Switch network security rapid configuration method and device

Abstract

The invention discloses a switch network security rapid configuration method and device, and the method comprises the steps: obtaining the configuration demands of the network security of a to-be-configured switch, and carrying out the configuration of the network security of the to-be-configured switch through employing different configuration strategies according to different configuration demands, comprising the following steps: when a configuration requirement is an existing configuration packet of switch network security configuration software, selecting the needed existing configuration packet to realize configuration; when the configuration requirement is the combination of the existing configuration packet and the existing additional item of the switch network security configuration software, the needed existing configuration packet and additional item are selected to realize configuration; when the configuration requirement is that the switch network security configuration software has the additional item combination, the required additional item is selected to realize configuration; and when the configuration requirement is that the switch network security configuration software has an unestablished configuration item, establishing a new configuration item and performing configuration. The method combines the advantages of command line configuration and web version configuration, and is suitable for nuclear power plant instrument control system switch network security configuration.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to a method and device for rapid configuration of switch network security, which are applied to the network security configuration of a switch in an instrumentation and control system of a nuclear power plant. Background Art

[0002] With the promulgation and implementation of laws and regulations such as the Cybersecurity Law and the Regulations on Security Protection of Critical Information Infrastructure Equipment, the country has paid more and more attention to the cybersecurity risks of critical infrastructure such as nuclear facilities. In the nuclear safety guideline HAD 102 / 10-2021, cybersecurity activities are clearly guided as an important part of the life cycle of nuclear instrumentation and control systems. As a common tool for data exchange in nuclear power plant instrumentation and control systems, the network security configuration of switches directly affects the safety and reliability of nuclear power plants.

[0003] Currently, there are two main methods for switch network security configuration: one is to configure through the command line in the switch configuration software, and the other is to configure through the web version configuration platform. The command line configuration method is more complicated. The more convenient method is to configure network security requirements through the web version configuration platform. However, the premise of web version configuration is to enable the switch HTTP service protocol login function. During the on-site operation of the nuclear power instrumentation and control system, in order to ensure the reliability of network security, generally only the console port login function is retained. Therefore, although the switch web version configuration method is convenient, it is limited in the actual operation of the nuclear power plant instrumentation and control system.

[0004] In view of this, this application is hereby filed. Summary of the invention

[0005] The technical problem to be solved by the present invention is that the command line configuration method in the existing switch network security configuration method is relatively complicated, and the premise of the web version configuration method is the switch HTTP service protocol login function that has been enabled. However, during the on-site operation of the nuclear power instrumentation and control system, in order to ensure the reliability of network security, generally only the console port login function is retained; therefore, this method is limited in the actual operation of the nuclear power plant instrumentation and control system. The purpose of the present invention is to provide a switch network security fast configuration method and device. In order to improve the convenience and safety of the switch network security configuration, the method only uses the switch console port as an available login service. It can be run independently and can also be embedded in the upper computer and other system application software as a toolkit to realize the switch network security demand configuration, hierarchical configuration and other functions. It combines the advantages of command line configuration and web version configuration, and is suitable for the network security configuration of the switch of the nuclear power plant instrumentation and control system.

[0006] The present invention is achieved through the following technical solutions:

[0007] In a first aspect, the present invention provides a method for fast configuration of network security of a switch, the method comprising:

[0008] Obtaining the configuration requirements of the network security of the switch to be configured, the configuration requirements including the existing configuration package of the network security configuration software of the switch, the combination of the existing configuration package and the existing additional items of the network security configuration software of the switch, the combination of the existing additional items of the network security configuration software of the switch, and the unbuilt configuration items of the network security configuration software of the switch;

[0009] According to different configuration requirements, different configuration strategies are used to configure the network security of the switch to be matched, including:

[0010] When the configuration requirement is that the switch network security configuration software already has a configuration package, the required existing configuration package is selected to implement the configuration; when the configuration requirement is that the switch network security configuration software already has a configuration package and an existing additional item combination, the required existing configuration package and additional item are selected to implement the configuration; when the configuration requirement is that the switch network security configuration software already has an additional item combination, the required additional item is selected to implement the configuration; when the configuration requirement is that the switch network security configuration software has an uncreated configuration item, a new configuration item is created and configured.

