information from the OPC-UA server 100.

In addition, the transmission proxy 210 may transmit the node information received from the OPC-UA server 100 to the reception proxy 220 (S830), thereby constructing an OPC-UA server proxy (S840).

At this time, the OPC-UA server proxy uses the same IP address as the OPC-UA server 100 in the safe area, so the OPC-UA client 300 in the non-safe area accesses the OPC-UA server 100 in the safe area. It can have the same effect as that of doing so, and it is possible to omit the execution of a separate setting change procedure.

After performing the OPC-UA server proxy building process of steps S810 to S840, the transmission proxy 210 of the one-way data transmission device 200 is based on the previously received node information, the OPC-UA server ( 100) can receive data by requesting real-time data and historical data.

In particular, the transmission proxy 210 of the one-way data transmission device 200 requests real-time data from the OPC-UA server 100 (S850), and receives real-time data from the OPC-UA server 100 (S860), The received real-time data is transmitted to the reception proxy 220. In addition, the reception proxy 220 that has received the real-time data may update the real-time data (S880).

And the transmission proxy 210 of the one-way data transmission device 200 requests historical data to the OPC-UA server 100 (S890), and receives the historical data from the OPC-UA server 100 (S900). , The received historical data is transmitted to the reception proxy 220 (S910). In addition, the reception proxy 220 that has received the historical data performs an update of the historical data (S920).

In the historical data update process, the transmission proxy 210 may repeatedly perform steps S890 to S910 of requesting historical data and transmitting the received historical data to the reception proxy 220.

In addition, the receiving proxy 220, which has updated the real-time data and the historical data through steps S880 and S920, is connected to the OPC-UA client 300 to provide data corresponding to the request of the OPC-UA client 300. Can provide.

As described above, in the one-way data transmission method performed by the OPC-UA-based one-way data transmission device in the one-way data transmission/reception system, synchronization between the OPC-UA server in the safe area and the OPC-UA server proxy in the receiving proxy is possible, It is not required to change additional settings of the OPC-UA server and OPC-UA client according to the prior art, and reliability of one-way data transmission for historical data can be improved. In addition, data can be stably monitored through this.

That is, the OPC-UA-based one-way data transmission device according to an embodiment of the present invention is a proxy that performs an appropriate operation on the sending side and the receiving side according to the characteristics of the data transmitted by the OPC-UA server to the OPC-UA client. By arranging, it is possible to effectively transfer the OPC-UA data of the safe area to the non-secure area while blocking intrusion from outside the safe area at the source.

9 is a block diagram showing a computer system according to an embodiment of the present invention.

Referring to FIG. 9, an embodiment of the present invention may be implemented in a computer system 900 such as a computer-readable recording medium. As shown in FIG. 9, the computer system 900 includes one or more processors 910, memory 930, user input devices 940, user output devices 950, and storage that communicate with each other through a bus 920. (960) may be included. Further, the computer system 900 may further include a network interface 970 connected to the network 980. The processor 910 may be a central processing unit or a semiconductor device that executes processing instructions stored in the memory 930 or the storage 960. The memory 930 and the storage 960 may be various types of volatile or nonvolatile storage media. For example, the memory may include a ROM 931 or a RAM 932.

Accordingly, an embodiment of the present invention may be implemented as a computer-implemented method or a non-transitory computer-readable medium in which instructions executable in a computer are recorded. When computer-readable instructions are executed by a processor, the computer-readable instructions may perform a method according to at least one aspect of the present invention.

As described above, the OPC-UA-based one-way data transmission apparatus and method according to the present invention is not limited to the configuration and method of the embodiments described as described above, but various modifications may be made to the embodiments. All or part of each of the embodiments may be selectively combined and configured.

100: OPC-UA server 200: one-way data transmission device
210: sending proxy 220: receiving proxy
300: OPC-UA client 610: OPC-UA server data
710: first historical data update
720: update the second historical data
730: third historical data update
810: new received data 820: previous received data
830: duplicate received data 900: computer system
910: processor 920: bus
930: memory 931: ROM
932: RAM 940: user input device
950: user output device 960: storage
970: network interface 980: network

Claims (20)

