A shore power network range system based on blockchain

Abstract

The present invention provides a shore power network range system based on blockchain, comprising: a shore power simulation industrial control system for simulating the operation of each industrial control device of a ship shore power system; a shore power range control and management system for controlling the shore power simulation industrial control system to simulate the operation, monitor, control, event alarm, ship power consumption monitoring and analysis of the industrial control devices of the ship shore power system; the shore power range control and management system is further used for performing network security vulnerability tests on the shore power simulation industrial control system based on blockchain as required; and the data obtained in each step during the network security vulnerability test process are stored on the blockchain to prevent data from being tampered with. The present invention has functions such as simulating the operation, data aggregation and exchange, monitoring, control and analysis of the industrial control devices of shore power facilities, fills the gaps in the prior art, and realizes network security vulnerability mining in the shore power industrial control scenario.

Description

Technical Field

[0001] The present invention belongs to the field of industrial control network security, and more specifically, relates to a shore power network range system based on blockchain. Background Art

[0002] The ship shore power system, referred to as the shore power system for short, means that when a ship docks at a wharf, it stops using the self - contained auxiliary generator on the ship and instead uses the land power supply to supply power to the main on - board systems; the ship shore power system mainly consists of three parts: the shore - based power supply system, the ship - shore interaction system, and the ship power receiving system. Industrial automation control, referred to as industrial control for short, means using technical means such as computer technology, microelectronics technology, and electrical means to make the production and manufacturing process of a factory more automated, efficient, and precise, and having controllability and visibility.

[0003] Port shore power is a facility that provides electrical energy to ships during berthing, and has advantages such as low noise and zero pollution. After the successful operation of the shore power test area in the Three Gorges Dam area in 2019, it has become a green power supply mode for cruise ships to dock at ports. According to statistics, in 2021, ships on the Hubei section of the Yangtze River used shore power 17,182 times, and the shore power consumption was 7.067 million kWh, a year - on - year increase of 92.03%. With the substantial increase in the utilization rate of shore power facilities, the network risks faced are also getting higher and higher. If the communication equipment is attacked by the network, seriously, it will cause damage to ships, shore power equipment, and the failure of on - line monitoring, and may even lead to electric shock accidents.

[0004] During the construction of the shore power system, in order to ensure the network and information security of the shore power system, through information security detection and inspection, on - site research, and organizing full - range network security penetration testing, etc., it is found that there are many problems in the shore power system that need to be addressed and solved urgently. Moreover, with the replacement of shore power industrial control facilities, many unknown problems have not been discovered, posing a greater information security risk. Due to the particularity of shore power facilities, it is impossible to frequently shut down for maintenance and conduct actual combat network security testing, resulting in the inability to guarantee the security of shore power equipment. The existing shore power system facilities are in the external service operation. The inspection personnel can only carry out work during the interval time, which affects the external service. And directly conducting security testing in the on - site environment has a high risk. Therefore, it is necessary to build an application environment that can simulate the on - site use of shore power industrial control equipment for security testing. Summary of the Invention

[0005] Aiming at the defects of the existing technology, the purpose of the present invention is to provide a shore power network range system based on blockchain, aiming to solve the problems that in the application scenario of shore power facilities, there is no case of realizing a simulated range for network security vulnerability mining, and there is no technology on how to conduct vulnerability mining on the ship shore power system without affecting its normal operation, and how to ensure that the information in the mining process is not tampered with, and is safe and reliable.

[0006] To achieve the above object, the present invention provides a shore power network test range system based on blockchain, including: a shore power simulation industrial control system and a shore power test range control system;

[0007] The shore power simulation industrial control system is used to simulate the operation of each industrial control device of the ship shore power system;

[0008] The shore power test range control system is used to control the shore power simulation industrial control system to perform simulation operation, monitoring, control, event warning, ship power consumption monitoring and analysis on the industrial control devices of the ship shore power system;

[0009] The shore power test range control system is further used to perform network security vulnerability testing on the shore power simulation industrial control system based on blockchain as needed; the network security vulnerability testing process is as follows:

[0010] Collect device information and generate a device basic information table;

[0011] For the communication access type, use a preset tool to capture the first message in the communication process, save the first message as a specific first message file, the first message file has a specific file type, and store the first message file in the designated area of the security device;

[0012] Perform vulnerability scanning on the device according to the device basic information table, confirm whether there are system vulnerabilities, and store the discovered system vulnerabilities in the form of a vulnerability field table for field-level data;

[0013] Collect communication protocols and parse them. After parsing the protocols, obtain a protocol feature library, and generate a corresponding protocol feature field table according to the protocol feature library for functional partitioning;

[0014] Capture the first message in the device communication process, extract the message and save the message information;

[0015] Compare the message information with the protocol feature field table to confirm the communication protocol used by the device simulated by the shore power simulation industrial control system;

[0016] According to the device basic information table, scan the device for vulnerabilities, confirm whether there are system vulnerabilities, and store the discovered system vulnerabilities in the form of a vulnerability field table for field-level data;

[0017] If system vulnerabilities are found, perform network security vulnerability testing; and obtain the network security vulnerability testing results, verify the vulnerabilities and confirm the vulnerability risk category, so as to test the vulnerabilities of the ship shore power system without affecting the normal operation of the ship shore power system, which is convenient for strengthening the ship shore power system; wherein, the network security vulnerability testing includes: fuzz testing and penetration testing, and the data obtained in each step of the network security vulnerability testing process is stored on the blockchain.

[0018] It should be noted that the "specific" file or "specific" file type referred to in the present invention refers to a file or file type in a certain preset format.

[0019] In an optional example, the onshore power test range control system stores the data obtained in each step of the network security vulnerability test on the blockchain. Specifically:

[0020] Perform a hash operation on the device basic information table to obtain a device hash, and store the device hash on the blockchain network;

[0021] Perform a hash operation on the communication access type information of the devices simulated by the onshore power simulation industrial control system, the information of the capture tool, the operation information of the capture tool for capturing the first message, the information of the first message, and the storage information of the first message through a random hash process to obtain a protocol hash, and then store the protocol hash on the blockchain network;

[0022] Perform a hash operation on the vulnerability field table to obtain a vulnerability hash, and then store the vulnerability hash on the blockchain network; perform a hash operation on the protocol feature field table to obtain a protocol feature hash, and then store the protocol feature hash on the blockchain network; extract the second message related to the communication protocol adopted by the first message from the captured first message, and perform a hash operation on the comparison result of the second message with the protocol feature field tables of each protocol and the confirmed communication protocol, and then store it on the blockchain network.

[0023] In an optional example, the onshore power test range control system performs a hash operation on the communication access type information of the devices simulated by the onshore power simulation industrial control system, the information of the capture tool, the operation information of the capture tool for capturing the first message, the information of the first message, and the storage information of the first message through a random hash process. Specifically:

[0024] Perform a hash operation on the communication access type information, the information of the capture tool, the operation information of the capture tool for capturing the first message, the information of the first message, and the storage information respectively using the first hash algorithm to obtain corresponding multiple hash values;

[0025] Sort the multiple hash values according to a preset sorting algorithm, then splice the sorted hash values to obtain a spliced hash value, and perform an integer conversion operation on the spliced hash value to convert the spliced hash value into a pure number;

[0026] Subsequently, a first modulo operation is performed on the result of the rotation and shaping operation to obtain a first remainder after modulo operation, and a hash algorithm is selected from multiple hash algorithms as the second hash algorithm according to the corresponding relationship between the preset first remainder and the preset multiple hash algorithms. Finally, the second hash algorithm is used to perform a hash operation on the concatenated hash value to obtain a protocol hash;

[0027] Wherein, the preset sorting algorithm is determined according to the second remainder obtained by performing a second modulo operation on the last two digits of the current operation time in nanoseconds. The modulus of the second modulo operation is equal to the number of preset sorting algorithms. Different second remainders correspond to different preset sorting algorithms, and the modulus of the first modulo operation is equal to the number of preset hash algorithms.