[0011] Furthermore, when the configuration requirement is that the switch network security configuration software already has a configuration package, the required existing configuration package is selected to implement the configuration, including:

[0012] Connect the console port of the switch to be configured to the computer, and obtain the configuration package type based on the main interface of the switch network security configuration software installed on the computer;

[0013] According to the type of configuration package obtained, load the configuration package and perform network security configuration on the switch;

[0014] After the configuration is completed, all configuration items are verified one by one, and the verification results are displayed one by one in the information display box of the main interface of the switch network security configuration software; all configuration items are verified one by one, including whether the network communication is successful and whether the access control complies with the specified ACL rules;

[0015] If the verification result is that all configuration items have passed the verification, the configuration is successful and the configuration operation is completed.

[0016] Furthermore, configuration package types include S1 level configuration package, S2 level configuration package, S3 level configuration package, non-safety level configuration package and other project requirement configuration packages.

[0017] S1-level configuration package refers to the combination of configuration items of switches for S1-level network security systems; S2-level configuration package refers to the combination of configuration items of switches for S2-level network security systems; S3-level configuration package refers to the combination of configuration items of switches for S2-level network security systems; non-security-level configuration package refers to the combination of configuration items of switches for non-security-level systems; other project requirement configuration packages refer to the combination of configuration items of switches for systems other than the above four cases.

[0018] Furthermore, when the configuration requirement is a combination of an existing configuration package and an existing additional item of the switch network security configuration software, the required existing configuration package and additional item are selected to implement the configuration, including:

[0019] Connect the console port of the switch to be configured to the computer, and obtain the configuration package type based on the main interface of the switch network security configuration software installed on the computer;

[0020] According to the type of configuration package obtained, load the configuration package and perform network security configuration on the switch;

[0021] Obtain additional items and configure them; additional items refer to configuration items that exceed the configuration package when a certain configuration package cannot fully meet the configuration content required by the system switch;

[0022] After the configuration package and additional items are configured, all configuration items and additional items are verified one by one, and the verification results are displayed one by one in the information display box of the main interface of the switch network security configuration software;

[0023] If the verification result is that all configuration items and additional items have passed the verification, the configuration is successful and the configuration operation is completed.

[0024] Furthermore, when the configuration requirement is that the switch network security configuration software already has a combination of additional items, the required additional items are selected to implement the configuration, including:

[0025] Connect the console port of the switch to be configured to the computer, and obtain additional items based on the main interface of the switch network security configuration software installed on the computer;

[0026] Configure additional items; additional items refer to configuration items that exceed the configuration package when a certain configuration package cannot fully meet the configuration content required by the system switch;

[0027] After the additional items are configured, all additional items are verified one by one, and the verification results are displayed one by one in the information display box of the main interface of the switch network security configuration software;

[0028] If the verification result is that all additional items have passed the verification, the configuration is successful and the configuration operation is completed.

[0029] Furthermore, when the configuration requirement is that the switch network security configuration software has uncreated configuration items, a new configuration item is created and configured, including:

[0030] Pre-configure the new configuration items in the secureCRT software of the switch, and confirm that the configuration command lines and verification command lines of the new configuration items are configured and verified successfully in the secureCRT software;

[0031] Connect the console port of the switch to be configured to the computer, and obtain the configuration package type based on the main interface of the switch network security configuration software installed on the computer;

[0032] According to the type of configuration package obtained, load the configuration package and perform network security configuration on the switch;

[0033] Enter the new configuration item through the additional item configuration. The new configuration item includes: enter the configuration item name in the new configuration item name, enter the configuration command line that is successfully configured in the secureCRT software into the new configuration command line, and enter the verification command line that is successfully configured in the secureCRT software into the new verification command line;

[0034] When saving a new configuration item, the new configuration item is compared with all existing configuration items. If the configuration policy of the pre-saved new configuration item is the same as that of an existing configuration item, it will prompt that the newly created configuration item already exists and display the configuration item name; otherwise, it will prompt that the newly created configuration item is saved successfully.

[0035] After the new configuration item is created successfully, configure it according to the network security configuration requirements of the switch to be configured.

[0036] Furthermore, when multiple switches need to be configured with a new solution, this is achieved by creating a new configuration package, specifically:

[0037] When the new configuration scheme has been configured in the switch and verified successfully, the configuration status of the switch is displayed in the information display box by viewing the switch configuration status; the configuration status of the switch refers to the new configuration scheme;

[0038] Based on the new configuration scheme, create a new configuration package and save it; creating a new configuration includes: entering a custom configuration package name in the new configuration package name field;

[0039] Compare the configuration items of the new configuration package with those of all existing configuration packages. If the configuration policy of the new configuration package is the same as that of an existing configuration package, a prompt message will be displayed indicating that the new configuration package already exists and the configuration package name will be displayed; otherwise, a prompt message will be displayed indicating that the new configuration package has been saved successfully and the new configuration package will be added to the configuration package list.

