Commercial password compliance verification method, system and device and storage medium

Abstract

The invention provides a commercial password compliance verification method, system and device and a storage medium, and belongs to the technical field of power system information security. The method comprises the following steps: searching a target device in a network through a built-in MySQL database and a packet capture program based on a Scaly algorithm, and collecting target detection data of the target device and encryption algorithm information used for data transmission; performing centralized management and standardization processing on the encryption algorithm information through an ELK log analysis system, and comparing the encryption algorithm information with a preset standard encryption algorithm type to generate a verification result; and performing front-end graphical web display on the checking result, and generating a checking report. According to the method, comprehensive collection, intelligent comparison and compliance check of the encryption algorithm information of the target equipment are realized, a visual, accurate and efficient check result is provided through front-end graphical display and PDF report generation, and the safety of the power monitoring system is effectively improved.

Description

Technical Field

[0001] The present invention relates to the field of power system information security technology, and more specifically to a commercial cryptographic compliance verification method, system, device and storage medium. Background Art

[0002] With the vigorous development of new power systems, the deployment of servers, network equipment and security facilities in power monitoring systems has increased significantly, especially in wind power, photovoltaic and other new energy sites, where the number of terminal devices connected has increased sharply. This trend has increased the complexity of the power monitoring system terminal site equipment access to the dispatching data network, thereby increasing the challenge of system security management.

[0003] At present, the power monitoring system mainly relies on simple passwords as a means of security protection, such as setting simple passwords. Such security protection measures are difficult to effectively guarantee the security protection level of the host and network equipment in the plant. Therefore, it is urgent to quickly improve the commercial password security protection capabilities within the power monitoring system. Given that a large number of devices need to be tested for commercial password compliance within the plant, verifying the effectiveness of compliance configuration is particularly critical.

[0004] However, due to the wide variety of on-site equipment, different operating systems, and different degrees of customization of operating systems by various business manufacturers, there is currently a lack of a commercial cryptographic compliance checking tool for power monitoring systems that can be universally applied, quickly verify, and accurately generate verification reports, which further hinders the improvement of security management efficiency. Summary of the invention

[0005] In view of the above problems, the purpose of the present invention is to provide a commercial encryption compliance verification method, system, device and storage medium, which utilizes the built-in MySQL database, the packet capture program based on the Scapy algorithm and the ELK log analysis system to realize the comprehensive collection, intelligent comparison and compliance verification of the encryption algorithm information of the target device, and provides intuitive, accurate and efficient verification results through front-end graphical display and PDF report generation, effectively improving the security of the power monitoring system.

[0006] In order to achieve the above object, the present invention is implemented through the following technical solutions: In a first aspect, the present invention discloses a commercial encryption compliance verification method, comprising: Through the built-in MySQL database and the packet capture program based on the Scapy algorithm, the target device is searched in the network, and the target detection data of the target device and the encryption algorithm information used for data transmission are collected; The encryption algorithm information is centrally managed and standardized through the ELK log analysis system, and compared with the preset standard encryption algorithm type to generate verification results; The verification results are displayed on the front-end graphical web and a verification report is generated.

[0007] Furthermore, the target device is searched in the network through the built-in MySQL database and the packet capture program based on the Scapy algorithm, and the operating system type and version information of the target device and the encryption algorithm information used for data transmission are collected, including: Use the built-in Scapy algorithm to search for the target device in the target device's network segment and summarize the target device: Extract the target detection data and encryption algorithm information used for data transmission from the target database of the target device, generate an encryption algorithm file, and download it.

[0008] Further, the use of the built-in Scapy algorithm to search for the target device in the network segment of the target device and summarize the target device includes: Based on ICMP, SNMP and ARP protocols, it constructs network data packets for detecting the target network and sends them to the network segment of the target device; Use the sniff function of the Scapy algorithm to monitor the response data packets, obtain the target device information by parsing the response data packets, and summarize them.

[0009] Further, the extraction of target detection data and encryption algorithm information used for data transmission in the target database of the target device, the generation of an encryption algorithm file, and the downloading of the encryption algorithm file include: According to the target device information, use the corresponding user name and commercial password to connect to the target device; Obtain the operating system type and version information of the target device by executing the query command; By performing a packet capture test, you can obtain the encryption algorithm information used by the target device for data transmission, generate an encryption algorithm file, download it, and save it as a copy.