[0028] In an optional example, the preset sorting algorithms include: time ascending order, time descending order, file size ascending order, file size descending order, and random sorting.

[0029] The preset multiple hash algorithms include: MD3, MD5, SHA256, SHA384, and SHA512.

[0030] In an optional example, the onshore power supply simulation industrial control system includes: a communication management machine, an edge Internet of Things proxy device, a switch, a server group, a cloud network data server, and a cloud network platform;

[0031] The communication management machine is used to integrate and summarize communication data for data exchange;

[0032] The edge Internet of Things proxy device is communicatively connected to the communication management machine and is used to forward the data summarized by the communication management machine;

[0033] The switch is communicatively connected to the edge Internet of Things device to receive the data forwarded by the edge Internet of Things proxy device (200) and forward the received data to the server group;

[0034] The server group is communicatively connected to the switch to store, visualize, and further process the data forwarded by the switch. The server group includes a terminal server, and the terminal server is used to form a software development platform for visualization and graphing;

[0035] The cloud network data server is communicatively connected to the terminal server and is used to transmit the data required by the cloud network platform;

[0036] The cloud network data server is wirelessly connected to the cloud network platform in the form of a 4G wireless router or by optical fiber to exchange data required by the cloud network platform with the onshore power supply simulation industrial control system and exchange instructions;

[0037] The cloud network platform is used to connect to the shore power box through multiple network protocols, and combine the data during the operation and running process of the shore power simulation industrial control system to control the shore power box and provide shore power for the shore power simulation industrial control system.

[0038] In an optional example, the server group further includes:

[0039] A monitoring workstation for data detection and display;

[0040] A storage device front-end server for storing information;

[0041] A metering and billing front-end server for collecting and calculating data of power equipment in the shore power simulation industrial control system and generating metering and billing reports;

[0042] A database server for storing process data, and the database corresponding to the database server is SQLServer.

[0043] In an optional example, a security isolation unit is provided between the communication management machine and the edge Internet of Things device to achieve one-way transmission of production area data and non-production area data; the security isolation unit is an industrial control firewall or an isolation device.

[0044] In an optional example, the shore power simulation industrial control system further includes:

[0045] A battery inspection device for power supply monitoring, connected to the communication management machine through RS485;

[0046] A microcomputer protection device for line protection, connected to the communication management machine through RS485;

[0047] A Xuji protection device for line protection and main transformer differential protection, connected to the communication management machine through RS485.

[0048] In an optional example, the shore power simulation industrial control system further includes an electricity consumption information collection device for collecting power data generated during the operation of the shore power simulation industrial control system; the electricity consumption information collection device includes:

[0049] A data acquisition PLC for collecting power data of the shore power simulation industrial control system, where the power data includes electrical parameters, alarm information, and remote control information; the data acquisition PLC is communicatively connected to the communication management machine;

[0050] Meters for measuring electrical parameters of the shore power simulation industrial control system, connected to the communication management machine through RS485, the number of the meters is one or more, and the meters are communicatively connected to the data acquisition PLC through RS485 or RS232; the meters refer to power meter metering and detection devices, including ammeters, voltmeters, wattmeters, and watt-hour meters.

[0051] In an optional example, the shore power simulation industrial control system further includes:

[0052] High-voltage reel, used for rotating and controlling the retraction and extension of the power supply cable;

[0053] A power supply cable retracting and releasing device is used to collect cable retracting and releasing data during the operation of the shore power simulation industrial control system; the power supply cable retracting and releasing device comprises:

[0054] High-voltage reel PLC, used to detect and control the power cable retracting device, connected to the industrial control firewall or isolation device via RJ-45;

[0055] Inverter, used to provide DC power, connected to the high-voltage reel PLC via RS485;

[0056] The sensing device is used to convert the physical quantity of the detection object into an electrical signal and is connected to the high-voltage drum PLC through RS485; the sensing device includes a temperature and humidity transmitter sensor, a liquid level sensor and a tension sensor; the temperature and humidity transmitter sensor is used for temperature and humidity detection and is connected to the high-voltage drum PLC through RS485; the liquid level sensor is installed on the pontoon for liquid level detection and is connected to the high-voltage drum PLC through hard wiring; the tension sensor is installed on the pontoon for tension detection and is connected to the high-voltage drum PLC through hard wiring;

[0057] The frequency converter is connected to the high voltage drum PLC through hard wiring;

[0058] The drum motor is used to control the retraction and extension of the high-voltage cable and is controlled by the frequency converter and connected to the frequency converter through hard wiring;

[0059] The solenoid valve is used to control the rotation direction of the drum motor. It is connected to the drum motor through hard wiring and connected to the high-voltage drum PLC through RS485.

[0060] In general, the above technical solution conceived by the present invention has the following beneficial effects compared with the prior art:

[0061] The blockchain-based shore power network range system provided by the present invention has the functions of simulating operation, data aggregation and exchange, monitoring, control and analysis of the industrial control equipment of shore power facilities, filling the gaps in the prior art and realizing network security vulnerability mining in the shore power industrial control scenario.

[0062] The blockchain-based shore power network range system provided by the present invention can simulate the application environment of shore power industrial control equipment, and can perform safety tests on shore power equipment without affecting normal operation, thereby ensuring the safety of shore power facilities.

[0063] The blockchain-based shore power network range system provided by the present invention can perform safety tests while controlling risks, avoiding the risks brought by direct testing in an actual environment.

[0064] The blockchain-based shore power network range system provided by the present invention can flexibly allocate time so that detection personnel can conduct tests in more time, ensuring the effectiveness of testing network security vulnerabilities and effectively improving the safety of shore power facilities.

[0065] The present invention uses blockchain technology to upload the network security vulnerability mining process and vulnerability results to the blockchain network for evidence storage, ensuring the authenticity, credibility and traceability of network security vulnerability data.

