Configuration checking method and device of electric power safety equipment, equipment and storage medium

Abstract

The embodiment of the invention provides a configuration checking method and device for electric power safety equipment, equipment and a storage medium. The method comprises the following steps: acquiring security configuration information of network security equipment of a power system, wherein the security configuration information comprises tunnel information and strategy information; extracting tunnel features of the tunnel information and strategy features of the strategy information; determining a suspicious tunnel and a suspicious reason of the suspicious tunnel based on the tunnel characteristics; and determining a suspicious strategy and a suspicious reason of the suspicious strategy based on the strategy characteristics. According to the method, the configuration information checking efficiency and the configuration information checking precision of the network security equipment in the power system are improved.

Description

Technical Field

[0001] The embodiments of the present application relate to the technical field of power systems, and in particular to a configuration verification method, apparatus, device and storage medium for power safety equipment. Background Art

[0002] The field of power system technology focuses on power equipment, power grids, power production and distribution systems and other power-related technologies and equipment. In this field, network security becomes particularly important, so some network security equipment is added to the power system, such as vertical encryption devices or firewalls.

[0003] In order to further improve network security, it is necessary to regularly check the configuration information of network security devices in the power system. However, the traditional technology has low efficiency in checking the configuration of network security devices and low accuracy of the checking results. Summary of the invention

[0004] Based on this, the embodiments of the present application provide a configuration verification method, apparatus, device and storage medium for power safety equipment, which can improve the configuration information verification efficiency of the power safety equipment and the accuracy of the verification results.

[0005] In a first aspect, an embodiment of the present application provides a configuration verification method for an electric power safety device, comprising:

[0006] Collecting security configuration information of network security equipment of the power system, wherein the security configuration information includes tunnel information and policy information;

[0007] Extracting tunnel features of the tunnel information and policy features of the policy information;

[0008] Determine the suspicious tunnel and the suspicious reason for the existence of the suspicious tunnel based on the tunnel characteristics;

[0009] A suspicious policy and a suspicious reason for the existence of the suspicious policy are determined based on the policy characteristics.

[0010] In a second aspect, an embodiment of the present application provides a configuration verification device for an electric power safety device, comprising:

[0011] A collection module, used to collect security configuration information of network security devices of the power system, wherein the security configuration information includes tunnel information and policy information;

[0012] A processing module is used to extract tunnel characteristics of the tunnel information and policy characteristics of the policy information; determine suspicious tunnels and suspicious reasons for the existence of suspicious tunnels based on the tunnel characteristics; determine suspicious policies and suspicious reasons for the existence of suspicious policies based on the policy characteristics.

[0013] In a third aspect, an embodiment of the present application provides an electronic device, comprising: a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, it implements the steps of the configuration verification method of the power safety device provided in the first aspect of the embodiment of the present application.

[0014] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of the configuration verification method of the power safety device provided in the first aspect of the embodiment of the present application are implemented.

[0015] The technical solution provided in the embodiment of the present application, after collecting the tunnel information and policy information of the network security device, extracts the tunnel characteristics of the tunnel information and the policy characteristics of the policy information, determines the suspicious tunnel and the suspicious reasons for the existence of the suspicious tunnel through the tunnel characteristics, and determines the suspicious policy and the suspicious reasons for the existence of the suspicious policy through the policy characteristics, that is, automatically realizes the configuration verification of the network security device in an automated manner, reduces the human participation, improves the configuration verification efficiency of the network security device, and can further obtain the suspicious reasons for the suspicious tunnel and the suspicious policy, thereby improving the configuration verification accuracy of the network security device. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 A schematic diagram of a flow chart of a method for verifying the configuration of an electric power safety device provided in an embodiment of the present application;

[0017] Figure 2 A schematic diagram of a security configuration information collection process provided in an embodiment of the present application;

[0018] Figure 3 Another schematic diagram of the security configuration information collection process provided in the embodiment of the present application;

[0019] Figure 4 Another flowchart of the configuration verification method of the power safety equipment provided in the embodiment of the present application;

[0020] Figure 5 A schematic diagram of a structure of a configuration verification device for electric power safety equipment provided in an embodiment of the present application;

[0021] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0022] In order to make the purpose, technical solutions and advantages of the present application more clearly understood, the technical solutions in the embodiments of the present application are further described in detail through the following embodiments and in combination with the accompanying drawings. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application. It should also be noted that, for the convenience of description, only the parts related to the present application are shown in the accompanying drawings, rather than all structures.

