Test and configuration platform for automatic configuration test of longitudinal encryption authentication device

Abstract

A test and distribution platform for automatic configuration test of a longitudinal encryption authentication device comprises an offline part and an online part, the offline part realizes version verification, security test, simulation test and pre-configuration of the longitudinal encryption authentication device before network access, and the offline part adopts independent networking and comprises a test environment and a configuration environment. Carrying out initial configuration and simulation test on the longitudinal encryption authentication device, wherein the configuration environment consists of a configuration issuing server and a database server; the online part completes online configuration verification of to-be-configured equipment in the current network and generates a result report; the online part carries out remote electronic lead sealing and unsealing operation on the plant station longitudinal encryption authentication device through a data network and is composed of a management and control server and a management and control gateway machine, and the management and control gateway machine is provided with a longitudinal encryption card used for longitudinal management and control. According to the scheme, the network access working difficulty and the configuration cost of the device are reduced.

Description

Technical Field

[0001] The present invention belongs to the field of vertical encryption authentication and power monitoring network security, and in particular relates to a testing and matching platform for automatic configuration testing of a vertical encryption authentication device. Background Art

[0002] As the State Grid Corporation attaches great importance to the security protection of the power monitoring system, the security protection technology of the entire network is constantly improving, the security protection equipment is constantly being configured, and the work pressure of on-site equipment configuration is increasing. Security problems caused by insufficient testing are also emerging in an endless stream. The current problems are mainly caused by the following aspects:

[0003] First, the pressure of on-site equipment configuration is high. At present, the vertical equipment work is completed by the staff of the equipment manufacturer going to the substation to complete the on-site configuration. Each equipment configuration requires the early coordination of equipment arrival information, the arrangement of the itinerary of relevant staff, and the planning of routes. The actual configuration time of each site is several hours, but the actual time is required to cover the round-trip journey, and many substations are located in remote locations. The actual working hours account for a low proportion of the total working hours, and there is room for improvement in work efficiency.

[0004] Secondly, on-site mismatch and omission problems often occur. Due to manual configuration, for newly built sites, some services have not been debugged yet. During the on-site configuration process of engineers, mismatch and omission problems may occur. For services that have not yet been put into use, once the vertical strategy is mismatched, it cannot be discovered in time. The problem will not be exposed until the new site is officially put into operation, affecting the process of formal operation on site and the overall progress.

[0005] Third, equipment failures often occur when they arrive on site. Currently, there is no testing environment for equipment before it is used on site after it leaves the factory. This means that once a problem occurs with the equipment, whether it is a factory problem or a problem during transportation, it will only be discovered after the equipment is powered on on site. If a problem is found during actual on-site use, the equipment can only be temporarily replaced to extend the working cycle. Summary of the invention

[0006] In order to solve the deficiencies in the prior art, the present invention provides a testing and configuration platform for automated configuration testing of vertical encryption authentication devices, so as to solve the technical problems caused by insufficient testing of vertical encryption authentication devices during on-site configuration and the lack of automated configuration testing technology for the devices.

[0007] In order to solve the above technical problems, the present invention adopts the following technical solutions.

[0008] The present invention first discloses a test and matching platform for automatic configuration test of a vertical encryption authentication device, including an offline part and an online part, and is characterized in that:

[0009] The offline part implements the pre-network version verification, security test, simulation test and pre-configuration of the vertical encryption authentication device. The offline part adopts an independent network, including a test environment and a configuration environment, and performs initial configuration and simulation test on the vertical encryption authentication device. The configuration environment is composed of a configuration delivery server and a database server;

[0010] The online part completes the online configuration verification of the equipment to be configured in the existing network and generates a result report; the online part performs remote electronic sealing and unsealing operations on the plant station vertical encryption authentication device through the data network, and is composed of a management and control server and a management and control gateway machine. The management and control gateway machine is equipped with a vertical encryption card for vertical management and control.

[0011] The present invention further includes the following preferred embodiments:

[0012] The offline part includes a platform function module, a platform audit module and a data interaction module. The platform management module provides asset management, device version management, function plug-in management, running network library management, test case library management, statistical analysis, log management and user management; the platform audit module provides audit information display, audit report generation and export for the configuration initialization records, version verification results and equipment detection results of the vertical encryption authentication device; the data interaction module is used to realize data interaction between the test environment and the configuration environment.