[0010] Furthermore, the encryption algorithm information is centrally managed and standardized through the ELK log analysis system, and compared with the preset standard encryption algorithm type to generate verification results, including: The encryption algorithm files are collected through the data collection engine Logstash, the data is parsed according to predefined rules, and the data is standardized. The processed encryption algorithm information is sent to the data search and analysis engine Elasticsearch. Use the data search and analysis engine Elasticsearch to distribute the encryption algorithm information and establish a database; The encryption algorithm information stored in the database is compared with the preset standards, and the verification results are generated based on the comparison results.

[0011] Furthermore, the verification results are displayed on a front-end graphical web and a verification report is generated, including: The verification results are displayed through a front-end graphical web interface using charts and interactive functions, including data statistics tables and trend analysis charts; Generate a PDF version of the commercial encryption compliance verification report for the power monitoring system based on the verification results.

[0012] Furthermore, the predefined rule adopts a regular expression.

[0013] In a second aspect, the present invention further discloses a commercial encryption compliance verification system, comprising: Batch information collection module, which is used to search for target devices in the network through the built-in MySQL database and the packet capture program based on the Scapy algorithm, and collect the target device's operating system type, version information and encryption algorithm information used for data transmission; The automatic parsing and comparison module is used to centrally manage and standardize the encryption algorithm information through the ELK log analysis system, and compare it with the preset standard encryption algorithm type to generate verification results; The verification report generation module is used to display the verification results in a front-end graphical web format and generate a PDF version of the commercial encryption compliance verification report.

[0014] In a third aspect, the present invention further discloses a commercial encryption compliance verification device, comprising: A memory for storing a commercial encryption compliance verification program; A processor is used to implement the steps of the commercial encryption compliance verification method as described in any one of the above items when executing the commercial encryption compliance verification program.

[0015] In a fourth aspect, the present invention further discloses a readable storage medium, on which a commercial cryptographic compliance verification program is stored. When the commercial cryptographic compliance verification program is executed by a processor, the steps of the commercial cryptographic compliance verification method as described in any one of the above items are implemented.

[0016] Compared with the prior art, the present invention has the following beneficial effects: 1. The present invention can efficiently search for target devices in the network and quickly collect their operating system types, version information, and encryption algorithm information used for data transmission through a built-in MySQL database and a packet capture program based on the Scapy algorithm. This not only improves the efficiency of data collection, but also ensures the comprehensiveness and accuracy of the data.

[0017] 2. The present invention uses the ELK log analysis system (Logstash, Elasticsearch, Kibana and other components) to achieve centralized management and standardized processing of encryption algorithm information, and intelligently compare it with the preset standard encryption algorithm types. This process not only simplifies the compliance verification process, but also improves the accuracy and efficiency of the verification.

[0018] 3. The present invention uses predefined rules (such as regular expressions) to parse and process data, which has certain flexibility and scalability. Users can adjust the rules according to actual needs to adapt to different application scenarios and data formats.

[0019] 4. The present invention uses a front-end graphical web interface to intuitively display the verification results, including data statistics tables and trend analysis charts, etc., using charts and interactive functions. At the same time, according to the verification results, a PDF version of the commercial password compliance verification report of the power monitoring system can be automatically generated, providing users with a convenient way to view results and generate reports.

[0020] It can be seen that compared with the prior art, the present invention has outstanding substantive features and significant progress, and the beneficial effects of its implementation are also obvious. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0022] Figure 1 It is a method flow chart of a specific implementation mode of the present invention.

[0023] Figure 2 It is a system structure diagram of a specific implementation mode of the present invention.

[0024] In the figure, 1. Batch information collection module; 2. Automatic analysis and comparison module; 3. Verification report generation module. DETAILED DESCRIPTION

[0025] In order to enable those skilled in the art to better understand the scheme of the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific implementation methods. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0026] See also Figure 1 As shown, this embodiment provides a commercial encryption compliance verification method, including the following steps: S1: Through the built-in MySQL database and the packet capture program based on the Scapy algorithm, it searches for the target device in the network and collects the target detection data of the target device and the encryption algorithm information used for data transmission.

[0027] In a specific implementation manner, this step includes the following two steps: In the first step, the built-in Scapy algorithm is used to search for the target device in the target device’s network segment and summarize the target device.

