Safety simulation unit, safety simulation unit interaction method and system

Abstract

The present invention discloses a security simulation unit, an interaction method for the security simulation unit, and a system. The security simulation unit includes security simulation hardware and program components running on the security simulation hardware. The program components include a security service program, a security service support component, and a system support component. The security service program includes a simulation ESAM unit management module, a 698 ciphertext protocol parsing module, a log recording module, an ESAM business simulation module, an SM encryption and decryption module, and a multi-task concurrent processing module, which is used to provide data security services for external devices and process client API call functions in a TCP / IP manner. The security simulation hardware includes an MCU, an SSD hard disk, a RAM, a network card, a communication interface, and an encryption card. The client interface part is the external interface of the security simulation unit, which calls the security service function and realizes customized function configuration. The security simulation unit has strong scalability, a high degree of modularity, wide hardware support, and good security and reliability.

Description

Technical Field

[0001] The present invention relates to the technical field of power systems, and more particularly, to a safety simulation unit, an interaction method for the safety simulation unit, and a system. Background Art

[0002] The simulation training device interacts with the client-side Power IoT training software to simulate various data collection and metering failures and electricity theft scenarios, meeting the needs of practical skills training and examinations. The security simulation unit simulates the security functions of smart energy meters, energy controllers, concentrators, and other devices. It also supports authentication and communication data encryption between the client-side Power IoT training software, simulation equipment, and the simulation training device. It consists of both security simulation software and security simulation hardware.

[0003] The security simulation unit should be able to simulate the security functions of the 2009 version of electricity meters, the 13 version of electricity meters, the object-oriented electricity meters, the 20 version of modular electricity meters, the smart IoT electricity meters, energy controllers, and concentrators. It should support identity authentication and communication data encryption and decryption between the simulation training device and the customer-side power IoT training software, and identity authentication and communication data encryption and decryption between the simulation training device and the simulation module.

[0004] At present, simulation training device companies do not have mature products for this type of security simulation unit in terms of key management, message authentication, data encryption, signature verification, etc. In order to meet the simulation training device's demand for secure application layer cryptographic services, there is an urgent need for a set of security simulation units with strong scalability, high modularity, wide hardware support, and good security and reliability. Summary of the Invention

[0005] According to the present invention, a security simulation unit, an interaction method for the security simulation unit and a system are provided to solve the technical problem that the current simulation training device companies do not have mature products in key management, message authentication, data encryption, signature verification and other aspects for such security simulation units. In order to meet the needs of simulation training devices for secure application layer cryptographic services, a set of security simulation units with strong scalability, high degree of modularity, wide hardware support, good security and reliability are urgently needed.

[0006] According to a first aspect of the present invention, there is provided a security simulation unit, the security simulation unit comprising security simulation hardware and program components running on the security simulation hardware, the program components comprising a security service program, a security service support component and a system support component;

[0007] The security service program includes an ESAM unit simulation management module, a 698 ciphertext protocol parsing module, a log recording module, an ESAM business simulation module, an SM encryption and decryption module, and a multi-task concurrent processing module, which is used to provide data security services for external devices and process client API call functions in TCP / IP mode;

[0008] The security simulation hardware includes MCU, SSD hard disk, RAM, network card, communication interface and encryption card. The client interface part is the external interface of the security simulation unit, which calls the security service function and realizes customized function configuration.

[0009] Optionally, the security service support component includes an open service interface, an encryption card interface, a database interface and a Linux system service interface. By configuring customized interface definitions and communication protocols, it supports key negotiation, encryption and decryption of security service programs, and realizes key downloading and secure interaction between the security simulation unit and the simulation training device, the main control unit and the simulation equipment.

[0010] Optionally, the system support components include a database, a Linux system and hardware drivers, using an industrial-grade industrial computer as a carrier and equipped with Linux system driver services to provide a safe, stable and closed operating environment.

[0011] Optionally, the simulation ESAM unit management module is used to allocate table addresses, download fixed keys, generate ESAM information, and initialize parameters;

[0012] The 698 ciphertext protocol parsing module is used for 698 ciphertext message protocol processing, and parses the obtained ciphertext message to obtain the plaintext message, assembles it according to the plaintext message protocol, and then sends it out;

[0013] The log recording module is used to record the logs generated during system operation, including historical message communication logs, general message logs, system warning logs and system operation abnormality logs;

[0014] The ESAM business simulation module is used to simulate ESAM functions, including ESAM information acquisition, simulation meter important parameter setting / update and session key negotiation;

[0015] The SM encryption and decryption module is used to complete plaintext encryption operations, ciphertext decryption operations and MAC verification operations based on the SM1, SM2, SM3, and SM4 cryptographic algorithms;

[0016] The multi-task concurrent processing module is used to support low-latency concurrent request responses from multiple clients and can support concurrent access from 100+ clients.

