RU2825561C1 - Programmable logic controller for controlling real-time devices - Google Patents

Abstract

FIELD: physics.

SUBSTANCE: invention relates to a programmable logic controller (PLC) for controlling real-time devices. Disclosed device is characterized by the fact that it contains a system on a chip (SoC), which includes at least two computer systems, memory, periphery and a high-speed data bus, where memory and periphery of the first computer system are isolated from the memory and periphery of the second computer system. First computer system comprises at least one computing core and is designed to: interact with a remote computer, interact with a second computer system; second computer system comprises at least one computing core and is designed to: for interaction with the first computer system, at which receives from the first computer system configuration data or control commands for the measuring or actuating device, sends status data to first computer system, converts configuration data into control commands for actuator; for interaction with actuating and/or measuring device.

EFFECT: improvement of devices which control real-time devices.

14 cl, 5 dwg

Description

Field of technology

The invention relates to the field of information security, and more specifically to a programmable logic controller for controlling real-time devices.

State of the art

A large number of enterprises and industries are moving towards automation of their processes using information technology. Automation of business and production allows to reduce the influence of the human factor, which reduces the probability of errors and increases the reliability of information systems. In addition, automation allows to obtain more data on the production process and manage production more effectively. Many of the elements of information systems operate in real time.

Real-time information systems are used for business and industrial automation, such as a real-time operating system. A real-time system must perform functionality within the required time constraints, ensuring predictability of operation, sufficient response (the time during which a control command is guaranteed to be executed, for example, if it is necessary to execute a control command in 1 millisecond or it is necessary to execute a control command within a specified hour, no earlier and no later) of the real-time system and its high reliability, thereby maintaining continuous and timely execution of functionality. Examples of real-time systems are an automated process control system (abbreviated APCS) of a chemical or nuclear reactor, on-board control systems for manned or unmanned aerial vehicles, spacecraft, cars, ships, vessels.

At enterprises, some processes, such as technological and informational ones, operate in real time. Such processes use specialized software, such as a real-time operating system (RTOS) running in a real-time system. The other part operates on computers with a general-purpose OS (Win/Linux), where there is no need to comply with strict requirements, as in real-time solutions. However, there is a need to synchronize the operation of such systems. For example, a general-purpose OS manages computer resources such as disks, network, peripherals, etc., and an RTOS is responsible for managing processes in a real-time system that require data processing speed and quick response, which a general-purpose OS cannot provide. Security issues for such systems are very acute; compromise of one of the systems can lead to a number of negative consequences related to information security. For example, a leak of confidential information (customer data, business plans, financial documents, etc.), which will lead to serious consequences for the company or a threat to the life and health of people.

The state of the art includes a large number of solutions from different companies in this area, such as NXP i.MX Series from NXP Semiconductors, Intel Stratix 10 from Intel, Renesas R-Car Series from Renesas Electronics (https://www.renesas.com/us/en/products/automotive-products/automotive-system-chips-socs). The mentioned solutions imply operation on several dedicated computing systems on which different software solutions can be deployed. In this case, computing systems can include a general-purpose OS and an RTOS. When connecting solutions with several operating systems on a single system on a chip to public networks, the network functionality must be protected from external malicious influences (for example, cyber attacks), which in turn is too complex. In this regard, RTOS-based solutions are usually used in closed information systems that do not have access or have limited access to public networks.

The prior art includes the solution WO 2020035742 A1 "Method for operating an industrial PC device and industrial PC device", which presents two operating systems: a general-purpose OS and an RTOS. The RTOS is responsible for the security of the industrial computer device in this solution. Some disadvantages of this solution include the implementation of a general-purpose OS and an RTOS on a single computing system, as well as the distribution of hardware resources between operating systems, which is carried out through a hypervisor, which in turn leads to deterioration in real-time characteristics, such as a delay in response or RTOS response time to external events.

Also known from the state of the art is the solution EP 3267649 A1 "Method and industrial computing apparatus for performing a secure communication" in which two OS are used, one of which is an RTOS. The specified solution is implemented using a secure channel between the OS using virtualization. The disadvantage of such a solution may be a decrease in performance on the RTOS side due to the separation of the OS by a virtual machine that requires a large amount of hardware resources and, as a consequence, a deterioration in real-time characteristics, for example, an increased response time of the RTOS.

An analysis of the prior art allows us to conclude that it is necessary to improve the previous technologies, the shortcomings of which are solved by the present invention, namely a programmable logic controller for controlling real-time devices.

Disclosure of the essence of the invention

The present invention is aimed at increasing the level of security associated with the management of real-time devices.

The technical result consists in improving devices that control real-time devices using the proposed programmable logic controller.

As an embodiment of the present invention, a programmable logic controller (PLC) is proposed, characterized in that it contains a system on a chip (SoC) including at least two computing systems, memory, periphery and a high-speed data transfer bus, where the memory and periphery interacting with the first computing system are isolated from the memory and periphery interacting with the second computing system, wherein: a) the first computing system contains at least one computing core and is intended for: interacting with a remote computer, interacting with the second computing system; b) the second computing system contains at least one computing core and is intended for: interacting with the first computing system, during which it carries out at least one of: receiving configuration data or control commands for a measuring or actuator from the first computing system, transmitting status data to the first computing system, converting configuration data into control commands for the actuator; interaction with at least one of the devices: an actuator and a measuring device, wherein during the interaction the following is carried out: collecting data from the measuring device, transmitting control commands to the actuator.