[0023] The embodiments of the present application can be used in many general or special computing device environments or configurations, such as personal computers, server computers, handheld devices or portable devices, tablet devices, multi-processor devices, and distributed computing environments including any of the above devices or equipment.

[0024] Embodiments of the present application may be described in the general context of computer executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. Embodiments of the present application may also be practiced in distributed computing environments, where tasks are performed by remote processing devices connected via a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0025] Figure 1 A flow chart of a method for checking the configuration of an electric safety device provided in an embodiment of the present application. Figure 1 As shown, the method may include:

[0026] S101. Collect security configuration information of network security devices in the power system, where the security configuration information includes tunnel information and policy information.

[0027] The network security device in this embodiment is a network security device related to the power system, for example, a vertical encryption device or a firewall in the power system. Taking the vertical encryption device as an example, in the power system, the vertical encryption device is used as a gateway device to encrypt and control the communication traffic between the substation network and the dispatching network. In order to facilitate the understanding of technicians, the following examples are all shown by taking the vertical encryption device as an example.

[0028] In the power system, usually, a vertical encryption device A can be installed and deployed at the network exit of the dispatching master station, and another vertical encryption device B can be installed and deployed at the network exit of the substation. An encryption tunnel (Tunnel) and a configuration policy (Rule) for communication are established between the vertical encryption device A and the vertical encryption device B. The encryption tunnel (Tunnel) is used to encrypt communication traffic, and the configuration policy (Rule) processes data packets based on the configured policy rules, for example, allowing data packets that meet the policy rules to communicate and rejecting data packets that do not meet the policy rules.

[0029] In specific implementation, a dispatching master station can manage more than 200 substations. If an encrypted tunnel is established between a dispatching master station and a substation, there are more than 200 tunnels in the vertical encryption device of a dispatching master station. Each tunnel is configured with corresponding tunnel information, such as each tunnel is configured with an IP address (local IP) of a dispatching master station vertical encryption device and an IP address (opposite IP) of a corresponding substation vertical encryption device, and there is a corresponding state of the tunnel (such as plain text or ciphertext) and a certificate name corresponding to the tunnel.

[0030] Multiple policies can be configured in one substation from one dispatching master station, which means that multiple policy information can be configured in one tunnel. Policy information consists of policy five-tuple information and actions. For the policy of the vertical encryption device in the dispatching master station, the policy five-tuple information may include the following information: intranet IP address range (i.e. source IP address range), intranet port range (i.e. source port range), extranet IP address range (i.e. destination IP address range), extranet port range (i.e. destination port range) and Transmission Control Protocol (TCP) / User Datagram Protocol (UDP).

[0031] The action is to allow or deny, and the vertical encryption device uses the default deny logic, that is, the data message that meets the five-tuple information of the policy is allowed to communicate, and the data message that does not meet the five-tuple information of the policy is not allowed to communicate.

[0032] The above security configuration information refers to configuration information related to network security. For example, the security configuration information may be tunnel information and policy information configured by a network security device.

[0033] Optionally, the security configuration information of the network security devices of the power system can be collected in the following ways:

[0034] Method 1: Establish a communication connection with the management center of the network security device and collect security configuration information of the network security device through the management center.

[0035] like Figure 2 As shown, a management center of a network security device is connected via a wireless network / wired network, and security configuration information of the network security device to be checked is read by accessing the management center.

[0036] Method 2: Establish a communication connection with the network security device through the management interface provided by the network security device, log in to the network security device and collect security configuration information of the network security device by running the hyperterminal command.

