A password management system for substation automation equipment

Abstract

The present invention relates to a password management system for substation automation equipment, comprising a password management platform and a portable password management terminal deployed in a safety zone 1 of an electric power system, wherein the password management platform and the password management terminal are signal-connected; the password management platform comprises a password storage module, an overdue reminder module, and a password generation module; the password management terminal comprises a password detection module and an automatic password modification module; the password generation module is used to generate a random password; and the password storage module is used to store the generated random password. The present invention ensures the strength and security of the password, while the password management terminal allows the user to memorize the password and ensures the accuracy of the password. The requirements for encrypted storage in the password management specification of the State Grid are met, and overdue reminders, automatic password generation, and one-key password modification are realized.

Description

Technical Field

[0001] The invention relates to a password management system for transformer substation automation equipment. Background Art

[0002] There are a large number of different passwords for different users and permissions in the substation monitoring system. According to the relevant regulations of the State Grid Corporation's power monitoring system and the relevant regulations on security assessment, the passwords of the monitoring system and automation equipment in the substation are required to be changed every three months and plain text records are not allowed. There are also high requirements for the strength of the passwords. The passwords are required to contain uppercase and lowercase letters, numbers and special characters, and there are strict regulations on the length. The passwords of the equipment in the substation are confidential. If the plain text records are leaked, it will affect the safe operation of the power monitoring system and bring huge hidden dangers to the power system.

[0003] Existing document CN103425921A, a password management device, a password management system and a method, the method comprising: connecting the password management device to a computer; when there is a user fingerprint in the memory, identifying and verifying the fingerprint collected by the fingerprint recognition module with the fingerprint stored in the memory; when the collected user fingerprint is consistent with the fingerprint in the memory, after the query button is pressed, a login window of the application system to be accessed is opened on the computer, and the website of the application system to be logged in is read; when the password management device contains an account and password for the user to log in to the application system according to the website, after the account extraction button and the password extraction button on the password management device are pressed, the account and password for the user to log in to the application system stored in the memory are extracted and entered into the account and password field of the login window.

[0004] Existing document CN112383914A, a password management method based on secure hardware, includes secure hardware and a password management APP, the secure hardware includes an encryption chip and a TurboNFC communication chip; the encryption chip is a trusted platform module, as an independent device for key generation and encryption and decryption, it has an independent processor and secure storage unit inside, which is used to store keys and feature data, and provide encryption and security authentication service functions for the password management APP; the password management APP transmits data with the encryption chip through asymmetric encryption communication, and the TurboNFC communication chip is responsible for data transmission and conversion of communication methods; the password management APP provides users with the required account and password management.

[0005] The above two methods do not involve the one-click password change function, and the existing password cannot be automatically modified. Summary of the invention

[0006] The technical problem to be solved by the present invention is to provide a password management system for substation automation equipment which can automatically modify passwords.

[0007] The present invention adopts the following technical solution:

[0008] The present invention comprises a password management platform and a portable password management terminal deployed in a safe zone 1 of an electric power system, wherein the password management platform and the password management terminal are signal-connected;

[0009] The password management platform includes a password storage module, an overdue reminder module and a password generation module;

[0010] The password management terminal includes a password detection module and an automatic password change module;

[0011] The password generation module is used to generate a random password;

[0012] The password storage module is used to store the generated random password.

[0013] The overdue reminder module of the present invention is used to query the time of the most recent password modification and send out a reminder signal when the limited time is exceeded.

[0014] The password detection module of the present invention is connected with the password storage module by signal, and the password detection module is used to detect the random password transmitted from the password storage module to the password detection module, and store the random password after it is correct.

[0015] The automatic password modification module of the present invention is used to perform one-key password modification on automated equipment.

[0016] The password storage module of the present invention comprises an encryption and decryption module. When the random password is stored in the password storage module, the random password is encrypted. When it needs to be transmitted to the automatic password modification module, the encrypted random password is decrypted.