[0040] Furthermore, the method further comprises:

[0041] View and / or delete existing configuration packages and configuration items of the switch network security configuration software, and view and / or delete existing switch configurations.

[0042] In a second aspect, the present invention further provides a switch network security rapid configuration device, the device comprising a computer, a switch and a communication cable, the computer being connected to the switch via the communication cable;

[0043] The computer is installed with switch network security configuration software that can implement the above-mentioned switch network security rapid configuration method.

[0044] Furthermore, the switch network security configuration software can be run independently or as a toolkit embedded in the system application software.

[0045] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0046] 1. The present invention provides a method and device for fast configuration of switch network security. The present invention can realize fast configuration of switches with the same configuration strategy; it can create new configuration schemes for different configuration requirements, and quickly select configuration combinations that meet the requirements from the existing configuration strategies to realize switch network security configuration; it also has the functions of viewing the detailed configuration status of the switch network security configuration, deleting the configuration, etc. It provides a reliable, convenient and efficient configuration method for the network security configuration of switches in the instrumentation and control system of nuclear power plants.

[0047] 2. The present invention provides a method and device for rapid configuration of switch network security. The method uses only the switch console port as an available login service. The method can run independently or be embedded as a toolkit in system application software such as a host computer to realize functions such as switch network security demand configuration and hierarchical configuration. It combines the advantages of command line configuration and web version configuration and is suitable for network security configuration of switches in nuclear power plant instrumentation and control systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] The drawings described herein are used to provide a further understanding of the embodiments of the present invention, constitute a part of this application, and do not constitute a limitation of the embodiments of the present invention. In the drawings:

[0049] Figure 1 A flow chart of a method for rapid configuration of switch network security according to the present invention;

[0050] Figure 2 The configuration package configuration flow chart of the present invention;

[0051] Figure 3 It is a combined configuration flow chart of the existing configuration package + existing additional items of the present invention;

[0052] Figure 4Configure a flow chart for the additional items of the present invention;

[0053] Figure 5 Create a new configuration package flow chart for the present invention;

[0054] Figure 6 Create a new configuration item flow chart for the present invention;

[0055] Figure 7 View the flow chart for the configuration status of the configuration package of the present invention;

[0056] Figure 8 Flowchart for deleting software configuration package of the present invention;

[0057] Fig. 9 A flowchart for viewing and deleting software configuration items of the present invention;

[0058] Fig.10 A flow chart for checking the configuration status of the switch of the present invention;

[0059] Fig.11 Delete the switch configuration flow chart for the present invention;

[0060] Fig.12 This is a diagram of the main interface of the network security configuration of the switch of the present invention;

[0061] Fig.13 A schematic diagram of a drop-down list for selecting a configuration package of the present invention;

[0062] Fig.14 This is a schematic diagram of the port configuration dialog box of the present invention;

[0063] Fig.15 Configure the interface diagram for the additional items of the present invention;

[0064] Fig.16 Create a new configuration item interface diagram for the present invention;

[0065] Fig.17 A confirmation pop-up box is displayed for the configuration status of the present invention;

[0066] Fig.18 Create a new configuration package interface diagram for the present invention;

[0067] Fig.19 The present invention has a configuration to delete the confirmation pop-up box;

[0068] Fig. 20 This is a structural block diagram of a switch network security rapid configuration device of the present invention. DETAILED DESCRIPTION

[0069] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with embodiments and drawings. The exemplary embodiments of the present invention and their description are only used to explain the present invention and are not intended to limit the present invention.

[0070] The command line configuration method is relatively complicated in the existing switch network security configuration method, and the web version configuration method is based on the premise that the switch HTTP service protocol login function is enabled. However, during the on-site operation of the nuclear power instrumentation and control system, in order to ensure the reliability of network security, generally only the console port login function is retained; therefore, this method is limited in the actual operation of the nuclear power plant instrumentation and control system.

[0071] Therefore, the present invention designs a method for quickly configuring the network security of a switch. By connecting a computer to a switch, and only using the console port of the switch as an available login service, the network security configuration of the switch with the same security level can be quickly configured in the form of a command line. The network security configuration of switches with different security levels can be configured in a hierarchical manner, and the switch with additional network security configuration item requirements can enter the design mode to perform additional requirement configuration.