In another embodiment of the present invention, the first computing system additionally comprises a general-purpose operating system (hereinafter referred to as a general-purpose OS), and the second computing system comprises a real-time operating system (hereinafter referred to as a RTOS).

In another embodiment of the present invention, the interaction of the first computing system with the second computing system is carried out via a high-speed data transfer bus.

In another embodiment of the present invention, a general-purpose operating system includes components: a security monitor, a web server, an authentication tool, a certificate control tool, and an interaction control tool.

In another embodiment of the present invention, the security monitor, the authentication tool, the certificate control tool, and the interaction control tool are trusted components, and the web server is an untrusted component.

In another embodiment of the present invention, the security monitor monitors the interaction of components with each other using interprocess communication mechanisms based on security policies.

In another embodiment of the present invention, the first computing system additionally authenticates the user based on the data received from the remote computer.

In another embodiment of the present invention, the first computing system transmits data to the second computing system only if the user is authenticated.

In another embodiment of the present invention, interaction between the remote computer and the PLC is accomplished by establishing an encrypted communication channel.

In another embodiment of the present invention, the certificate control means supports an HTTPS connection between a remote interface on the computing device and a web server.

In another embodiment of the present invention, the interaction control means transmits configuration data from a remote computer via a high-speed data transmission bus to a computing system with an RTOS, and also receives data from the computing system with an RTOS concerning the operation of the measuring device.

In another embodiment of the present invention, the web server receives HTTP requests from a remote interface on the computing device and provides HTTP responses with an HTML page.

In another embodiment of the present invention, the security monitor is responsible for determining permissions or prohibitions for interaction between general-purpose OS components using interprocess communication mechanisms based on security policies.

Brief description of the drawings

The accompanying drawings illustrate only exemplary embodiments and therefore should not be considered limiting its scope; other, no less effective, embodiments may be allowed. Additional objectives, features and advantages of the present invention will be apparent from reading the following description of the embodiment of the invention with reference to the accompanying drawings, in which:

Fig. 1 represents an example of a structural diagram of a computing device for controlling executive and/or measuring devices.

Fig. 2 shows an example of a system for controlling executive and/or measuring devices in real time.

Fig. 3 shows an example of the implementation of a solution responsible for interaction with a computing device via a computer network.

Fig. 4 shows a method for controlling actuators and/or measuring devices in real time.

Fig. 5 is an example of a computer system by which at least part of the present invention is implemented.

Implementation of the invention

The objects and features of the present invention, the methods for achieving these objects and features will become apparent by reference to exemplary embodiments. However, the present invention is not limited to the exemplary embodiments disclosed below, it can be embodied in various forms. The substance given in the description is nothing more than specific details necessary to help a person skilled in the art to fully understand the invention, and the present invention is defined within the scope of the appended claims.

Below are defined a number of terms that will be used in describing embodiments of the invention.

System-on-a-Chip (SOC) is an electronic circuit that performs the functions of an entire device (for example, a computer) and is placed on an integrated circuit. The SoC can receive and process digital, analog, radio signals or operate in analog-to-digital mode, combining a processor (or several processors), peripherals, RAM and long-term memory on a crystal.

A computing system is a set of hardware and software tools that form a single environment designed to solve information processing (computing) problems, for example, a computer system.

A computing core is a part of a computing system's processor that handles data and performs computational and logical operations.

A real-time system is a system in which the success of any program depends not only on its logical correctness, but also on the time it takes to obtain a result. If the time constraints are not met, a system failure is recorded. The most commonly mentioned real-time systems are hard real-time systems and soft real-time systems. Soft real-time systems are characterized by the fact that the response delay is not critical. Hard real-time systems provide for a guaranteed system response time to a specific event, such as a hardware interrupt, a control command, etc. Examples of real-time system characteristics are deadline, latency, and jitter. Deadline refers to a critical service time interval or the deadline for completing a process. Latency indicates the system response time to an event as a whole. Jitter characterizes the spread of system response times, which may arise, for example, under the influence of other events occurring in an object or process. Examples of hard real-time systems are on-board control systems, emergency protection systems, and emergency event recorders. Real-time systems include both real-time solutions with an operating system and real-time solutions without an operating system.

A real-time operating system (RTOS) is a type of specialized operating system whose main purpose is to provide the necessary and sufficient functionality for the design, development, and operation of real-time systems on specific hardware.

An actuator is a device for automatic control or regulation that acts on the controlled object in accordance with the received control command. The action is carried out by converting one type of energy (electrical, magnetic, thermal, chemical) into another (most often - mechanical), which leads to the execution of a certain action specified by the control signal.

A measuring device is a sensor that converts a controlled value (pressure, temperature, level, flow rate, frequency, speed, displacement, voltage, electric current, etc.) into a signal that is convenient for measurement, storage, recording, conversion and transmission to a control device (controller, regulator, computer).

Fig. 1 shows an example of a structural diagram of a computing device for controlling executive and/or measuring devices. Examples of a computing device on which the claimed solution can be implemented are a computer, a laptop, a microcontroller, a programmable logic controller, and any other computing device that allows the claimed invention to be implemented. Further, we will consider the implementation of the computing device using the example of the implementation of a programmable logic controller.