[0017] The encryption and decryption module of the present invention is an encryption and decryption program written based on the elliptic curve public key cryptography SM2 algorithm issued by the State Cryptography Administration.

[0018] The reminder signal sent by the overdue reminder module of the present invention is given in the form of a pop-up window.

[0019] The password generation module of the present invention generates a random password based on a Linux script program and according to the user's parameter settings.

[0020] The automatic password change module of the present invention is based on a Linux script program, and generates a password change script according to a random password and the user's supplementary parameters. After the password management terminal is connected to the automation device, the user changes the password of the automation device with one click according to the password change script.

[0021] The password management platform of the present invention also includes a log audit module for recording the person who changed the password information, the time of change, the user, and the usage time log.

[0022] The positive effects of the present invention are as follows:

[0023] The user generates a random password through the password generation module on the password management platform and stores it in the password storage module. The portable password management terminal is connected to the password management platform signal, and the random password is downloaded to the password management terminal. After the password is tested, a password change script is generated through the automatic password change module. The user can then use the password management terminal to connect to the automation equipment, and then use the password change script to change the password of the automation equipment with one click.

[0024] The present invention ensures the strength and security of the password, and the password management terminal enables the user to not have to remember the password, while ensuring the accuracy of the password.

[0025] It meets the requirements of the State Grid's password management specifications for encrypted storage, and implements expiration reminders, automatic password generation, and one-click password changes. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 It is the principle diagram of the present invention;

[0027] Figure 2 This is a schematic diagram of the overdue reminder module of the present invention;

[0028] Figure 3 This is a schematic diagram of the password generation module of the present invention;

[0029] Figure 4 This is a schematic diagram of the automatic encryption module of the present invention. DETAILED DESCRIPTION

[0030] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. The following description of at least one exemplary embodiment is actually only illustrative and is by no means intended to limit the present application and its application or use.

[0031] Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making any creative work shall fall within the scope of protection of this application.

[0032] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present application.

[0033] As used herein, unless the context clearly indicates otherwise, the singular forms are intended to include the plural forms. In addition, it should be understood that when the terms "including" and / or "comprising" are used in this specification, they indicate the presence of features, steps, operations, devices, components and / or their combinations.

[0034] Unless otherwise specifically stated, the relative arrangement of the components and steps described in these embodiments, numerical expressions and numerical values ​​do not limit the scope of the present application. Meanwhile, it should be understood that for ease of description, the sizes of the various parts shown in the drawings are not drawn according to the actual proportional relationship.

[0035] Technologies, methods, and apparatus known to ordinary technicians in the relevant field may not be discussed in detail, but where appropriate, such technologies, methods, and apparatus should be considered part of the authorization specification.

[0036] In all examples shown and discussed herein, any specific values ​​should be interpreted as merely exemplary and not as limiting.

[0037] Therefore, other examples of the exemplary embodiments may have different values.It should be noted that similar reference numerals and letters denote similar items in the following figures, and therefore, once an item is defined in one figure, it need not be further discussed in subsequent figures.

[0038] In the description of the present application, it should be understood that the directions or positional relationships indicated by directional words such as "front, back, up, down, left, right", "lateral, vertical, perpendicular, horizontal" and "top, bottom" are usually based on the directions or positional relationships shown in the drawings, and are only for the convenience of describing the present application and simplifying the description. Unless otherwise specified, these directional words do not indicate or imply that the device or element referred to must have a specific direction or be constructed and operated in a specific direction, and therefore cannot be understood as limiting the scope of protection of the present application; the directional words "inside and outside" refer to the inside and outside relative to the contours of each component itself.

[0039] For ease of description, spatially relative terms such as "on", "above", "on the upper surface of", "upper", etc. may be used herein to describe the spatial positional relationship between a device or feature and other devices or features as shown in the figures. It should be understood that the spatially relative terms are intended to include different orientations of the device in use or operation in addition to the orientation described in the figures.