[0072] like Figure 1 As shown, Figure 1 This is a flowchart of a method for fast configuration of switch network security. First, a basic configuration package is set for different security levels; Fig.13 As shown, the present invention sets up safety level 1-safety level 3 configuration packages (i.e., safety level 1 configuration package-S1 level configuration package, safety level 2 configuration package-S2 level configuration package, safety level 3 configuration package-S3 level configuration package), NC level configuration package (i.e., non-safety level configuration package) and XX project configuration package (i.e., special project requirement configuration package, other project requirement configuration package).

[0073] S1-level configuration package refers to the combination of configuration items of switches for S1-level network security systems; S2-level configuration package refers to the combination of configuration items of switches for S2-level network security systems; S3-level configuration package refers to the combination of configuration items of switches for S2-level network security systems; non-security-level configuration package refers to the combination of configuration items of switches for non-security-level systems; other project requirement configuration packages refer to the combination of configuration items of switches for systems other than the above four cases.

[0074] The present invention can realize fast configuration of switches with the same configuration strategy; it can create new configuration schemes for different configuration requirements, and quickly select configuration combinations that meet the requirements from the existing configuration strategies to realize switch network security configuration; it also has the functions of viewing the detailed network configuration status of the switch, deleting the configuration, etc. It provides a reliable, convenient and efficient configuration method for the network security configuration of switches in the instrumentation and control system of nuclear power plants.

[0075] Example 1

[0076] like Figure 1 As shown, the present invention provides a method for quickly configuring a switch network security, the method comprising:

[0077] Obtain the configuration requirements of the network security of the switch to be configured, including the existing configuration package of the switch network security configuration software, the combination of the existing configuration package and the existing additional items of the switch network security configuration software, the combination of the existing additional items of the switch network security configuration software, and the unbuilt configuration items of the switch network security configuration software;

[0078] According to different configuration requirements, different configuration strategies are used to configure the network security of the switch to be matched, including:

[0079] When the configuration requirement is that the switch network security configuration software already has a configuration package, select the required existing configuration package to implement the configuration; when the configuration requirement is that the switch network security configuration software already has a configuration package + an existing additional item combination, select the required existing configuration package and additional items to implement the configuration; when the configuration requirement is that the switch network security configuration software already has an additional item combination, select the required additional item to implement the configuration; when the configuration requirement is that the switch network security configuration software has an uncreated configuration item, create a new configuration item and configure it.

[0080] As a further implementation, when the configuration requirement is that the switch network security configuration software has an existing configuration package, the required existing configuration package is selected to implement the configuration, including:

[0081] Connect the console port of the switch to be configured to the computer, and obtain the configuration package type based on the main interface of the switch network security configuration software installed on the computer;

[0082] According to the type of configuration package obtained, load the configuration package and perform network security configuration on the switch;

[0083] After the configuration is completed, all configuration items are verified one by one, and the verification results are displayed one by one in the information display box of the main interface of the switch network security configuration software; all configuration items are verified one by one, including whether the network communication is successful and whether the access control complies with the specified ACL rules;

[0084] If the verification result is that all configuration items have passed the verification, the configuration is successful and the configuration operation is completed.

[0085] Among them, configuration items refer to the configuration content implemented on the switch to meet network security requirements, such as login user password configuration, password complexity requirement configuration, and power separation configuration.

[0086] As a further implementation, when the configuration requirement is a combination of an existing configuration package and an existing additional item of the switch network security configuration software, the required existing configuration package and additional item are selected to implement the configuration, including:

[0087] Connect the console port of the switch to be configured to the computer, and obtain the configuration package type based on the main interface of the switch network security configuration software installed on the computer;

[0088] According to the type of configuration package obtained, load the configuration package and perform network security configuration on the switch;

[0089] Get additional items and configure them; additional items refer to configuration items that exceed the configuration package when a certain configuration package cannot fully meet the configuration content required by the system switch; such as QOS configuration, etc.

[0090] After the configuration package and additional items are configured, all configuration items and additional items are verified one by one, and the verification results are displayed one by one in the information display box of the main interface of the switch network security configuration software;

[0091] If the verification result is that all configuration items and additional items have passed the verification, the configuration is successful and the configuration operation is completed.

[0092] As a further implementation, when the configuration requirement is that the switch network security configuration software already has a combination of additional items, the required additional items are selected to implement the configuration, including:

[0093] Connect the console port of the switch to be configured to the computer, and obtain additional items based on the main interface of the switch network security configuration software installed on the computer;

[0094] Configure additional items; additional items refer to configuration items beyond the configuration package when a certain configuration package cannot fully meet the configuration content required by the system switch; such as QOS configuration, etc.