The computing device 100 is a programmable logic controller (abbreviated PLC), characterized in that it contains at least a system on a chip 105 (SoC), including two computing systems 110 and 115, where each computing system contains its own dedicated memory and periphery, and a high-speed data bus 150 (hereinafter referred to as data bus 150) is located between computing systems 110 and 115. In turn, the computing system 110 contains at least one computing core 120, periphery 130, memory 140. Similarly, the computing system 115 contains at least one computing core 125, periphery 135, memory 145.

The computing system 110 is intended to interact with a remote computer via an interface on the remote computer via a computer network, such as the Internet, and to interact with the computing system 110 with the computing system 115 via a data bus 150. An example of a remote computer is shown in Fig. 5. The computing system 115 is intended to process information, data, signals or control commands in real time, including those received from the computing system 110. One example is the transmission of control commands to the actuator from the computing system 115, as well as the reception of signals from the measuring device and the output of data from it or the actuator to the computing system 110. In one embodiment, the computing system 115 processes information in real time, such as high-frequency trading (HFT) - a type of automated trading in which the main role is played by the speed of decision-making and execution of operations; or updating databases in real time; real-time monitoring of health indicators (heart rate, blood oxygen saturation, blood pressure), provision of real-time data on the number of hotel rooms booked, etc.

In one embodiment, a software solution, such as a general-purpose operating system (hereinafter referred to as a general-purpose OS), is executed in the computing system 110, and a real-time solution, such as a real-time operating system (hereinafter referred to as a RTOS), is executed in the computing system 115.

In another embodiment, the computing system 110 executes a software solution without an operating system, such as executing binary code compiled for a microcontroller, to optimize the use of the limited resources of said microcontroller.

Depending on the embodiment, the computing system 110 contains at least one computing core 120, and the computing system 115 contains at least one computing core 125.

Each computing system 110 and 115 has its own peripherals 130 and 135 (for example, I2C, SPI, USB, Ethernet, etc.) and memory 140 and 145, for example, the cache of computing cores, random access memory (hereinafter referred to as RAM), etc.

In a particular embodiment, there is a common memory between computing systems 110 and 115, for example a read-only memory device, ROM (not shown in the figures).

For interaction between computing systems 110 and 115, a data transmission bus 150, for example RapidIO, is used.

In a particular embodiment, at least two high-speed data transmission buses are used for interaction between computing systems 110 and 115.

In another particular embodiment, the interaction of computing systems 110 and 115 is carried out through a rewritable common ROM memory with a bootloader code, for example, EEPROM.

In another particular embodiment, interaction between computing systems 110 and 115 is carried out via mailboxes.

Thus, each computing system 110 or 115 is an independent hardware computing system that cannot be influenced from another computing system through common memory or periphery, and interaction between computing systems 110 and 115 occurs via data transfer bus 150. Each such computing system can be considered isolated and, accordingly, computing cores 120 and 125 will also be isolated from each other.

Isolation of the periphery and memory for each of the computing systems 110 and 115 implies that the hardware modules for working with memory are also isolated, for example by using direct memory access (DMA). Thus, the hardware DMA module of the computing system 110 and any module of the periphery 130 has access only to the periphery 130 and memory 140 of its computing system. The same is implied for the computing system 115 with the periphery 135 and memory 145. Including, when isolating the memory 140 and 145, the memory of the caches inside each computing system 110 and 115 is taken into account, not allowing it to affect the operation of the other computing system.

In a particular embodiment, the isolation of memory 140 and 145, such as RAM, is implemented inside SoC 105 in such a way that outside SoC 105, the same memory of SoC 105 is used for both computing systems 110 and 115. In such a case, the isolation of memory 140 and 145 of computing systems 110 and 115 is provided by arbiters of the corresponding buses inside SoC 105, and outside SoC 105, it is assumed that there are no other hardware modules, such as PCI, Ethernet, peripherals 130 and 135, having access to RAM, bypassing the above-mentioned bus arbiters inside SoC 105.

Also, for the safe use of computing systems 110 and 115 in SoC 105, in one embodiment, isolation of the remaining hardware modules not related to memory and peripherals (for example, a power controller, an interrupt controller) is additionally ensured, so that the computing system or hardware modules related to it cannot influence the operation of another computing system or its hardware modules.

In a particular embodiment, the use of hardware isolation does not exclude the use of virtual isolation within each computing system 110 and 115 (for example, IOMMU, TEE, etc.).

In one embodiment, a non-real-time solution, such as a bare metal (https://itglobal.com/ru-ru/company/glossary/bare-metal/) software solution, is executed on the computing system 110, and a real-time solution (hereinafter referred to as RTOS) is executed on the computing system 115.

In the case when a real-time solution is executed in the computing system 115, the proposed approach to hardware isolation of computing systems 110 and 115 improves the characteristics of the real-time solution compared to the use of approaches of virtual isolation of solutions (for example, TEE). Due to the use of single computing resources for both solutions and context switching within the entire system in approaches with virtual isolation of solutions, the determinism of the execution time of primitives in the real-time solution decreases and various time delays increase. Therefore, the proposed approach to hardware isolation of computing systems 110 and 115, in addition to improving the real-time characteristics, allows using real-time solutions known from the state of the art with fewer modifications. This is achieved due to the fact that the real-time solution executed on the computing system 115 has its own independent resources, while the computing system 110 does not affect the operation of the said real-time solution and is intended to implement security functions for interaction with a computer network, for example the Internet. Also, the placement of security functions in the computing system 110 does not increase the computing load on the computing system 115. Thus, the real-time solution implemented on the computing system 115 is responsible for the real-time functionality, and the solution implemented on the computing system 110 is responsible for secure interaction over a computer network, such as, for example, the Internet. In one embodiment, the real-time solution on the computing system 115 is an RTOS, and the solution responsible for secure interaction over the Internet on the computing system 110 is a general-purpose OS.