[0028] The second step is to extract the target detection data and encryption algorithm information used for data transmission from the target database of the target device, generate an encryption algorithm file, and download it.

[0029] As an example, in the first step, first, ensure that the execution device of the method and the target device are in the same network segment for network communication, configure the network interface, and ensure that the tool can send and receive data packets.

[0030] Then, based on ICMP, SNMP and ARP protocols, a network data packet is constructed to detect the target network and sent to the network segment of the target device. This includes: constructing an ICMP Echo request packet (i.e., a Ping request) to detect the online status of the target device; constructing an SNMP GET request packet to obtain the system information of the target device (such as device name, IP address, MAC address, etc.); and constructing an ARP request packet to parse the ARP table of the target network and obtain the mapping relationship between the MAC address and IP address of the target device.

[0031] At this time, the constructed ICMP, SNMP and ARP detection data packets are sent to the target network. When sending data packets, the broadcast address sending method or the specific target IP address sending method can be used.

[0032] Furthermore, use Scapy's sniff function or similar mechanisms to monitor response packets on the network, including ICMPEcho Reply (Ping response), SNMP GET Response (system information response), and ARP Reply (ARP resolution response).

[0033] After successful monitoring, parse the returned ICMP Echo Reply data packet to confirm the online status of the target device. Specifically include: Parse the returned SNMP GET Response data packet and extract the system information of the target device, such as device name, IP address, MAC address, operating system type (if allowed by SNMP configuration), etc.

[0034] Parse the returned ARP Reply data packet, update the ARP table, and confirm the mapping relationship between the MAC address and IP address of the target device.

[0035] Finally, all the parsed target device information (including online status, IP address, MAC address, system information, etc.) is summarized into the database for subsequent processing and analysis.

[0036] As an example, in the second step, first use the corresponding user name and commercial password to connect to the target device based on the target device information; then obtain the operating system type and version information of the target device by executing a query command; finally, perform a packet capture test through the Wireshark or tcpdump network analysis tool to obtain the encryption algorithm information used for data transmission of the target device, generate an encryption algorithm file, download it and save it as a copy.

[0037] S2: The encryption algorithm information is centrally managed and standardized through the ELK log analysis system, and compared with the preset standard encryption algorithm type to generate verification results.

[0038] In a specific implementation, first, Logstash's input plug-in (such as file or beats) is used in combination with regular expressions and parsers to capture and centrally manage encryption algorithm files. The captured data is preprocessed through Logstash's filter plug-in (such as grok, mutate), such as extracting key information, formatting data, etc., to ensure data consistency and accuracy. Finally, Logstash sends the processed data to Elasticsearch through the output plug-in (such as elasticsearch) for storage and further analysis.

[0039] Then, in Elasticsearch, by defining index templates and mappings, a structured storage environment is created for encryption algorithm information. Elasticsearch uses distributed storage and indexing technology to efficiently store the data sent by Logstash on multiple nodes and provide fast search and query functions. Through Elasticsearch's query DSL (Domain Specific Language), complex retrieval and analysis of stored encryption algorithm information can be performed to provide data support for subsequent comparison and verification.

[0040] Finally, use programming languages ​​(such as Python, Java) or scripts (such as Shell scripts) to write comparison logic, and compare the encryption algorithm information stored in Elasticsearch with the preset standard encryption algorithm types one by one. During the comparison process, regular expressions and hash algorithms can be used to ensure the accuracy and efficiency of the comparison. Based on the comparison results, the verification results are generated.

[0041] S3: Display the verification results on the front-end graphical web and generate a verification report.

[0042] In a specific implementation, firstly, the verification result of the encryption algorithm processed by Logstash and stored by Elasticsearch is obtained from Elasticsearch, and the verification result is pre-processed, such as deduplication, sorting, statistics, etc., to ensure that the displayed data is accurate.

[0043] At this point, design appropriate chart types, such as bar charts, pie charts, line charts, etc., based on the content of the verification results to intuitively display the data results. Use front-end frameworks (such as React, Vue, etc.) and chart libraries (such as ECharts, Chart.js, etc.) to create these charts. Then, build a user-friendly web page to display a graphical representation of the verification results.