[0095] After the additional items are configured, all additional items are verified one by one, and the verification results are displayed one by one in the information display box of the main interface of the switch network security configuration software;

[0096] If the verification result is that all additional items have passed the verification, the configuration is successful and the configuration operation is completed.

[0097] As a further implementation, when the configuration requirement is that there are no configuration items in the switch network security configuration software, a new configuration item is created and configured, including:

[0098] Pre-configure the new configuration items in the secureCRT software of the switch, and confirm that the configuration command lines and verification command lines of the new configuration items are configured and verified successfully in the secureCRT software;

[0099] Connect the console port of the switch to be configured to the computer, and obtain the configuration package type based on the main interface of the switch network security configuration software installed on the computer;

[0100] According to the type of configuration package obtained, load the configuration package and perform network security configuration on the switch;

[0101] Enter the new configuration item through the additional item configuration. The new configuration item includes: enter the configuration item name in the new configuration item name, enter the configuration command line that is successfully configured in the secureCRT software into the new configuration command line, and enter the verification command line that is successfully configured in the secureCRT software into the new verification command line;

[0102] When saving a new configuration item, the new configuration item is compared with all existing configuration items. If the configuration policy of the pre-saved new configuration item is the same as that of an existing configuration item, it will prompt that the newly created configuration item already exists and display the configuration item name; otherwise, it will prompt that the newly created configuration item is saved successfully.

[0103] After the new configuration item is created successfully, configure it according to the network security configuration requirements of the switch to be configured.

[0104] As a further implementation, when multiple switches need to be configured with a new solution, it is implemented by creating a new configuration package, specifically:

[0105] When the new configuration scheme has been configured in the switch and verified successfully, the configuration status of the switch is displayed in the information display box by viewing the switch configuration status; the configuration status of the switch refers to the new configuration scheme;

[0106] Based on the new configuration scheme, create a new configuration package and save it; creating a new configuration includes: entering a custom configuration package name in the new configuration package name field;

[0107] Compare the configuration items of the new configuration package with those of all existing configuration packages. If the configuration policy of the new configuration package is the same as that of an existing configuration package, a prompt message will be displayed indicating that the new configuration package already exists and the configuration package name will be displayed; otherwise, a prompt message will be displayed indicating that the new configuration package has been saved successfully and the new configuration package will be added to the configuration package list.

[0108] As a further implementation, the method further includes:

[0109] View and / or delete existing configuration packages and configuration items of the switch network security configuration software, and view and / or delete existing switch configurations.

[0110] In specific implementation, the present invention is developed and implemented based on LabVIEW. The method is used for configuring the network security requirements of a switch. The following specifically describes the operation steps of the network security configuration method of the switch of the present invention according to different situations according to the requirements of the switch to be configured.

[0111] When the configuration requirement is that the switch network security configuration software already has a configuration package, that is, there is a configuration package that can meet the configuration requirements of the switch to be configured, the required existing configuration package is selected to implement the configuration. The specific configuration process is as follows: Figure 2 As shown in the figure, the operation steps are: S01, connect the console port of the switch to be configured to the computer, and confirm that the switch and computer software communicate normally; S02, log in to the switch network security configuration software and enter the main interface as shown in Fig.12 S03. Select the configuration package from the drop-down list. Fig.13 As shown, select the required configuration package; S04, click the "Load Configuration Package" button to configure the switch network security. When it involves entering ports, VLANs, etc., a dialog box will pop up (the port configuration dialog box is as follows Fig.14 As shown in the figure, other configuration dialog boxes such as VLAN are similar), just enter the information according to the system requirements; S05. After the configuration operation is completed, click the "Configuration Verification" button to verify all configuration items one by one, such as whether the network communication is successful, whether the access control complies with the specified ACL rules, etc. The verification results will be displayed one by one in the "Information Display Box" on the right side of the interface. When the verification result shows "All configurations have been verified", it is determined that the configuration is successful and the configuration operation is completed.