Fig. 2 shows an example of a system for controlling executive and/or measuring devices in real time (hereinafter referred to as system 200).

As part of the implementation of system 200, a computing device (hereinafter referred to as CD) 100 is presented. An example of the implementation of CD 100 may be a computer, laptop, microcontroller, programmable logic controller (PLC) and any other computing device that allows the implementation of the claimed invention.

System 200 includes:

• at least one VU 100, intended for controlling the measuring device and/or actuator, as well as ensuring interaction over a computer network,

• at least one remote computer 210 for interacting with the VU 100 via a computer network,

• at least one of the devices:

o measuring device 230 (hereinafter referred to as sensor 230),

o actuator 235.

An example of the implementation of the remote computer 210 is shown in Fig. 5. In turn, the CU 100 includes a SoC 105, containing a computing system 110 and a computing system 115 with isolated memory and periphery for each computing system. The computing system 110 contains a general-purpose operating system 220 (hereinafter referred to as OS 220), and the computing system 115 of the computing system 115 contains a real-time operating system 225 (hereinafter referred to as RTOS 225). For interaction between the computing system 110 and the computing system 115, the data transmission bus 150 previously mentioned in the description of Fig. 1 is used.

An example of an interface at the remote computer 210, intended for interaction with the VU 100, is a web browser. In a particular embodiment, the interface at the remote computer 210 is any program capable of interacting with the VU 100 (i.e. sending commands that the VU 100 can interpret), and also having the ability to encrypt the connection.

The computing systems 110 and 115 have their own peripherals 130 and 135 (SATA ports, Ethernet, NAND flash memory, USB) and memory 140 and 145 (random access memory, RAM). This approach allows the OS 220 on the computing system 110 and the RTOS 225 on the computing system 115 to operate in isolation from each other. The computing system 110 contains at least one computing core 120, similarly the computing system 115 contains at least one computing core 125.

In one embodiment, OS 220 is an OS with a microkernel architecture (for example, KasperskyOS - https://os.kaspersky.ru/), providing a minimal set of elementary functions for managing processes and abstractions for working with hardware. This contributes to a higher level of reliability and security of the microkernel architecture of the OS, since a small amount of microkernel code is easier to check for vulnerabilities and other errors.

OS 220 is responsible for both interaction via the interface on the remote computer 210 over the Internet, and for interaction between the components of OS 220 itself, which can be trusted and untrusted components, as well as for interaction with RTOS 225.

In a particular implementation variant, OS 220 acts as a secure gateway. A security gateway is understood as a connection point between networks, between network segments, or between software applications in different security domains, designed to protect the network in accordance with the existing security policy (https://base.garant.ru/70246078/).

In turn, the RTOS 225 is intended for interaction with the OS 220 and interaction with at least one executive device 235 and/or one measuring device – sensor 230. The RTOS 225, during interaction with the OS 220, for example, transmits status data to the OS 220 and receives configuration data from the OS 220. Status data are understood to mean data that contain information about values or indicators from such devices as devices 230 or 235. The configuration data received by the RTOS 225 from the OS 220 are converted into control commands for the executive device 235.

In turn, the interaction of the RTOS 225 with the sensor 230 is carried out by collecting data from the sensor 230 by the RTOS 225. In a particular embodiment, the parameters of the sensor 230 are controlled. An example of data that is transmitted from the sensor 230 to the RTOS 225 is the state of the equipment, the temperature in the room, the pressure, etc. A particular example of controlling the parameters of the sensor 230 is increasing the sensitivity of the alarm sensor. The interaction of the RTOS 225 with the actuator 235 is carried out by transmitting control commands to the actuator 235. In a particular embodiment, the transmission of control commands from the RTOS 225 to the actuator 235 is carried out depending on the data received from the sensor 230. The RTOS 225 also transmits data from the actuator 235 to the OS 220 concerning the operation of the actuator 235. Examples of data transmitted from the OS 220 to the RTOS 225 are configuration data, such as the values of the liquid feed rate into the tank, the values of the liquid filling volume of the tank, the sensitivity values of the smoke detector sensor. Examples of status data transmitted from the RTOS 225 to the OS 220 are the state of the pipeline flaps, information on the state of the aircraft chassis, information from water meters, information from water leak sensors, information on the health of the patient, and the like.

In a particular embodiment, the periphery 135 of the computing system 115 has general-purpose outputs GPIO, which are used to directly connect the actuator 235 and the sensor 230.

As described previously, a data bus 150 is used to communicate between the computing system 110 and the computing system 115. This allows the OS 220 in the computing system 110 to exchange information and data with the RTOS 225 on the computing system 115. For example, the data bus 150 may be RapidIO, a high-performance communication bus.

Fig. 3 shows an example of the implementation of a solution responsible for interaction with a computing device via a computer network.

In an embodiment, the OS 220 includes at least such components as a security monitor 310, a web server 320, an authentication engine 330, a certificate control engine 340, and an interaction control engine 350. The OS 220 is located in the computing system 110.