[0017] Optionally, the multi-task concurrent processing module includes a data storage module and a system configuration module;

[0018] The data storage module is used to store key information, ESAM information, and simulated meter information through the MySQL database to ensure safe and fast data retrieval;

[0019] The system configuration module is used to configure the listening port, thread pool size, log level and administrator permissions.

[0020] According to another aspect of the present invention, a security simulation unit interaction method includes:

[0021] The management master station initializes the key download and related data in the security simulation unit through a protocol command;

[0022] The main control unit exchanges command messages with the management master station to ensure the security of the simulation device through the encryption and decryption services provided by the security simulation unit;

[0023] The security simulation unit detects the legitimacy of the command message and filters out illegal command messages;

[0024] The simulation training device includes a main control unit and a safety simulation unit.

[0025] Optionally, the management master station initializes the key download and related data in the security simulation unit through a protocol command, including:

[0026] The management master station dynamically creates a virtual ESAM inside the security simulation unit according to the number of simulated devices and dynamically initializes the simulation device parameter information. The virtual ESAM of the security simulation unit simulates all the functions provided by the ESAM chip.

[0027] Optionally, it also includes:

[0028] After the simulation device is connected to the virtual ESAM through the device address, it is bound to the virtual ESAM;

[0029] The security simulation unit parses and frames 698 protocol messages, and provides security services for session establishment, identity authentication, parameter setting, broadcasting, and message reading for 698 protocol messages.

[0030] The simulation device and the main control unit send relevant instructions to call the data security service in the security simulation unit according to the security service program communication protocol.

[0031] Optionally, the management master station initializes the key download and related data in the security simulation unit through a protocol command, including:

[0032] Obtaining, through the main control unit, a first simulation device list of the simulation device and a second simulation device list of the security simulation unit, and determining whether the first simulation device list and the second simulation device list are consistent;

[0033] If they are consistent, the security unit information will not be updated;

[0034] If they are inconsistent, the first simulation device list is reported to the management main station to request a key update, and at the same time, an instruction is sent to the security unit to clear the expired key package;

[0035] The management master station generates a device key package based on the first simulation device list and sends it to the simulation devices one by one;

[0036] The key package is forwarded to the security unit for storage, and the process is executed in a loop until the key packages of all devices are updated.

[0037] Optionally, the main control unit exchanges command messages with the management master station to ensure the security of the simulation device through the encryption and decryption service provided by the security simulation unit, including:

[0038] When the main control unit receives the command message sent by the management master station, it determines whether the command message is an encrypted message or a plain text message;

[0039] When the command message is an encrypted message, the main control unit sends the encrypted message to the security simulation unit for decryption and execution;

[0040] When the command message is a plaintext message, the main control unit executes the plaintext message;

[0041] When the main control unit sends a command message to the management master station, it determines whether the command message needs encryption protection;

[0042] When the command message needs to be encrypted, the main control unit sends the command message to the security simulation unit, encrypts it, and then forwards it to the management master station;

[0043] When the command message does not need to be encrypted, the main control unit sends the command message to the management main station.

[0044] According to another aspect of the present invention, there is also provided an interactive system of a security simulation unit, comprising:

[0045] Initialization key data module, used for managing the master station to initialize the key download and related data in the security simulation unit through protocol commands;

[0046] An interactive command message module is used for the main control unit to exchange command messages with the management master station to ensure the security of the simulation device through the encryption and decryption service provided by the security simulation unit;

[0047] An illegal message filtering module is used for the security simulation unit to detect the legitimacy of the command message and filter out illegal command messages;

[0048] The simulation training device includes a main control unit and a safety simulation unit.

[0049] Optionally, initializing the key data module includes:

[0050] The dynamic initialization parameter information submodule is used to manage the master station to dynamically create a virtual ESAM inside the security simulation unit according to the number of simulation devices, and dynamically initialize the simulation device parameter information. The virtual ESAM of the security simulation unit simulates all the functions provided by the ESAM chip.

[0051] Optionally, it also includes:

[0052] Binding virtual ESAM submodule is used to bind the simulation device to the virtual ESAM after the device address is attached to the virtual ESAM;

[0053] The parsing and framing submodule is used for the security simulation unit to parse and frame 698 protocol messages, and complete the message security services of session establishment, identity authentication, parameter setting, broadcasting, and reading for 698 protocol messages;

[0054] The data security service sending submodule is used to simulate the device and the main control unit to send relevant instructions to call the data security service in the security simulation unit according to the security service program communication protocol.

