A test and configuration platform for longitudinal encryption authentication device automatic configuration test

Abstract

A kind of test and configuration platform for longitudinal encryption authentication device automatic configuration test, including offline part and online part, the offline part realizes the version check of longitudinal encryption authentication device before being connected to network, security test, simulation test and pre-configuration, the offline part uses independent networking, contains test environment and configuration environment, initialization configuration and simulation test are carried out to longitudinal encryption authentication device, the configuration environment is composed of configuration issuing server and database server;The online part completes the online configuration check of present network to be configured equipment, and generates result report;The online part carries out remote electronic lead seal and unsealing operation to station longitudinal encryption authentication device by data network, is composed of control server and control gateway machine, and longitudinal control card is configured on control gateway machine and is used for longitudinal control.The scheme of the application reduces the difficulty and configuration cost of device being connected to network.

Description

Technical Field

[0001] This invention belongs to the fields of vertical encryption authentication and power monitoring network security, and specifically relates to a testing and configuration platform for automated configuration testing of vertical encryption authentication devices. Background Technology

[0002] With the State Grid Corporation of China placing greater emphasis on the security of power monitoring systems, network-wide security technologies are continuously improving, and security equipment is being deployed more frequently. This has increased the workload of configuring on-site equipment, leading to a surge in security issues arising from insufficient testing. The current problems mainly stem from the following aspects:

[0003] First, the on-site equipment configuration work is quite demanding. Currently, all vertical equipment configuration work is completed by the equipment manufacturer's personnel traveling to the substations for on-site configuration. Each configuration requires prior coordination of equipment delivery information, scheduling of relevant personnel's travel, and route planning. The actual configuration time for each site is several hours, but the actual time spent includes travel to and from the substations, and many substations are located in remote areas. Therefore, the actual working hours account for a relatively small percentage of the total working hours, indicating room for improvement in work efficiency.

[0004] Secondly, on-site misconfiguration and omissions frequently occur. Because configuration is done manually, some services at newly built sites may not be fully debugged. During on-site configuration by engineers, misconfiguration and omissions can occur. For services not yet in use, any omissions in vertical strategy configuration may not be detected in time, only becoming apparent when the new site is officially launched, thus affecting the on-site launch process and the overall schedule.

[0005] Third, equipment malfunctions upon arrival at the site are frequent. Currently, equipment is not tested in a suitable environment before being used on-site. This means that any problems, whether factory-related or during transportation, will only be discovered after the equipment is powered on at the site. If problems are found during actual on-site use, the only option is to temporarily replace the equipment, extending the work cycle. Summary of the Invention

[0006] To address the shortcomings of existing technologies, this invention provides a testing and configuration platform for automated configuration testing of vertical encryption authentication devices, thereby resolving security issues caused by insufficient testing of vertical encryption authentication devices during on-site configuration and the lack of automated configuration testing technology for such devices.

[0007] To solve the above-mentioned technical problems, the present invention adopts the following technical solution.

[0008] This invention first discloses a testing and configuration platform for automated configuration testing of vertical encryption authentication devices, comprising an offline component and an online component, characterized in that:

[0009] The offline part realizes the pre-network access version verification, security test, simulation test and pre-configuration of the vertical encryption authentication device. The offline part adopts an independent network and includes a test environment and a configuration environment. It performs initialization configuration and simulation test on the vertical encryption authentication device. The configuration environment consists of a configuration distribution server and a database server.

[0010] The online component completes the online configuration verification of the devices to be configured on the existing network and generates a result report; the online component performs remote electronic sealing and unsealing operations on the vertical encryption authentication device of the plant through the data network, and consists of a management server and a management gateway. The management gateway is configured with a vertical encryption card for vertical management.

[0011] The present invention further includes the following preferred embodiments:

[0012] The offline component includes a platform function module, a platform audit module, and a data interaction module. The platform management module provides asset management, device version management, function plugin management, runtime network library management, test case library management, statistical analysis, log management, and user management. The platform audit module provides audit information display, audit report generation, and export for the configuration initialization records, version verification results, and device detection results of the vertical encryption authentication device. The data interaction module is used to realize data interaction between the test environment and the configuration environment.