[0037] The management interface can be a network port or a serial port. Figure 3 As shown, the network security device to be checked is connected through the network port / serial port, the network security device is logged in, and the security configuration information of the network security device is read by running the hyperterminal command of the network security device.

[0038] S102: Extract tunnel features of the tunnel information and policy features of the policy information.

[0039] After the tunnel information and the policy information are collected, feature extraction is performed on the tunnel information and the policy information to extract key tunnel feature information and policy feature information.

[0040] S103: Determine the suspicious tunnel and the suspicious reason for the existence of the suspicious tunnel based on the tunnel characteristics.

[0041] S104: Determine suspicious policies and suspicious reasons for the existence of suspicious policies based on policy features.

[0042] By performing a multi-dimensional analysis on the tunnel feature information of each tunnel, suspicious tunnels and suspicious reasons for the existence of suspicious tunnels can be determined. By performing a multi-dimensional analysis on the policy feature information of each policy, suspicious policies and suspicious reasons for the existence of suspicious policies can be determined. Furthermore, suspicious tunnels and suspicious reasons for the existence of suspicious tunnels, suspicious policies and suspicious reasons for the existence of suspicious policies can be output in a preset report format, so that operation and maintenance personnel can promptly learn about and rectify security configuration problems in network security equipment.

[0043] The technical solution provided in the embodiment of the present application, after collecting the tunnel information and policy information of the network security device, extracts the tunnel characteristics of the tunnel information and the policy characteristics of the policy information, determines the suspicious tunnel and the suspicious reasons for the existence of the suspicious tunnel through the tunnel characteristics, and determines the suspicious policy and the suspicious reasons for the existence of the suspicious policy through the policy characteristics, that is, automatically realizes the configuration verification of the network security device in an automated manner, reduces the human participation, improves the configuration verification efficiency of the network security device, and can further obtain the suspicious reasons for the suspicious tunnel and the suspicious policy, thereby improving the configuration verification accuracy of the network security device.

[0044] Optionally, the above policy features include source IP address range, destination port range, destination IP number and location of service port.

[0045] The following is an introduction to the service ports in the policy:

[0046] According to the management mode of the substation, when the dispatching master station communicates with the substation, in most cases: the dispatching master station's server initiates a connection to the substation equipment as a client. Therefore, in the strategy of the vertical encryption device of the dispatching master station, the source IP address is the IP address of the dispatching master station's server, the source port is 0-65535, the destination IP address is the IP address of the substation plant's server or device, and the destination port is the service port of the substation plant's server or device. In this case, the service port is on the substation plant's equipment.

[0047] In other cases, the server or device of the substation plant initiates a connection to the equipment of the dispatching master station as a client. Therefore, in the strategy of the vertical encryption device of the dispatching master station, the source IP address is the IP address of the master station server, the source port is the service port of the master station server, the destination IP address is the IP of the server or device of the substation plant, and the destination port is 0-65535 of the server or device of the substation plant. At this time, the service port is on the master station device.

[0048] Introduction to strategy features: Since one dispatching master station can access multiple substations, the services of each substation are consistent. The IP address of the server of one dispatching master station and the IP addresses of servers or devices of multiple substations are fixed static IPs. Under normal circumstances, the IP addresses of servers or devices of each substation are different, but the same services use the same service port and the same services have the same number of plant and station device IPs (that is, the number of destination IPs is the same), and the service ports are located in the same location.

[0049] For example, for telecontrol services, in the policies for three substations configured in the vertical encryption device, the service ports are the same, and the master station IP address (or called the intranet IP address, source IP address) is consistent. Although the destination IP address range is different, the number of destination IPs is the same. Based on this principle, optionally, Figure 4 As shown, the above S104 may include:

[0050] S401: Group policy information based on policy features to obtain multiple policy groups.

[0051] The policy information is grouped according to the above policy features (i.e., source IP address range, destination port range, destination IP number, and service port location), and policy information with the same policy features are grouped into the same group, thereby forming multiple policy groups. It is understandable that the policy features of each policy in the same policy group are the same, and the policy features of policies in different policy groups are different.