[0044] Finally, use a PDF generation library (such as iText, Puppeteer) or a PDF editor to design a professional report template, fill the verified and graphically displayed data results into the PDF template, and use the PDF generation library or editor to generate the final PDF report.

[0045] The present invention provides a commercial encryption compliance verification method, which utilizes a built-in MySQL database, a packet capture program based on the Scapy algorithm, and an ELK log analysis system to achieve comprehensive collection, intelligent comparison, and compliance verification of encryption algorithm information of target devices. It also provides intuitive, accurate, and efficient verification results through front-end graphical display and PDF report generation, effectively improving the security of the power monitoring system.

[0046] See also Figure 2 As shown, the present invention also discloses a commercial encryption compliance verification system, including: a batch information collection module 1, an automatic parsing and comparison module 2 and a verification report generation module 3. The batch information collection module 1 is used to search for target devices in the network through a built-in MySQL database and a packet capture program based on the Scapy algorithm, and collect the operating system type and version information of the target device and the encryption algorithm information used for data transmission.

[0047] The automatic parsing and comparison module 2 is used to centrally manage and standardize the encryption algorithm information through the ELK log analysis system, and compare it with the preset standard encryption algorithm type to generate a verification result.

[0048] The verification report generation module 3 is used to display the verification results in a front-end graphical web format and generate a PDF version of the commercial encryption compliance verification report.

[0049] The specific implementation of the commercial encryption compliance verification system of this embodiment is basically the same as the specific implementation of the above-mentioned commercial encryption compliance verification method, and will not be repeated here.

[0050] The present invention also discloses a commercial password compliance verification device, comprising a processor and a memory; wherein, when the processor executes the commercial password compliance verification program stored in the memory, the steps of the commercial password compliance verification method as described in any one of the above items are implemented.

[0051] Furthermore, the commercial password compliance verification device in this embodiment may also include: The input interface is used to obtain the commercial password compliance verification program imported from the outside, and save the obtained commercial password compliance verification program to the memory, and can also be used to obtain various instructions and parameters transmitted by external terminal devices, and transmit them to the processor, so that the processor can use the above various instructions and parameters to carry out corresponding processing. In this embodiment, the input interface can specifically include but is not limited to a USB interface, a serial interface, a voice input interface, a fingerprint input interface, a hard disk reading interface, etc.

[0052] The output interface is used to output various data generated by the processor to the terminal device connected thereto, so that other terminal devices connected to the output interface can obtain various data generated by the processor. In this embodiment, the output interface may specifically include but is not limited to a USB interface, a serial interface, etc.

[0053] The communication unit is used to establish a remote communication connection between the commercial password compliance verification device and the external server so that the commercial password compliance verification device can mount the image file to the external server. In this embodiment, the communication unit may specifically include but is not limited to a remote communication unit based on wireless communication technology or wired communication technology.

[0054] The keyboard is used to obtain various parameter data or instructions input by the user by tapping the keycaps in real time.

[0055] A display for displaying real-time information related to running the commercial encryption compliance verification process.

[0056] The mouse can be used to assist users in inputting data and simplify user operations.

[0057] The present invention also discloses a readable storage medium, wherein the readable storage medium includes a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable hard disk, a CD-ROM or any other form of storage medium known in the technical field. The readable storage medium stores a commercial password compliance verification program, and when the commercial password compliance verification program is executed by a processor, the steps of the commercial password compliance verification method described in any one of the above items are implemented.

[0058] In summary, the present invention utilizes the built-in MySQL database, the packet capture program based on the Scapy algorithm, and the ELK log analysis system to realize the comprehensive collection, intelligent comparison, and compliance verification of the encryption algorithm information of the target device, and provides intuitive, accurate, and efficient verification results through front-end graphical display and PDF report generation, effectively improving the security of the power monitoring system.

[0059] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. As for the method disclosed in the embodiment, since it corresponds to the system disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0060] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0061] In the several embodiments provided by the present invention, it should be understood that the disclosed systems, systems and methods can be implemented in other ways. For example, the system embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of systems or units, which can be electrical, mechanical or other forms.

[0062] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0063] In addition, each functional module in each embodiment of the present invention may be integrated into one processing unit, or each module may exist physically separately, or two or more modules may be integrated into one unit.

[0064] Similarly, each processing unit in each embodiment of the present invention may be integrated into one functional module, or each processing unit may exist physically, or two or more processing units may be integrated into one functional module.