The security monitor 310 is designed to determine whether the OS 220 components are allowed to interact with each other using inter-process communication (IPC) mechanisms based on security policies. An example of a security policy is, for example, "default deny", which prohibits all interactions between components that are not explicitly allowed by the security policy.

The components of the OS 220 are divided into trusted and untrusted components. Trusted components of the OS 220 are considered to be at least the security monitor 310, the authentication tool 330, the certificate control tool 340, and the interaction control tool 350. The specified components are developed by a trusted software manufacturer. Untrusted components are understood to be components that are not trusted, but also not recognized as malicious, for example, by an antivirus application.

An untrusted component of OS 220 is considered to be web server 320. Web server 320 is understood to be an application, service or server that receives HTTP requests from a remote computer 210 and gives it HTTP responses, usually together with an HTML page (web page), image, file, media stream or other data. Web server 320 also has its own separate file system, which is necessary for web server 320 to store web pages, CSS pages (Cascading style sheets) and other information necessary for operation. Being an untrusted component of OS 220, web server 320 does not have access to the file systems of OS components 220 based on the established security policies.

As stated earlier, one of the trusted components of the OS 220 is the security monitor 310. The security monitor 310 is a component that monitors all interprocess communications between the components of the OS 220 and checks whether each interprocess communication complies with the established security policies. Another trusted component of the OS 220 is the authentication tool 330, which checks the authentication of users and stores a database of authenticated users in its file system (not shown in the figures).

Another trusted component of the OS 220 is the certificate control tool 340, designed to provide support for an HTTPS connection between the interface on the remote computer 210 and the web server 320, as well as to control the certificates of web pages. The certificate control tool 340 contains a certificate database in its file system (not shown in the figures). The certificate database of the certificate control tool 340 contains SSL certificates representing digital certificates that certify the authenticity of a website (web page) and allow the use of an encrypted connection.

Another trusted component of the OS 220 is the interaction control tool 350, which transmits configuration data from the remote computer 210 via the data bus 150 to the RTOS 225, and also receives data from the RTOS 225 concerning the operation of the sensor 230 (for example, data from the water leak sensor), and transmits them to the remote computer 210.

It is worth noting that such components as authentication tool 330, certificate control tool 340, interaction control tool 350 have their own file systems for working with user logs, and certificate control tool 340 additionally has a file system for working with certificates. At the same time, only interaction control tool 350 has access to the network file system and only interaction control tool 350 can receive network packets for interaction with RTOS 225.

Let us consider in more detail an example of interaction between components when starting OS 220, authenticating the user, and terminating the user session. When OS 220 starts, IPC channels are initialized by security monitor 310 between OS 220 components, and when the user is not yet authenticated, based on security policies, it is established that web server 320 is prohibited from interacting with interaction control tool 350 when the IPC channel is established, but web server 320 is allowed to interact with authentication tool 330 and certificate control tool 340 via established IPC channels. In order for the web server 320 to start interacting via the IPC channel with the interaction control tool 350, the user must be authenticated in the system using the remote computer 210. Authentication and authorization of the user is provided by the authentication tool 330. When authentication is successful, the user is authorized, and a working session with the authenticated user on the remote device 210 begins. The security monitor 310, based on security policies, establishes that only one session can be supported at a time. The detailed process of user authentication will be disclosed below.

At the moment of user authentication, authentication means 330 transmits the status of successful user authentication to interaction control means 350 via the IPC channel. After interaction control means 350 receives the status of successful authentication, security monitor 310, based on security policies, allows interaction between web server 320 and interaction control means 350 via the IPC channel, while interaction between web server 320 and authentication means 330 and certificate control means 340 is still allowed. After security monitor 310 has allowed interaction between web server 320 and interaction control means 350, the user can interact with RTOS 225 via interaction control means 350, and also receive information from RTOS 225. The IPC channel between web server 320 and interaction control means 350 remains open with permission to interact through it until the moment of termination of the working session with the user. During the active session, an encryption key is generated by the remote computer 210, for example, using the Diffie-Hellman algorithm. The authentication tool 330 stores the encryption key during the active session. In the active session, based on the security policy, the security monitor 310 prohibits authentication attempts.

At the moment of the end of the working session with the user, the authentication means 330 transmits the session end status to the security monitor 310, after which the security monitor 310 breaks the IPC channel between the web server 320 and the interaction control means 350. For a new session, the user must again undergo authentication in accordance with the established security policies. Also, the authentication means 330, after sending the session end status to the security monitor 310, deletes the encryption key generated during authentication. In this case, the session with the user can be ended after a certain timeout, for example, a period of user inactivity for 15 minutes. In the event of a compromise of the web server 320 and an attempt to interact with the interaction control means 350 at a time when the user is not authenticated, the security monitor 310, based on the security policies, will prohibit the interaction of the web server 320 with the interaction control means 350.

Let's look at the detailed process of user authentication with the transfer of critical information. Critical information refers to user credentials such as login and password, or information that, if compromised, could lead to negative consequences.

By means of web server 320, an HTTPS connection is established with remote computer 210 and critical information, such as user login and password, is transferred from remote computer 210 to authentication means 330 via web server 320. In this case, the transfer of critical information via web server 320, which is an untrusted component of OS 220, must be carried out securely, i.e. without the possibility of compromising this information. To solve such a problem using remote computer 210, for example, an encrypted channel is established. The establishment of an encrypted channel will be described below using the Diffie-Hellman key exchange protocol (DH) as an example.