[0052] S402: Determine the number of policies included in each policy group, and determine a suspicious policy group among the multiple policy groups according to the number of policies included in each policy group.

[0053] Usually, most of the policies configured in the vertical encryption device meet the requirements, and a small number of policies do not meet the requirements. Based on this, the number of policies included in each policy group can be counted, and suspicious policies can be determined according to the number of policies included in each policy group. Exemplarily, a policy group with a number of policies less than a preset number is determined as a suspicious policy group, and a policy group with a number of policies greater than or equal to the preset number is determined as a normal policy group. Among them, all policies in a suspicious policy group are suspicious policies.

[0054] S403: Determine suspicious reasons for each suspicious policy in the suspicious policy group according to the policy groups other than the suspicious policy group.

[0055] There are differences in policy characteristics between the suspicious policy group and the normal policy group. These differences are often caused by mismatches and special historical reasons. Therefore, we can focus on the suspicious policies within the suspicious policy group.

[0056] Furthermore, based on the policy information in the normal policy group other than the suspicious policy group, the suspicious reasons for the existence of each suspicious policy in the suspicious policy group may be further determined.

[0057] Optionally, for each suspicious policy in the suspicious policy group, based on policy features, feature comparison is performed between the suspicious policy and policy information in policy groups outside the suspicious policy group; a reference policy is determined based on the feature comparison result; and a suspicious reason for the suspicious policy is determined based on the reference policy.

[0058] Specifically, according to the policy features (i.e., source IP address range, destination port range, destination IP number, and service port location), the suspicious policy is compared with the policies in the policy group other than the suspicious policy group. The comparison results will not necessarily be exactly the same (because policies with exactly the same features will be classified into the same policy group). However, the feature comparison results may include the following situations:

[0059] a. For the currently compared suspicious strategy, there are one or more normal strategies, and 3 of the 4 strategy features are the same.

[0060] b. For the currently compared suspicious strategy, there are one or more normal strategies, and 2 of the 4 strategy features are the same.

[0061] c. For the suspicious strategy currently being compared, there are one or more normal strategies, and one of the four strategy features is the same.

[0062] d. For the currently compared suspicious strategy, there are one or more normal strategies, and the characteristics of the four strategies are all different.

[0063] Next, any strategy in result a is selected as a reference strategy, and the strategy information of the suspicious strategy is compared with that of the reference strategy to further determine which feature is different and what kind of difference exists.

[0064] Among them, the differences may include the following situations: the main site IP address range is configured with more, the main site IP address range is configured with less, there is no intersection with the main site IP address range, there is an intersection with the main site IP address range but it is different, the destination port range is configured with more, the destination port range is configured with less, there is no intersection with the destination port range, there is an intersection with the destination port range but it is different, the number of plant site IPs is configured with more, the number of plant site IPs is configured with less, and the location of the service ports is different, etc.

[0065] Exemplarily, assuming that the suspicious policy and the reference policy have three common features, but different numbers of destination IPs, and the number of destination IPs configured for the suspicious policy is greater than that for the reference policy, the suspicious reason for the suspicious policy is that there are too many destination IPs configured.

[0066] In this embodiment, by using a horizontal comparison method for all substation policies within the same network security device, policy information is grouped according to policy characteristics, and suspicious policy groups are automatically determined based on the number of policies contained in the grouped policy groups. The reference policy that is most similar to the suspicious policy is found through feature comparison as a benchmark for the suspicious policy. The specific difference characteristics of the suspicious policy can be more clearly found through the reference strategy, thereby improving the accuracy of policy configuration verification.

[0067] In one implementation, optionally, the above-mentioned policy feature may include policy quintuple information or a port value of a service port.

[0068] Optionally, the determining of the suspicious policy and the suspicious reason for the existence of the suspicious policy based on the policy characteristics includes:

[0069] Determine the policy with abnormal address configuration range in the policy information based on the policy quintuple information;

[0070] Determine the policies with repeated or overlapping contents in the policy information based on the policy quintuple information;

[0071] A policy for service port anomalies in the policy information is determined based on the service port information.

