Safety detection method, device and equipment of nuclear power plant control system and medium

Abstract

The invention discloses a safety detection method, device and equipment for a nuclear power plant control system and a medium. The method comprises the following steps: acquiring a system design strategy of the nuclear power plant control system, performing risk analysis on the system design strategy to judge whether a risk exists, and generating a risk assessment result; if the risk assessment result shows that the system design strategy has the risk, obtaining a plurality of items to be detected in the system design strategy; judging whether the to-be-detected item meets a preset safety detection standard or not, and obtaining a safety detection result; according to verification of a preset test case, performing a security test on the to-be-detected entry, and generating a security test result; and performing safety assessment according to at least one of the safety detection result, the safety test result and the risk assessment result, and generating a safety assessment report of the nuclear power plant control system. By implementing the method provided by the invention, the problem that the safety of the nuclear power plant control system cannot be effectively detected and evaluated in the prior art can be solved.

Description

Technical Field

[0001] The present invention relates to the technical field of nuclear power safety, and in particular to a safety detection method, device, equipment and medium for a nuclear power plant control system. Background Art

[0002] With the continuous evolution and breakthrough of digital and intelligent technologies, intelligent control systems have gradually emerged in the field of nuclear power industrial control with their significant advantages in stability, reliability, accuracy and maintenance convenience, and have gradually replaced traditional analog equipment. Under this development trend, the widespread application of intelligent systems and equipment in the design and development stages of nuclear power plants, as well as in the upgrading and transformation of in-service nuclear power plants, has become a general trend. However, given the extreme importance of nuclear power plant safety, ensuring the information security of intelligent control systems and their security in practical applications has become a key issue that needs to be solved urgently. Unfortunately, the current technical field has not yet proposed specific and feasible operating methods for safety prevention and in-depth analysis of intelligent control systems in nuclear power plants, which makes it impossible to objectively and effectively detect and evaluate the safety of nuclear power plant control systems. Summary of the invention

[0003] The embodiments of the present invention provide a safety detection method, device, equipment and medium for a nuclear power plant control system, aiming to solve the problem in the prior art that the safety of a nuclear power plant control system cannot be effectively detected and evaluated.

[0004] In a first aspect, an embodiment of the present invention provides a safety detection method for a nuclear power plant control system, comprising: obtaining a system design strategy for the nuclear power plant control system, performing a risk analysis on the system design strategy to determine whether there is a risk, and generating a risk assessment result; if the risk assessment result shows that the system design strategy has a risk, obtaining a number of items to be detected in the system design strategy; determining whether the items to be detected meet preset safety detection standards, and obtaining a safety detection result; performing a safety test on the items to be detected according to preset test case verification, and generating a safety test result; performing a safety assessment based on at least one of the safety detection result, the safety test result, and the risk assessment result, and generating a safety assessment report for the nuclear power plant control system.

[0005] In a second aspect, an embodiment of the present invention further provides a safety detection device for a nuclear power plant control system, comprising: a risk analysis unit, used to obtain a system design strategy for the nuclear power plant control system, perform a risk analysis on the system design strategy to determine whether there is a risk, and generate a risk assessment result; an acquisition unit, used to obtain a number of items to be detected in the system design strategy if the risk assessment result shows that the system design strategy has a risk; a judgment unit, used to determine whether the items to be detected meet preset safety detection standards and obtain safety detection results; a testing unit, used to perform a safety test on the items to be detected according to preset test case verification and generate a safety test result; an evaluation unit, used to perform a safety assessment based on at least one of the safety detection result, the safety test result and the risk assessment result, and generate a safety assessment report for the nuclear power plant control system.

[0006] In a third aspect, an embodiment of the present invention further provides a computer device, which includes a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the above method when executing the computer program.

[0007] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium, wherein the storage medium stores a computer program, wherein the computer program includes program instructions, and the program instructions can implement the above method when executed by a processor.

[0008] The embodiment of the present invention provides a safety detection method, device, equipment and medium for a nuclear power plant control system. The method includes obtaining a system design strategy for the nuclear power plant control system, performing a risk analysis on the system design strategy to determine whether there is a risk, and generating a risk assessment result; if the risk assessment result shows that the system design strategy has a risk, obtaining several items to be detected in the system design strategy; determining whether the items to be detected meet the preset safety detection standards and obtaining safety detection results; performing safety tests on the items to be detected according to preset test case verification and generating safety test results; performing safety assessment according to at least one of the safety detection results, the safety test results and the risk assessment results, and generating a safety assessment report for the nuclear power plant control system. The embodiment of the present invention determines whether there is a risk by performing a risk analysis on the system design strategy. If there is a risk, each item to be detected in the system is evaluated and safety tested. Finally, a final safety assessment report is generated according to the risk assessment result or the safety detection result and the safety test result, so as to perform a comprehensive safety analysis on the intelligent control system in the nuclear power plant, so as to solve the problem that the safety of the nuclear power plant control system cannot be effectively detected and evaluated in the prior art, and provide a guiding method, operating specifications and platform for the analysis process of the safety precautions analysis of the nuclear power plant control system, so as to improve the standardization and automation of the safety precautions analysis, and provide technical support for the information security assessment of the nuclear power plant. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying any creative work.