[0013] The offline part includes a certificate management module, a fixed value configuration module, and an electronic sealing and unsealing module; the certificate management module realizes interaction with the certificate center, issues, verifies and imports the device certificate in an offline manner, and sends it to the device; the fixed value configuration module is used for the normative review, analysis, import, deletion, and viewing of the device fixed value sheet, and sends the configuration information to the device, and synchronizes it to the online part to automatically add related assets; the electronic sealing and unsealing module remotely electronically seals and unseals the vertical encryption authentication device based on the signature verification technology. In the sealed state, the device can only receive the unsealing message, and the device function returns to normal in the unsealed state.

[0014] The offline part includes a version management module, a security testing module, a simulation testing module and a log monitoring module. The version management module manages and controls the version information of the vertical encryption authentication device entered into the version library of the test and matching platform, and provides version registration, entry and verification functions; the security testing module performs content audit on the device based on the industrial control vulnerability library and penetration tools; the simulation testing module automatically switches switches and routers according to the network configuration information of the device to be tested to simulate the on-site network environment, automatically modifies the configuration of the simulated network security management platform to simulate the on-site main platform, modifies the vertical configuration of the main station to simulate the vertical configuration of the on-site main station, and realizes communication testing, online testing, management and control testing, message filtering testing, and performance testing of the actual configuration of the device to be tested; the log monitoring module receives and parses the syslog log sent by the device to be tested, and then displays it through the platform log monitoring interface.

[0015] The online part includes an asset management module, a user management module, and a log management module. The asset management module is used to provide device addition, editing, copying, deletion, exporting, fuzzy query, and access status management operations; the user management module is used to verify the user identity at login and grant relevant permissions based on the user role; the log management module is used to record and query the operations of the online part itself, and the content of the log record includes the date and time of the event, the user, the event type, and whether the event is successful.

[0016] The simulation test module is further used to utilize network virtualization technology to simulate the real environment that needs to be configured for the vertical encryption authentication device to be tested, so as to test and verify its configuration, communication, management and control, and message filtering functions before the device is officially connected to the network.

[0017] The network virtualization technology is used to abstract routers and switch entities into virtual resources, and build a virtual network together with front-end servers and main station vertical encryption authentication devices.

[0018] The online part includes a fixed value management module, which is used for normative verification, viewing, importing, deleting, parsing of fixed value lists and interacting with the fixed value list configuration information of the offline part. A fixed value list is generated according to the configuration of the vertical encryption authentication device. The vertical encryption authentication device of the online part is verified online and automatically according to the fixed value list configuration information synchronized by the offline part, and a verification result report is generated in the form of a report.

[0019] Accordingly, the present application also discloses a terminal, including a processor and a storage medium;

[0020] The storage medium is used to store instructions;

[0021] The processor is used to operate according to the instructions to implement the aforementioned testing and configuration platform for automated configuration testing of vertical encryption authentication devices.

[0022] Correspondingly, the present application also discloses a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, it implements the aforementioned testing and matching platform for automated configuration testing of a vertical encryption authentication device.

[0023] The beneficial effect of the present invention is that, compared with the prior art, the present invention provides a test and matching platform for the automated configuration test of the vertical encryption authentication device. In view of the security problems caused by insufficient testing of the vertical encryption authentication device during the on-site configuration process and the lack of automated configuration test technology for the device, the present invention relies on network virtualization technology to abstract and virtualize physical resources such as routers and switches in the network, and together with the front-end server, the simulation master station vertical encryption authentication device, etc., form a simulation environment of the real business network, and support the version verification, hardware testing, security testing, simulation testing, etc. of the plant station vertical encryption authentication device before entering the network. In addition, under the new vertical control specification, through the vertical configuration customization and singulation, the vertical certificate issuance and customized configuration are completed before entering the network, so that the device can be directly used without configuration after entering the network, solve the problems of large workload on the site of the device and easy errors in manual operation, further improve the work efficiency and management level of security devices, adapt to the lean management needs of the State Grid Corporation's production and operation, improve the efficiency and accuracy of on-site work, and reduce the difficulty and configuration cost of device access. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 It is a functional structure diagram of the new measurement and matching platform in the present invention.

[0025] Figure 2 This is a configuration architecture diagram of the new measurement and matching platform in the present invention. DETAILED DESCRIPTION

[0026] In order to make the purpose, technical solution and advantages of the present invention more clear, the technical solution of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0027] The embodiments described in this application are only some embodiments of the present invention, not all embodiments. Based on the spirit of the present invention, other embodiments obtained by ordinary technicians in this field without creative work are all within the protection scope of the present invention.

