A configuration-free operation and maintenance method, system, device and storage medium for operation and maintenance gateway

Abstract

The present invention discloses a configuration-free operation and maintenance method, system, device and storage medium for an operation and maintenance gateway, wherein the method comprises: obtaining an operation and maintenance connection initiated by an operation and maintenance terminal based on a management channel established after the operation and maintenance terminal obtains an IP through an IP automatic allocation class protocol; automatically identifying application protocols according to the operation and maintenance connection, proxying and controlling application protocols in a control list, and transparently forwarding and recording and auditing application protocols not in a control list. The present invention realizes the operation and maintenance of an object to be operated and maintained without changing the original operation and maintenance mode of a substation, adding additional configurations, or adding additional IP resources, and does not reduce the efficiency of on-site operation and maintenance. Moreover, the entire operation and maintenance process is controllable, auditable, replayable, and traceable, which greatly improves the network security of the substation.

Description

Technical Field

[0001] The present invention belongs to the technical field of safe operation and maintenance, and specifically relates to a configuration-free operation and maintenance method, system, device and storage medium for an operation and maintenance gateway. Background Art

[0002] With the implementation of the Cybersecurity Law, Cybersecurity Level Protection and Critical Information Infrastructure Security Protection Regulations, the cybersecurity of substations has received more and more attention. At present, the corresponding equipment has been deployed for boundary protection and security monitoring of substations, but there are still some deficiencies in security operation and maintenance.

[0003] Since substations are usually a local area network, the main method for operation and maintenance of substation equipment is for the operation and maintenance personnel to configure an IP address in the same network segment on the operation and maintenance terminal, and then connect the operation and maintenance terminal to the switch of the substation for configuration and debugging. In order to achieve control over the operation and maintenance process, an operation and maintenance gateway is added between the operation and maintenance terminal and the object being operated and maintained. However, due to the different experience levels of the operation and maintenance personnel, the operation and maintenance gateway cannot be effectively configured. Incorrect configuration may affect the efficiency and effect of on-site operation and maintenance, and may even cause the wrong object to be operated and maintained, resulting in serious safety accidents.

[0004] Therefore, it is currently impossible to achieve safe operation, maintenance and debugging of various types of equipment in substations. In particular, the demand for methods or equipment that do not change the current operation and maintenance methods as much as possible and do not reduce the operation and maintenance efficiency is becoming more and more urgent. Summary of the invention

[0005] The purpose of the present invention is to overcome the deficiencies in the prior art and to provide a configuration-free operation and maintenance method, system, device and storage medium for an operation and maintenance gateway. The operation and maintenance of the operation and maintenance object can be realized without changing the original substation operation and maintenance mode, adding additional configuration and adding additional IP resources, and the efficiency of on-site operation and maintenance can be reduced. The entire operation and maintenance process can be controlled, audited, replayed and traced, thereby further improving the network security of the substation.

[0006] The present invention provides the following technical solutions:

[0007] In a first aspect, a configuration-free operation and maintenance method for an operation and maintenance gateway is provided, comprising:

[0008] Based on the management channel established after the operation and maintenance terminal obtains the IP through the IP automatic allocation protocol, the operation and maintenance connection initiated by the operation and maintenance terminal is obtained;

[0009] The application protocol is automatically identified according to the operation and maintenance connection, the application protocols in the control list are proxied and controlled, and the application protocols in the non-control list are transparently forwarded and recorded and audited.

[0010] Furthermore, the operation and maintenance gateway stores serialized IPs and turns on the IP automatic allocation function; the operation and maintenance terminal is provided with management and control software, and after the management and control software obtains the IP from the operation and maintenance gateway through the IP automatic allocation protocol, it uses the IP to establish a management channel with the operation and maintenance gateway, and the operation and maintenance terminal supports manual addition of IPs.

[0011] Furthermore, the operation and maintenance terminal is provided with management and control software, and the management and control software communicates with the operation and maintenance gateway as a client of the TCP connection in the management channel; the communication adopts a private protocol, and the private protocol contains encryption and authentication functions, and the private protocol is used to realize access authentication of the operation and maintenance terminal, status transmission of the operation and maintenance terminal and screen recording data of the operation and maintenance process; when the management channel is initialized, the legal operation and maintenance source IP is notified to the operation and maintenance gateway, and the legitimacy of the source IP is verified when the operation and maintenance connection is established.