[0055] Optionally, initializing the key data module includes:

[0056] A simulation device list acquisition submodule is used to acquire a first simulation device list of simulation devices and a second simulation device list of security simulation units through the main control unit;

[0057] A simulation list determination submodule, configured to determine whether the first simulation device list and the second simulation device list are consistent;

[0058] The submodule for not updating the security unit information is used to not update the security unit information if the information is consistent;

[0059] The key update submodule is used to report the first simulation device list to the management main station if there is inconsistency, requesting a key update, and at the same time send an instruction to the security unit to clear the expired key package;

[0060] A device key package making submodule is configured to manage the master station to make a device key package according to the first simulation device list and send it to the simulation devices one by one;

[0061] The key package forwarding submodule is used to forward the key package to the security unit for storage and execute the process in a loop until the key packages of all devices are updated.

[0062] Optionally, the interactive command message module includes:

[0063] A submodule for determining whether a message is encrypted, configured to determine whether the command message is an encrypted message or a plaintext message when the main control unit receives a command message sent by the management master station;

[0064] The decryption and execution message submodule is used for, when the command message is an encrypted message, the main control unit sends the encrypted message to the security simulation unit for decryption and execution;

[0065] A direct message execution submodule, configured to cause the main control unit to execute the plaintext message when the command message is a plaintext message;

[0066] A submodule for determining whether a message needs to be encrypted is used to determine whether the command message needs encryption protection when the main control unit sends a command message to the management master station;

[0067] The encrypted forwarding message submodule is used for, when the command message needs to be encrypted and protected, the main control unit sends the command message to the security simulation unit, encrypts it, and then forwards it to the management main station;

[0068] The direct message sending submodule is used for the main control unit to send the command message to the management main station when the command message does not need to be encrypted.

[0069] The main control unit and emulation devices utilize the encryption and decryption services provided by the security emulation unit to securely protect messages exchanged with the master station. The security emulation unit verifies the legitimacy of command messages and filters out illegal ones, providing identity verification and message filtering capabilities to ensure secure and effective interactive commands. The security emulation unit offers strong scalability, a high degree of modularity, extensive hardware support, and excellent security and reliability. This addresses the immature technical issues of existing security emulation units in key management, message authentication, data encryption, and signature verification. BRIEF DESCRIPTION OF THE DRAWINGS

[0070] A more complete understanding of exemplary embodiments of the present invention may be obtained by referring to the following drawings:

[0071] Figure 1 is a schematic diagram of a security simulation unit according to this embodiment;

[0072] Figure 2 is a flow chart of an interactive method of a security simulation unit according to this embodiment;

[0073] Figure 3is a schematic diagram of the interaction between the security simulation unit and the main control unit according to this embodiment;

[0074] Figure 4 Schematic diagram of the process of downloading the security simulation unit key according to this embodiment;

[0075] Figure 5 Schematic diagram of the process of secure interaction between the security simulation unit and the main control unit according to this embodiment;

[0076] Figure 6 Schematic diagram of the process of secure interaction between the security simulation unit and the simulation device according to this embodiment;

[0077] Figure 7 Schematic diagram of the overall design of the safety simulation unit according to this embodiment;

[0078] Figure 8 is a software design diagram of the security simulation unit according to this embodiment;

[0079] Figure 9 Schematic diagram of an interactive system of a security simulation unit according to this embodiment. DETAILED DESCRIPTION

[0080] Exemplary embodiments of the present invention will now be described with reference to the accompanying drawings. However, the present invention may be embodied in many different forms and is not limited to the embodiments described herein. These embodiments are provided to provide a thorough and complete disclosure of the present invention and to fully convey the scope of the present invention to those skilled in the art. The terminology used in the exemplary embodiments shown in the accompanying drawings is not intended to limit the present invention. In the accompanying drawings, identical elements are denoted by the same reference numerals.

[0081] Unless otherwise specified, the terms used herein (including technical terms) have the meanings commonly understood by those skilled in the art. In addition, it is understood that terms defined in commonly used dictionaries should be understood to have the same meanings as those in the context of the relevant fields, and should not be understood as idealized or overly formal meanings.