[0010] Figure 1 A schematic flow chart of a safety detection method for a nuclear power plant control system provided by an embodiment of the present invention;

[0011] Figure 2 A schematic diagram of a sub-process of a safety detection method for a nuclear power plant control system provided by an embodiment of the present invention;

[0012] Figure 3 A schematic diagram of a sub-process of a safety detection method for a nuclear power plant control system provided by an embodiment of the present invention;

[0013] Figure 4 A schematic diagram of a sub-process of a safety detection method for a nuclear power plant control system provided by an embodiment of the present invention;

[0014] Figure 5A schematic diagram of a sub-process of a safety detection method for a nuclear power plant control system provided by an embodiment of the present invention;

[0015] Figure 6 A schematic diagram of a sub-process of a safety detection method for a nuclear power plant control system provided by an embodiment of the present invention;

[0016] Figure 7 A schematic diagram of a sub-process of a safety detection method for a nuclear power plant control system provided by an embodiment of the present invention;

[0017] Figure 8 A schematic diagram of a sub-process of a safety detection method for a nuclear power plant control system provided by an embodiment of the present invention;

[0018] Fig. 9 A schematic diagram of a sub-process of a safety detection method for a nuclear power plant control system provided by an embodiment of the present invention;

[0019] Fig.10 A schematic block diagram of a safety detection device for a nuclear power plant control system provided by an embodiment of the present invention;

[0020] Fig.11 A schematic block diagram of a computer device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0021] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0022] It should be understood that when used in this specification and the appended claims, the terms "include" and "comprises" indicate the presence of described features, integers, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or combinations thereof.

[0023] It should also be understood that the terms used in this specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. As used in the specification of the present invention and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include plural forms.

[0024] It should be further understood that the term "and / or" used in the present description and the appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0025] See also Figure 1 , Figure 1 A flow chart of a safety detection method for a nuclear power plant control system provided in an embodiment of the present invention. The safety detection method for a nuclear power plant control system in this embodiment can be applied to the safety detection of an intelligent control system within a nuclear power plant. Through the method of the present invention, effective safety precautions can be taken for intelligent control systems, intelligent devices, and other settings within a nuclear power plant, solving the problem that the prior art cannot effectively detect and evaluate the safety of a nuclear power plant control system.

[0026] Figure 1 1 is a flow chart of a safety detection method for a nuclear power plant control system provided by an embodiment of the present invention. As shown in the figure, the method includes the following steps S110-S150.

[0027] S110, obtaining a system design strategy for the nuclear power plant control system, performing a risk analysis on the system design strategy to determine whether there is a risk, and generating a risk assessment result.

[0028] In this embodiment, the nuclear power plant control system is a control system with complex algorithms and architectures such as intelligent perception, calculation, human-computer interaction, and learning in the nuclear power plant. It can be understood that a nuclear power plant may include multiple intelligent control systems, and the present invention is a method for performing safety detection on one of the control systems. The system design strategy is a system design document, that is, the system design document includes all design schemes and implementation methods of the control system. The system design strategy is risk analyzed to determine whether there is a risk, and a risk assessment result is generated. Specifically, according to the system design strategy, the interface information that can be connected to the outside in the control system is obtained, wherein the interface includes a hard-wired interface and a network communication interface, and it is determined whether the hard-wired interface and the network communication interface have risks, so as to generate corresponding risk assessment results. For example, if the system design strategy shows that the intelligent system only includes a hard-wired interface, a risk assessment result that the control system does not have risks can be generated. It can be understood that because the hard-wired interface is a way of connecting different parts of the electronic device through wires, such as AI / AO (analog input / output interface), DI / DO (digital input / output interface) and other interfaces, the probability of risk is extremely low, so a risk assessment result that the control system does not have risks can be generated. By performing a risk analysis on the system design strategy to determine whether there is a risk, it is determined whether there is a risk in the system design, and unnecessary safety detection is avoided.

[0029] In one embodiment, if Figure 2 As shown, the step S110 also includes steps S111-S113.

[0030] S111, detecting whether there is a network communication interface connected to the outside in the system design strategy;

[0031] S112, if it exists, determining whether the network communication interface is a remote access interface or a redundant interface, and if it is one of the interfaces, generating a safety assessment report indicating that the control system has a high risk, wherein the redundant interface is an interface that is not used and not disabled;

[0032] S113. If the network communication interface is not the remote access interface or the redundant interface, generate a risk assessment result indicating that the network communication interface has risks.

[0033] In this embodiment, the network communication interface is an interface for communicating data over the network according to the network protocol. According to the system design strategy, it is detected whether there is a network communication interface and a hard-wired interface connected to the outside in the system design. If there is only a hard-wired interface, no further judgment is required, and a risk-free risk assessment result is directly generated, and a safety assessment is directly performed to generate a safety assessment report for the nuclear power plant control system. If the network communication interface exists, it means that there are safety hazards in the control system, and it is further detected whether the network communication interface is a remote access interface or a redundant interface, wherein the remote access interface is an interface that allows a user or administrator to remotely access and control a server or other device through a network. This interface usually provides the same permissions and functions as local access, so that users and administrators can perform various operations without physical contact with the device. The redundant interface is an interface that is not used and not disabled. For example, the device corresponding to the intelligent control system has an export when it leaves the factory, but it is not used in actual applications and is not physically disabled. If the network communication interface is a remote access interface or a redundant interface, a security assessment report of the control system with high risk is directly generated. If it is not the remote access interface or the redundant interface, a risk assessment result of the network communication interface with risk is generated, and the intelligent control system with risk is further judged. By performing a preliminary risk analysis on the control system according to the system design strategy, further judgment can be made based on the analysis results.

[0034] S120: If the risk assessment result shows that the system design strategy has risks, obtain several items to be detected in the system design strategy.

[0035] In this embodiment, if the risk assessment result shows that the system design strategy has risks, the control system is further tested, specifically, a number of system design items and a number of method design items in the system design strategy are obtained, wherein the item to be tested is the smallest design item after the system design file content is converted into a design item, specifically, the item to be tested refers to the smallest component that can independently realize a certain function or have a certain characteristic in a system or product. The items to be tested include system design items, requirement items, component design items, and method design items for software / hardware, for example, a module, a class, an interface, or a database table is a component design item in software, or a circuit board, a camera device is a component design item in hardware. Among them, a number of items to be detected in the system design strategy can be obtained through the security prevention analysis object module, and the security prevention analysis object module needs to provide the object type of the item to be detected, the coding and content input by the analysis operator, the content and time of the modification of each item by the analysis operator, and when the update of the item to be detected is identified, the corresponding content in the corresponding superior item is immediately updated, and after the update of the item to be detected is identified, it should return to the node where the item first appears and re-acquire the item. Among them, there is no limitation on the specific analysis method, and it only needs to meet the above requirements. For example, the above requirements can be achieved through Java and other functional codes. When there is a risk in the control system, the control system is subjected to layer-by-layer security detection to obtain accurate detection results.