An encrypted channel is established between the remote computer 210 and the authentication means 330 via the web server 320 to transmit authentication information from the remote computer 210 to the web server 320. Before generating a cryptographic key, the certificate control means 340 verifies the web page certificate.

At the moment of the start of the session with the user, a request to start the session is received from the remote computer 210 to the web server 320, then the request is transmitted from the web server 320 to the authentication tool 330. In response to the request received from the web server 320, the authentication tool 330 generates the values of the Diffie-Hellman algorithm g, p, A and transmits them to the web server 320 and the certificate control tool 330. In turn, the web server 320 adds the values g, p, A to its authentication database (not shown in the figures), generates a web page for entering authentication data and transmits the web page to the remote computer 210 in its interface through the certificate control tool 340. Then, the certificate control tool 340 checks whether the web page was generated correctly by the web server 320 (since this page contains values for calculating the cryptographic key K), as well as the correctness of the format web page and the location of the values g, p, A on it and compares them with the values g, p, A that were transmitted from the authentication means 330. The user enters the login and password on the remote computer 210, after which the cryptographic key K is generated. The authentication information is encrypted on this key, and the value B is also found. The key is transmitted back to the authentication means 330 via the web server 320. If the web server 320 has been subjected to a cyber attack and has been hacked, the key with the encrypted information cannot be decrypted. Then the authentication means 330, having received the data from the remote computer 210, calculates the value K based on the value B, decrypts the encrypted information, compares the authentication information with the database of authenticated users (not shown in the figures) and authenticates the user if the authentication information matches the information from the database of authenticated users.

After the authentication is successful, the user can interact with applications in the RTOS 225 using the remote computer 210 via the OS 220. In turn, the user sends configuration data using the remote computer 210 via the interaction control tool 350 via the data transmission bus 150 to the RTOS 225. The received configuration data in the RTOS 225 are converted into control commands for the executive device 235 and sent further to the executive device 235. In response, the RTOS 225 transmits information about the operation of the executive device 235 to the OS 220.

As an example of the implementation of system 200 with the composition of operating system 220, we will consider the operation of pipeline valve control with remote monitoring and control.

The user uses the remote computer 210 to interact with the OS 220 on the VU 100 to control the pipeline valves. The user is authenticated, after which the pipeline control interface becomes available to him. The control interface in the form of an HTML page is provided by the web server 320 running on the OS 220.

For a full understanding of the example, we will provide specific concepts and quantities. A tank with a liquid of 1000 liters; an inlet pipe that supplies liquid to the tank with liquid at a certain speed Vin. Liquid flow from the tank is provided by outlet pipes, for example, two - V1, V2. Maximum liquid flow rates through the outlet pipes are V1max, V2max, and all pipes can be closed by valves. When the tank is filled to a level of Hin,0 = 950 liters, the inlet valve of the inlet pipe closes to prevent the tank from overflowing. When the tank is emptied to a level of Hin,1 = 200 liters, the inlet valve of the inlet pipe opens. To avoid complete emptying of the tank, when the liquid reaches a level of Hout,0 = 50 liters, the liquid flow rate is limited by the valves of the outlet pipes. In this case, the outlet pipe with the lowest priority for liquid supply is closed first - starting with pipe V2, ending with pipe V1 if the liquid level continues to fall. The rate of liquid supply through the outlet pipes is resumed when the liquid level in the tank reaches Hout,1 = 800 liters.

The user authenticates in OS 220 and specifies the following values: Hin,0; Hout,1; Hin,1; Hout,0 – liquid levels in the tank (can be specified as a percentage), while the entered values must meet the following conditions: Hin,0 > Hout,1 > Hin,1 > Hout,0; Vin – liquid feed rate into the tank; V1,max, V2,max – maximum liquid flow rates through pipes. During the program operation, the values V1, V2 can be changed.

After the user has set the values, all configuration data are transmitted from OS 220 to RTOS 225 via data transmission bus 150 and converted into control commands for actuator 235. If the values V1, V2 change, the data are retransmitted to RTOS 225 from OS 220 and also converted into control commands. In turn, RTOS 225 transmits data on the liquid level in the tank from sensors 230, as well as on the state of the valves of the inlet and outlet pipes to OS 220. In this case, data are transmitted from RTOS 225 to OS 220 when the water level in the tank changes by more than 1% of the maximum value.

Fig. 4 shows an example of a method for interacting with actuators and measuring devices in real time 400 (hereinafter referred to as method 400). The presented method 400 is implemented under the control of the control unit 100 shown in the description of Fig. 1 and the system 200 shown in the description of Fig. 2.

The method 400 is implemented using the system 200, wherein at least the computing device 100 is used. In turn, the CU 100 includes a SoC 105, containing a computing system 110 and a computing system 115 with isolated memory and periphery for each computing system. For interaction between the computing system 110 and the computing system 115, a data transmission bus 150 is used. It is worth noting that in the method 400, interaction with the CU 100 is implemented using a remote computer 210 over a computer network, for example the Internet. An example of a computing device is shown in Fig. 5. The computing system 110 contains at least one computing core 120, similarly, the computing system 115 contains at least one computing core 125.