[0066] The present invention uses blockchain technology to store the vulnerability detection, mining test process and results unique to the power system on the chain, and through a specially designed algorithm, it gives the selection sort algorithm and the hash algorithm randomness, which can effectively prevent the calculation process and results of the protocol hash from being stolen and tampered with, and effectively ensure the authenticity and uniqueness of the generation process and results of the original evidence data, significantly improve the difficulty of information falsification, avoid data forgery, and achieve the effect of urging the relevant responsible persons of the power system to do their jobs well. BRIEF DESCRIPTION OF THE DRAWINGS

[0067] Figure 1 It is a diagram of the shore power network range system architecture provided by an embodiment of the present invention;

[0068] Figure 2 This is an architecture diagram of a shore power simulation industrial control system provided by an embodiment of the present invention;

[0069] Figure 3 is a security vulnerability mining flow chart provided by an embodiment of the present invention;

[0070] In all the drawings, the same reference numerals are used to represent the same elements or structures, among which: 100, communication management machine; 200, edge IoT agent device; 300, switch; 400 server group; 410, monitoring workstation; 420, storage device front-end server; 430, metering and billing front-end server; 440, database server; 450, terminal server; 510, cloud network data server; 520, cloud network platform; 600, power consumption information collection device; 610, data collection PLC; 620, meter; 700, power supply cable retracting device; 710, high-voltage drum PLC; 720, inverter; 730, sensor device; 731, temperature and humidity transmitter sensor; 732, liquid level sensor; 733, tension sensor; 740, frequency converter; 750, drum motor; 810, battery inspection equipment; 820, microcomputer protection device; 830, Xuji protection device; 900, safety isolation unit. Detailed implementation manners

[0071] To make the objectives, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Apparently, the described embodiments are only a part rather than all of the embodiments of the present invention. The following description of at least one exemplary embodiment is actually illustrative only and in no way constitutes a limitation to the present invention and its application or use. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.

[0072] In the description of the present invention, unless otherwise clearly defined, terms such as "arrangement", "installation", and "connection" shall be understood in a broad sense. Those skilled in the art can reasonably determine the specific meanings of the above terms in the present invention in combination with the specific content of the technical solutions.

[0073] In the description of the present invention, the descriptions with reference to terms such as "one embodiment", "some embodiments", "illustrative embodiments", "examples", "specific examples", or "some examples" mean that the specific features, structures, materials, or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic descriptions of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described can be combined in a suitable manner in any one or more embodiments or examples.

[0074] In practice, how to ensure that, after a data security incident occurs in a system that has been confirmed to have vulnerabilities, those responsible for handling relevant vulnerabilities are held accountable is a requirement of the system security guarantee mechanism of the power system.

[0075] The present invention provides a shore power network range system based on a blockchain, which can use intrusion devices to simulate hackers to attack a shore power simulation environment, and at the same time display the harm caused after the simulation environment is attacked. Specifically, after the device is connected to the platform to be tested, a simulated attack, data collection and analysis, and network security vulnerability analysis can be initiated on the device. It realizes live network security testing without downtime, discovers network security vulnerabilities, and ensures the security of shore power equipment.

[0076] The following are some examples to illustrate the attack and vulnerability mining means that can be carried out based on this platform, but are not limited to the following means: 1. Network traffic attack; 2. Bypass authentication attack; 3. Replay attack.

[0077] 1. Network traffic attack, DDOS (Distributed Denial of Service) attack test

[0078] It refers to the situation where a large number of data packets are sent to the shore control device in a short period of time, causing it to be unable to receive normal data packets, thus leading to a dangerous situation where the shore power system gets out of control.

[0079] The device under test, such as the high-voltage reel PLC, communicates with the control end using the Siemens S7 protocol. The network port of the high-voltage reel under test is connected to the data switch. The intrusion device accesses the data switch through the network cable and conducts attack tests on the high-voltage reel PLC under test.

[0080] The intrusion device, such as a laptop, uses script code to forge a large number of communication messages to communicate with the target controller's IP and port. The services requested by the data packets consume a large amount of system resources, causing the target device to malfunction and ultimately leading to system crashes. Hackers can use this method to block the operator's control of the shore power system and thus carry out illegal intrusion activities.

[0081] If the device can still work properly, it indicates that the device has a verification mechanism or a DDOS defense mechanism.

[0082] 2. Bypass identity authentication attack

[0083] In the industrial control network, when a device executes a command in the network, it needs to first confirm whether the command comes from the correct initiator. If this link is missing, then hackers can bypass the identity authentication mechanism and attack the network device.

[0084] To adapt to the water level drop in different seasons, the Three Gorges shore power is equipped with an automated cable retraction and deployment system. Through GPS sensors and tension sensors, the automatic retraction and deployment of the cable are realized. Here, we use a low-power reel motor to imitate the high-voltage cable reel retractor, and the liquid level sensor and tension sensor to simulate the water level signal and tension sensor signal. When the water level changes, the GPS positioning information of the floating dock changes accordingly, and then controls the cable retraction and deployment. When the cable retraction and deployment are in place, the cable tension sensor will shut down the cable retraction and deployment reel according to the tension signal to ensure the smooth retraction and deployment of the cable.

[0085] The existing automated cable retraction and deployment system does not set an identity verification function. That is to say, it neither verifies whether the water level signal change is sent by the liquid level sensor device, nor verifies whether the instruction to stop retracting and deploying the cable is sent by the tension sensor. As long as there is a device in the network sending a signal of the floating dock displacement to the controller, the cable reel will rotate.

[0086] The intrusion device is connected to the data switch through the network cable, and the script code simulates the ARP (Address Resolution Protocol) attack to deceive the normal communication traffic of the device under test to the intrusion device. On the intrusion device, the normal communication traffic is analyzed and reversed through the protocol packet capture and analysis software such as Wireshark.

[0087] If it is a well-known protocol, the attack traffic is simulated directly according to the well-known protocol specifications and rules.

[0088] If it is a private protocol, the data payload and protocol communication mechanism are parsed, such as judging the meaning of the data message through the plaintext string or byte string contained in the data payload of the request and reply messages and the device status.

[0089] By analyzing the obtained protocol data, the intrusion device uses a code script to simulate the control terminal to initiate communication with the high-voltage reel to be tested. Send a specified message, such as a signal message of the displacement of a pontoon. The high-voltage reel to be tested receives the forged communication message initiated by the intrusion device, and the high-voltage reel to be tested begins to rotate. If the hacker's computer is connected to the shore power network and continuously sends a signal of the displacement of a pontoon to the controller, the controller will always think that the cable needs to be tightened. Even if the real tension sensor sends a correct signal at this time, the controller will ignore it, resulting in excessive tightening of the cable reel, resulting in the consequences of breaking the cable or damaging the equipment.

[0090] If the high-voltage reel to be tested has an identification and authentication mechanism for forged protocol data (such as a verification code verification mechanism generated in the message through a special algorithm, combined with the message length, content, timestamp, etc. For example, at the beginning of the session, multiple requests are initiated to obtain a registration code, function code and other verification mechanisms to identify the reliability of the session and the authenticity of the message), the high-voltage reel to be tested will reject the request or not execute the forged message action.

[0091] 3. Replay Attack

[0092] A replay attack is a network attack in which an attacker sends a packet that has already been received by the destination host in order to deceive the system. It is mainly used in the identity authentication process to destroy the correctness of the authentication.

[0093] If the high-voltage reel to be tested has a flow verification mechanism, a replay attack test can be performed.

[0094] The steps of a replay attack are as follows:

[0095] S1. The intrusion device accesses the data switch through the network cable and simulates an ARP attack through script code to deceive the normal communication traffic of the device under test to the intrusion device. On the intrusion device, protocol packet capture and analysis software such as Wireshark is used to parse and reverse the normal communication traffic.

[0096] S2. If it is a well-known protocol, directly simulate the attack traffic according to the well-known protocol specifications and norms.

[0097] If it is a private protocol, parse the data payload and the protocol communication mechanism. For example, by combining the clear text strings or byte strings contained in the data payloads of the request and response messages and considering the device status, judge the meaning of the data messages, etc.