[0036] S130: Determine whether the item to be detected meets the preset security detection standard, and obtain the security detection result.

[0037] In this embodiment, the security detection result is a detection result generated for the item to be detected, wherein the system design strategy includes multiple items to be detected, and the items to be detected include system design items including software / hardware, requirement items, component design items, and method design items, wherein one system design item requires one or more requirement items to be implemented, one requirement item requires one or more component design items to be implemented, and one component design item requires one or more method design items to be implemented. Determine whether the item to be detected meets the preset security detection standard. Specifically, first determine whether the system design item meets the preset security detection standard. If it does, then determine the requirement item. If the requirement item meets the preset security detection standard, then determine the component design item, until the determination of the method design item is completed. Different security assessment reports are generated according to the judgment results of each stage. For example, if the system design items do not meet the preset security detection standards, a security assessment report is generated that the system design has risks, and relevant instructions are given in the user manual, that is, it is necessary for the user to provide additional physical access control measures in the use environment to cooperate with management means to achieve it, or to add firewalls, intrusion detection, traffic auditing and other network security equipment to the equipment in the entire communication network to ensure the security of the intelligent control system. If the requirement items do not meet the preset security detection standards, it is necessary to generate a corresponding analysis problem description, and return the process of obtaining the items to be detected, so that the staff can make additional designs and generate a security detection report that the system design items do not meet the preset security detection standards. By judging whether the items to be detected meet the preset security detection standards and obtaining security detection results, the control system is security-checked layer by layer, saving detection time and obtaining accurate detection results.

[0038] In one embodiment, if Figure 3 As shown, the step S130 includes steps S131-S133.

[0039] S131, traversing the software system design items, and determining whether the software system design items have preset software security attributes;

[0040] S132: If the software system design items do not have the preset software security attribute in total, determining whether the hardware system design items have the preset hardware security attribute;

[0041] S133: If the hardware system design items collectively possess the preset hardware security attributes, then determine that the system design items meet the preset security detection standards.

[0042] In this embodiment, the system design items constitute the entire control system, therefore, the system design items include corresponding software system design items and hardware system design items, the software design items are the smallest components of the software level that can independently implement a certain function or have a certain characteristic, for example, functions such as setting different types of access rights and generating operation logs are the software system design items, and the hardware system design items are the smallest components of the hardware level that can independently implement a certain function or have a certain characteristic, for example, cabinets, locks, monitoring equipment, etc. It can be understood that both the software system design items and the hardware system design items have corresponding software or hardware requirement items, component design items, and method design items. The preset software security attributes are attributes that the software system items should possess in total to protect the safety of the nuclear power system. Specifically, the preset software security attributes in this embodiment are integrity, confidentiality, availability, and auditability. When judging all software system design items, it can be judged whether the software system design items are provided with technical designs such as data verification to ensure integrity (such as CRC verification, offline modification), technical designs such as data encryption to ensure data confidentiality (such as key encryption, private communication protocols, special communication fields, etc.), and whether there are technical designs such as access authorization to ensure the availability of legal personnel (such as access rights of different types of personnel), and whether there are technical designs such as operation logs and non-repudiation operator identification to ensure the auditability of the operation process (such as access control of personal identification code + password, personal identification code + operation record). If the software system design items possess the above-mentioned software security attributes in total, it is determined that the system design items meet the preset security detection standards. If the software system design items do not have the preset software security attributes in total, then determine whether the hardware system design items have the preset hardware security attributes. Specifically, determine whether the hardware system design items have technical designs to ensure that data is not tampered with (such as: cabinet + lock, etc.), technical designs to ensure that data is not illegally obtained (such as: cabinet + lock and other physical access control measures), access authorization and other technical designs to ensure that legal personnel are available (such as: multi-level cabinets, locks and other physical protections), and technical measures to achieve auditability (such as: cabinet + lock + alarm, screen monitoring + motion capture alarm, etc.). If the total has the hardware security attributes, then it is determined that the system design strategy meets the preset security detection standards, and relevant instructions are made in the user manual, and the user performs corresponding operations in the physical access control process through management means. Otherwise, the relevant instructions in the user manual require the user to provide additional physical access control measures in the use environment to cooperate with management means, or add firewalls, intrusion detection, traffic auditing and other network security equipment to the equipment in the entire communication network to ensure the security of the intelligent control system.When the software system design items do not have the safety detection strategy in total, the hardware system design items corresponding to the system are detected to see whether they meet the preset safety detection standards, so as to perform a complete and accurate detection of the control system.

[0043] In one embodiment, if Figure 4 As shown, step S133 also includes steps S134-S136.

[0044] S134, associating the requirement item with the system design item according to a preset association method;

[0045] S135, determining whether the associated requirement items can realize the system design items and whether they have preset requirement security attributes in total;

[0046] S136. If the total of the requirement items can realize the system design items and have the preset requirement security attributes, it is determined that the requirement items meet the preset security detection standards.