[0112] When the configuration requirement is a combination of an existing configuration package and an existing additional item of the switch network security configuration software, select the required existing configuration package and additional items to implement the configuration. The specific configuration process is as follows: Figure 3 As shown, the operation steps are: S11, perform the operation according to the above steps S01-S04; S12, click the "Additional Item Configuration" button to enter the "Additional Item Configuration" interface, such as Fig.15 S13, select the required additional items in the "Select additional items" list box, click the "Configure additional items" button, and configure the required additional items for the switch. When it involves entering ports, VLANs, etc., a dialog box will pop up (the port configuration dialog box is as follows Fig.14 As shown, other configuration dialog boxes such as VLAN are similar); S14, after the additional items are configured, click the "Return" button to return to the main interface, and then perform the operation according to the above step S05 to complete the configuration operation.

[0113] When the configuration requirement is that the switch network security configuration software already has a combination of additional items, select the required additional items to implement the configuration. The configuration process is as follows: Figure 4As shown, the operation steps are: S21 performs operations according to the above steps S01-S02; S22 performs operations according to the above steps S12-S14 to complete the configuration operation.

[0114] When the configuration requirement is that the switch network security configuration software has uncreated configuration items (that is, the configuration requirement of the switch to be configured contains new configuration items that are not in the software), a new configuration item is created and configured. The configuration process is as follows: Figure 5 As shown, the operation steps are as follows: S31, first pre-configure the new configuration item in the secureCRT software of the switch, and confirm that the configuration command line and verification command line of the new configuration item are configured and verified successfully in the secureCRT software; S32, perform the operation according to the above steps S01-S04; S33, after entering the main interface, click the "Additional Item Configuration" button to enter the "Additional Item Configuration" interface, and then click "New Configuration Item" to enter the "New Configuration Item" interface as shown Fig.16 As shown; S34. Enter the custom configuration item name in "New Configuration Item Name", enter the configuration command line that is successfully configured in the secureCRT software into "New Configuration Command Line", and enter the verification command line that is successfully configured in the secureCRT software into "New Verification Command Line"; S35. After confirming that all input information is correct, click "Confirm" to save the new configuration item. The software automatically compares the new configuration item with all existing configuration items. If the pre-saved configuration item is exactly the same as the configuration policy of an existing configuration item, the prompt message "The new configuration item already exists and the configuration item name is XXX" is displayed; otherwise, "The new configuration item is saved successfully" is displayed; S36. After successfully creating the new configuration item, configure it according to the switch configuration requirements.

[0115] When multiple switches need to be configured with a new solution, a new configuration package can be created. The process of creating a new configuration package is as follows: Figure 6 As shown, the operation steps are: under the condition that the new configuration scheme has been configured in the switch and the verification is successful (such as the above step S14 or S22 is successfully completed), S41, click the "View Configuration Status" button on the main interface, and a dialog box pops up as shown Fig.17 As shown, select "View switch configuration status" and click the "OK" button. The configuration status of the switch (i.e., the new configuration scheme) will be displayed in the "Information Display Box"; S42, click "New Configuration Package" to enter the "New Configuration Package" interface as shown Fig.18As shown, the new configuration scheme will be displayed in the "Configuration Package Details Display Box" to confirm that the configuration scheme is correct; S43, enter the custom configuration package name in the "New Configuration Package Name", click "Save" to save the new configuration package, and the software will compare the configuration items of the new configuration package with those of all existing configuration packages. If the configuration policy of the new configuration package is exactly the same as that of an existing configuration package, the prompt message "New configuration package already exists, the configuration package name is XXX" will be displayed; otherwise, "New configuration package saved successfully" will be displayed; S44, click the "Return" button to return to the main interface, pull down the "Select Configuration Package" drop-down list, the new configuration package name will be added to the last item in the list, and the new configuration package operation is completed.

[0116] In addition, the switch network security configuration software also has the function of viewing and deleting the details of the software's existing configuration packages and configuration items, and the function of viewing and deleting the details of the switch's existing configurations.

[0117] The process of viewing the details of the existing configuration package of the software is as follows Figure 7 As shown, the operation steps are: S51, perform the operation according to the above steps S01-S02; S52, select the configuration package to be viewed in the "Select Configuration Package" drop-down list; S53, click the "View Configuration Status" button on the main interface to enter the Fig.17 After the dialog box is displayed, select "View configuration package configuration status" and click the "OK" button; S54, return to the main interface and display all configuration item information in the configuration package in the "Information Display Box".

[0118] The process of deleting the existing configuration package of the software is as follows Figure 8 As shown, the operation steps are: S61, perform the operation according to the above steps S01-S02; S62, select the configuration package to be viewed in the "Select Configuration Package" drop-down list; S63, click the "Delete Configuration Package" button on the main interface to enter the Fig.19 Select "Delete software configuration package" and click the "OK" button after the dialog box is displayed, and "The selected configuration package has been deleted" will be displayed, and the configuration package selected in step S62 will be deleted.