[0072] Specifically, case 1: if any of the source IP address range, destination IP address range, and service port range in the policy quintuple information of a policy exceeds the specified threshold, the policy is considered suspicious. The specific suspicious reasons may be that the source IP address range is too wide, the service port range is too wide, or the destination IP address range is too wide.

[0073] Case 2: If the service port of a policy is a designated port, the policy is determined to be a suspicious policy. The designated ports may include 21, 23, 80, 135, 137, 139, 3389, etc.

[0074] Case 3: If each element in the policy quintuple information of two policies has an intersection or is completely consistent, then the two policies are determined to be policies with overlapping or repeated content. The two policies can be merged into one policy and the redundant policy can be deleted.

[0075] For example, if the source IP address range, destination IP address range, destination port range (service port range), and source port range of the two policies all have intersections, and the protocol type is TCP, then the two policies are overlapping policies. If the five-tuple information of the above policies is completely consistent, then the two policies are duplicate policies. Among them, the above source port is the client port, and the value range is 0-65535, and it is also possible not to compare.

[0076] In this embodiment, by checking the policy quintuple information and service port of the policy, suspicious policies in the policy information configured by the network security device are further checked, that is, the policy information is comprehensively checked through multiple dimensions, thereby improving the accuracy of policy configuration verification.

[0077] Optionally, the tunnel characteristics include an IP address associated with the tunnel, tunnel status information, and tunnel certificate information.

[0078] The above-mentioned determination of suspicious tunnels and suspicious reasons for the existence of suspicious tunnels based on tunnel characteristics includes:

[0079] Identify suspicious tunnels with duplicate content in tunnel information based on the IP addresses associated with the tunnels;

[0080] determining, based on the tunnel state information, unencrypted suspicious tunnels in the tunnel information;

[0081] Based on the tunnel certificate information, suspicious tunnels that do not use the national secret encryption algorithm in the tunnel information are determined.

[0082] Specifically, case 1: obtain the matching certificate of each tunnel and analyze the certificate content to determine whether each tunnel uses the national secret certificate and national secret encryption algorithm.

[0083] Case 2: The IP addresses associated with the tunnel may include the source IP address and the peer IP address. If the source IP address and the peer IP address of the two tunnels are the same, the two tunnels are determined to be duplicate tunnels and the redundant tunnel can be deleted.

[0084] Case 3: The above tunnel status information may include plain text and cipher text, and whether the tunnel is an unencrypted plain text tunnel is determined based on the tunnel status information.

[0085] In this embodiment, suspicious tunnels in the tunnel information configured by the network security device are checked through the IP address, tunnel status information and tunnel certificate information associated with the tunnel, that is, the tunnel information is comprehensively checked through multiple dimensions, thereby improving the accuracy of tunnel configuration verification.

[0086] It should be noted that the above embodiment only introduces the verification process of the policy information and tunnel information of the vertical encryption device as an example. Other network security devices in the power system (such as firewalls, etc.) can also refer to the above process for configuration verification, and the embodiments of this application will not be repeated here.

[0087] Optionally, the method further includes: in response to detecting that a USB flash drive is connected, running a specified program in the USB flash drive to implement the configuration verification method of the power safety device provided in the embodiment of the present application. By placing the configuration verification program for the power safety device in the USB flash drive, it cannot be copied and does not need to be installed. Only the above program is run on the USB flash drive, which is plug-and-play, thereby improving the convenience of configuration verification.

[0088] Figure 5 A schematic diagram of a configuration verification device for power safety equipment provided in an embodiment of the present application. Figure 5 As shown, the device includes: a collection module 501 and a processing module 502.

[0089] Specifically, the collection module 501 is used to collect security configuration information of network security devices of the power system, and the security configuration information includes tunnel information and policy information;

[0090] The processing module 502 is used to extract the tunnel characteristics of the tunnel information and the policy characteristics of the policy information; determine the suspicious tunnel and the suspicious reasons for the existence of the suspicious tunnel based on the tunnel characteristics; determine the suspicious policy and the suspicious reasons for the existence of the suspicious policy based on the policy characteristics.