[0040] For example, if a device in the drawings is turned over, a device described as “above” or “over the other devices or structures” would then be oriented “below” or “beneath the other devices or structures”.

[0041] Thus, the exemplary term "above" can encompass both an orientation of above and below.

[0042] The device may be otherwise oriented (rotated 90 degrees or at other orientations) and the spatially relative descriptors used herein interpreted accordingly.

[0043] In addition, it should be noted that the use of terms such as "first" and "second" to limit components is only for the convenience of distinguishing the corresponding components. Unless otherwise stated, the above terms have no special meaning and therefore cannot be understood as limiting the scope of protection of this application.

[0044] Example 1

[0045] As attached Figure 1 As shown in FIG. 4 , the present invention includes a password management platform and a portable password management terminal deployed in a safe zone 1 of the power system, and the password management platform and the password management terminal are signal-connected;

[0046] The password management platform adopts a multi-layer architecture based on SOA, uses a B / S client for front-end display, and implements RIA through Tornado+AJAX technology;

[0047] The WEB layer responds to the front-end HTTP request through uwsgi and calls the background service to complete other logical operations;

[0048] The service component layer adopts a hybrid mode.

[0049] The portable password management terminal in the password management system adopts an embedded development method.

[0050] The password management platform includes a password storage module, an overdue reminder module and a password generation module;

[0051] The password management terminal includes a password detection module and an automatic password change module;

[0052] The password generation module is used to generate a random password;

[0053] The password storage module is used to store the generated random password.

[0054] The overdue reminder module is used to query the last password modification time and send a reminder signal when the limited time is exceeded. The limited time is generally 15 days.

[0055] The password detection module is signal-connected to the password storage module. The password detection module is used to detect the random password transmitted from the password storage module to the password detection module, and store the random password after it is correct.

[0056] The automatic password change module is used to change the password of the automation equipment with one click.

[0057] The password storage module includes an encryption and decryption module. When the random password is stored in the password storage module, the random password is encrypted. When it needs to be transmitted to the automatic password modification module, the encrypted random password is decrypted.

[0058] The encryption and decryption module is an encryption and decryption program written based on the elliptic curve public key cryptography SM2 algorithm issued by the State Cryptography Administration.

[0059] The reminder signal sent by the overdue reminder module is in the form of a pop-up window.

[0060] Example 2

[0061] As attached Figure 1 —4, based on Example 1,

[0062] The same as Example 1 is:

[0063] The present invention comprises a password management platform and a portable password management terminal deployed in a safe zone 1 of an electric power system, wherein the password management platform and the password management terminal are signal-connected;

[0064] The password management platform adopts a multi-layer architecture based on SOA, uses a B / S client for front-end display, and implements RIA through Tornado+AJAX technology;

[0065] The WEB layer responds to the front-end HTTP request through uwsgi and calls the background service to complete other logical operations;

[0066] The service component layer adopts a hybrid mode.

[0067] The portable password management terminal in the password management system adopts an embedded development method.

[0068] The password management platform includes a password storage module, an overdue reminder module and a password generation module;

[0069] The password management terminal includes a password detection module and an automatic password change module;

[0070] The password generation module is used to generate a random password;

[0071] The password storage module is used to store the generated random password.

[0072] The overdue reminder module is used to query the last password modification time and send a reminder signal when the limited time is exceeded. The limited time is generally 15 days.

[0073] The password detection module is signal-connected to the password storage module. The password detection module is used to detect the random password transmitted from the password storage module to the password detection module, and store the random password after it is correct.

[0074] The automatic password change module is used to change the password of the automation equipment with one click.

[0075] The password storage module includes an encryption and decryption module. When the random password is stored in the password storage module, the random password is encrypted. When it needs to be transmitted to the automatic password modification module, the encrypted random password is decrypted.