[0119] The process of viewing and deleting software configuration item details is as follows: Fig. 9 As shown, the operation steps are: S71, perform the operation according to the above steps S01-S02; S72, click the "Additional Item Configuration" button on the main interface to enter the "Additional Item Configuration" interface;

[0120] S73. Select a configuration item in the "Select additional items" list box in the "Additional item configuration" interface; S74. Click the "View configuration items" button to display the configuration command line and verification command line of the configuration item in the "Configuration item details display box" on the right side of the interface; S75. Click the "Delete configuration item" button in the "Additional item configuration" interface to delete the configuration item selected in step S73.

[0121] The process of viewing the configuration details of the switch is as follows: Fig.10 As shown, the operation steps are: S81, perform the operation according to the above steps S01-S02; S82, click the "View Configuration Status" button on the main interface to enter the Fig.17 Select “View switch configuration status” and click the “OK” button after the dialog box is displayed; S83, it will return to the main interface and display all the configuration item information of the switch in the “Information Display Box”.

[0122] The process of deleting existing configurations on a switch is as follows: Fig.11 As shown, the operation steps are as follows: S91 execute the operation according to the above steps S01-S02; S92 click the "Delete Configuration Package" button on the main interface to enter the Fig.19 After the dialog box is displayed, click "Delete Switch Configuration" and click the "OK" button to display "Switch Configuration Deleted".

[0123] The present invention provides a reliable and convenient solution for the network security configuration of switches in the instrumentation and control system of nuclear power plants. For switches with the same configuration strategy, operations such as rapid configuration and configuration verification can be realized; new configuration items can be added at any time; new configuration schemes for switches can be quickly set; and the method is simple to operate and easy to use, which greatly improves the network security configuration efficiency of switches and is beneficial to the network security configuration and maintenance work of switches.

[0124] Example 2

[0125] like Fig. 20 As shown, the difference between this embodiment and embodiment 1 is that this embodiment provides a switch network security rapid configuration device, the device includes a computer, a switch and a communication cable, and the computer is connected to the switch through the communication cable;

[0126] Wherein, the computer is installed with switch network security configuration software capable of implementing the above-mentioned switch network security rapid configuration method;

[0127] As a further implementation, the switch network security configuration software can be run independently or as a toolkit embedded in the system application software.

[0128] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0129] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0130] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0131] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0132] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for rapid configuration of switch network security, characterized in that: The method includes: Obtaining configuration requirements for the network security of the switch to be configured, wherein the configuration requirements include an existing configuration package of the network security configuration software of the switch, a combination of an existing configuration package and an existing additional item of the network security configuration software of the switch, a combination of an existing additional item of the network security configuration software of the switch, and an unbuilt configuration item of the network security configuration software of the switch; According to different configuration requirements, different configuration strategies are used to configure the network security of the switch to be matched, including: When the configuration requirement is that the switch network security configuration software already has a configuration package, the required existing configuration package is selected to implement the configuration; when the configuration requirement is that the switch network security configuration software already has a configuration package and an existing additional item combination, the required existing configuration package and additional item are selected to implement the configuration; when the configuration requirement is that the switch network security configuration software already has an additional item combination, the required additional item is selected to implement the configuration; when the configuration requirement is that the switch network security configuration software has an uncreated configuration item, a new configuration item is created and configured.

2. A method for rapid configuration of switch network security according to claim 1, characterized in that: When the configuration requirement is that the switch network security configuration software has an existing configuration package, the required existing configuration package is selected to implement the configuration, including: Connect the console port of the switch to be configured to the computer, and obtain the configuration package type based on the main interface of the switch network security configuration software installed on the computer; According to the type of configuration package obtained, load the configuration package to perform network security configuration on the switch; After the configuration is completed, all configuration items are verified one by one, and the verification results are displayed one by one in the information display box of the main interface of the switch network security configuration software; all configuration items are verified one by one, including whether the network communication is successful and whether the access control complies with the specified ACL rules; If the verification result is that all configuration items have passed the verification, the configuration is successful and the configuration operation is completed.

3. A method for rapid configuration of switch network security according to claim 2, characterized in that: The configuration package types include S1 level configuration package, S2 level configuration package, S3 level configuration package, non-safety level configuration package and other project requirement configuration packages; The S1 level configuration package refers to the configuration item combination of the switch with the network security of S1 level system; The S2 level configuration package refers to the configuration item combination of the switch with the network security level S2 system; The S3 level configuration package refers to the configuration item combination of the switch with network security level S2 system; A non-security level configuration package refers to a combination of configuration items of switches in a non-security level system; Other project requirement configuration packages refer to the configuration item combinations of the system switches other than the above four cases.