For implementing the method 400, the CU 100 comprises a computing system 110 with a general-purpose operating system 220 (hereinafter referred to as OS 220), and a computing system 115 with a real-time operating system 225 (hereinafter referred to as RTOS 225), as well as a data transmission bus 150 between the computing system 110 and the computing system 115. OS 220 is intended for interaction with a remote computer 210, interaction between trusted and untrusted components of OS 220, and interaction with RTOS 225. RTOS 225 is intended for interaction with OS 220 to transmit status data to OS 220, receive configuration data or control commands for the measuring or actuator from OS 220, and convert the received configuration data into control commands for the actuator 235. Also, interaction with at least one of the devices: measuring device 230 (hereinafter referred to as sensor 230) and actuator device 235. In an embodiment, the OS 220 includes at least such components as a security monitor 310, a web server 320, an authentication tool 330, a certificate control tool 340, and an interaction control tool 350 previously shown in Fig. 3 and disclosed in Fig. 2.

Access to RTOS 225 with OS 220 is possible only for an authenticated user via remote computer 210.

At step 410, a request for the start of a user session is transmitted to the computing system 110 using the remote computer 210. The request is carried out by transmitting a request for the start of a session from the remote computer 210 to the OS 220 to the web server 320, after which the web server 320 transmits the request to the authentication means 330. An example of an interface on the remote computer 210 intended for interaction with the computing system 110 is a web browser. In a particular embodiment, the interface on the remote computer 210 is any program capable of sending commands that the VU 100 can interpret, as well as encrypt the connection.

At step 420, an encrypted channel is established using the remote computer 210 between the remote computer 210 and the computing system 110. The encrypted channel is established between the remote computer 210 and the authentication means 330 via the web server 320. Establishing an encrypted channel using the Diffie-Hellman cryptographic protocol as an example was given earlier in the description of Fig. 3.

At step 430, the user is authenticated in the computing system 110, as a result of which the remote computer 210 is allowed to interact with the computing system 115 in the event of successful authentication. The user is authenticated by means of the OS 220 components on the computing system 110. The authenticated user interacts with the RTOS 225 on the computing system 115.

In step 440, using the remote computer 210, configuration data is sent through the computing system 110 to the computing system 115. For example, the value of the set liquid level in the tank from the previously described example of Fig. 3 is transmitted.

At step 450, the configuration data is converted using the computing system 115 into control commands for the actuator 235.

At step 460, the computing system 115 interacts with at least one measuring device 230 and one actuator 235. The computing system 115 interacts with the sensor 230 by collecting data from the sensor 230. The computing system 115 interacts with the actuator 235 by transmitting control commands to the actuator 235. For example, data on the liquid level in the reservoir is transmitted, as well as data on the state of the valves of the inlet and outlet pipes from the previously described example of the implementation of the system 200. In a particular embodiment, control commands are transmitted from the computing system 115 to the actuator 235 depending on the data received from the sensor 230.

As shown in Fig. 5, the computer system 20 includes: a central processor 21, a system memory 22 and a system bus 23 that connects various system components, including memory associated with the central processor 21. The system bus 23 is implemented as any bus structure known in the art, which in turn contains a bus memory or a bus memory controller, a peripheral bus and a local bus capable of interacting with any other bus architecture. Examples of buses are: PCI, ISA, PCI-Express, HyperTransport™, InfiniBand™, Serial ATA, I2C and other suitable connections between components of the computer system 20. The central processor 21 includes one or more processors having one or more cores. The central processor 21 executes one or more sets of machine-readable instructions that implement the methods presented in this document. The system memory 22 may be any memory for storing data and/or computer programs executed by the central processor 21. The system memory may contain both a read-only memory (ROM) 24 and a random access memory (RAM) 25. The main input/output system (BIOS) 26 contains the main procedures that ensure the transfer of information between elements of the computer system 20, for example, at the time of loading the operating system using the ROM 24.

The computer system 20 includes one or more data storage devices, such as one or more removable storage devices 27, one or more non-removable storage devices 28, or combinations of removable and non-removable devices. One or more removable storage devices 27 and/or non-removable storage devices 28 are connected to the system bus 23 via the interface 32. In one embodiment, the removable storage devices 27 and the corresponding computer-readable storage media are non-volatile modules for storing computer instructions, data structures, program modules and other data of the computer system 20. The system memory 22, the removable storage devices 27 and the non-removable storage devices 28 can use various computer-readable storage media. Examples of computer-readable storage media include computer memory such as cache memory, SRAM, DRAM, Z-RAM, T-RAM, eDRAM, EDO RAM, DDR RAM, EEPROM, NRAM, RRAM, SONOS, PRAM; flash memory or other memory technologies such as solid-state drives (SSD) or flash drives; magnetic cassettes, magnetic tapes, and magnetic disks such as hard disks or floppy disks; optical media such as compact discs (CD-ROM) or digital versatile discs (DVD); and any other media that can be used to store the desired data and that can be accessed by computer system 20.

The system memory 22, the removable storage devices 27 and the non-removable storage devices 28 contained in the computer system 20 are used to store the operating system 35, applications 37, other program modules 38 and program data 39. The computer system 20 includes a peripheral interface 46 for transmitting data from input devices 40, such as a keyboard, mouse, stylus, game controller, voice input device, touch input device, or other peripheral devices, such as a printer or scanner through one or more input/output ports, such as a serial port, parallel port, universal serial bus (USB) or other peripheral interface. A display device 47, such as one or more monitors, projectors or built-in displays, is also connected to the system bus 23 through an output interface 48, such as a video adapter. In addition to the display devices 47, the computer system 20 is equipped with other peripheral output devices (not shown in Fig. N), such as speakers and other audiovisual devices.