[0047] In this embodiment, the requirement design item represents a specific function or performance requirement, which will be used to guide the design and implementation of software or hardware. Specifically, the requirement item is determined based on the minimum requirement unit in the software requirement file or the hardware requirement file, and the requirement item is usually constructed based on the system design item. For example, if the system design item is to set different types of access rights, then the minimum requirement item is that different identity identification information needs to be set according to different personnel responsibilities and levels for permission control. The requirement item is associated with the system design item according to a preset association method. Specifically, a mapping relationship between the requirement item and the system design item can be established based on the functions corresponding to the requirement item and the system design item, and the requirement item is associated with the system design item through the mapping relationship. The specific association method is not limited, and it is sufficient to fully associate the two. It is judged whether the associated requirement items can realize the system design items and whether they have the preset requirement security attributes in total, that is, one system design item can be associated with one or more requirement items, and it is judged whether the associated requirement items can realize the system design items. For example, the system design item is to set access rights, that is, it is judged whether the associated requirement items can realize the function of setting access rights. If so, the requirement items can realize the system design items in total, and at the same time, it is judged whether they have the preset requirement security attributes in total. The preset requirement security attributes are the attributes that the requirement items should have in total to protect the software / hardware security in the nuclear power system. Specifically, the preset requirement security attributes in this embodiment are integrity, confidentiality, availability, and auditability. For example, it is determined whether the requirement design items in the detection software have the requirements for data integrity verification, data encryption, access rights setting, and operation log generation. If several of the requirement design items have the preset requirement security attributes in total, it can be determined that the system design items meet the preset safety detection standards. If not, it is necessary to generate a corresponding analysis problem description, and return to the analysis object entry process, so that the staff can make a supplementary design, and generate a safety detection report that does not meet the preset safety detection standards. Among them, the hardware requirement items are also judged for integrity, confidentiality, availability, and auditability. The specific judgment method is similar to that of the system design items, and will not be repeated here. It is sufficient to effectively judge whether they have the preset required security attributes in total. After the system design items meet the standards, the software and hardware requirement items in the system are security tested, and the control system is gradually tested from large to small, so that each step of the control system is tested at the same depth to ensure the accuracy of the test results.

[0048] In one embodiment, if Figure 5 As shown, step S136 also includes steps S137-S139.

[0049] S137, associating the component design item with the requirement item according to the preset association method;

[0050] S138, determining whether the associated component design items can realize the requirement items and whether they have preset component security attributes in total;

[0051] S139: If the component design items can realize the requirement items in total and have the preset component security attributes, it is determined that the component design items meet the preset security detection standards.

[0052] In this embodiment, the component design entry represents a specific design element or component. These entries provide developers with detailed guidance on implementing the requirement entries. Specifically, the component entry is determined based on the minimum requirement unit in the software design file or the hardware design file. One requirement entry corresponds to multiple component design entries. For example, if the requirement entry is to verify the identity of the visitor to ensure data security, the corresponding component design entry can be a database for storing personnel identities, or a password lock for fingerprint verification. The component design entry is associated with the requirement entry according to the preset association method. The specific association method is the same as the association method between the requirement entry and the system design entry, which will not be repeated here. It is judged whether the associated component design items can realize the requirement items and whether they have the preset requirement security attributes in total, that is, one requirement item can be associated with one or more component design items, and it is judged whether the associated component design items can realize the requirement items. For example, if the requirement item is a functional requirement for setting access rights, it is judged whether the requirement item can be realized in the component design item. If the corresponding software design items cannot realize setting access rights in total, it is judged whether the hardware can realize it. If the hardware design items include setting a password lock for fingerprint verification to realize setting access rights, it is determined that the component design items can realize the requirement items in total, and at the same time, it is judged whether they have the preset component security attributes. The preset component security attributes are the attributes that the component design items should have in total to protect the software / hardware security in the nuclear power system. Specifically, the preset component security attributes in this embodiment are integrity, confidentiality, availability, and auditability. For example, it is judged whether the technical measures of integrity, confidentiality, availability, and auditability are gradually realized in the software / hardware design. Among them, the specific technical measures have been exemplified in the above system design items and requirement items, and will not be repeated here. By further conducting safety checks on several component design items corresponding to the requirement items after the system design items and requirement items meet the standards, the control system can be subjected to safety checks of the same depth to ensure the accuracy of the test results.

[0053] In one embodiment, if Figure 6 As shown, step S139 also includes steps S1310-S1312.

[0054] S1310, associating the method design item with the component design item according to the preset association method;

[0055] S1311, determining whether the associated method design items can implement the component design items and whether they have a preset method security attribute in total;

[0056] S1312: If the method design items can realize the component design items in total and have the preset method security attributes, then it is determined that the method design items meet the preset security detection standards.

[0057] In this embodiment, the method design entry is the smallest unit for implementing the component design entry. For example, in software, the method design entry can be a function or a method, and in hardware, the method design entry can be a circuit board or a component. The component entry is determined according to the smallest requirement unit in the software design file or the hardware design file. One component design entry corresponds to multiple method design entries. For example, if the component design entry is a database storing personnel identities, the corresponding method design entry can be a data table storing personnel job positions, or a lock core for fingerprint verification. The method design entry is associated with the component design entry according to the preset association method. The specific association method is the same as the association method between the above-mentioned requirement entry and the system design entry, which will not be repeated here. It is judged whether the associated method design entry can realize the component design entry and whether it has the preset method security attribute in total, that is, a component design entry can be associated with one or more method design entries, and it is judged whether the associated method design entry can realize the component design entry, wherein the judgment process is similar to the above-mentioned process of judging whether the component design entry realizes the requirement entry, which will not be repeated here. If the method design items can realize the component design items in total, it is determined whether the total has the preset method security attribute. The preset method security attribute is the attribute that the method design items should have in total to protect the software / hardware security in the nuclear power system. Specifically, the preset method security attribute in this embodiment is integrity, confidentiality, availability, and auditability. For example, it is determined whether the technical measures of integrity, confidentiality, availability, and auditability are gradually implemented in the software code or hardware design. After the system design items, the requirement design items, and the component design items meet the standards, the method design items are further security tested, so that the control system is subjected to the same depth of security testing to ensure the accuracy of the test results.

[0058] S140: Perform security testing on the item to be detected according to preset test case verification, and generate a security test result.