[0082] According to a first aspect of the present invention, there is provided a security simulation unit, the security simulation unit comprising security simulation hardware and program components running on the security simulation hardware, the program components comprising a security service program, a security service support component and a system support component;

[0083] The security service program includes an ESAM unit simulation management module, a 698 ciphertext protocol parsing module, a log recording module, an ESAM business simulation module, an SM encryption and decryption module, and a multi-task concurrent processing module, which is used to provide data security services for external devices and process client API call functions in TCP / IP mode;

[0084] The security simulation hardware includes MCU, SSD hard disk, RAM, network card, communication interface and encryption card. The client interface part is the external interface of the security simulation unit, which calls the security service function and realizes customized function configuration.

[0085] Specifically, refer to Figure 1 As shown, the security simulation unit is equipped with Linux system and provides external services in TCP / IP mode;

[0086] The processor module includes the CPU, memory, internal storage, USB, 485 and other key functional circuits required by the security simulation unit;

[0087] The power management module is responsible for the power supply of the entire safety simulation unit system.

[0088] Optionally, the security service support component includes an open service interface, an encryption card interface, a database interface and a Linux system service interface. By configuring customized interface definitions and communication protocols, it supports key negotiation, encryption and decryption of security service programs, and realizes key downloading and secure interaction between the security simulation unit and the simulation training device, the main control unit and the simulation equipment.

[0089] Optionally, the system support components include a database, a Linux system and hardware drivers, using an industrial-grade industrial computer as a carrier and equipped with Linux system driver services to provide a safe, stable and closed operating environment.

[0090] Optionally, the simulation ESAM unit management module is used to allocate table addresses, download fixed keys, generate ESAM information, and initialize parameters;

[0091] The 698 ciphertext protocol parsing module is used for 698 ciphertext message protocol processing, and parses the obtained ciphertext message to obtain the plaintext message, assembles it according to the plaintext message protocol, and then sends it out;

[0092] The log recording module is used to record the logs generated during system operation, including historical message communication logs, general message logs, system warning logs and system operation abnormality logs;

[0093] The ESAM business simulation module is used to simulate ESAM functions, including ESAM information acquisition, simulation meter important parameter setting / update and session key negotiation;

[0094] The SM encryption and decryption module is used to complete plaintext encryption operations, ciphertext decryption operations and MAC verification operations based on the SM1, SM2, SM3, and SM4 cryptographic algorithms;

[0095] The multi-task concurrent processing module is used to support low-latency concurrent request responses from multiple clients and can support concurrent access from 100+ clients.

[0096] Optionally, the multi-task concurrent processing module includes a data storage module and a system configuration module;

[0097] The data storage module is used to store key information, ESAM information, and simulated meter information through the MySQL database to ensure safe and fast data retrieval;

[0098] The system configuration module is used to configure the listening port, thread pool size, log level and administrator permissions.

[0099] The security simulation unit provided by the present invention has flexible space selection and small size, which can meet the needs of smaller installation spaces; the installation method is flexible and can be divided into wall-mounted, rack-mounted, desktop, and embedded; the peripheral interfaces are rich and the scalability is good, and various mainstream interfaces are reserved to support diversified functions. It supports the encryption function bound to the motherboard and the hard disk, and system encryption; supports dual-channel memory; supports VGA interface; supports USB 3.0 interface; supports SATA interface; supports RS485, RS232; supports M-SATA SSD solid-state hard disk; supports Gigabit Ethernet interface; supports Mini-PCIE slot. It has a high degree of modularity, uses the Linux kernel, and has a unique modular mechanism to meet diverse needs and subsequent expansion requirements; it supports a wide range of hardware and is suitable for access to all training devices that can be modularly designed; it has good security and reliability, uses the Linux kernel, and runs efficiently and stably.

[0100] According to another aspect of the present invention, a method 200 is provided, referring to Figure 2 As shown, the method 200 includes:

[0101] S201: The management master station initializes the key download and related data in the security simulation unit through a protocol command;

[0102] S202: The main control unit exchanges command messages with the management master station to ensure the security of the simulation device through the encryption and decryption service provided by the security simulation unit;

[0103] S203: The security simulation unit detects the legitimacy of the command message and filters out illegal command messages;

[0104] The simulation training device includes a main control unit and a safety simulation unit.

[0105] Specifically, refer to Figure 3 As shown in the figure, the security simulation unit provides relevant security services to the main control unit and simulation devices:

[0106] 1) The management master station completes the key download and related data initialization in the security simulation unit through relevant protocol commands;

[0107] 2) The main control unit and simulation device use the encryption and decryption services provided by the security simulation unit to complete the security protection of the interactive messages with the master station;

[0108] 3) The security simulation unit detects the legitimacy of command messages, filters illegal command messages, and provides identity recognition and message filtering functions to ensure the security and effectiveness of interactive commands.