[0098] S3. According to the analysis situation, judge whether there are encryption measures for the key function instructions of the communication traffic. (Such as whether the message adopts SSH or SSL encryption measures, whether the data payload bytes always maintain a specific mapping relationship with the device actions, etc.). If not, the intrusion device starts to normally forward the communication traffic to the control end, including the control end verification message.

[0099] S4. The device end authenticates the normal control traffic and starts to transmit the communication message. While normally forwarding the traffic, tamper with or forge the key messages. For example, tamper with or forge the shutdown message. At this time, the device under test receives the forged message and shuts down. If the device encrypts the communication message data, the communication message cannot be tampered with or forged.

[0100] The present invention provides a shore power network test range system based on blockchain, including: a shore power simulation industrial control system and a shore power test range management and control system;

[0101] The shore power simulation industrial control system is used to simulate the operation of each industrial control device of the ship shore power system;

[0102] The shore power test range management and control system, that is, the above-mentioned shore power intelligent Internet of Things monitoring system, has functions such as operation monitoring, control, event alarm, ship power consumption monitoring and analysis, etc. After various underlying monitoring devices are interconnected, the private protocol is converted by the communication management machine into a unified standard specification and collected to the core switch, and the process data is respectively uploaded to the server group through the edge Internet of Things proxy device, such as Figure 1 As shown, the shore power network test range system further includes:

[0103] The communication management machine 100 is used to integrate and summarize all communication data for data exchange.

[0104] The edge Internet of Things proxy device 200 is used to support the unified access, protocol parsing and nearby intelligent analysis and calculation of various Internet of Things sensors and acquisition terminals. The edge Internet of Things device is communicatively connected to the communication management machine.

[0105] The switch 300 is used to establish a network channel between multiple pairs of transmission ports, and the switch is communicatively connected to the edge IoT device.

[0106] The server group 400 is communicatively connected to the switch; the server group includes:

[0107] The terminal server 450 is used to form a visual and graphical software development platform;

[0108] The database server 440 is used to provide data services. The database server stores process data, and the corresponding database of the database server is SQL Server;

[0109] The metering and billing front-end server 430 is used to collect and calculate data of onshore power range electrical equipment and generate metering and billing reports;

[0110] The storage device front-end server 420 is used to store information;

[0111] The monitoring workstation 410 is used for data detection and display;

[0112] The cloud network data server 510 is used to transmit the data required by the cloud network platform. The cloud network data server is wirelessly connected to the cloud network platform in the form of a 4G wireless router or by optical fiber to exchange data and instructions between the data required by the cloud network platform and the onshore power range system.

[0113] The cloud network platform 520 is connected to the server group 400 and the onshore power box through the cloud network data server 510 to provide onshore power for the ship. It establishes communication with the power connection box through multiple protocols (such as: RS485, Ethernet, wireless, CAN bus) and notifies the power connection box to start power supply. After the power connection box is connected to the power switch and supplies power to the ship through the cable, the ship enters the power consumption state.

[0114] The power consumption information collection device 600 is communicatively connected to the communication management machine. The power consumption information collection device is used to distributively collect the power data generated during the operation of the system through the meter; the power consumption information collection device includes:

[0115] The data collection PLC 610 is used to collect power data. The power data includes electrical parameters, alarm information, and remote control information; the data collection PLC is communicatively connected to the communication management machine;

[0116] Meter 620, where the meter refers to an electric energy meter metering and detection device, including an ammeter, a voltmeter, a wattmeter, and a kilowatt-hour meter; the meter is used to measure electrical parameters, and the meter is communicatively connected to the data acquisition PLC via RS485 or RS232;

[0117] The power consumption information acquisition device 600 develops a communication interface for distributed communication acquisition of power data. After the station address of the meter is edited in the PLC, it communicates with the master station of the power data acquisition PLC via a fieldbus according to a communication protocol, and performs data calculation inside the PLC. The analog signal is converted into a digital signal through the underlying logic code, and the data is stored in the specified register through an algorithm.

[0118] The type of the fieldbus is preferably RS485 or RS232. RS232 and RS485 are classic serial interfaces and have been widely used;

[0119] The communication protocol can be any one of the meter private protocol, IEC103 protocol, Modbus protocol, etc.;

[0120] The object of the data calculation is the data obtained from the meter, which can specifically be current, voltage, active power, or reactive power.

[0121] Due to the characteristics of the Three Gorges Dam area, such as large water level drop, large dock slope, and offshore distance, for docks with large electricity demand, the high-voltage end of the onshore power system needs to be moved forward, and the substation equipment needs to be installed on the floating dock, resulting in a series of problems such as high-voltage cable retraction, positioning, communication, and control. These problems can be solved by the power supply cable retraction device.

[0122] Reference Figure 1 , the comprehensive control system for the onshore power industrial control simulation range also includes:

[0123] A power supply cable retraction device 700, which is used to perform distributed communication acquisition of analog signals during the operation of the system, transmit cable retraction data to the comprehensive control system for the onshore power industrial control simulation range, and realize centralized control of the cable retraction data; the cable retraction data includes: sensor signal data, GPS signal data, remote control signal data, temperature data, cable layer data, and fault data; the power supply cable retraction device is communicatively connected to the communication management machine; the power supply cable retraction device includes:

[0124] A PLC control unit 710, which can detect the number of rotations of the reel motor, cooperate with time, and detect the cable retraction displacement and retraction speed. It includes:

[0125] An input module for collecting analog and digital signals;

[0126] An output module for analog and digital output;

[0127] A communication module for communicating with a communication management machine and remote control.

[0128] An actuator 740, including an inverter and a winch motor, for performing cable retraction and deployment operations. The peripheral devices of the actuator include a local operation box and a remote controller for local control.

[0129] A tension monitoring unit 720 for collecting equivalent cable tension data. The tension monitoring unit includes:

[0130] A cable pulley, a barge, a tension sensor, and a cable. The cable pulley is connected to the barge through the cable, and the cable is a 10 kV cable. Both ends of the tension sensor are connected to the cable pulley and the barge respectively through steel wires, and the bending radian of the steel wire is smaller than that of the cable. When the displacement change between the barge and the shore base is caused by the water level change, the tension sensor detects the tension change prior to the high-voltage cable, and the actuator is adjusted to retract and deploy the cable through the PLC control unit.

[0131] A GPS unit 730 for collecting cable tension data and displacement change data. The GPS unit real-time collects the horizontal and vertical displacements of the equipment connecting the barge and the shore base, and both detect the cable tension and displacement changes caused by the water level change.

[0132] Specifically, a method for establishing an onshore power control network simulation range based on protocol parsing includes the following steps:

[0133] Reference Figure 1 And Figure 2 , step S1, forming an onshore power simulation industrial control system. The specific steps are: forming a control platform working network with various-purpose servers and switches; that is, forming a control platform working network with the relevant equipment of the onshore power range control system described above. The components involved include: a communication management machine 100, an edge IoT proxy device 200, a switch 300, a server group 400, a cloud network data server 510, and a cloud network platform 520;

[0134] The communication management machine 100 is used to integrate and summarize communication data for data exchange;

[0135] The edge IoT proxy device 200 is communicatively connected to the communication management machine 100 and is used to forward the data summarized by the communication management machine 100;

[0136] As a preferred solution, a security isolation unit 900 is provided between the communication management machine 100 and the edge Internet of Things device 200, which is used for horizontally isolating the core control system to achieve unidirectional transmission of production area data and non-production area data; preferably, the security isolation unit 900 is an industrial control firewall or an isolation device; compared with the industrial control firewall, the isolation device is generally used under more stringent conditions.