[0059] In this embodiment, the preset test case is a method for testing the items to be tested. For example, for the items to be tested in hardware, the preset test case describes how to test the entire hardware system to ensure that the various parts can work together correctly. Among them, the method design items will be security tested from the perspective of integrity, confidentiality, availability, and auditability to determine whether the items to be tested can achieve the integrity, confidentiality, availability, and auditability they depict, and generate corresponding security test results. It should be noted that the result of the security test of the items to be tested must be passed. If it fails, no subsequent security test evaluation will be performed, and the process will be paused to allow the operator to supplement the design so that the items to be tested can pass the security test. By performing security tests on the items to be tested, it is determined whether the results depicted by the items to be tested can be achieved, thereby determining whether the entire control system can achieve the corresponding effect, thereby completing the safety test of the nuclear power plant control system.

[0060] In one embodiment, if Figure 7 As shown, the step S140 includes steps S141-S142.

[0061] S141, performing static code analysis on the software method design items having the preset method security attributes and dynamically testing them through the preset software test cases;

[0062] S142. Perform software system testing on items associated with software method design items that pass dynamic testing through preset system test cases.

[0063] In this embodiment, the method design items include software method design items in software, for example, one method and one function are both the software method design items. It can be understood that the method design items can pass the security test when they have the preset method security attributes, that is, a method design item may have only one property. For example, there are three method design items, among which method design item A has confidentiality, method design item B has integrity and availability, and method design item C has auditability. Then the method design items have the preset method security attributes in total. Therefore, when testing the software method design items, they are tested according to the preset method security attributes they have. Specifically, the correctness of the encryption algorithm, the correctness of the data packet structure containing the encryption field, and the correctness of the encryption timing are tested for the method design item A with confidentiality. And the corresponding software test cases are used to perform normal communication tests with correct decryption and dynamic tests of abnormal communication with incorrect decryption. The component design items and system design items associated with the method design item A are subjected to software system testing through preset system test cases. Specifically, a normal communication test of a correct encryption policy data packet and an abnormal communication test of an incorrect encryption policy data packet are constructed through preset system test cases to test the confidentiality of the method design item A. Similarly, static code analysis is performed on the method design item B with integrity and availability. When performing integrity analysis, the correctness of the algorithm, the correctness of the data packet structure containing the check bit, and the correctness of the timing are verified. The method design item is verified using correct data through corresponding software test cases; and the method design item is verified using tampered data. Finally, the component design items and system design items associated with the method design item B are subjected to software system testing through preset system test cases. Specifically, a normal communication test of a correct data packet and an abnormal communication test of an incorrect data field are constructed, and the test results are obtained. When performing availability testing, the correctness of the access control policy and the correctness of the access control authorization partition of the code are analyzed, and a normal communication test of correct authorized access, an abnormal communication test of incorrect authorized access, and a communication test of exceeding the scope of authorized access are performed through corresponding software test cases. And the component design items and system design items associated with the method design item B are subjected to software system testing through preset system test cases. The system test at this time is the same as the dynamic test method and will not be repeated. When the auditable method design item C is subjected to static code analysis, the correctness of the algorithm's logging function and the correctness of the non-repudiation identification of personnel and operations are analyzed. Among them, the correctness of the logging function and the correctness of the non-repudiation identification of personnel and operations are judged during dynamic testing and system testing, which will not be repeated. Security testing is performed on the software method design items to detect whether the planned effects can be accurately achieved.

[0064] In one embodiment, the step S140 includes step S143.

[0065] S143. Perform hardware system testing on the hardware method design items having the preset method security attributes and their associated items through the preset system test cases.

[0066] In this embodiment, the method design items include hardware design items. The system test case describes how to test the entire system to ensure that it meets all requirements and that the various parts can work together correctly. The integrity, confidentiality, availability and auditability of the hardware method design items are tested through the preset system test cases. Specifically, the preset system test cases are used to determine whether the hardware method design items have physical protection packages (such as metal cabinets, etc.) or whether the physical protection is equipped with access control methods (such as locks, etc.) to test integrity, confidentiality and auditability. And the preset system test cases are used to determine whether the hardware method design items have physical protection packages, whether the physical protection is equipped with access control methods, and whether the access control partitions are correct to perform availability tests. Security testing is performed on the hardware of the control system to determine whether the software and hardware aspects of the system can jointly maintain the use of the control system.

[0067] S150. Perform a safety assessment based on at least one of the safety detection result, the safety test result, and the risk assessment result, and generate a safety assessment report for the nuclear power plant control system.

[0068] In this embodiment, the safety assessment report is a specific test report generated after the safety assessment of the nuclear power plant. The safety assessment report can display the risk status of the control system of the nuclear power plant and the safety assessment score of the control system, as well as the problems found in the analysis process. Safety assessment is performed based on at least one of the safety test results, the safety test results, and the risk assessment results. Specifically, if the risk assessment result is that there is no risk, a safety assessment report with a full score and no risk in the assessment result can be directly generated. If the risk assessment result shows that there is a risk, a corresponding safety assessment report is generated based on the safety test results and the safety test results. By generating the safety assessment report of the nuclear power plant control system based on the safety test results, the safety test results, and the risk assessment results, the operator can clearly understand the assessment results of the nuclear power plant control system and the areas that need to be supplemented.

[0069] In one embodiment, if Figure 8 As shown, step S150 includes steps S151-S153.

[0070] S151, performing a security assessment on the to-be-tested item that has passed the security test according to preset assessment items and the security test result, and obtaining a corresponding assessment result;

[0071] S152, summing up the evaluation results according to the weight ratio corresponding to each of the preset evaluation items to obtain a security evaluation score;

[0072] S153: Generate a safety assessment report for the control system according to the safety detection result and the safety assessment score.