[0013] The offline component includes a certificate management module, a value configuration module, and an electronic seal and deseal module. The certificate management module interacts with the certificate center, issuing, verifying, and importing device certificates offline, and then distributing them to the device. The value configuration module is used for the standardization review, parsing, importing, deleting, and viewing of device value sheets, distributing configuration information to the device, and synchronizing with the online component for automatic addition of relevant assets. The electronic seal and deseal module performs remote electronic sealing and desealing of the vertical encryption authentication device based on signature verification technology. In the sealed state, the device can only receive deseal messages; in the deseal state, the device's functions return to normal.

[0014] The offline component includes a version management module, a security testing module, a simulation testing module, and a log monitoring module. The version management module manages the version information of the vertical encryption authentication device entered into the test and configuration platform's version library, providing version registration, entry, and verification functions. The security testing module performs content auditing on the device based on an industrial control vulnerability database and penetration testing tools. The simulation testing module automatically switches switches and routers to simulate the on-site network environment based on the network configuration information of the device under test, automatically modifies the configuration of the simulated network security management platform to simulate the on-site main platform, and modifies the vertical configuration of the main station to simulate the vertical configuration of the on-site main station, thereby realizing communication testing, online testing, control testing, packet filtering testing, and performance testing of the device under test with the actual configuration. The log monitoring module receives and parses the syslog logs sent by the device under test, and then displays them through the platform's log monitoring interface.

[0015] The online component includes an asset management module, a user management module, and a log management module. The asset management module provides operations such as adding, editing, copying, deleting, exporting, fuzzy querying, and managing access status of devices. The user management module verifies user identity upon login and assigns relevant permissions based on user roles. The log management module records and queries the online component's own operations, and the log records include the date and time of the event, the user, the event type, and whether the event was successful.

[0016] The simulation testing module is further used to simulate the real environment required for the vertical encryption authentication device under test by utilizing network virtualization technology, so as to test and verify its configuration, communication, control and message filtering functions before the device is officially connected to the network.

[0017] The network virtualization technology is used to abstract routers and switches into virtual resources, and together with front-end servers and main station vertical encryption and authentication devices, to build a virtual network.

[0018] The online component includes a value management module, which is used for the standardization verification, viewing, importing, deleting, and parsing of value sheets, as well as interacting with the value sheet configuration information of the offline component. It generates value sheets based on the configuration of the vertical encryption authentication device, performs online and automated configuration verification of the vertical encryption authentication device in the online component based on the value sheet configuration information synchronized with the offline component, and generates a verification result report in the form of a report.

[0019] Accordingly, this application also discloses a terminal, including a processor and a storage medium;

[0020] The storage medium is used to store instructions;

[0021] The processor is used to operate according to the instructions to implement the aforementioned test platform for automated configuration testing of longitudinal encryption authentication devices.

[0022] Accordingly, this application also discloses a computer-readable storage medium storing a computer program that, when executed by a processor, implements the aforementioned test platform for automated configuration testing of a longitudinal encryption authentication device.

[0023] The beneficial effects of this invention are as follows: Compared with the prior art, this invention provides a testing and configuration platform for automated configuration testing of vertical encryption authentication devices. Addressing issues such as insufficient testing of vertical encryption authentication devices during on-site configuration leading to security problems and the lack of automated configuration testing technology, this invention relies on network virtualization technology to abstract and virtualize physical resources such as routers and switches in the network. Together with a front-end server and a simulated master station vertical encryption authentication device, it forms a simulation environment of a real business network, supporting version verification, hardware testing, security testing, and simulation testing of vertical encryption authentication devices before they are put into service at the plant. Furthermore, under the new vertical control specifications, through customized vertical configuration, vertical certificate issuance and customized configuration are completed before network access, enabling devices to be used directly without configuration after network access. This solves problems such as high workload on-site and errors in manual operation, further improving work efficiency and the management level of security devices, adapting to the lean management needs of the State Grid Corporation's production operations, improving on-site work efficiency and accuracy, and reducing the difficulty and configuration cost of device network access. Attached Figure Description

[0024] Figure 1 This is a functional structure diagram of the novel testing and matching platform in this invention.

[0025] Figure 2 This is a configuration architecture diagram of the novel testing and matching platform in this invention. Detailed Implementation

[0026] To make the objectives, technical solutions, and advantages of the present invention clearer, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention.

[0027] The embodiments described in this application are merely some, not all, embodiments of the present invention. Based on the spirit of the present invention, other embodiments obtained by those skilled in the art without inventive effort are all within the protection scope of the present invention.