[0091] Optionally, the policy features include source IP address range, destination port range, destination IP number and location of service ports;

[0092] The processing module 502 is also used to group the policy information based on the policy characteristics to obtain multiple policy groups; determine the number of policies contained in each policy group, and determine the suspicious policy group among the multiple policy groups based on the number of policies contained in each policy group; and determine the suspicious reasons for the existence of each suspicious policy in the suspicious policy group based on the policy groups other than the suspicious policy group.

[0093] On the basis of the above embodiment, optionally, the above processing module 502 is also used to, for each suspicious policy in the suspicious policy group, perform feature comparison between the suspicious policy and policy information in policy groups outside the suspicious policy group based on the policy features; determine a reference policy based on the feature comparison results; and determine the suspicious reason for the existence of the suspicious policy based on the reference policy.

[0094] Based on the above embodiments, optionally, the policy features include policy quintuple information or service port information; the above processing module 502 is also used to determine the policy for abnormal address configuration range in the policy information based on the policy quintuple information; determine the policy for repeated or overlapping content in the policy information based on the policy quintuple information; determine the policy for abnormal service port in the policy information based on the service port information.

[0095] Based on the above embodiment, optionally, the tunnel characteristics include an IP address associated with the tunnel, tunnel status information and tunnel certificate information; the above processing module 502 is also used to determine a suspicious tunnel with repeated content in the tunnel information based on the IP address associated with the tunnel; determine an unencrypted suspicious tunnel in the tunnel information based on the tunnel status information; determine a suspicious tunnel in the tunnel information that does not use a national secret encryption algorithm based on the tunnel certificate information.

[0096] Based on the above embodiment, optionally, the above-mentioned collection module 501 is also used to establish a communication connection with the management center of the network security device, and collect the security configuration information of the network security device through the management center; or, establish a communication connection with the network security device through the management interface provided by the network security device, log in to the network security device and collect the security configuration information of the network security device by running the super terminal command.

[0097] Optionally, the processing module 502 is further configured to, in response to detecting that a USB flash drive is connected, run a specified program in the USB flash drive to implement the configuration verification method of the power safety device.

[0098] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application, such as Figure 6As shown, the device includes a processor 60, a memory 61, an input device 62 and an output device 63; the number of the processor 60 in the device can be one or more. Figure 6 A processor 60 is taken as an example; the processor 60, memory 61, input device 62 and output device 63 in the device can be connected by a bus or other means. Figure 6 The example of connecting through bus is taken in the following.

[0099] The memory 61, as a computer-readable storage medium, can be used to store software programs, computer executable programs and modules, such as program instructions / modules corresponding to the configuration verification method of the power safety device in the embodiment of the present application (for example, the acquisition module 501 and the processing module 502 in the configuration verification device of the power safety device). The processor 60 executes various functional applications and data processing of the device by running the software programs, instructions and modules stored in the memory 61, that is, realizes the configuration verification method of the power safety device mentioned above.

[0100] The memory 61 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system and at least one application required for a function; the data storage area may store data created during the configuration verification of the power safety device, etc. In addition, the memory 61 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some instances, the memory 61 may further include a memory remotely arranged relative to the processor 60, and these remote memories may be connected to the device / terminal / server via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0101] The input device 62 may be used to receive input digital or character information and generate key signal input related to user settings and function control of the electronic device. The output device 63 may include a display device such as a display screen.

[0102] In one embodiment, a computer readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0103] Collecting security configuration information of network security equipment of the power system, wherein the security configuration information includes tunnel information and policy information;

[0104] Extracting tunnel features of the tunnel information and policy features of the policy information;

[0105] Determine the suspicious tunnel and the suspicious reason for the existence of the suspicious tunnel based on the tunnel characteristics;

[0106] A suspicious policy and a suspicious reason for the existence of the suspicious policy are determined based on the policy characteristics.