[0109] Based on the number of simulated devices, the management master dynamically creates a virtual ESAM within the security simulation unit and initializes its parameters. This virtual ESAM simulates all the functions provided by the ESAM chip. Simulated devices attach to the virtual ESAM using their device addresses, effectively binding to it. The security simulation unit implements 698 protocol message parsing and framing, providing security services for 698 protocol messages, including session establishment, authentication, parameter setting, broadcasting, and data transmission.

[0110] The simulation device and the main control unit can send relevant instructions according to the Security Service Program Communication Protocol (SSAP) to call the data security service in the security simulation unit.

[0111] The main control unit and emulation devices utilize the encryption and decryption services provided by the security emulation unit to securely protect messages exchanged with the master station. The security emulation unit verifies the legitimacy of command messages and filters out illegal ones, providing identity verification and message filtering capabilities to ensure secure and effective interactive commands. The security emulation unit offers strong scalability, a high degree of modularity, extensive hardware support, and excellent security and reliability. This addresses the immature technical issues of existing security emulation units in key management, message authentication, data encryption, and signature verification.

[0112] Optionally, the management master station initializes the key download and related data in the security simulation unit through a protocol command, including:

[0113] The management master station dynamically creates a virtual ESAM inside the security simulation unit according to the number of simulated devices and dynamically initializes the simulation device parameter information. The virtual ESAM of the security simulation unit simulates all the functions provided by the ESAM chip.

[0114] Optionally, it also includes:

[0115] After the simulation device is connected to the virtual ESAM through the device address, it is bound to the virtual ESAM;

[0116] The security simulation unit parses and frames 698 protocol messages, and provides security services for session establishment, identity authentication, parameter setting, broadcasting, and message reading for 698 protocol messages.

[0117] The simulation device and the main control unit send relevant instructions to call the data security service in the security simulation unit according to the security service program communication protocol.

[0118] Optionally, the management master station initializes the key download and related data in the security simulation unit through a protocol command, including:

[0119] Obtaining, through the main control unit, a first simulation device list of the simulation device and a second simulation device list of the security simulation unit, and determining whether the first simulation device list and the second simulation device list are consistent;

[0120] If they are consistent, the security unit information will not be updated;

[0121] If they are inconsistent, the first simulation device list is reported to the management main station to request a key update, and at the same time, an instruction is sent to the security unit to clear the expired key package;

[0122] The management master station generates a device key package based on the first simulation device list and sends it to the simulation devices one by one;

[0123] The key package is forwarded to the security unit for storage, and the process is executed in a loop until the key packages of all devices are updated.

[0124] 1)Reference Figure 4 As shown, the simulation device and each simulation device and the safety simulation unit are powered on, and the device obtains the information of each simulation device in plain text to obtain device list 1;

[0125] 2) The simulation device obtains the device list 2 from the security simulation unit in plain text;

[0126] 3) The simulation device compares device list 1 and device list 2;

[0127] 4) If they are consistent, the security unit information does not need to be updated and jump to step 8;

[0128] 5) If there is any inconsistency, the device list 1 shall prevail. The simulation device shall report the device list 1 information to the management master station and request to update the key. At the same time, it shall send an instruction to the security unit to clear the expired key package.

[0129] 6) The management master station creates a device key package based on the information in device list 1 and sends it to the devices one by one (because the device key package is relatively large, it is recommended to create a key package for each device and send it sequentially);

[0130] 7) The device forwards the key package to the security unit for storage and executes the process in a loop until the key packages of all devices are updated.

[0131] Optionally, the main control unit exchanges command messages with the management master station to ensure the security of the simulation device through the encryption and decryption service provided by the security simulation unit, including:

[0132] When the main control unit receives the command message sent by the management master station, it determines whether the command message is an encrypted message or a plain text message;

[0133] When the command message is an encrypted message, the main control unit sends the encrypted message to the security simulation unit for decryption and execution;

[0134] When the command message is a plaintext message, the main control unit executes the plaintext message;

[0135] When the main control unit sends a command message to the management master station, it determines whether the command message needs encryption protection;

[0136] When the command message needs to be encrypted, the main control unit sends the command message to the security simulation unit, encrypts it, and then forwards it to the management master station;

[0137] When the command message does not need to be encrypted, the main control unit sends the command message to the management main station.

[0138] Specifically, refer to Figure 5 As shown in the figure, the simulation channel process is described as follows:

[0139] 1) The simulation device as a whole communicates with the management master station as a simulation terminal, mainly referring to the 698 object-oriented terminal communication protocol. The device main control unit and the management master station communicate through the simulation channel;

[0140] 2) When the device receives a message from the master station, if it finds that the data field is ciphertext, it will hand over the entire frame message to the security simulation unit for decryption processing, and then process it after obtaining the plaintext message;

[0141] 3) When the device sends a message to the management master station, if ciphertext transmission is required, the entire frame of the message will be sent to the security simulation unit for encryption processing, and the encrypted and protected entire frame of the message will be uploaded.