[0028] The novel testing and matching platform functional structure disclosed in this invention is as follows: Figure 1As shown, the testing and configuration platform is configured with both online and offline components. The offline component includes general support modules such as platform function modules, platform audit modules, and data interaction modules; configuration center modules such as certificate management modules, value configuration modules, and electronic seal and unsealing modules; and test center modules such as version management modules, security testing modules, simulation testing modules, and log monitoring modules. The online component includes platform management modules such as asset management modules, user management modules, and log management modules, as well as a value management module. The offline component performs pre-network access version verification, security testing, simulation testing, and pre-configuration for the vertical encryption authentication device. The online component completes online configuration verification of the devices to be configured in the existing network and generates a result report. This testing and configuration platform solves the problems of high workload at the device site and error-prone manual operation, further improving work efficiency and the management level of security devices, and reducing the difficulty and configuration cost of device network access.

[0029] The offline portion employs an independent network, comprising a test environment and a configuration environment, for initializing, configuring, and simulating the vertical encryption authentication device. The configuration environment consists of a configuration distribution server and a database server. Preferably, the test environment is a virtualized runtime environment, integrating three virtual servers, two sets of simulation management platforms, and two virtual switches.

[0030] The online component remotely performs electronic sealing and desealing operations on the plant's vertical encryption authentication device via a data network. It consists of a control server and a control gateway, with the gateway configured with a vertical encryption card for vertical control. This online component can be integrated with the network security management platform, configuring relevant programs without adding hardware, and implementing the online functions of the testing and configuration platform based on the network security management platform's functionality.

[0031] The platform management module provides functions such as asset management, device version management, functional plugin management, runtime network library management, test case library management, statistical analysis, log management, and user management. The platform audit module provides audit information display, audit report generation, and export functions for the configuration initialization records, version verification results, and device testing results of the vertical encryption authentication device. The data interaction module is used to realize data interaction between the test environment and the configuration environment.

[0032] The setpoint configuration module utilizes vertical automatic initialization technology to automatically send the configuration information contained in the setpoint sheet to the offline vertical encryption authentication device to be tested, and simultaneously synchronizes the configuration information to the online vertical encryption authentication device, thereby achieving the purpose of eliminating manual intervention and debugging.

[0033] The configuration center module comprises three parts: certificate management, value configuration, and electronic seal and deseal. The certificate management module interacts with the certificate center, issuing, verifying, and importing device certificates offline, and then distributing them to the device. The value configuration module is used for the standardization review, parsing, importing, deleting, and viewing of device value sheets, and can also distribute configuration information to the device and synchronize it with the online system for automatic addition of relevant assets. The electronic seal and deseal module uses signature verification technology to remotely electronically seal and deseal the vertical encryption authentication device. While sealed, the device can only receive deseal messages; once desealable, the device's functions return to normal.

[0034] The testing center module comprises four parts: version management, security testing, simulation testing, and log monitoring. The version management module controls the version information of the vertical encryption authentication device entered into the testing platform's version repository, providing functions such as version registration, entry, and verification. The security testing module performs content auditing on the device based on industrial control vulnerability databases and penetration testing tools. The simulation testing module automatically switches switches and routers to simulate the on-site network environment based on the network configuration information of the device under test, automatically modifies the configuration of the simulated network security management platform to simulate the on-site main platform, and modifies the main station's vertical configuration to simulate the on-site main station's vertical configuration, realizing communication testing, online testing, control testing, packet filtering testing, and performance testing of the device under test with the actual configuration. The log monitoring module receives and parses the syslog logs sent by the device under test, and then displays them through the platform's log monitoring interface.

[0035] Furthermore, the simulation test module utilizes network virtualization technology to simulate the real environment required for the configuration of the vertical encryption authentication device under test, thereby testing and verifying its configuration, communication, control, message filtering and other functions before the device is officially connected to the network.

[0036] The asset management module provides operations such as adding, editing, copying, deleting, exporting, fuzzy searching, and managing access status for devices. The user management module verifies user identity upon login and assigns relevant permissions based on user roles. The log management module records and queries its own online operations. Log entries include the date and time of the event, the user, the event type, and whether the event was successful. Specifically, logs are categorized into four types: asset management, remote maintenance, platform auditing, and platform management.