[0137] The switch 300 is communicatively connected to the edge Internet of Things device 200 to receive the data forwarded by the edge Internet of Things proxy device 200 and forward the received data to the server group 400;

[0138] The server group 400 is communicatively connected to the switch 300 to store, visualize, and further process the data forwarded by the switch 300;

[0139] The server group 400 includes:

[0140] 1. A monitoring workstation 410 for data detection and display;

[0141] 2. A storage device front-end server 420 for storing information;

[0142] 3. A metering and billing front-end server 430 for collecting and calculating data of power equipment in the onshore power simulation industrial control system and generating metering and billing reports;

[0143] 4. A database server 440 for storing process data, and the database corresponding to the database server is SQLServer.

[0144] 5. A terminal server 450, and the terminal server 450 is used to form a software development platform for visualization and graphing;

[0145] The cloud network data server 510 is communicatively connected to the terminal server 450, for example, through the IEC104 protocol, and is used to transmit the data required by the cloud network platform 520;

[0146] The cloud network data server 510 is wirelessly connected to the cloud network platform 520 in the form of a 4G wireless router or by optical fiber to exchange data and instructions between the data required by the cloud network platform 520 and the onshore power simulation industrial control system;

[0147] The cloud network platform 520 is used to connect to the onshore power box through multiple network protocols, and in combination with the data during the operation and operation of the onshore power simulation industrial control system, control the onshore power box to provide onshore power for the onshore power simulation industrial control system. The onshore power box refers to a ship onshore power distribution box, which is a special ship power supply guarantee device installed at the port terminal.

[0148] The battery inspection device 810 is used for power supply monitoring and is connected to the communication management machine 100 via RS485;

[0149] The microcomputer protection device 820 is used for line protection and is connected to the communication management machine 100 via RS485;

[0150] The Xuji protection device 830 is used for line protection and main transformer differential protection and is connected to the communication management machine 100 via RS485.

[0151] Reference Figure 2 , Step S2, network the various acquisition and control devices through hardwiring connection or communication connection. The hardwiring is the direct connection cable between devices, and the communication connection is the connection through softwiring methods such as the Modbus protocol and CAN protocol. The devices involved include:

[0152] The electricity information acquisition device 600 is used for acquiring the power data generated during the operation of the onshore power analog industrial control system;

[0153] The electricity information acquisition device 600 includes:

[0154] The data acquisition PLC 610 is used for acquiring the power data of the onshore power analog industrial control system. The power data includes electrical parameters, alarm information, and remote control information; the data acquisition PLC 610 is communicatively connected to the communication management machine 100;

[0155] The meter 620 is used for measuring the electrical parameters of the onshore power analog industrial control system and is connected to the communication management machine 100 via RS485. The number of the meters 620 is one or more, and the meters are communicatively connected to the data acquisition PLC 610 via RS485 or RS232; the meter 620 refers to the electric energy meter metering and detection device, including ammeter, voltmeter, wattmeter, and kilowatt-hour meter.

[0156] The high-voltage reel is used for rotating and controlling the retraction and extension of the power supply cable;

[0157] The power supply cable retraction and extension device 700 is used for acquiring the cable retraction and extension data during the operation of the onshore power analog industrial control system;

[0158] The power supply cable retraction and extension device 700 includes:

[0159] The high-voltage reel PLC 710 is used for detecting and controlling the power supply cable retraction and extension device and is connected to the industrial control firewall or isolation device via RJ-45;

[0160] The inverter 720 is used for providing DC power and is connected to the high-voltage reel PLC 710 via RS485;

[0161] The sensing device 730 is used to convert the physical quantity of the detection object into an electrical signal, and is connected to the high-voltage reel PLC710 via RS485; the sensing device 730 includes a temperature and humidity transmitter sensor 731, a liquid level sensor 732 and a tension sensor 733; the temperature and humidity transmitter sensor 731 is used for temperature and humidity detection, and is connected to the high-voltage reel PLC710 via RS485; the liquid level sensor 732 is installed on the pontoon for liquid level detection, and is connected to the high-voltage reel PLC710 via hard wiring; the tension sensor 733 is installed on the pontoon for tension detection, and is connected to the high-voltage reel PLC710 via hard wiring; the sensing device may also include a GPS sensor.

[0162] The frequency converter 740 is connected to the high voltage reel PLC 710 through hard wiring;

[0163] The reel motor 750 is used to control the retraction and extension of the high-voltage cable and is controlled by the frequency converter 740 and is connected to the frequency converter 740 through hard wiring;

[0164] The solenoid valve 760 is used to control the rotation direction of the reel motor 750, and is connected to the reel motor 750 through hard wiring and connected to the high-voltage reel PLC 710 through RS485.

[0165] S3, distributed data collection

[0166] After the networking of various acquisition and control devices is completed, the private protocol is converted into a unified standard protocol through the communication management machine, and collected in the core controller PLC of each subsystem and the human-machine HMI. The data can be exchanged normally by developing the underlying code and software communication interface in the PLC and HMI. In this embodiment, the core controller PLC includes the data acquisition PLC 610 and the high-voltage reel PLC 710.

[0167] S4, data processing, network security vulnerability mining testing and blockchain

[0168] In step S41, the power consumption information collection device 600 and the power supply cable retracting device 700 upload the data to the shore power range management and control system through the switch, so as to realize the centralized monitoring of the relevant data of the shore power simulation industrial control system.

[0169] The input data of the shore power range control system includes:

[0170] 1. The electricity parameters, alarm information and remote control information of the meter 620 collected by the electricity information collection device 600 are collected by the communication management machine 100 and stored in the real-time database;

[0171] 2. Signal data, control signal data and fault data of the sensor device 730 acquired by the power supply cable retracting and releasing device 700.

[0172] After processing the above data, the output data includes:

[0173] 1. Operating parameter data such as voltage and current that need to be monitored in real time. The operating parameters can display values on the human-machine interface and can also be displayed in the form of lists, waveform diagrams, analog pointers, etc.

[0174] 2. Real-time database data and historical database data generated based on the operating parameter data. The relevant data recording interval can be set by oneself, and the relevant data recording retention time is not less than 1 year.

[0175] 3. Circuit breaker operation records, operation records, alarm records, and protection records.

[0176] 4. Provide various analog real-time curves and historical curves that meet the requirements of the current system and their combinations.

[0177] 5. Statistical data such as over-limit time, recovery limit time, maximum or minimum over-limit value, average value, extreme value, etc. recorded.

[0178] 6. Total electricity consumption, peak, valley, and flat electricity consumption record data.

[0179] 7. Various daily report, monthly report, annual report, and hourly record data.

[0180] 8. Modified record data of the original parameter table.

[0181] 9. Abnormal record data of microcomputer system equipment and communication channels.

[0182] 10. Record system failures and accidents and generate corresponding report data.

[0183] Step S42, Network security vulnerability mining test

[0184] The development of electric power security has entered a new historical stage. Modern society has higher and higher requirements for the reliability of power supply. The status of electric power industry security is more important than ever. Electric power security and efficiency have become prominent issues. Electric power security has become an important part of national security. The more the economy develops, the greater the impact caused by the power system, and economic and political events caused by the power grid are not uncommon at home and abroad.