In the one-way data transmission device for transmitting the data of the OPC-UA server to the OPC-UA client,
A transmission proxy for receiving information on a management target node from the OPC-UA server, requesting data corresponding to a management target node to the OPC-UA server, and receiving real-time data and historical data corresponding to the management target node , And
Receive information on the management target node from the transmission proxy to establish an OPC-UA server proxy, receive the real-time data and the historical data from the transmission proxy, and use the established OPC-UA server proxy. A reception proxy that updates the real-time data and the historical data for a management target node, and transmits data corresponding to the request of the OPC-UA client to the OPC-UA client
Including,
The historical data,
Data received from the OPC-UA server to correspond to the periodic transmission request of the transmission proxy,
The transmission proxy,
OPC, characterized in that the transmission request of the historical data corresponding to the request period and the request range is transmitted to the OPC-UA server, and the historical data corresponding to the transmission request is received from the OPC-UA server. -UA-based one-way data transmission device. The method of claim 1,
The real-time data,
OPC-UA-based one-way data transmission apparatus comprising at least one of OPC DA data, OPC alarm data, and OPC event data, and is data automatically generated when data of the management target node changes. delete delete The method of claim 1,
The transmission proxy,
At each time corresponding to the request period, a request for transmission of the historical data for a time corresponding to the request range is transmitted to the OPC-UA server based on the current time. OPC-UA-based one-way data transmission device. The method of claim 1,
The receiving proxy,
When at least one of the transmission proxy and the reception proxy is restarted, the OPC-UA-based one-way data transmission device, characterized in that rebuilding the OPC-UA server proxy. The method of claim 6,
The receiving proxy,
When constructing the OPC-UA server proxy, the OPC-UA-based one-way data transmission device, characterized in that storing construction information corresponding to the OPC-UA server proxy. The method of claim 7,
The receiving proxy,
Check the setting information related to the establishment of the OPC-UA server proxy, and if there is information on the previously established node, rebuild the OPC-UA server proxy based on the establishment information, and the information on the previously established node OPC-UA-based one-way data transmission apparatus, characterized in that the OPC-UA server is reconstructed by receiving information of the node from the transmission proxy when there is no presence. The method of claim 6,
The receiving proxy,
OPC-UA-based one-way data, characterized in that when the transmission proxy is restarted, the OPC-UA server proxy is rebuilt, and when only the receiving proxy is restarted, the OPC-UA server proxy is selectively rebuilt. Transmitting device. The method of claim 1,
The receiving proxy,
When receiving information on a new node from the transmission proxy, the OPC-UA server proxy is rebuilt based on the information on the new node. In the one-way data transmission method performed by an OPC-UA-based one-way data transmission device for transmitting data from an OPC-UA server to an OPC-UA client,
Receiving information on a management target node from the OPC-UA server to establish an OPC-UA server proxy,
Requesting and receiving real-time data from the OPC-UA server, and updating the real-time data,
Requesting and receiving historical data from the OPC-UA server, and updating the historical data, and
Transmitting data including at least one of the real-time data and the historical data to the OPC-UA client to correspond to the request of the OPC-UA client
Including,
The OPC-UA-based one-way data transmission device,
A transmission proxy that accesses the OPC-UA server and receives information on the management target node, and
A reception proxy for transmitting the real-time data and the historical data received from the OPC-UA server to the OPC-UA client
Including,
The historical data,
It is data received from the OPC-UA server to correspond to the periodic transmission request of the historical data,
The step of updating the historical data,
Transmitting, by the transmission proxy, a request for transmission of the historical data corresponding to a request period and a request range to the OPC-UA server, and
Receiving, by the transmission proxy, the historical data corresponding to the transmission request from the OPC-UA server
OPC-UA-based one-way data transmission method comprising a. delete The method of claim 11,
The real-time data,
One-way data transmission method comprising at least one of OPC DA data, OPC alarm data, and OPC event data, and is automatically generated when data of the management target node changes. delete delete The method of claim 13,
Transmitting the request for transmission of the historical data to the OPC-UA server,
At each time corresponding to the request period, the transmission proxy sends a request for transmission of the historical data to the OPC-UA server for a time corresponding to the request range based on the current time. One-way data transmission method, characterized in that the transmission. The method of claim 11,
When at least one of the transmission proxy and the reception proxy is restarted, rebuilding the OPC-UA server proxy
One-way data transmission method further comprising a. The method of claim 17,
When establishing the OPC-UA server proxy, storing, by the receiving proxy, construction information corresponding to the OPC-UA server proxy
One-way data transmission method further comprising a. The method of claim 18,
Rebuilding the OPC-UA server proxy,
The receiving proxy confirms setting information related to the establishment of the OPC-UA server proxy,
Re-establishing the OPC-UA server proxy based on the establishment information when information on the previously established node exists, and
Rebuilding the OPC-UA server by receiving node information from the transmission proxy when the previously established node information does not exist
One-way data transmission method comprising a. The method of claim 17,
Rebuilding the OPC-UA server proxy,
When the transmission proxy is restarted, the OPC-UA server proxy is rebuilt, and when only the receiving proxy is restarted, the OPC-UA server proxy is selectively rebuilt.

Images