[0107] The configuration verification device, electronic device, and storage medium of the power safety equipment provided in the above embodiments can execute the configuration verification method of the power safety equipment provided in any of the above embodiments, and have the corresponding functional modules and beneficial effects of executing the method. For technical details not fully described in the above embodiments, please refer to the configuration verification method of the power safety equipment provided in any of the above embodiments.

[0108] The technical features of the above-described embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0109] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A configuration verification method for electric power safety equipment, characterized in that: include: Collecting security configuration information of network security equipment of the power system, wherein the security configuration information includes tunnel information and policy information; Extracting tunnel features of the tunnel information and policy features of the policy information; Determine the suspicious tunnel and the suspicious reason for the existence of the suspicious tunnel based on the tunnel characteristics; A suspicious policy and a suspicious reason for the existence of the suspicious policy are determined based on the policy characteristics.

2. The method according to claim 1, characterized in that The policy features include source IP address range, destination port range, destination IP number and service port location; The determining of the suspicious policy and the suspicious reason for the existence of the suspicious policy based on the policy characteristics includes: Grouping the policy information based on the policy characteristics to obtain multiple policy groups; Determining the number of policies included in each policy group, and determining a suspicious policy group among the multiple policy groups according to the number of policies included in each policy group; The suspicious reasons for the existence of each suspicious policy in the suspicious policy group are determined according to the policy groups other than the suspicious policy group.

3. The method according to claim 2, characterized in that The determining, based on the policy groups other than the suspicious policy group, the suspicious reasons for the existence of each suspicious policy in the suspicious policy group includes: For each suspicious policy in the suspicious policy group, based on the policy feature, feature comparison is performed between the suspicious policy and policy information in policy groups other than the suspicious policy group; Determine a reference strategy based on the feature comparison results; The suspicious reason for the existence of the suspicious policy is determined according to the reference policy.

4. The method according to claim 1, characterized in that: The policy features include policy quintuple information or service port information; The determining of the suspicious policy and the suspicious reason for the existence of the suspicious policy based on the policy characteristics includes: Determine, based on the policy quintuple information, a policy with an abnormal address configuration range in the policy information; Determine, based on the policy quintuple information, policies with duplicate or overlapping content in the policy information; A policy for abnormal service port in the policy information is determined based on the service port information.

5. The method according to claim 1, characterized in that The tunnel characteristics include an IP address associated with the tunnel, tunnel status information, and tunnel certificate information; The determining of the suspicious tunnel and the suspicious reason for the existence of the suspicious tunnel based on the tunnel characteristics includes: Determining a suspicious tunnel with duplicate content in the tunnel information based on the IP address associated with the tunnel; Determine, based on the tunnel state information, an unencrypted suspicious tunnel in the tunnel information; Based on the tunnel certificate information, suspicious tunnels in the tunnel information that do not adopt the national secret encryption algorithm are determined.

6. The method according to claim 1, characterized in that The collecting of security configuration information of network security devices of the power system includes: Establishing a communication connection with a management center of the network security device, and collecting security configuration information of the network security device through the management center; Alternatively, a communication connection is established with the network security device through a management interface provided by the network security device, the network security device is logged in, and the security configuration information of the network security device is collected by running a hyperterminal command.

7. The method according to any one of claims 1 to 6, characterized in that Also includes: In response to detecting that a USB flash drive is connected, a specified program in the USB flash drive is run to implement the configuration verification method of the power safety device.

8. A configuration verification device for electric power safety equipment, characterized in that: include: A collection module, used to collect security configuration information of network security devices of the power system, wherein the security configuration information includes tunnel information and policy information; A processing module, used for extracting tunnel features of the tunnel information and policy features of the policy information; Based on the tunnel characteristics, a suspicious tunnel and a suspicious reason for the existence of the suspicious tunnel are determined; based on the policy characteristics, a suspicious policy and a suspicious reason for the existence of the suspicious policy are determined.

9. An electronic device, characterized in that: include: A memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images