[0076] The encryption and decryption module is an encryption and decryption program written based on the elliptic curve public key cryptography SM2 algorithm issued by the State Cryptography Administration.

[0077] The reminder signal sent by the overdue reminder module is in the form of a pop-up window.

[0078] The difference is:

[0079] The password generation module generates a random password based on a Linux script program and according to the user's parameter settings.

[0080] Example 3

[0081] As attached Figure 1 —4, based on Example 2,

[0082] The same as Example 2 is:

[0083] The present invention comprises a password management platform and a portable password management terminal deployed in a safe zone 1 of an electric power system, wherein the password management platform and the password management terminal are signal-connected;

[0084] The password management platform adopts a multi-layer architecture based on SOA, uses a B / S client for front-end display, and implements RIA through Tornado+AJAX technology;

[0085] The WEB layer responds to the front-end HTTP request through uwsgi and calls the background service to complete other logical operations;

[0086] The service component layer adopts a hybrid mode.

[0087] The portable password management terminal in the password management system adopts an embedded development method.

[0088] The password management platform includes a password storage module, an overdue reminder module and a password generation module;

[0089] The password management terminal includes a password detection module and an automatic password change module;

[0090] The password generation module is used to generate a random password;

[0091] The password storage module is used to store the generated random password.

[0092] The overdue reminder module is used to query the last password modification time and send a reminder signal when the limited time is exceeded. The limited time is generally 15 days.

[0093] The password detection module is signal-connected to the password storage module. The password detection module is used to detect the random password transmitted from the password storage module to the password detection module, and store the random password after it is correct.

[0094] The automatic password change module is used to change the password of the automation equipment with one click.

[0095] The password storage module includes an encryption and decryption module. When the random password is stored in the password storage module, the random password is encrypted. When it needs to be transmitted to the automatic password modification module, the encrypted random password is decrypted.

[0096] The encryption and decryption module is an encryption and decryption program written based on the elliptic curve public key cryptography SM2 algorithm issued by the State Cryptography Administration.

[0097] The reminder signal sent by the overdue reminder module is in the form of a pop-up window.

[0098] The password generation module generates a random password based on a Linux script program and according to the user's parameter settings.

[0099] The difference is:

[0100] The automatic password change module is based on a Linux script program, and generates a password change script according to a random password and the user's supplementary parameters. After the password management terminal is connected to the automation device, the user changes the password of the automation device with one click according to the password change script.

[0101] Example 4

[0102] As attached Figure 1 —4, based on Example 3,

[0103] The same as in Example 3 is:

[0104] The present invention comprises a password management platform and a portable password management terminal deployed in a safe zone 1 of an electric power system, wherein the password management platform and the password management terminal are signal-connected;

[0105] The password management platform adopts a multi-layer architecture based on SOA, uses a B / S client for front-end display, and implements RIA through Tornado+AJAX technology;

[0106] The WEB layer responds to the front-end HTTP request through uwsgi and calls the background service to complete other logical operations;

[0107] The service component layer adopts a hybrid mode.

[0108] The portable password management terminal in the password management system adopts an embedded development method.

[0109] The password management platform includes a password storage module, an overdue reminder module and a password generation module;

[0110] The password management terminal includes a password detection module and an automatic password change module;

[0111] The password generation module is used to generate a random password;

[0112] The password storage module is used to store the generated random password.

[0113] The overdue reminder module is used to query the last password modification time and send a reminder signal when the limited time is exceeded. The limited time is generally 15 days.

[0114] The password detection module is signal-connected to the password storage module. The password detection module is used to detect the random password transmitted from the password storage module to the password detection module, and store the random password after it is correct.

[0115] The automatic password change module is used to change the password of the automation equipment with one click.

[0116] The password storage module includes an encryption and decryption module. When the random password is stored in the password storage module, the random password is encrypted. When it needs to be transmitted to the automatic password modification module, the encrypted random password is decrypted.