[0028] The functional structure of the novel test and matching platform disclosed in the present invention is as follows: Figure 1As shown. The measurement and matching platform is synchronously set up with two parts, online and offline. The offline part includes common support modules such as platform function module, platform audit module and data interaction module, configuration center modules such as certificate management module, fixed value configuration module and electronic lead seal and unsealing module, as well as test center modules such as version management module, security test module, simulation test module and log monitoring module. The online part includes platform management modules such as asset management module, user management module, log management module and fixed value management module. The offline part implements the pre-network version verification, security test, simulation test and pre-configuration of the vertical encryption authentication device, and the online part completes the online configuration verification of the existing network to be configured equipment and generates a result report. The above-mentioned measurement and matching platform solves the problems of large workload on site and easy errors in manual operation, further improves work efficiency and management level of security devices, and reduces the difficulty of network access and configuration cost of devices.

[0029] The offline part adopts independent networking, including a test environment and a configuration environment, to perform initial configuration and simulation testing on the vertical encryption authentication device. The configuration environment consists of a configuration distribution server and a database server. Preferably, the test environment is a virtualized operating environment, integrating three virtual servers, two simulation management and control platforms, and two virtual switches.

[0030] The online part performs remote electronic lead sealing and unsealing operations on the plant station vertical encryption authentication device through the data network, and is composed of a control server and a control gateway machine. The control gateway machine is equipped with a vertical encryption card for vertical control. The online part can be merged with the network security management platform function, and the relevant programs are configured without adding hardware equipment. The online part of the measurement and matching platform can be realized on the basis of the network security management platform function.

[0031] The platform management module provides functions such as asset management, device version management, function plug-in management, operation network library management, test case library management, statistical analysis, log management and user management. The platform audit module provides audit information display, audit report generation and export functions for the configuration initialization record, version verification results and equipment detection results of the vertical encryption authentication device. The data interaction module is used to realize data interaction between the test environment and the configuration environment.

[0032] The fixed value configuration module uses the longitudinal automatic initialization technology to automatically send the configuration information contained in the fixed value list to the offline longitudinal encryption authentication device to be tested, and at the same time synchronizes the configuration information to the longitudinal encryption authentication device configured in the online part, thereby achieving the purpose of no manual work and no debugging.

[0033] The configuration center module includes three parts: certificate management, fixed value configuration, and electronic sealing and unsealing. Among them, the certificate management module realizes the interaction with the certificate center, issues, verifies and imports the device certificate in an offline manner, and sends it to the device. The fixed value configuration module is used for the normative review, analysis, import, deletion, and viewing of the device fixed value list, and can send the configuration information to the device, and synchronize it to the online part to automatically add related assets. The electronic sealing and unsealing module remotely electronically seals and unseals the vertical encryption authentication device based on the signature verification technology. In the sealed state, the device can only receive the unsealing message, and the device function returns to normal in the unsealed state.

[0034] The test center module includes four parts: version management, security testing, simulation testing, and log monitoring. Among them, the version management module manages and controls the version information of the vertical encryption authentication device entered into the version library of the test and matching platform, and provides functions such as version registration, entry, and verification. The security testing module performs content audits on the device based on the industrial control vulnerability library, penetration tools, etc. The simulation test module automatically switches switches and routers to simulate the on-site network environment according to the network configuration information of the device to be tested, automatically modifies the configuration of the simulated network security management platform to simulate the on-site main platform, modifies the vertical configuration of the main station to simulate the vertical configuration of the on-site main station, and realizes communication testing, online testing, management and control testing, message filtering testing, performance testing, etc. of the actual configuration of the device to be tested. The log monitoring module receives and parses the syslog log sent by the device to be tested, and then displays it through the platform log monitoring interface.

[0035] Furthermore, the simulation test module uses network virtualization technology to simulate the real environment that needs to be configured for the vertical encryption authentication device to be tested, so as to test and verify its configuration, communication, management, message filtering and other functions before the device is officially connected to the network.

[0036] The asset management module is used to provide operations such as adding, editing, copying, deleting, exporting, fuzzy query, and access status management of devices. The user management module is used to verify the user identity when logging in and grant relevant permissions based on the user role. The log management module is used to record and query the online part's own operations. The log records include relevant information such as the date and time of the event, the user, the event type, whether the event was successful, etc., specifically including four types of logs: asset management, remote operation and maintenance, platform audit, and platform management.