[0185] In an industrial control range simulation processing system, there is a large amount of data exchange and transmission among various modules within the system. If there are information security vulnerabilities, the security of the power system will be endangered. The present invention realizes actual combat network security testing during non-stop maintenance by building a shore power range simulation system, discovers network security vulnerabilities, and ensures the security of shore power equipment. In practice, how to hold the handlers of relevant vulnerabilities accountable after a data security incident occurs in a system that has been confirmed as having vulnerabilities is a requirement of the system security guarantee mechanism of the power system. The present invention uploads the network security vulnerability mining process and vulnerability results to the blockchain network for evidence storage through blockchain technology, ensuring the authenticity, credibility, and traceability of network security vulnerability data.

[0186] To verify whether there are network security vulnerabilities in the equipment to be connected to the shore power, before all equipment enters the on-site deployment of the shore power, it is necessary to simulate the access of the corresponding equipment in the shore power simulation industrial control system first, and then the shore power range control system conducts network security vulnerability testing on the shore power simulation industrial control system based on the blockchain as needed;

[0187] Reference Figure 3 , and its network security vulnerability testing process is as follows:

[0188] Collect device information and generate a device basic information table;

[0189] Collect communication protocols and parse them. After parsing the protocols, obtain a protocol feature library, and generate corresponding protocol feature field tables according to the protocol feature library for functional partitioning;

[0190] Capture the first message in the device communication process, and save the message information after extracting the message;

[0191] Compare the message information with the protocol feature field table to confirm the communication protocol used by the device simulated by the shore power simulation industrial control system;

[0192] According to the device basic information table, scan for device vulnerabilities, confirm whether there are system vulnerabilities, and store the discovered system vulnerabilities in the form of a vulnerability field table for field-level data;

[0193] If system vulnerabilities are found, conduct network security vulnerability testing; and obtain the network security vulnerability testing results, verify the vulnerabilities and confirm the vulnerability risk categories, so as to test the vulnerabilities of the ship shore power system without affecting the normal operation of the ship shore power system, facilitating the reinforcement of the ship shore power system; wherein, the network security vulnerability testing includes: fuzz testing and penetration testing.

[0194] The data obtained in each step during the network security vulnerability testing process is stored as evidence on the blockchain, which can prevent the data during the network security vulnerability testing process from being tampered with.

[0195] It is understandable that the present invention first simulates the security of the equipment of the ship shore power system operating normally in the simulation environment of the shore power network range system based on the blockchain. By launching attack simulations, data collection and analysis, and vulnerability analysis on the equipment in the simulation environment of the present invention, corresponding network security protection measures are deployed on-site to ensure the safe and stable operation of the shore power network.

[0196] In a specific embodiment, the present invention provides a method for mining network security vulnerabilities and its corresponding blockchain information deposit method. Specifically, a security device is built with a notebook equipped with kali linux as the control core, an Ethernet port and a serial port (interface forms such as RS485, CAN bus, RS232, etc.) expansion module are configured, a common power grid industrial control protocol feature library is configured, and a PitFile for common power grid industrial control protocols generated by Peach is utilized, and then network security vulnerability mining is carried out, including the following steps:

[0197] S310. Device information collection

[0198] Collect device information. According to the collected device information, a device basic information table is generated;

[0199] Specifically, scanning software such as Nmap is used to collect information such as the system information, system kernel version, IP address, MAC address, open ports, and running applications of the device, and a device basic information table is generated according to the corresponding fields and stored in the database of the security device;

[0200] In a further preferred solution, the device basic information table is used to obtain a device hash through hash operation, and the device hash is stored on the blockchain network through chain storage;

[0201] S320. Communication protocol collection

[0202] For the communication access type, a preset tool is used to capture the first message in the communication process, and the first message is saved as a specific first message file. The first message file has a specific file type, and the first message file is stored in a specified area of the security device, such as a cache library;

[0203] In a further preferred solution, information such as the communication access type information (Ethernet communication, serial port communication), preset tool information, operation information of the preset tool for capturing the first message, first message file information, and first message file information stored in the specified area is used to obtain a protocol hash value through hash operation, and the protocol hash value is stored on the blockchain network through chain storage;

[0204] Specifically, it is divided into two cases:

[0205] Case 1: For Ethernet communication, use ARP spoofing technology, capture the communication process of the device using tools such as Wireshark and Eettercap, save it as a pcap packet, and store it.

[0206] Case 2: For serial communication, use the "man-in-the-middle" technology to forward the protocol, save the forwarded protocol to form a CSV file, and store it; the "man-in-the-middle" technology includes the steps of connecting the outgoing line of the device's serial port to the incoming line of the serial port of the security toolset detection platform; connecting the outgoing line of the serial port of the security toolset detection platform to the incoming line of the shore power range serial port; using a python script to forward data to each other and record the content of the forwarded data to form a CSV file for output.

[0207] Among them, the hash operation process for obtaining the protocol hash value includes the following steps:

[0208] S321, respectively select the first hash algorithm for the communication access type information (such as Ethernet communication, serial communication), preset tool information, operation information for the preset tool to capture the first message, first message file information, and first message file information stored in the specified area to obtain the corresponding hash values, and sort these hash values according to the sorting algorithm;

[0209] Preferably, the sorting algorithm is obtained by taking the modulo operation of the last two digits of the current time in nanoseconds to obtain the modulo remainder. Refer to Table 1, and obtain the sorting algorithm corresponding to the serial number according to the modulo remainder and the sorting algorithm comparison table:

[0210] Table 1

[0211]

[0212] S322, splice the sorted hash values to obtain a spliced hash value;

[0213] S323, perform an integer conversion operation on the spliced hash value to obtain an integer-converted data in pure digital format;

[0214] S324, perform a modulo operation on the integer-converted data to obtain a modulo remainder, and the modulus of the modulo operation is the number of preset hash algorithms;

[0215] S325, refer to Table 2, and obtain the hash algorithm corresponding to the serial number according to the modulo remainder and the hash algorithm comparison table as the second hash algorithm;

[0216] Table 2

[0217]

[0218] S326, perform a hash operation on the spliced hash value through the second hash algorithm to obtain the protocol hash value:

[0219] It should be noted that Table 1 takes 5 preset hash algorithms as examples for illustration, and Table 2 takes 5 preset sorting algorithms as examples for illustration. Tables 1 and 2 are only for illustration purposes. The specific types of hash algorithms or sorting algorithms can be preset according to actual situations, not limited to 5 types. For example, they can be 3 to 99 types or more.

[0220] Through blockchain technology, the present invention uploads the unique vulnerability detection, mining test process and results of the power system to the blockchain for evidence storage. And through a specially designed algorithm, it endows the selection sorting algorithm and the hash algorithm with randomness, which can effectively prevent the calculation process and results of the protocol hash from being stolen and tampered with, effectively guarantee the authenticity and uniqueness of the generation process and generation results of the original evidence storage data, significantly increase the difficulty of information forgery, avoid data forgery, and achieve the effect of urging relevant responsible persons in the power system to do their jobs well.

[0221] S330. Vulnerability mining

[0222] Perform a vulnerability scan on the device according to the device basic information table, confirm whether there are system vulnerabilities, and store the discovered system vulnerabilities in the form of a vulnerability field table for field-level data;

[0223] In a further preferred solution, obtain the vulnerability hash through hash operation on the vulnerability field table, and upload and store the vulnerability hash to the blockchain network;

[0224] Specifically, use tools such as the platforms or frameworks of Nessus, Metasploit, and Empire to perform a vulnerability scan on the device, and match the scan results with the CVE vulnerability database to confirm whether there are system vulnerabilities (such as high-risk open ports, unpatched vulnerabilities, etc.), and store the obtained vulnerabilities in the vulnerability table according to fields.