4. A method for rapid configuration of switch network security according to claim 1, characterized in that: When the configuration requirement is a combination of an existing configuration package and an existing additional item of the switch network security configuration software, the required existing configuration package and additional item are selected to implement the configuration, including: Connect the console port of the switch to be configured to the computer, and obtain the configuration package type based on the main interface of the switch network security configuration software installed on the computer; According to the type of configuration package obtained, load the configuration package to perform network security configuration on the switch; Acquire additional items and configure the additional items; the additional items refer to configuration items that exceed the configuration package when a configuration package cannot fully meet the configuration content required by the system switch; After the configuration package and additional items are configured, all configuration items and additional items are verified one by one, and the verification results are displayed one by one in the information display box of the main interface of the switch network security configuration software; If the verification result is that all configuration items and additional items have passed the verification, the configuration is successful and the configuration operation is completed.

5. A method for rapid configuration of switch network security according to claim 1, characterized in that: When the configuration requirement is that the switch network security configuration software already has a combination of additional items, the required additional items are selected to implement the configuration, including: Connect the console port of the switch to be configured to the computer, and obtain additional items based on the main interface of the switch network security configuration software installed on the computer; The additional items are configured; the additional items refer to configuration items that exceed the configuration package when a configuration package cannot fully meet the configuration content required by the system switch; After the additional items are configured, all additional items are verified one by one, and the verification results are displayed one by one in the information display box of the main interface of the switch network security configuration software; If the verification result is that all additional items have passed the verification, the configuration is successful and the configuration operation is completed.

6. A method for rapid configuration of switch network security according to claim 1, characterized in that: When the configuration requirement is that there are no configuration items in the switch network security configuration software, a new configuration item is created and configured, including: Pre-configure the new configuration items in the secureCRT software of the switch, and confirm that the configuration command lines and verification command lines of the new configuration items are configured and verified successfully in the secureCRT software; Connect the console port of the switch to be configured to the computer, and obtain the configuration package type based on the main interface of the switch network security configuration software installed on the computer; According to the type of configuration package obtained, load the configuration package to perform network security configuration on the switch; Enter the new configuration item through the additional item configuration. The new configuration item includes: enter the configuration item name in the new configuration item name, enter the configuration command line that is successfully configured in the secureCRT software into the new configuration command line, and enter the verification command line that is successfully configured in the secureCRT software into the new verification command line; When saving a new configuration item, the new configuration item is compared with all existing configuration items. If the configuration policy of the pre-saved new configuration item is the same as that of an existing configuration item, it will prompt that the newly created configuration item already exists and display the configuration item name; otherwise, it will prompt that the newly created configuration item is saved successfully. After the new configuration item is created successfully, configure it according to the network security configuration requirements of the switch to be configured.

7. A method for rapid configuration of switch network security according to claim 6, characterized in that: When multiple switches need to be configured with a new solution, it is implemented by creating a new configuration package, specifically: When the new configuration scheme has been configured in the switch and verified successfully, the configuration status of the switch is displayed in the information display box by viewing the switch configuration status; the configuration status of the switch refers to the new configuration scheme; Based on the new configuration scheme, a new configuration package is created and saved; the new configuration includes: entering a custom configuration package name in the new configuration package name field; The new configuration package is compared with the configuration items of all existing configuration packages. If the configuration policy of the new configuration package is the same as that of an existing configuration package, a prompt message is displayed indicating that the new configuration package already exists and the configuration package name is displayed; otherwise, a prompt message is displayed indicating that the new configuration package is saved successfully and the new configuration package is appended to the configuration package list.

8. A method for rapid configuration of switch network security according to claim 1, characterized in that: The method further includes: View and / or delete existing configuration packages and configuration items of the switch network security configuration software, and view and / or delete existing switch configurations.

9. A switch network security rapid configuration device, characterized in that: The device comprises a computer, a switch and a communication cable, wherein the computer is connected to the switch via the communication cable; The computer is installed with switch network security configuration software capable of implementing a switch network security rapid configuration method as claimed in any one of claims 1 to 8.

10. A switch network security rapid configuration device according to claim 9, characterized in that: The switch network security configuration software can be run independently or as a toolkit embedded in the system application software.

Images