[0037] The value management module is used for the standardization verification, viewing, importing, deleting, parsing of value sheets, and interaction with the configuration information of value sheets in the offline part. It generates value sheets based on the configuration of the vertical encryption authentication device, performs online and automated configuration verification of the vertical encryption authentication device in the online part based on the configuration information of the value sheets synchronized in the offline part, and generates a verification result report in the form of a report.

[0038] The described vertical automatic initialization technology is based on a novel management detection mechanism, which establishes communication with the uninitialized vertical encryption authentication device through message broadcasting. Simultaneously, it aggregates the configuration information of the vertical encryption authentication device to form a vertical setting sheet. During the initialization process of the vertical encryption authentication device, the testing and configuration platform can automatically send all configuration information to the vertical encryption authentication device through the setting sheet information, completing an automated, one-click configuration process.

[0039] The network virtualization technology abstracts physical entities such as routers and switches into virtual resources, and together with front-end servers, main station vertical encryption and authentication devices, etc., constructs a virtual network, enabling rapid construction and modification, maximizing the utilization of hardware resources, and breaking through physical configuration limitations.

[0040] The vertical encryption authentication device testing and configuration platform collects, uploads, distributes, and verifies the device's configuration information based on a predefined format setting sheet, completing the device's pre-network access testing and verification and pre-configuration, as well as automatic verification and configuration after network access.

[0041] In an exemplary embodiment, the specific format design of the device configuration setting sheet is shown in Table 1.

[0042]

[0043] Table 1

[0044] The beneficial effects of this invention are as follows: Compared with the prior art, this invention provides a testing and configuration platform for automated configuration testing of vertical encryption authentication devices. Addressing issues such as insufficient testing of vertical encryption authentication devices during on-site configuration leading to security problems and the lack of automated configuration testing technology, this invention relies on network virtualization technology to abstract and virtualize physical resources such as routers and switches in the network. Together with a front-end server and a simulated master station vertical encryption authentication device, it forms a simulation environment of a real business network, supporting version verification, hardware testing, security testing, and simulation testing of vertical encryption authentication devices before they are put into service at the plant. Furthermore, under the new vertical control specifications, through customized vertical configuration, vertical certificate issuance and customized configuration are completed before network access, enabling devices to be used directly without configuration after network access. This solves problems such as high workload on-site and errors in manual operation, further improving work efficiency and the management level of security devices, adapting to the lean management needs of the State Grid Corporation's production operations, improving on-site work efficiency and accuracy, and reducing the difficulty and configuration cost of device network access.

[0045] Based on the spirit of this invention, those skilled in the art will readily conceive of a computer program product based on the aforementioned testing and configuration platform for automated configuration testing of vertical encryption authentication devices. The computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for causing a processor to implement various aspects of this disclosure. That is, this application also includes a terminal comprising a processor and a storage medium; the storage medium is used to store instructions; the processor is used to operate according to the instructions to implement the aforementioned testing and configuration platform for automated configuration testing of vertical encryption authentication devices.

[0046] Computer-readable storage media can be tangible devices capable of holding and storing instructions for use by an instruction execution device. Computer-readable storage media can be, for example, but not limited to, electrical storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of computer-readable storage media include: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disc read-only memory (CD-ROM), digital multifunction disc (DVD), memory sticks, floppy disks, mechanical encoding devices, such as punch cards or recessed protrusions storing instructions thereon, and any suitable combination of the foregoing. The computer-readable storage media used herein are not to be construed as transient signals themselves, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (e.g., light pulses through fiber optic cables), or electrical signals transmitted through wires.

[0047] The computer-readable program instructions described herein can be downloaded from computer-readable storage media to various computing / processing devices, or downloaded via a network, such as the Internet, local area network, wide area network, and / or wireless network, to an external computer or external storage device. The network may include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards them to the computer-readable storage media in the respective computing / processing device.

[0048] Computer program instructions used to perform the operations of this disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, status setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk, C++, etc., and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The computer-readable program instructions may execute entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, electronic circuitry, such as programmable logic circuitry, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), is personalized by utilizing the status information of the computer-readable program instructions to implement various aspects of this disclosure.

[0049] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the protection scope of the claims of the present invention.