[0012] Furthermore, the operation and maintenance terminal is provided with an operation and maintenance tool software, which initiates an operation and maintenance connection according to the operation and maintenance parameters of the operated and maintained object; the operation and maintenance parameters include the protocol type, destination IP, destination port parameters in the network connection and the baud rate, data bit, stop bit, and check bit parameters in the serial port connection.

[0013] Furthermore, the automatic identification of application protocols includes determining the protocol type according to the characteristics of the application protocols, the application protocols including network operation and maintenance protocols, serial port operation and maintenance protocols and industrial control protocols, the network operation and maintenance protocols including SSH and TELNET, the serial port operation and maintenance protocols including CONSOLE, and the industrial control protocols including network-type industrial control protocols IEC104 and IEC61850 and serial port-type industrial control protocols IEC101.

[0014] Furthermore, the control of application protocols includes: illegal protocol ports that need to be blocked or warned, dangerous commands that need to be blocked or warned for command control protocols, and virus signature libraries that need to be blocked or warned for file transfer protocols;

[0015] The proxy for network protocol adopts transparent proxy mode, which does not change the protocol type, source / destination IP, source / destination port of the link; the proxy for serial port protocol does not change the serial port channel parameters.

[0016] Furthermore, the transparent forwarding of the network protocol does not perform a transport layer proxy for the protocol, and directly forwards the message to the opposite network port; the transparent forwarding of the serial port protocol directly forwards the serial port message to the opposite side via the serial port with the same channel parameters.

[0017] In a second aspect, an operation and maintenance gateway configuration-free operation and maintenance system is provided, including:

[0018] The operation and maintenance connection acquisition module is used to obtain the operation and maintenance connection initiated by the operation and maintenance terminal based on the management channel established after the operation and maintenance terminal obtains the IP through the IP automatic allocation protocol;

[0019] The identification and management module is used to automatically identify the application protocol according to the operation and maintenance connection, to proxy and control the application protocols in the control list, and to transparently forward and record and audit the application protocols not in the control list.

[0020] In a third aspect, a configuration-free operation and maintenance device for an operation and maintenance gateway is provided, including a processor and a storage medium;

[0021] The storage medium is used to store instructions;

[0022] The processor is used to operate according to the instructions to execute the steps of the method described in the first aspect.

[0023] According to a fourth aspect, a computer-readable storage medium is provided, on which a computer program is stored, and when the program is executed by a processor, the steps of the method described in the first aspect are implemented.

[0024] Compared with the prior art, the present invention has the following beneficial effects:

[0025] (1) The configuration-free operation and maintenance method for the operation and maintenance gateway provided by the present invention establishes a management channel with the operation and maintenance gateway after the operation and maintenance terminal obtains the IP through the IP automatic allocation protocol, which does not add additional IP resources. The operation and maintenance personnel do not need to know the IP allocation status of the substation and do not need to configure the IP for the operation and maintenance gateway.

[0026] (2) The operation and maintenance gateway configuration-free operation and maintenance method provided by the present invention obtains the operation and maintenance connection initiated by the operation and maintenance terminal based on the management channel, automatically identifies the application protocol according to the operation and maintenance connection, proxies and controls the application protocols in the control list, and transparently forwards and records and audits the application protocols not in the control list. There is no need to configure the operation and maintenance gateway, and no additional requirements are required for the operation and maintenance personnel. The operation and maintenance gateway realizes automatic access, automatic identification and control of the operation and maintenance process, and does not reduce the efficiency of on-site operation and maintenance;

[0027] (3) The operation and maintenance method without configuration of the operation and maintenance gateway provided by the present invention does not need to change the original operation and maintenance mode. It only needs to connect the operation and maintenance gateway between the operation and maintenance terminal and the object to be operated and maintained. The operation and maintenance gateway is transparent to the operation and maintenance personnel.

[0028] (4) The configuration-free operation and maintenance method for the operation and maintenance gateway provided by the present invention can avoid network security threats and risks introduced in the conventional operation and maintenance process. The entire operation and maintenance process can be controlled, audited, replayed, and traced, greatly improving the network security of the substation. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 It is a schematic diagram of the network structure and steps of the configuration-free operation and maintenance method of the operation and maintenance gateway in an embodiment of the present invention. DETAILED DESCRIPTION

[0030] The present invention will be further described below in conjunction with the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solution of the present invention, and cannot be used to limit the protection scope of the present invention.

[0031] Example 1

[0032] like Figure 1 As shown, this embodiment provides a configuration-free operation and maintenance method for an operation and maintenance gateway, and the steps are as follows:

[0033] Step 1: Based on the management channel established after the operation and maintenance terminal obtains the IP through the IP automatic allocation protocol, obtain the operation and maintenance connection initiated by the operation and maintenance terminal.