[0225] The vulnerability table includes the following fields: vulnerability name, vulnerability number, installed system version, device model, vulnerability type, vulnerability trigger condition, vulnerability threat level (high, medium, low), and corresponding field values.

[0226] S340. Protocol parsing

[0227] Collect communication protocols for protocol parsing, generate corresponding protocol feature field tables according to different protocol function codes of the same protocol; summarize all protocol feature field tables of the same protocol to generate a corresponding protocol feature library;

[0228] In a further preferred solution, obtain the protocol feature hash through hash operation on the protocol feature library, and upload and store the protocol feature hash to the blockchain network;

[0229] The first message in the communication process of the grabbing device, save the message information after extracting the message;

[0230] Compare the message information with the protocol feature field table to confirm the communication protocol used by the device simulated by the onshore power simulation industrial control system;

[0231] In a further preferred solution, the comparison result and the confirmed communication protocol of this step are hashed and then stored on the blockchain network through the chain;

[0232] S350. Security test

[0233] The security test includes: fuzz testing of the communication protocol and penetration testing of the device body.

[0234] Among them, for the fuzz testing of the communication protocol, the reference steps are:

[0235] According to the confirmed communication protocol, the corresponding protocol test script (such as PitFile test script) (such as generated by Peach) is sent to the device under test in sequence to verify whether the device under test works abnormally; if it works abnormally, locate the abnormal data packet (based on monitor positioning), and extract and reconstruct it into a protocol message according to the abnormal data, confirm the abnormal protocol message causing the vulnerability, and further confirm the reason for the abnormality of the abnormal protocol message; further, the communication protocol information received by the device under test, the abnormal working information of the device under test, the abnormal data packet information, the reconstructed protocol message information and the determined protocol message are hashed and then stored on the blockchain network through the chain; the process of going through the chain refers to the algorithm in the part of "S320. Communication protocol collection".

[0236] Among them, for the Ethernet protocol, extract the port information from the captured PCAP packets containing a large number of the same protocol. Due to the characteristics that the common industrial control protocol is a private protocol and the ports are roughly fixed, first further confirm a certain or certain protocols with suspicion to reduce the detection range; use the protocol feature library detection module to detect the captured messages in a polling manner according to a certain or certain suspected protocols. If the detection is successful, output the determined protocol. If the match is not successful, expand the range of detected protocols and detect again. If the detection is successful, output the determined protocol; if the match is still not successful, output the undetected result and prompt manual access to add new industrial control protocols to the protocol feature library.

[0237] Among them, for the serial port protocol, extract a sufficient amount of protocol messages from the captured CSV files containing a large number of the same protocol, and use the protocol feature library detection module to detect all serial port protocols in a polling manner. If the detection is successful, output the determined protocol; if the match is still not successful, output the undetected result and prompt manual access to add new industrial control protocols to the protocol feature library.

[0238] The PitFile test script is an XML file, which is prepared by developers in advance for the function codes, data, etc. of common power grid industrial control protocols. For each common power grid industrial control protocol, different PitFile test scripts will be written for different test contents. Its advantage is that different PitFile test scripts for different protocols can be written according to the access of the scenario and continuously expanded.

[0239] Verify whether the device under test is working abnormally through the PitFile test script, including the steps:

[0240] S351. After extracting the captured Modbus-TCP message, analyze its Modbus-TCP to obtain the 02 e2 00 00 00 06 01 03 0f a0 00 0a request message. The content of this message is to request 10 groups of data starting from address 4000, and the function code is 03;

[0241] S352. According to this request message, configure the PitFlie file, set the socket listening mode, and perform fuzz testing on the data part. <number name="06" size="16" value="00 0a" valueType="hex" signed="false" / > <!-- Without adding mutable="false", it means to perform fuzz on this value (the red part indicates fuzz testing on the data part) --> Determine abnormal data packets based on monitor.

[0242] S353. Use peach to run the prepared PitFile file and observe whether there is an error.

[0243] Among them, for the penetration testing of the device body, refer to the steps:

[0244] Perform penetration testing on the device body according to the vulnerability table (call the appropriate tool from the tool library), and the results of the penetration testing are confirmed by the detection personnel.

[0245] S360. Vulnerability verification

[0246] Obtain the fuzz testing results and penetration testing results, verify the vulnerabilities and confirm the vulnerability risk categories;

[0247] The said vulnerability risk categories include:

[0248] 1. 0 Day vulnerability, which means the first discovered vulnerability, that is, a vulnerability that has not been discovered worldwide and is discovered for the first time in this test; it needs to be recorded, notify the device user, and apply for a solution;

[0249] 2. Non-0 Day vulnerability and there is already a vulnerability reinforcement plan, and the device user needs to be notified;

[0250] 3. For non-0 Day vulnerabilities without a vulnerability reinforcement plan, a solution application needs to be submitted.

[0251] In a further preferred solution, the obtained fuzz testing results, penetration testing result information, process information for verifying vulnerabilities, and confirmed vulnerability risk category information are stored on the blockchain network after being hashed, and the process of uploading to the chain refers to the algorithm in the section of "S320. Communication Protocol Collection".

[0252] It is easy for those skilled in the art to understand that the above are only the preferred embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent replacements, and improvements made within the spirit and principle of the present invention should be included within the protection scope of the present invention.

Claims

1. A shore power network range system based on blockchain, characterized in that, Including: An onshore power supply simulation industrial control system and an onshore power supply range control and management system; The onshore power supply simulation industrial control system is used to simulate the operation of each industrial control device in the ship onshore power supply system; The onshore power supply range control and management system is used to control the onshore power supply simulation industrial control system to simulate the operation, monitoring, control, event warning, ship power consumption monitoring and analysis of the industrial control devices in the ship onshore power supply system; The onshore power supply range control and management system is also used to perform network security vulnerability testing on the onshore power supply simulation industrial control system based on the blockchain as needed; The process of its network security vulnerability testing is as follows: Device information collection: Collect device information and generate a device basic information table based on the collected device information; Communication protocol collection: For the communication access type, use a preset tool to capture the first message during the communication process, save the first message as a specific first message file, which has a specific file type, and store the first message file in the specified area of the security device; Vulnerability mining: Scan the device for vulnerabilities according to the device basic information table, confirm whether there are system vulnerabilities, and store the discovered system vulnerabilities in the form of a vulnerability field table for field-level data; Protocol parsing: Collect communication protocols for protocol parsing, and generate corresponding protocol feature field tables according to different protocol function codes of the same protocol; Summarize all protocol feature field tables of the same protocol to generate a corresponding protocol feature library; Compare the message information with the protocol feature field table to confirm the communication protocol used by the device simulated by the onshore power supply simulation industrial control system; Security vulnerability testing: Security vulnerability testing includes fuzz testing of communication protocols and penetration testing of device bodies; The data obtained in each step during the security vulnerability testing process is stored on the blockchain; Vulnerability verification: Obtain the fuzz testing results and penetration testing results, verify the vulnerabilities and confirm the vulnerability risk categories.