[0073] In this embodiment, the evaluation result is an evaluation of whether the control system has risks and the acceptability of the risks, and the safety evaluation score is an overall score for the safety factor of the control system. A safety evaluation is performed on the items to be tested that have passed the safety test according to the preset evaluation items and the safety test results to obtain the corresponding evaluation results. Specifically, a safety evaluation is performed on the component design, requirements, system design and other items corresponding to the design items that have passed the safety test. The preset evaluation items are integrity evaluation, confidentiality evaluation, availability evaluation and auditability evaluation. Specifically, an evaluation is performed on the system design items that have passed the safety test according to the preset evaluation items. For example, there are three system design items, and the safety test results show that: a system design item passes the safety test, b system design item fails the safety test due to lack of confidentiality, and c system design item fails the test of the safety test results due to lack of auditability. When the preset evaluation items are evaluated for safety according to the safety test results, the control system can be scored as 10 points for integrity, 6 points for confidentiality, 10 points for auditability, and 6 points for availability, wherein the evaluation results are totaled according to the weight ratio corresponding to each of the preset evaluation items to obtain the safety evaluation score, specifically, the final safety evaluation score = integrity score * a + confidentiality score * b + availability score * c + auditability score * d. And generate the corresponding safety evaluation report according to the score, such as, if the safety evaluation score is greater than the preset excellent score, a test report can be generated that the safety test result of the control system is satisfactory, wherein the specific preset score dividing line and the gradient of the evaluation result can be set according to specific needs, and there is no limitation on this. It should be noted that a system design item has one or more requirement items corresponding to it, a requirement item has multiple component design items corresponding to it, and a component design item also has multiple method design items corresponding to it. Therefore, if the requirement items, component design items or method design items in the system design item do not have a certain safety property in total, the system design item does not have its corresponding safety property. By performing security assessments on items that have passed security tests according to the corresponding security test results based on preset assessment items, a security assessment report is generated to unify the evaluation criteria and improve the standardization and automation of security prevention analysis.

[0074] In one embodiment, if Fig. 9 As shown, step S151 also includes steps S1511-S1512.

[0075] S1511, performing software security assessment on the software system design item and its corresponding requirement item, the component design item, and the software method design item according to the preset assessment items, and obtaining a software assessment result;

[0076] S1512. Perform a hardware security assessment on the hardware system design item and its corresponding requirement item, the component design item, and the hardware method design item according to the preset assessment items to obtain a hardware assessment result.

[0077] In this embodiment, a security assessment is performed on the software system design items in the items to be tested according to the preset assessment items (integrity assessment, confidentiality assessment, availability assessment, and auditability assessment). Specifically, the software system design items and their corresponding items are checked one by one according to the security test results of the items to see if they meet the requirements of the preset assessment items, thereby obtaining the security assessment results of the software system. For example, the security test results of software system design item A show that it has the preset software security attributes and meets the preset security test standards, but its associated requirement item a does not have integrity, and the component design item corresponding to its associated requirement item c does not have confidentiality. Then the final assessment result of software system design item A will be affected by requirement items a and c, and the software assessment result shows that software system design item A does not have integrity and confidentiality. In the same way, a hardware security assessment is performed on the hardware system design items and their corresponding requirement items, the component design items, and the hardware method design items to obtain the hardware assessment results. The final assessment result is formed based on the hardware assessment results and the software assessment results. By conducting security assessments on software and hardware items that have passed security tests according to the preset assessment items and the corresponding security test results, a security assessment report can be generated to conduct a more comprehensive security assessment and improve the standardization and automation of security prevention analysis.

[0078] Fig.10 2 is a schematic block diagram of a safety detection device 200 for a nuclear power plant control system provided by an embodiment of the present invention. Fig.10 As shown, corresponding to the safety detection method of the nuclear power plant control system, the present invention also provides a safety detection device for the nuclear power plant control system. The safety detection device for the nuclear power plant control system includes a unit for executing the safety detection method of the nuclear power plant control system, and the device can be configured in a desktop computer, a tablet computer, a laptop computer, and other terminals. Specifically, please refer to Fig.10 The safety detection device of the nuclear power plant control system includes a risk analysis unit 210, an image acquisition unit 220, a judgment unit 230, a test unit 240 and an evaluation unit 250.

[0079] The risk analysis unit 210 is used to obtain the system design strategy of the nuclear power plant control system, perform risk analysis on the system design strategy to determine whether there is a risk, and generate a risk assessment result.

[0080] In one embodiment, the risk analysis unit 210 includes an interface detection unit, a first generation unit, and a second generation unit.

[0081] An interface detection unit, used to detect whether there is a network communication interface connected to the outside in the system design strategy;

[0082] A first generating unit, configured to determine whether the network communication interface is a remote access interface or a redundant interface if it exists, and to generate a safety assessment report indicating that the control system has a high risk if it is one of the interfaces, wherein the redundant interface is an interface that is not used and not disabled;

[0083] The second generating unit is configured to generate a risk assessment result indicating that the network communication interface has a risk if the network communication interface is not the remote access interface or the redundant interface.

[0084] The acquisition unit 220 is configured to acquire a number of items to be detected in the system design strategy if the risk assessment result shows that the system design strategy has risks.

[0085] The judging unit 230 is used to judge whether the item to be checked meets the preset security checking standard and obtain the security checking result.

[0086] In one embodiment, the judgment unit 230 includes a first judgment unit, a second judgment unit and a first determination unit.

[0087] A first judging unit, configured to traverse the software system design items and judge whether the software system design items have a preset software security attribute;

[0088] A second judgment unit is used to judge whether the hardware system design items have the preset hardware security attributes if the software system design items do not have the preset software security attributes in total;

[0089] The first determination unit is configured to determine that the system design items meet the preset security detection standard if the hardware system design items collectively have the preset hardware security attribute.

[0090] In one embodiment, the judging unit 230 includes a first associating unit, a third judging unit and a second determining unit.

[0091] A first associating unit, configured to associate the requirement item with the system design item according to a preset association method, wherein one system design item may be associated with one or more requirement items;

[0092] A third judgment unit is used to judge whether the associated requirement items can realize the system design items and whether they have a preset requirement security attribute in total;

[0093] The second determination unit is configured to determine that the requirement items meet the preset safety detection standard if the requirement items can realize the system design items in total and have the preset requirement safety attributes.