[0034] The operation and maintenance gateway has a serialized IP stored in the factory and the IP automatic allocation function is turned on. The operation and maintenance terminal is equipped with management and control software to cooperate with the operation and maintenance gateway to realize the operation and maintenance function. After the management and control software is turned on, it will automatically detect the operation and maintenance gateway in the network, obtain the IP from the operation and maintenance gateway through the IP automatic allocation protocol, and then use the IP to establish a management channel with the operation and maintenance gateway; in addition, since the operation and maintenance terminal needs to manually configure the IP for operation and maintenance, it also needs to support manual addition of IP.

[0035] The control software communicates with the operation and maintenance gateway as a client of the TCP connection in the management channel; the communication adopts a private protocol, which is used to realize the access authentication of the operation and maintenance terminal, the state transmission of the operation and maintenance terminal, and the screen recording data of the operation and maintenance process. The private protocol contains encryption and authentication functions: the encryption algorithm adopts symmetric encryption, and the symmetric key is negotiated by the communicating parties after each connection is established. Since the key generation process contains random numbers, the encryption key is different each time; the authentication process adopts one-way authentication, and the operation and maintenance terminal authenticates with the operation and maintenance gateway by using UKEY or biometrics.

[0036] The establishment of a management channel is a necessary condition for the establishment of an operation and maintenance connection. Before the operation and maintenance connection is established, a management channel must exist. If the management channel is disconnected, all operation and maintenance connections will be disconnected. When the management channel is initialized, the operation and maintenance gateway will be notified of the legal operation and maintenance source IP. When the operation and maintenance connection is established, the source IP will be verified for legality.

[0037] The operation and maintenance terminal is equipped with operation and maintenance tool software, which initiates the operation and maintenance connection according to the operation and maintenance parameters of the object being operated and maintained; the operation and maintenance parameters include the protocol type, destination IP, destination port parameters in the network connection, and the baud rate, data bit, stop bit, check bit and other parameters in the serial port connection. The operation and maintenance tools usually used on site include both general serial terminal debugging tools, network debugging tools, and special device debugging tools.

[0038] Step 2: Automatically identify application protocols based on the operation and maintenance connection obtained in step 1, proxy and control application protocols in the control list, and transparently forward and record audits application protocols not in the control list.

[0039] Automatic identification of application protocols refers to determining the protocol type based on the characteristics of the application protocol. Application protocols include network protocols and serial port protocols, specifically network operation and maintenance protocols, serial port operation and maintenance protocols, and industrial control protocols. The network operation and maintenance protocols include SSH and TELNET, the serial port operation and maintenance protocols include CONSOLE, and the industrial control protocols include network-type industrial control protocols IEC104 and IEC61850 and serial port-type industrial control protocols IEC101.

[0040] The control list contains pre-configured protocol type groups and definitions of control over these protocol behaviors. Control over application protocols includes: illegal protocol ports that need to be blocked or alerted, dangerous commands (high-risk instructions) that need to be blocked or alerted for command control protocols, and virus signature libraries that need to be blocked or alerted for file transfer protocols.

[0041] The proxy for network protocol adopts transparent proxy mode, which does not change the protocol type, source / destination IP, source / destination port of the link; the proxy for serial port protocol does not change the serial port channel parameters.

[0042] Transparent forwarding of network protocols does not proxy the protocol at the transport layer, but directly forwards the message to the opposite network port; transparent forwarding of serial port protocols directly forwards the serial port message to the opposite side via the serial port with the same channel parameters.

[0043] Example 2

[0044] This embodiment provides an operation and maintenance gateway configuration-free operation and maintenance system, including:

[0045] The operation and maintenance connection acquisition module is used to obtain the operation and maintenance connection initiated by the operation and maintenance terminal based on the management channel established after the operation and maintenance terminal obtains the IP through the IP automatic allocation protocol;

[0046] The identification and management module is used to automatically identify the application protocol according to the operation and maintenance connection, to proxy and control the application protocols in the control list, and to transparently forward and record and audit the application protocols not in the control list.

[0047] Example 3

[0048] This embodiment provides an operation and maintenance device for an operation and maintenance gateway without configuration, including a processor and a storage medium; the storage medium is used to store instructions; the processor is used to operate according to the instructions to execute the steps of the method described in Example 1.

[0049] Example 4

[0050] This embodiment provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the steps of the method described in Embodiment 1 are implemented.