Claims

1. A testing and configuration platform for automated configuration testing of vertical encryption authentication devices, comprising an offline component and an online component, characterized in that: The offline part realizes the pre-network access version verification, security test, simulation test and pre-configuration of the vertical encryption authentication device. The offline part adopts an independent network and includes a test environment and a configuration environment. It performs initialization configuration and simulation test on the vertical encryption authentication device. The configuration environment consists of a configuration distribution server and a database server. The online component completes the online configuration verification of the devices to be configured on the existing network and generates a result report; The online component remotely performs electronic sealing and desealing operations on the plant's vertical encryption authentication device via a data network. It consists of a control server and a control gateway, with a vertical encryption card configured on the control gateway for vertical control. The offline component includes a platform function module, a platform audit module, and a data interaction module. The platform management module provides asset management, device version management, function plugin management, runtime network library management, test case library management, statistical analysis, log management, and user management. The platform audit module provides audit information display, audit report generation, and export for the configuration initialization records, version verification results, and device detection results of the vertical encryption authentication device. The data interaction module is used to realize data interaction between the test environment and the configuration environment. The offline component includes a certificate management module, a value configuration module, and an electronic seal and deseal module. The certificate management module interacts with the certificate center, issuing, verifying, and importing device certificates offline, and then distributing them to the device. The value configuration module is used for the standardization review, parsing, importing, deleting, and viewing of device value sheets, distributing configuration information to the device, and synchronizing with the online component for automatic addition of relevant assets. The electronic seal and deseal module performs remote electronic sealing and desealing of the vertical encryption authentication device based on signature verification technology. In the sealed state, the device can only receive deseal messages; in the deseal state, the device's functions return to normal.

2. The testing and configuration platform for automated configuration testing of vertical encryption authentication devices according to claim 1, characterized in that, The offline component includes a version management module, a security testing module, a simulation testing module, and a log monitoring module. The version management module manages the version information of the vertical encryption authentication device entered into the test and configuration platform's version library, providing version registration, entry, and verification functions. The security testing module performs content auditing on the device based on an industrial control vulnerability database and penetration testing tools. The simulation testing module automatically switches switches and routers to simulate the on-site network environment based on the network configuration information of the device under test, automatically modifies the configuration of the simulated network security management platform to simulate the on-site main platform, and modifies the vertical configuration of the main station to simulate the vertical configuration of the on-site main station, thereby realizing communication testing, online testing, control testing, packet filtering testing, and performance testing of the device under test with the actual configuration. The log monitoring module receives and parses the syslog logs sent by the device under test, and then displays them through the platform's log monitoring interface.

3. The testing and configuration platform for automated configuration testing of vertical encryption authentication devices according to claim 2, characterized in that, The online component includes an asset management module, a user management module, and a log management module. The asset management module is used to provide operations such as adding, editing, copying, deleting, exporting, fuzzy querying, and access status management of devices. The user management module is used to verify the user's identity during login and to grant relevant permissions according to the user's role; The log management module is used to record and query the online part's own operations. The log records include the date and time of the event, the user, the event type, and whether the event was successful.

4. The testing and configuration platform for automated configuration testing of vertical encryption authentication devices according to claim 3, characterized in that, The simulation testing module is further used to simulate the real environment required for the vertical encryption authentication device under test by utilizing network virtualization technology, so as to test and verify its configuration, communication, control and message filtering functions before the device is officially connected to the network.

5. The testing and configuration platform for automated configuration testing of vertical encryption authentication devices according to claim 4, characterized in that, The network virtualization technology is used to abstract routers and switches into virtual resources, and together with front-end servers and main station vertical encryption and authentication devices, to build a virtual network.

6. The testing and configuration platform for automated configuration testing of a vertical encryption authentication device according to claim 5, characterized in that, The online component includes a value management module, which is used for the standardization verification, viewing, importing, deleting, and parsing of value sheets, as well as interacting with the value sheet configuration information of the offline component. It generates value sheets based on the configuration of the vertical encryption authentication device, performs online and automated configuration verification of the vertical encryption authentication device in the online component based on the value sheet configuration information synchronized with the offline component, and generates a verification result report in the form of a report.

7. A terminal, comprising a processor and a storage medium; characterized in that: The storage medium is used to store instructions; The processor is configured to operate according to the instructions to implement the test platform for automated configuration testing of a longitudinal encryption authentication device according to any one of claims 1-6.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by the processor, the program implements the test platform for automated configuration testing of longitudinal encryption authentication devices as described in any one of claims 1-6.

Images