[0142] refer to Figure 6 As shown, the sampling channel process is described:

[0143] 1) When the simulation device receives the message from the master station, if it finds that the data field is ciphertext, it will send the entire frame message to the security simulation unit for decryption processing, and then process it after obtaining the plaintext message;

[0144] 2) When the simulation device sends a message to the user master station, if ciphertext transmission is required, the entire frame of the message will be sent to the security simulation unit for encryption processing, and the encrypted and protected entire frame of the message will be uploaded.

[0145] refer to Figure 7 As shown, the overall design of the safety simulation unit includes:

[0146] 1) Intel I3 5010U CPU dual-core 2.1GHz;

[0147] 2) Supports encryption function binding between motherboard and hard disk, and system encryption;

[0148] 3) Support dual-channel memory 4G;

[0149] 4) Provide VGA interface;

[0150] 5) Provide USB 3.0 interface;

[0151] 6) Provide USB 2.0 interface;

[0152] 7) Provide SATA interface;

[0153] 8) Provide RS232 serial port;

[0154] 9) Provide RS485 serial port;

[0155] 10) Support M-SATA SSD 64G;

[0156] 11) Provides 2 Gigabit Ethernet interfaces;

[0157] 12) Provide Mini-PCIE slot;

[0158] 13) Support automatic power-on function;

[0159] 14) Supports 12V DC power supply, which has reverse connection protection function. Reverse connection of the power supply will not cause damage to the motherboard and external power supply.

[0160] refer to Figure 8 As shown, Figure 8 A schematic diagram of the various modules in the safety simulation unit.

[0161] The main control unit and emulation devices utilize the encryption and decryption services provided by the security emulation unit to securely protect messages exchanged with the master station. The security emulation unit verifies the legitimacy of command messages and filters out illegal ones, providing identity verification and message filtering capabilities to ensure secure and effective interactive commands. The security emulation unit offers strong scalability, a high degree of modularity, extensive hardware support, and excellent security and reliability. This addresses the immature technical issues of existing security emulation units in key management, message authentication, data encryption, and signature verification.

[0162] According to another aspect of the present invention, there is also provided an interactive system 900 of a security simulation unit, referring to Figure 9 As shown, the system 900 includes:

[0163] Initialization key data module 910, used to manage the master station to initialize the key download and related data in the security simulation unit through protocol commands;

[0164] Interaction command message module 920, used for the main control unit to exchange command messages with the management master station to ensure the security of the simulation device through the encryption and decryption service provided by the security simulation unit;

[0165] Illegal message filtering module 930, used for the security simulation unit to detect the legitimacy of the command message and filter out illegal command messages;

[0166] The simulation training device includes a main control unit and a safety simulation unit.

[0167] Optionally, initializing the key data module 910 includes:

[0168] The dynamic initialization parameter information submodule is used to manage the master station to dynamically create a virtual ESAM inside the security simulation unit according to the number of simulation devices, and dynamically initialize the simulation device parameter information. The virtual ESAM of the security simulation unit simulates all the functions provided by the ESAM chip.

[0169] Optionally, it also includes:

[0170] Binding virtual ESAM submodule is used to bind the simulation device to the virtual ESAM after the device address is attached to the virtual ESAM;

[0171] The parsing and framing submodule is used for the security simulation unit to parse and frame 698 protocol messages, and complete the message security services of session establishment, identity authentication, parameter setting, broadcasting, and reading for 698 protocol messages;

[0172] The data security service sending submodule is used to simulate the device and the main control unit to send relevant instructions to call the data security service in the security simulation unit according to the security service program communication protocol.

[0173] Optionally, initializing the key data module 910 includes:

[0174] A simulation device list acquisition submodule is used to acquire a first simulation device list of simulation devices and a second simulation device list of security simulation units through the main control unit;

[0175] A simulation list determination submodule, configured to determine whether the first simulation device list and the second simulation device list are consistent;

[0176] The submodule for not updating the security unit information is used to not update the security unit information if the information is consistent;

[0177] The key update submodule is used to report the first simulation device list to the management main station if there is inconsistency, requesting a key update, and at the same time send an instruction to the security unit to clear the expired key package;

[0178] A device key package making submodule is configured to manage the master station to make a device key package according to the first simulation device list and send it to the simulation devices one by one;

[0179] The key package forwarding submodule is used to forward the key package to the security unit for storage and execute the process in a loop until the key packages of all devices are updated.