[0094] In one embodiment, the judging unit 230 includes a second associating unit, a fourth judging unit and a third determining unit.

[0095] A second associating unit, configured to associate the component design item with the requirement item according to the preset associating method;

[0096] A fourth judgment unit, used to judge whether the associated component design items can realize the requirement items and whether they have a preset component security attribute in total;

[0097] The third determination unit is configured to determine that the component design items meet the preset safety detection standard if the component design items can realize the requirement items in total and have the preset component safety attributes.

[0098] In one embodiment, the judging unit 230 includes a third associating unit, a fifth judging unit and a fourth determining unit.

[0099] A third associating unit, configured to associate the method design item with the component design item according to the preset associating manner;

[0100] A fifth judgment unit, used to judge whether the associated method design items can implement the component design items and whether they have a preset method security attribute in total;

[0101] The fourth determination unit is configured to determine that the method design item meets the preset safety detection standard if the method design item can realize the component design item in total and has the preset method safety attribute.

[0102] The testing unit 240 is used to perform a security test on the item to be tested according to a preset test case verification and generate a security test result.

[0103] In one embodiment, the testing unit 240 includes an analysis unit and a software testing unit.

[0104] An analysis unit, used to perform static code analysis on software method design items having the preset method security attributes and to perform dynamic testing on the items through the preset software test cases;

[0105] The software testing unit is used to perform software system testing on items associated with software method design items that pass dynamic testing through preset system test cases.

[0106] In one embodiment, the testing unit 240 includes a hardware testing unit.

[0107] The hardware testing unit is used to perform hardware system testing on the hardware method design items having the preset method security attributes and their associated items through the preset system test cases.

[0108] The evaluation unit 250 is used to perform a safety evaluation according to at least one of the safety detection result, the safety test result and the risk evaluation result, and generate a safety evaluation report of the nuclear power plant control system.

[0109] In one embodiment, the evaluation unit 250 includes an evaluation subunit, a summary unit, and a reporting unit.

[0110] An evaluation subunit, configured to perform a security evaluation on the items to be tested that have passed the security test according to preset evaluation items and the security test results, and obtain corresponding evaluation results;

[0111] A summing unit, used to sum up the evaluation results according to the weight ratio corresponding to each of the preset evaluation items to obtain a safety evaluation score;

[0112] A reporting unit is used to generate a safety assessment report of the control system according to the safety detection result and the safety assessment score.

[0113] In one embodiment, the evaluation unit 250 includes a software evaluation unit and a hardware evaluation unit.

[0114] A software evaluation unit, configured to perform a software security evaluation on the software system design item and its corresponding requirement item, the component design item, and the software method design item according to the preset evaluation items, and obtain a software evaluation result;

[0115] The hardware evaluation unit is used to perform hardware security evaluation on the hardware system design items and their corresponding requirement items, the component design items and the hardware method design items according to the preset evaluation items to obtain hardware evaluation results.

[0116] It should be noted that technicians in the relevant field can clearly understand that the specific implementation process of the safety detection device 200 and each unit of the above-mentioned nuclear power plant control system can refer to the corresponding description in the aforementioned method embodiment, and for the convenience and conciseness of the description, it will not be repeated here.

[0117] The safety detection device of the nuclear power plant control system can be implemented in the form of a computer program. Fig.11 Runs on the computer device shown.

[0118] See also Fig.11 , Fig.11 5 is a schematic block diagram of a computer device provided in an embodiment of the present application. The computer device 500 may be a terminal or a server, wherein the terminal may be an electronic device with communication functions such as a smart phone, a tablet computer, a laptop computer, a desktop computer, a personal digital assistant, and a wearable device. The server may be an independent server or a server cluster composed of multiple servers.

[0119] See also Fig.11 The computer device 500 includes a processor 502 , a memory and a network interface 505 connected via a system bus 501 , wherein the memory may include a non-volatile storage medium 503 and an internal memory 504 .

[0120] The non-volatile storage medium 503 can store an operating system 5031 and a computer program 5032. The computer program 5032 includes program instructions, and when the program instructions are executed, the processor 502 can execute a safety detection method for a nuclear power plant control system.

[0121] The processor 502 is used to provide computing and control capabilities to support the operation of the entire computer device 500 .

[0122] The internal memory 504 provides an environment for the operation of the computer program 5032 in the non-volatile storage medium 503. When the computer program 5032 is executed by the processor 502, the processor 502 can execute a safety detection method for a nuclear power plant control system.

[0123] The network interface 505 is used to communicate with other devices over the network. Fig.11 The structure shown in the figure is merely a block diagram of a portion of the structure related to the solution of the present application, and does not constitute a limitation on the computer device 500 to which the solution of the present application is applied. The specific computer device 500 may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0124] The processor 502 is used to run a computer program 5032 stored in the memory to implement the steps of the above method.

[0125] It should be understood that in the embodiment of the present application, the processor 502 may be a central processing unit (CPU), and the processor 502 may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Among them, the general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0126] It can be understood by those skilled in the art that all or part of the processes in the method for implementing the above embodiment can be completed by instructing the relevant hardware through a computer program. The computer program includes program instructions, and the computer program can be stored in a storage medium, which is a computer-readable storage medium. The program instructions are executed by at least one processor in the computer system to implement the process steps of the embodiment of the above method.

[0127] Therefore, the present invention also provides a storage medium. The storage medium may be a computer-readable storage medium. The storage medium stores a computer program, wherein the computer program includes program instructions. When the program instructions are executed by a processor, the processor executes the steps of the above method.

[0128] The storage medium may be a USB flash drive, a mobile hard disk, a read-only memory (ROM), a magnetic disk, or an optical disk, etc., which are computer-readable storage media that can store program codes.

[0129] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0130] In the several embodiments provided by the present invention, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of each unit is only a logical function division, and there may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed.