[0037] The fixed value management module is used for normative verification, viewing, importing, deleting, parsing of fixed value lists, and interaction with the fixed value list configuration information of the offline part. It generates a fixed value list based on the configuration of the vertical encryption authentication device, performs online and automatic configuration verification on the vertical encryption authentication device of the online part based on the fixed value list configuration information synchronized by the offline part, and generates a verification result report in the form of a report.

[0038] The vertical automatic initialization technology is based on a new management detection mechanism, which establishes communication with uninitialized vertical encryption authentication devices by means of message broadcasting. At the same time, the configuration information of the vertical encryption authentication device is aggregated to form a vertical setting list. During the initialization process of the vertical encryption authentication device, the measurement and matching platform can automatically send all configuration information to the vertical encryption authentication device through the setting list information, completing the automated, one-click configuration process.

[0039] The network virtualization technology abstracts entities such as routers and switches into virtual resources, and builds a virtual network together with front-end servers, main site vertical encryption authentication devices, etc., to achieve rapid construction and modification, and can maximize the use of hardware resources and break the limitations of physical configuration.

[0040] The vertical encryption authentication device testing and matching platform collects, uploads, issues, verifies and other operations through the device's configuration information according to a setting list in a predefined format, completes the device's pre-network test verification and pre-configuration, as well as automatic verification and configuration after network access.

[0041] In an exemplary embodiment, the specific format design of the configuration setting sheet of the device is shown in Table 1.

[0042]

[0043] Table 1

[0044] The beneficial effect of the present invention is that, compared with the prior art, the present invention provides a test and matching platform for the automated configuration test of the vertical encryption authentication device. In view of the security problems caused by insufficient testing of the vertical encryption authentication device during the on-site configuration process and the lack of automated configuration test technology for the device, the present invention relies on network virtualization technology to abstract and virtualize physical resources such as routers and switches in the network, and together with the front-end server, the simulation master station vertical encryption authentication device, etc., form a simulation environment of the real business network, and support the version verification, hardware testing, security testing, simulation testing, etc. of the plant station vertical encryption authentication device before entering the network. In addition, under the new vertical control specification, through the vertical configuration customization and singulation, the vertical certificate issuance and customized configuration are completed before entering the network, so that the device can be directly used without configuration after entering the network, solve the problems of large workload on the site of the device and easy errors in manual operation, further improve the work efficiency and management level of security devices, adapt to the lean management needs of the State Grid Corporation's production and operation, improve the efficiency and accuracy of on-site work, and reduce the difficulty and configuration cost of device access.

[0045] Based on the spirit of the present invention, those skilled in the art can easily think that a computer program product can be obtained based on the aforementioned test and matching platform for automated configuration and testing of vertical encryption authentication devices. The computer program product may include a computer-readable storage medium on which are loaded computer-readable program instructions for enabling a processor to implement various aspects of the present disclosure. That is, the present application also includes a terminal, including a processor and a storage medium; the storage medium is used to store instructions; the processor is used to operate according to the instructions to implement the aforementioned test and matching platform for automated configuration and testing of vertical encryption authentication devices.

[0046] Computer readable storage medium can be a tangible device that can keep and store the instructions used by the instruction execution device. Computer readable storage medium can be, for example, - but not limited to - electrical storage device, magnetic storage device, optical storage device, electromagnetic storage device, semiconductor storage device or any suitable combination of the above. More specific examples (non-exhaustive list) of computer readable storage medium include: portable computer disk, hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disk read-only memory (CD-ROM), digital versatile disk (DVD), memory stick, floppy disk, mechanical encoding device, for example, punch card or groove protrusion structure with instructions stored thereon and any suitable combination of the above. Computer readable storage medium used here is not interpreted as instantaneous signal itself, such as radio wave or other free propagating electromagnetic wave, electromagnetic wave propagated by waveguide or other transmission medium (for example, light pulse by optical fiber cable) or electrical signal transmitted by wire.

[0047] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0048] The computer program instructions for performing the operation of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages-such as Smalltalk, C++, etc., and conventional procedural programming languages-such as "C" language or similar programming languages. Computer-readable program instructions may be executed completely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or completely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network-including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect via the Internet). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA) may be personalized by utilizing the state information of a computer-readable program instruction, and the electronic circuit may execute a computer-readable program instruction, thereby realizing various aspects of the present disclosure.