[0117] The encryption and decryption module is an encryption and decryption program written based on the elliptic curve public key cryptography SM2 algorithm issued by the State Cryptography Administration.

[0118] The reminder signal sent by the overdue reminder module is in the form of a pop-up window.

[0119] The password generation module generates a random password based on a Linux script program and according to the user's parameter settings.

[0120] The automatic password change module is based on a Linux script program, and generates a password change script according to a random password and the user's supplementary parameters. After the password management terminal is connected to the automation device, the user changes the password of the automation device with one click according to the password change script.

[0121] The difference is:

[0122] The password management platform also includes a log audit module for recording the person who changed the password information, the time of change, the user, and the usage time log.

[0123] The user generates a random password through the password generation module on the password management platform and stores it in the password storage module. The portable password management terminal is connected to the password management platform signal, and the random password is downloaded to the password management terminal. After the password is tested, a password change script is generated through the automatic password change module. The user can then use the password management terminal to connect to the automation equipment, and then use the password change script to change the password of the automation equipment with one click.

[0124] The present invention ensures the strength and security of the password, and the password management terminal enables the user to not have to remember the password, while ensuring the accuracy of the password.

[0125] It meets the requirements of the State Grid's password management specifications for encrypted storage, and implements expiration reminders, automatic password generation, and one-click password changes.

[0126] At present, the technical solution of this application has been put into pilot production, that is, a small-scale experiment before the large-scale mass production of the product; after the pilot production was completed, a user usage survey was conducted in a small range, and the survey results showed that user satisfaction was high; now we are preparing for the formal production and industrialization of the product (including intellectual property risk warning survey).

[0127] Finally, it should be noted that the above is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, it is still possible for those skilled in the art to modify the technical solutions described in the aforementioned embodiments or to make equivalent substitutions for some of the technical features therein. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A password management system for substation automation equipment, characterized in that: It includes a password management platform and a portable password management terminal deployed in a safe zone 1 of the power system, wherein the password management platform and the password management terminal are signal-connected; The password management platform adopts a multi-layer architecture based on SOA, uses a B / S client for front-end display, and implements RIA through Tornado+AJAX technology; The WEB layer responds to the front-end HTTP request through uwsgi and calls the background service to complete other logical operations; the service component layer adopts a hybrid mode; The portable password management terminal in the password management system adopts the embedded development method; The password management platform includes a password storage module, an overdue reminder module and a password generation module; The password management terminal includes a password detection module and an automatic password change module; The password generation module is used to generate a random password; The password storage module is used to store the generated random password; The password storage module includes an encryption and decryption module, which encrypts the random password when it is stored in the password storage module, and decrypts the encrypted random password when it needs to be transmitted to the automatic password modification module; The encryption and decryption module is based on the elliptic curve public key cryptography SM2 algorithm issued by the State Cryptography Administration to write encryption and decryption programs; The reminder signal sent by the overdue reminder module is used as a pop-up window to remind; The password generation module is based on a Linux script program and generates a random password according to the user's parameter settings; The automatic password change module is based on a Linux script program, and generates a password change script according to a random password and the user's supplementary parameters. After the password management terminal is connected to the automation device, the user changes the password of the automation device with one click according to the password change script.

2. A password management system for substation automation equipment according to claim 1, characterized in that: The overdue reminder module is used to query the time of the most recent password modification and send a reminder signal when the limited time is exceeded.

3. A password management system for substation automation equipment according to claim 2, characterized in that: The password detection module is connected to the password storage module by signal, and is used to detect the random password transmitted from the password storage module to the password detection module, and store the random password after it is correct.

4. A password management system for substation automation equipment according to claim 3, characterized in that: The automatic password change module is used to change the password of the automation equipment with one click.

5. A password management system for substation automation equipment according to claim 1, characterized in that: The password management platform also includes a log audit module for recording the person who changed the password information, the time of change, the user, and the usage time log.

Images