2. The system according to claim 1, characterized in that, The onshore power supply range control and management system stores the data obtained in each step during the network security vulnerability testing process on the blockchain, specifically: Perform a hash operation on the device basic information table to obtain a device hash, and store the device hash on the blockchain network; Perform a hash operation on the communication access type information of the device simulated by the onshore power supply simulation industrial control system, the information of the capture tool, the operation information of the capture tool for capturing the first message, the information of the first message, and the storage information of the first message through a random hash process to obtain a protocol hash, and then store the protocol hash on the blockchain network; Perform a hash operation on the vulnerability field table to obtain a vulnerability hash, and then store the vulnerability hash on the blockchain network; Perform a hash operation on the protocol feature field table to obtain a protocol feature hash, and then store the protocol feature hash on the blockchain network; Extract the second message related to the communication protocol used by the captured first message from the captured first message, and store the comparison result of the second message with the protocol feature field tables of each protocol and the confirmed communication protocol on the blockchain network after hash operation.

3. The system according to claim 2, wherein The onshore power test range control system performs a hashing operation on the communication access type information of the devices simulated by the onshore power simulation industrial control system, the information of the grabbing tool, the operation information of the grabbing tool for grabbing the first message, the information of the first message, and the storage information of the first message through a random hashing process. Specifically: Use the first hashing algorithm to perform hashing operations on the communication access type information, the information of the grabbing tool, the operation information of the grabbing tool for grabbing the first message, the information of the first message, and the storage information of the first message respectively to obtain corresponding multiple hash values; Sort the multiple hash values according to a preset sorting algorithm, then splice the sorted hash values to obtain a spliced hash value, and perform an integer conversion operation on the spliced hash value to convert the spliced hash value into a pure number; Subsequently, perform a first modulo operation on the result of the integer conversion operation to obtain a first remainder after modulo operation, and select a hashing algorithm from multiple hashing algorithms as the second hashing algorithm according to the corresponding relationship between the preset first remainder and the preset multiple hashing algorithms. Finally, use the second hashing algorithm to perform a hashing operation on the spliced hash value to obtain the protocol hash; Among them, the preset sorting algorithm is determined by the second remainder obtained by performing a second modulo operation on the last two digits of the current operation time in nanoseconds. The modulus of the second modulo operation is equal to the number of preset sorting algorithms. Different second remainders correspond to different preset sorting algorithms, and the modulus of the first modulo operation is equal to the number of preset hashing algorithms.

4. The system according to claim 3, wherein The preset sorting algorithms include: ascending time order, descending time order, ascending file size order, descending file size order, and random sorting; The preset multiple hashing algorithms include: MD3, MD5, SHA256, SHA384, and SHA512.

5. The system according to claim 1, wherein The onshore power simulation industrial control system includes: a communication management machine (100), an edge IoT proxy device (200), a switch (300), a server group (400), a cloud network data server (510), and a cloud network platform (520); The communication management machine (100) is used to integrate and summarize communication data for data exchange; The edge IoT proxy device (200), which is communicatively connected to the communication management machine (100), is used to forward the data summarized by the communication management machine (100); The switch (300), which is communicatively connected to the edge IoT device (200), is used to receive the data forwarded by the edge IoT proxy device (200) and forward the received data to the server group (400); The server group (400), which is communicatively connected to the switch (300), is used to store, visualize, and further process the data forwarded by the switch (300). The server group (400) includes a terminal server (450), and the terminal server (450) is used to form a software development platform for visualization and graphing; The cloud network data server (510), which is communicatively connected to the terminal server (450), is used to transmit the data required by the cloud network platform (520); The cloud network data server (510) is wirelessly connected to the cloud network platform (520) in the form of a 4G wireless router or by optical fiber to exchange data and instructions between the data required by the cloud network platform (520) and the onshore power supply analog industrial control system; The cloud network platform (520) is used to connect to the onshore power supply box through multiple network protocols, and combine the data during the operation and running of the onshore power supply analog industrial control system to control the onshore power supply box to provide onshore power for the onshore power supply analog industrial control system.

6. The system according to claim 5, wherein The server group (400) further includes: A monitoring workstation (410) for data detection and display; A storage device front-end server (420) for storing information; A metering and billing front-end server (430) for collecting and calculating the data of power equipment in the onshore power supply analog industrial control system and generating metering and billing reports; A database server (440) for storing process data, and the database corresponding to the database server is SQLServer.

7. The system according to claim 5, wherein A security isolation unit (900) is provided between the communication management machine (100) and the edge IoT device (200) to achieve one-way transmission of production area data and non-production area data; the security isolation unit (900) is an industrial control firewall or an isolation device.

8. The system according to claim 5, wherein The onshore power supply analog industrial control system further includes: A battery inspection device (810) for power supply monitoring, connected to the communication management machine (100) through RS485; A microcomputer protection device (820) for line protection, connected to the communication management machine (100) through RS485; A Xuji protection device (830) for line protection and main transformer differential protection, connected to the communication management machine (100) through RS485.

9. The system according to claim 7, wherein The onshore power supply analog industrial control system further includes a power consumption information collection device (600) for collecting power data generated during the operation of the onshore power supply analog industrial control system; The power consumption information collection device (600) includes: A data collection PLC (610) for collecting the power data of the onshore power supply analog industrial control system, and the power data includes electrical parameters, alarm information, and remote control information; the data collection PLC (610) is communicatively connected to the communication management machine (100); Meters (620) for measuring the electrical parameters of the onshore power supply analog industrial control system, connected to the communication management machine through RS485. The number of meters (620) is one or more, and the meters are communicatively connected to the data collection PLC (610) through RS485 or RS232; the meters (620) refer to power meter metering and detection devices, including ammeters, voltmeters, wattmeters, and watt-hour meters.

10. The system according to claim 7, wherein The onshore power supply analog industrial control system further includes: A high-voltage reel for rotating and controlling the retraction and extension of the power supply cable; A power supply cable retraction and extension device (700) for collecting cable retraction and extension data during the operation of the onshore power supply analog industrial control system; the power supply cable retraction and extension device (700) includes: A high-voltage reel PLC (710) for detecting and controlling the power supply cable retraction and extension device, connected to the industrial control firewall or isolation device through RJ-45; The inverter (720) is used to provide a DC power supply and is connected to the high voltage reel PLC (710) via RS485; A sensing device (730) is used to convert a physical quantity of a detection object into an electrical signal, and is connected to a high-voltage drum PLC (710) via RS485; the sensing device (730) comprises a temperature and humidity transmitter sensor (731), a liquid level sensor (732), and a tension sensor (733); the temperature and humidity transmitter sensor (731) is used for temperature and humidity detection, and is connected to the high-voltage drum PLC (710) via RS485; the liquid level sensor (732) is installed on a pontoon, is used for liquid level detection, and is connected to the high-voltage drum PLC (710) via hard wiring; the tension sensor (733) is installed on a pontoon, is used for tension detection, and is connected to the high-voltage drum PLC (710) via hard wiring; The frequency converter (740) is connected to the high voltage drum PLC (710) through hard wiring; A reel motor (750) is used to control the retraction and extension of the high-voltage cable and is controlled by a frequency converter (740) and is connected to the frequency converter (740) via hard wiring; The solenoid valve (760) is used to control the rotation direction of the reel motor (750), is connected to the reel motor (750) through hard wiring, and is connected to the high-voltage reel PLC (710) through RS485.

Images