[0049] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents, and any modifications or equivalent replacements that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A test and matching platform for automated configuration testing of a vertical encryption authentication device, comprising an offline part and an online part, characterized in that: The offline part implements the pre-network version verification, security test, simulation test and pre-configuration of the vertical encryption authentication device. The offline part adopts an independent network, including a test environment and a configuration environment, and performs initial configuration and simulation test on the vertical encryption authentication device. The configuration environment is composed of a configuration delivery server and a database server; The online part completes the online configuration verification of the equipment to be configured in the existing network and generates a result report; The online part performs remote electronic sealing and unsealing operations on the plant station vertical encryption authentication device through the data network, and is composed of a management and control server and a management and control gateway machine. The management and control gateway machine is equipped with a vertical encryption card for vertical management and control.

2. The test and matching platform for automated configuration and testing of vertical encryption authentication devices according to claim 1, characterized in that: The offline part includes a platform function module, a platform audit module and a data interaction module. The platform management module provides asset management, device version management, function plug-in management, running network library management, test case library management, statistical analysis, log management and user management; the platform audit module provides audit information display, audit report generation and export for the configuration initialization records, version verification results and equipment detection results of the vertical encryption authentication device; the data interaction module is used to realize data interaction between the test environment and the configuration environment.

3. The test and matching platform for automated configuration and testing of vertical encryption authentication devices according to claim 2, characterized in that: The offline part includes a certificate management module, a fixed value configuration module, and an electronic sealing and unsealing module; the certificate management module realizes interaction with the certificate center, issues, verifies and imports the device certificate in an offline manner, and sends it to the device; the fixed value configuration module is used for the normative review, analysis, import, deletion, and viewing of the device fixed value sheet, and sends the configuration information to the device, and synchronizes it to the online part to automatically add related assets; the electronic sealing and unsealing module remotely electronically seals and unseals the vertical encryption authentication device based on the signature verification technology. In the sealed state, the device can only receive the unsealing message, and the device function returns to normal in the unsealed state.

4. The test and matching platform for automated configuration and testing of vertical encryption authentication devices according to claim 3, characterized in that: The offline part includes a version management module, a security testing module, a simulation testing module and a log monitoring module. The version management module manages and controls the version information of the vertical encryption authentication device entered into the version library of the test and matching platform, and provides version registration, entry and verification functions; the security testing module performs content audit on the device based on the industrial control vulnerability library and penetration tools; the simulation testing module automatically switches switches and routers according to the network configuration information of the device to be tested to simulate the on-site network environment, automatically modifies the configuration of the simulated network security management platform to simulate the on-site main platform, modifies the vertical configuration of the main station to simulate the vertical configuration of the on-site main station, and realizes communication testing, online testing, management and control testing, message filtering testing, and performance testing of the actual configuration of the device to be tested; the log monitoring module receives and parses the syslog log sent by the device to be tested, and then displays it through the platform log monitoring interface.

5. The test and matching platform for automated configuration and testing of vertical encryption authentication devices according to claim 4, characterized in that: The online part includes an asset management module, a user management module, and a log management module. The asset management module is used to provide device adding, editing, copying, deleting, exporting, fuzzy query, and access status management operations; The user management module is used to verify the user's identity when logging in and grant relevant permissions according to the user's role; The log management module is used to record and query the online part's own operations. The content of the log record includes the date and time of the event, the user, the event type, and whether the event is successful.

6. The test and matching platform for automated configuration and testing of vertical encryption authentication devices according to claim 5, characterized in that: The simulation test module is further used to utilize network virtualization technology to simulate the real environment that needs to be configured for the vertical encryption authentication device to be tested, so as to test and verify its configuration, communication, management and control, and message filtering functions before the device is officially connected to the network.

7. The test and matching platform for automated configuration and testing of vertical encryption authentication devices according to claim 6, characterized in that: The network virtualization technology is used to abstract routers and switch entities into virtual resources, and build a virtual network together with front-end servers and main station vertical encryption authentication devices.

8. The test and matching platform for automated configuration and testing of vertical encryption authentication devices according to claim 7, characterized in that: The online part includes a fixed value management module, which is used for normative verification, viewing, importing, deleting, parsing of fixed value lists and interacting with the fixed value list configuration information of the offline part. A fixed value list is generated according to the configuration of the vertical encryption authentication device. The vertical encryption authentication device of the online part is verified online and automatically according to the fixed value list configuration information synchronized by the offline part, and a verification result report is generated in the form of a report.

9. A terminal comprising a processor and a storage medium; characterized in that: The storage medium is used to store instructions; The processor is used to operate according to the instructions to implement a testing and matching platform for automated configuration testing of a vertical encryption authentication device according to any one of claims 1-8.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, a testing and matching platform for automated configuration testing of a vertical encryption authentication device according to any one of claims 1 to 8 is implemented.

Images