[0180] Optionally, the interactive command message module 920 includes:

[0181] A submodule for determining whether a message is encrypted, configured to determine whether the command message is an encrypted message or a plaintext message when the main control unit receives a command message sent by the management master station;

[0182] The decryption and execution message submodule is used for, when the command message is an encrypted message, the main control unit sends the encrypted message to the security simulation unit for decryption and execution;

[0183] A direct message execution submodule, configured to cause the main control unit to execute the plaintext message when the command message is a plaintext message;

[0184] A submodule for determining whether a message needs to be encrypted is used to determine whether the command message needs encryption protection when the main control unit sends a command message to the management master station;

[0185] The encrypted forwarding message submodule is used for, when the command message needs to be encrypted and protected, the main control unit sends the command message to the security simulation unit, encrypts it, and then forwards it to the management main station;

[0186] The direct message sending submodule is used for the main control unit to send the command message to the management main station when the command message does not need to be encrypted.

[0187] An interactive system 900 of a security simulation unit according to an embodiment of the present invention corresponds to an interactive method 200 of a security simulation unit according to another embodiment of the present invention, and details thereof will not be repeated herein.

[0188] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code. The scheme in the embodiment of the present application can be implemented in various computer languages, for example, object-oriented programming language Java and literal translation scripting language JavaScript, etc.

[0189] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the steps in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0190] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0191] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0192] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present application.

[0193] Obviously, those skilled in the art may make various changes and modifications to this application without departing from the spirit and scope of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalents, this application is intended to include these modifications and variations.

Claims

1. An interactive method for a security simulation unit, characterized in that: include: The management master station initializes the key download and related data in the security simulation unit through a protocol command; The main control unit exchanges command messages with the management master station to ensure the security of the simulation device through the encryption and decryption services provided by the security simulation unit; The security simulation unit detects the legitimacy of the command message and filters out illegal command messages; The simulation training device includes a main control unit and a safety simulation unit; The management master station initializes the key download and related data in the security simulation unit through protocol commands, including: The management master station dynamically creates a virtual ESAM inside the security simulation unit according to the number of simulated devices and dynamically initializes the simulation device parameter information. The virtual ESAM of the security simulation unit simulates all the functions provided by the ESAM chip. After the simulation device is connected to the virtual ESAM through the device address, it is bound to the virtual ESAM; The security simulation unit parses and frames 698 protocol messages, and provides security services for session establishment, identity authentication, parameter setting, broadcasting, and message reading for 698 protocol messages. The simulation device and the main control unit send relevant instructions to call the data security service in the security simulation unit according to the security service program communication protocol; Obtaining, through the main control unit, a first simulation device list of the simulation device and a second simulation device list of the security simulation unit, and determining whether the first simulation device list and the second simulation device list are consistent; If they are consistent, the security unit information will not be updated; If they are inconsistent, the first simulation device list is reported to the management main station to request a key update, and at the same time, an instruction is sent to the security unit to clear the expired key package; The management master station generates a device key package based on the first simulation device list and sends it to the simulation devices one by one; The key package is forwarded to the security unit for storage, and the process is executed in a loop until the key packages of all devices are updated.

2. The method according to claim 1, characterized in that The main control unit exchanges command messages with the management master station through the encryption and decryption services provided by the security simulation unit to ensure the security of the simulation device, including: When the main control unit receives the command message sent by the management master station, it determines whether the command message is an encrypted message or a plain text message; When the command message is an encrypted message, the main control unit sends the encrypted message to the security simulation unit for decryption and execution; When the command message is a plaintext message, the main control unit executes the plaintext message; When the main control unit sends a command message to the management master station, it determines whether the command message needs encryption protection; When the command message needs to be encrypted, the main control unit sends the command message to the security simulation unit, encrypts it, and then forwards it to the management master station; When the command message does not need to be encrypted, the main control unit sends the command message to the management main station.