[0065] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0066] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0067] The commercial encryption compliance verification method, system, device and readable storage medium provided by the present invention are introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of the present invention, the present invention can also be improved and modified, and these improvements and modifications also fall within the scope of protection of the present invention.

Claims

1. A commercial encryption compliance verification method, characterized in that: include: Through the built-in MySQL database and the packet capture program based on the Scapy algorithm, the target device is searched in the network, and the target detection data of the target device and the encryption algorithm information used for data transmission are collected; The encryption algorithm information is centrally managed and standardized through the ELK log analysis system, and compared with the preset standard encryption algorithm type to generate verification results; The verification results are displayed on the front-end graphical web and a verification report is generated.

2. The commercial encryption compliance verification method according to claim 1, characterized in that: The method searches for target devices on the network through the built-in MySQL database and the packet capture program based on the Scapy algorithm, and collects the target device's operating system type, version information, and encryption algorithm information used for data transmission, including: Use the built-in Scapy algorithm to search for the target device in the target device's network segment and summarize the target device: Extract the target detection data and encryption algorithm information used for data transmission from the target database of the target device, generate an encryption algorithm file, and download it.

3. The commercial encryption compliance verification method according to claim 2, characterized in that: The built-in Scapy algorithm is used to search for the target device in the network segment of the target device and summarize the target device, including: Based on ICMP, SNMP and ARP protocols, it constructs network data packets for detecting the target network and sends them to the network segment of the target device; Use the sniff function of the Scapy algorithm to monitor the response data packets, obtain the target device information by parsing the response data packets, and summarize them.

4. The commercial encryption compliance verification method according to claim 3, characterized in that: The step of extracting target detection data and encryption algorithm information used for data transmission in a target database of a target device, generating an encryption algorithm file, and downloading the file includes: According to the target device information, use the corresponding user name and commercial password to connect to the target device; Obtain the operating system type and version information of the target device by executing the query command; By performing a packet capture test, you can obtain the encryption algorithm information used by the target device for data transmission, generate an encryption algorithm file, download it, and save it as a copy.

5. The commercial encryption compliance verification method according to claim 4, characterized in that: The ELK log analysis system is used to centrally manage and standardize the encryption algorithm information, and compare it with the preset standard encryption algorithm type to generate verification results, including: The encryption algorithm files are collected through the data collection engine Logstash, the data is parsed according to predefined rules, and the data is standardized. The processed encryption algorithm information is sent to the data search and analysis engine Elasticsearch. Use the data search and analysis engine Elasticsearch to distribute the encryption algorithm information and establish a database; The encryption algorithm information stored in the database is compared with the preset standards, and the verification results are generated based on the comparison results.

6. The commercial encryption compliance verification method according to claim 5, characterized in that: The verification results are displayed on the front-end graphical web and a verification report is generated, including: The verification results are displayed through a front-end graphical web interface using charts and interactive functions, including data statistics tables and trend analysis charts; Generate a PDF version of the commercial encryption compliance verification report for the power monitoring system based on the verification results.

7. The commercial encryption compliance verification method according to claim 5, characterized in that: The predefined rule adopts a regular expression.

8. A commercial encryption compliance verification system, characterized in that: The system adopts the commercial password compliance verification method as described in any one of claims 1 to 7; The system comprises: Batch information collection module, which is used to search for target devices in the network through the built-in MySQL database and the packet capture program based on the Scapy algorithm, and collect the target device's operating system type, version information and encryption algorithm information used for data transmission; The automatic parsing and comparison module is used to centrally manage and standardize the encryption algorithm information through the ELK log analysis system, and compare it with the preset standard encryption algorithm type to generate verification results; The verification report generation module is used to display the verification results in a front-end graphical web format and generate a PDF version of the commercial encryption compliance verification report.

9. A commercial encryption compliance verification device, characterized in that: include: A memory for storing a commercial encryption compliance verification program; A processor, used to implement the steps of the commercial encryption compliance verification method as described in any one of claims 1 to 7 when executing the commercial encryption compliance verification program.

10. A readable storage medium, characterized in that: The readable storage medium stores a commercial password compliance verification program, and when the commercial password compliance verification program is executed by the processor, the steps of the commercial password compliance verification method as described in any one of claims 1 to 7 are implemented.

Images