[0131] The steps in the method of the embodiment of the present invention can be adjusted in order, combined and deleted according to actual needs. The units in the device of the embodiment of the present invention can be combined, divided and deleted according to actual needs. In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0132] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a storage medium. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, terminal, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention.

[0133] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed by the present invention, and these modifications or replacements should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A safety detection method for a nuclear power plant control system, characterized in that: include: Acquiring a system design strategy for the nuclear power plant control system, performing a risk analysis on the system design strategy to determine whether there is a risk, and generating a risk assessment result; If the risk assessment result shows that the system design strategy has risks, then obtaining several items to be detected in the system design strategy; Determine whether the item to be tested meets the preset security test standard and obtain the security test result; Perform security testing on the items to be tested according to preset test case verification and generate security test results; A safety assessment is performed based on at least one of the safety detection result, the safety test result, and the risk assessment result, and a safety assessment report of the nuclear power plant control system is generated.

2. The method according to claim 1, characterized in that The step of performing risk analysis on the system design strategy to determine whether there is a risk includes: Detecting whether there is a network communication interface connected to the outside in the system design strategy; If it exists, determining whether the network communication interface is a remote access interface or a redundant interface, and if it is one of the interfaces, generating a safety assessment report indicating that the control system has a high risk, wherein the redundant interface is an interface that is not used and not disabled; If the network communication interface is not the remote access interface or the redundant interface, a risk assessment result indicating that the network communication interface is at risk is generated.

3. The method according to claim 1, characterized in that The items to be detected include system design items, and the system design items include software system design items and hardware system design items. The step of determining whether the items to be detected meet the preset safety detection standards includes: Traversing the software system design items to determine whether the software system design items have preset software security attributes; If the software system design items do not have the preset software security attributes in total, determining whether the hardware system design items have the preset hardware security attributes; If the hardware system design items collectively possess the preset hardware security attributes, then it is determined that the system design items meet the preset security detection standards.

4. The method according to claim 3, characterized in that The items to be tested include requirement items, and after the step of determining that the system design items meet the preset safety testing standards, the method further includes: Associating the requirement item with the system design item according to a preset association method, wherein one system design item can be associated with one or more requirement items; Determine whether the associated requirement items can realize the system design items and whether they have the preset requirement security attributes in total; If the total of the requirement items can realize the system design items and have the preset requirement security attributes, then it is determined that the requirement items meet the preset security detection standards.

5. The method according to claim 4, characterized in that The items to be tested include component design items, and after the step of determining that the requirement items meet the preset safety testing standards, the method further includes: Associating the component design item with the requirement item according to the preset association method; Determine whether the associated component design items can realize the requirement items and whether they have preset component security attributes in total; If the component design items can realize the requirement items in total and have the preset component security attributes, then it is determined that the component design items meet the preset security detection standards.

6. The method according to claim 5, characterized in that The items to be tested include method design items, and after the step of determining that the component design items meet the preset safety testing standards, the method further includes: Associating the method design item with the component design item according to the preset association method; Determine whether the associated method design items can implement the component design items and whether they collectively possess preset method security attributes; If the method design items can realize the component design items in total and have the preset method security attributes, then it is determined that the method design items meet the preset security detection standards.

7. The method according to claim 6, characterized in that The method design items include software method design items, the preset test case verification includes preset software test cases and preset system test cases, and the step of performing security testing on the items to be detected according to the preset test case verification includes: Performing static code analysis on software method design items having the preset method security attributes and dynamically testing them through the preset software test cases; Software system testing is performed on items associated with software method design items that pass dynamic testing through preset system test cases.

8. The method according to claim 7, characterized in that The method design items include hardware method design items, and the step of verifying the safety test of the items to be tested according to the preset test case includes: The preset system test cases are used to perform hardware system tests on the hardware method design items having the preset method security attributes and their associated items.

9. The method according to claim 8, characterized in that The step of performing safety assessment according to the safety detection result and the safety test result to generate a safety assessment report of the nuclear power plant control system comprises: Performing a security assessment on the items to be tested that have passed the security test according to the preset assessment items and the security test results, and obtaining corresponding assessment results; The evaluation results are totaled according to the weight ratio corresponding to each of the preset evaluation items to obtain a safety evaluation score; A safety assessment report of the control system is generated according to the safety detection result and the safety assessment score.

10. The method according to claim 9, characterized in that The step of performing a security assessment on the to-be-tested item that has passed the security test according to the preset assessment items and the security test result to obtain the corresponding assessment result comprises: Performing software security assessment on the software system design items and the corresponding requirement items, the component design items, and the software method design items according to the preset assessment items to obtain software assessment results; A hardware security assessment is performed on the hardware system design item and its corresponding requirement item, the component design item and the hardware method design item according to the preset assessment items to obtain a hardware assessment result.

11. A safety detection device for a nuclear power plant control system, characterized in that: include: a risk analysis unit, used for obtaining a system design strategy of the nuclear power plant control system, performing a risk analysis on the system design strategy to determine whether there is a risk, and generating a risk assessment result; an acquisition unit, configured to acquire a plurality of items to be detected in the system design strategy if the risk assessment result shows that the system design strategy has risks; A judging unit, used to judge whether the item to be detected meets the preset safety detection standard and obtain the safety detection result; A testing unit, used to perform a security test on the item to be tested according to a preset test case verification and generate a security test result; An evaluation unit is used to perform a safety evaluation based on at least one of the safety detection result, the safety test result, and the risk evaluation result, and generate a safety evaluation report for the nuclear power plant control system.

12. A computer device, characterized in that: The computer device comprises a memory and a processor, the memory stores a computer program, and the processor implements the method according to any one of claims 1 to 10 when executing the computer program.

13. A storage medium, characterized in that: The storage medium stores a computer program, wherein the computer program includes program instructions, and when the program instructions are executed by a processor, the method according to any one of claims 1 to 10 can be implemented.

Images