3. An interactive system of a safety simulation unit, characterized in that: include: Initialization key data module, used for managing the master station to initialize the key download and related data in the security simulation unit through protocol commands; An interactive command message module is used for the main control unit to exchange command messages with the management master station to ensure the security of the simulation device through the encryption and decryption service provided by the security simulation unit; An illegal message filtering module is used for the security simulation unit to detect the legitimacy of the command message and filter out illegal command messages; The simulation training device includes a main control unit and a safety simulation unit; Initialize the key data module, including: The dynamic initialization parameter information submodule is used to manage the master station to dynamically create a virtual ESAM inside the security simulation unit according to the number of simulated devices and dynamically initialize the simulation device parameter information. The virtual ESAM of the security simulation unit simulates all the functions provided by the ESAM chip; Binding virtual ESAM submodule is used to bind the simulation device to the virtual ESAM after the device address is attached to the virtual ESAM; The parsing and framing submodule is used for the security simulation unit to parse and frame 698 protocol messages, and complete the message security services of session establishment, identity authentication, parameter setting, broadcasting, and reading for 698 protocol messages; The data security service sending submodule is used to simulate the device and the main control unit to send relevant instructions to call the data security service in the security simulation unit according to the security service program communication protocol; A simulation device list acquisition submodule is used to acquire a first simulation device list of simulation devices and a second simulation device list of security simulation units through the main control unit; A simulation list determination submodule, configured to determine whether the first simulation device list and the second simulation device list are consistent; The submodule for not updating the security unit information is used to not update the security unit information if the information is consistent; The key update submodule is used to report the first simulation device list to the management main station if there is inconsistency, requesting a key update, and at the same time send an instruction to the security unit to clear the expired key package; A device key package making submodule is configured to manage the master station to make a device key package according to the first simulation device list and send it to the simulation devices one by one; The key package forwarding submodule is used to forward the key package to the security unit for storage and execute the process in a loop until the key packages of all devices are updated.

4. The system according to claim 3, characterized in that Interactive command message module, including: A submodule for determining whether a message is encrypted, configured to determine whether the command message is an encrypted message or a plaintext message when the main control unit receives a command message sent by the management master station; The decryption and execution message submodule is used for, when the command message is an encrypted message, the main control unit sends the encrypted message to the security simulation unit for decryption and execution; A direct message execution submodule, configured to cause the main control unit to execute the plaintext message when the command message is a plaintext message; A submodule for determining whether a message needs to be encrypted is used to determine whether the command message needs encryption protection when the main control unit sends a command message to the management master station; The encrypted forwarding message submodule is used for, when the command message needs to be encrypted and protected, the main control unit sends the command message to the security simulation unit, encrypts it, and then forwards it to the management main station; The direct message sending submodule is used for the main control unit to send the command message to the management main station when the command message does not need to be encrypted.

5. A security simulation unit, applied to the interactive method according to claim 1, characterized in that: The security simulation unit includes security simulation hardware and program components running on the security simulation hardware, wherein the program components include a security service program, a security service support component and a system support component; The security service program includes an ESAM unit simulation management module, a 698 ciphertext protocol parsing module, a log recording module, an ESAM business simulation module, an SM encryption and decryption module, and a multi-task concurrent processing module, which is used to provide data security services for external devices and process client API call functions in TCP / IP mode; The security simulation hardware includes MCU, SSD hard disk, RAM, network card, communication interface and encryption card. The client interface part is the external interface of the security simulation unit, which calls the security service function and realizes the customized function configuration; The security service support component includes an open service interface, an encryption card interface, a database interface, and a Linux system service interface. By configuring customized interface definitions and communication protocols, it supports key negotiation, encryption and decryption of security service programs, and realizes key downloading and secure interaction between the security simulation unit and the simulation training device, the main control unit, and the simulation equipment. The system support components include database, Linux system and hardware drivers, using industrial-grade industrial computers as carriers and equipped with Linux system driver services to provide a safe, stable and closed operating environment; Described simulation ESAM unit management module is used for allocating table address, downloading fixed key, generating ESAM information, initialization parameter; The 698 ciphertext protocol parsing module is used for 698 ciphertext message protocol processing, and parses the obtained ciphertext message to obtain the plaintext message, assembles it according to the plaintext message protocol, and then sends it out; The log recording module is used to record the logs generated during system operation, including historical message communication logs, general message logs, system warning logs and system operation abnormality logs; The ESAM business simulation module is used to simulate ESAM functions, including ESAM information acquisition, simulation meter important parameter setting / update and session key negotiation; The SM encryption and decryption module is used to complete plaintext encryption operations, ciphertext decryption operations and MAC verification operations based on the SM1, SM2, SM3, and SM4 cryptographic algorithms; The multi-task concurrent processing module is used to support low-latency concurrent request responses from multiple clients.

6. The simulation unit according to claim 5, characterized in that The multi-task concurrent processing module includes a data storage module and a system configuration module; The data storage module is used to store key information, ESAM information, and simulated meter information through the MySQL database to ensure safe and fast data retrieval; The system configuration module is used to configure the listening port, thread pool size, log level and administrator permissions.

Images