The computer system 20 may operate in a network environment using a network connection with one or more remote computers 49. The remote computer (or computers) 49 is a working personal computer or a server that contains most or all of the components mentioned earlier in describing the nature of the computer system 20 shown in Fig. N. Other devices may also be present in the network environment, such as routers, network stations or other network nodes. The computer system 20 may include one or more network interfaces 51 or network adapters for communicating with the remote computers 49 via one or more networks, such as a local area network (LAN) 50, a wide area network (WAN), an intranet and the Internet. Examples of a network interface 51 are an Ethernet interface, a Frame Relay interface, a SONET interface and wireless interfaces.

Embodiments of the present invention may be a system, a method, or a computer-readable storage medium (or carrier).

A computer-readable storage medium is a tangible device that stores and stores program code in the form of computer-readable instructions or data structures that are accessible to the central processor 21 of the computer system 20. The computer-readable storage medium may be an electronic, magnetic, optical, electromagnetic, semiconductor memory device, or any suitable combination thereof. As an example, such a computer-readable storage medium may include random access memory (RAM), read-only memory (ROM), EEPROM, a portable compact disc with read-only memory (CD-ROM), a digital versatile disk (DVD), flash memory, a hard disk, a portable computer diskette, a memory card, a floppy disk, or even a mechanically encoded device such as punched cards or relief structures with instructions recorded thereon.

The system and method of the present invention can be considered in terms of means. The term "means" as used herein refers to an actual device, component or group of components implemented by hardware, such as an application-specific integrated circuit (ASIC) or FPGA, or as a combination of hardware and software, such as a microprocessor system and a set of machine-readable instructions for implementing the functionality of the means, which (during execution) transform the microprocessor system into a special-purpose device. The means can also be implemented as a combination of these two components, whereby some functions can be implemented only by hardware, and other functions - by a combination of hardware and software. In some embodiments, at least part, and in some cases all, of the means can be executed on the central processor 21 of the computer system 20. Accordingly, each means can be implemented in various suitable configurations and should not be limited to any particular embodiment given herein.

Finally, it should be noted that the information provided in the description is examples that do not limit the scope of the present invention defined by the claims. It will be clear to one skilled in the art that in developing any actual embodiment of the present invention, many decisions specific to a particular embodiment must be made in order to achieve specific goals, and these specific goals will be different for different embodiments. It is understood that such development efforts can be complex and time-consuming, but, nevertheless, they will be a routine engineering task for those of ordinary skill in the art, using the present disclosure.

Claims (14)

1. A programmable logic controller (PLC) for controlling real-time devices, characterized in that it contains a system on a chip including at least two computing systems, each of which contains a memory, a periphery, where the memory and the periphery interacting with the first computing system are isolated from the memory and the periphery interacting with the second computing system, wherein: the first computing system is intended for interacting with a remote computer and interacting with the second computing system; the second computing system is intended for interacting with the first computing system, during which it carries out at least one of: receiving configuration data or control commands for a measuring or actuator device from the first computing system, transmitting status data to the first computing system, converting configuration data into control commands for the actuator; for interacting with at least one of the devices: an actuator and a measuring device, wherein during the interaction the following is performed: collecting data from the measuring device, transmitting control commands to the actuator. 2. A PLC according to claim 1, wherein each computing system comprises at least one computing core. 3. A PLC according to claim 1, wherein the interaction of the first computing system with the second computing system is carried out via a high-speed data transmission bus. 4. The PLC according to claim 1, wherein the first computing system additionally authenticates the user based on the data received from the remote computer. 5. The PLC of claim 4, wherein the first computing system transmits data to the second computing system only if the user is authenticated. 6. A PLC according to claim 1, wherein the interaction between the remote computer and the PLC is carried out through the establishment of an encrypted communication channel. 7. A PLC according to claim 1, wherein the first computing system additionally comprises a general-purpose operating system (OS) and the second computing system comprises a real-time operating system (RTOS). 8. The PLC of claim 7, wherein the general-purpose operating system includes components: a security monitor, a web server, an authentication tool, a certificate control tool, and an interaction control tool. 9. The PLC of claim 8, wherein the security monitor, the authentication tool, the certificate control tool, and the interaction control tool are trusted components, and the web server is an untrusted component. 10. The PLC according to claim 8, wherein the security monitor controls the interaction of components with each other using interprocess communication mechanisms based on security policies. 11. The PLC according to claim 8, wherein the certificate control means supports an HTTPS connection between the remote interface on the computing device and the web server. 12. The PLC according to item 8, wherein the interaction control means transmits configuration data from a remote computer via a high-speed data transmission bus to a computing system with an RTOS, and also receives data from the computing system with an RTOS concerning the operation of the measuring device. 13. The PLC of claim 8, wherein the web server receives HTTP requests from a remote interface on the computing device and produces HTTP responses with an HTML page. 14. The PLC according to claim 8, wherein the security monitor is responsible for determining permissions or prohibitions on interaction between general-purpose OS components using interprocess communication mechanisms based on security policies.