[0051] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0052] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0053] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0054] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0055] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A configuration-free operation and maintenance method for an operation and maintenance gateway, characterized in that: include: Based on the management channel established after the operation and maintenance terminal obtains the IP through the IP automatic allocation protocol, the operation and maintenance connection initiated by the operation and maintenance terminal is obtained; Automatically identify application protocols based on the operation and maintenance connection, proxy and control application protocols in the control list, and transparently forward and record audit application protocols not in the control list; The control list contains pre-configured protocol type groups and definitions of protocol behavior control; The control of application protocols includes: illegal protocol ports that need to be blocked or alerted, dangerous commands that need to be blocked or alerted for command control protocols, and virus signature libraries that need to be blocked or alerted for file transfer protocols; The proxy for network protocol adopts transparent proxy mode, which does not change the protocol type, source / destination IP, source / destination port of the link; the proxy for serial port protocol does not change the serial port channel parameters; Transparent forwarding of network protocols does not proxy the protocol at the transport layer, but directly forwards the message to the opposite network port; transparent forwarding of serial port protocols directly forwards the serial port message to the opposite side via the serial port with the same channel parameters.

2. The configuration-free operation and maintenance method for the operation and maintenance gateway according to claim 1, characterized in that: The operation and maintenance gateway stores serialized IPs and turns on the IP automatic allocation function; the operation and maintenance terminal is provided with management and control software. After the management and control software obtains the IP from the operation and maintenance gateway through the IP automatic allocation protocol, it uses the IP to establish a management channel with the operation and maintenance gateway. The operation and maintenance terminal supports manual addition of IPs.

3. The configuration-free operation and maintenance method for the operation and maintenance gateway according to claim 1, characterized in that: The operation and maintenance terminal is provided with management and control software, which communicates with the operation and maintenance gateway as a client of the TCP connection in the management channel; the communication adopts a private protocol, which contains encryption and authentication functions, and is used to realize access authentication of the operation and maintenance terminal, state transmission of the operation and maintenance terminal, and screen recording data of the operation and maintenance process; When the management channel is initialized, the legitimate operation and maintenance source IP is notified to the operation and maintenance gateway, and the legitimacy of the source IP is verified when the operation and maintenance connection is established.

4. The configuration-free operation and maintenance method for the operation and maintenance gateway according to claim 1, characterized in that: The operation and maintenance terminal is provided with operation and maintenance tool software, which initiates an operation and maintenance connection according to the operation and maintenance parameters of the object being operated and maintained; the operation and maintenance parameters include the protocol type, destination IP, destination port parameters in the network connection and the baud rate, data bit, stop bit, and check bit parameters in the serial port connection.

5. The configuration-free operation and maintenance method for the operation and maintenance gateway according to claim 1, characterized in that: The automatic identification of application protocols includes determining the protocol type according to the characteristics of the application protocols, the application protocols include network operation and maintenance protocols, serial port operation and maintenance protocols and industrial control protocols, the network operation and maintenance protocols include SSH and TELNET, the serial port operation and maintenance protocols include CONSOLE, and the industrial control protocols include network-type industrial control protocols IEC104 and IEC61850 and serial port-type industrial control protocols IEC101.

6. An operation and maintenance gateway configuration-free operation and maintenance system, characterized in that: include: The operation and maintenance connection acquisition module is used to obtain the operation and maintenance connection initiated by the operation and maintenance terminal based on the management channel established after the operation and maintenance terminal obtains the IP through the IP automatic allocation protocol; An identification and management module, which is used to automatically identify application protocols according to the operation and maintenance connection, proxy and control the application protocols in the control list, and transparently forward and record audit the application protocols not in the control list; The control list contains pre-configured protocol type groups and definitions of protocol behavior control; The control of application protocols includes: illegal protocol ports that need to be blocked or alerted, dangerous commands that need to be blocked or alerted for command control protocols, and virus signature libraries that need to be blocked or alerted for file transfer protocols; The proxy for network protocol adopts transparent proxy mode, which does not change the protocol type, source / destination IP, source / destination port of the link; the proxy for serial port protocol does not change the serial port channel parameters; Transparent forwarding of network protocols does not proxy the protocol at the transport layer, but directly forwards the message to the opposite network port; transparent forwarding of serial port protocols directly forwards the serial port message to the opposite side via the serial port with the same channel parameters.

7. An operation and maintenance device without configuration of an operation and maintenance gateway, characterized in that: including processor and storage medium; The storage medium is used to store instructions; The processor is used to operate according to the instructions to execute the steps of the method according to any one of claims 1 to 5.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the method described in any one of claims 1 to 5 are implemented.

Images