A safety detection method, device, equipment and medium for a nuclear power plant control system

Abstract

This invention discloses a safety testing method, apparatus, equipment, and medium for a nuclear power plant control system. The method includes: acquiring the system design strategy of the nuclear power plant control system; performing risk analysis on the system design strategy to determine whether any risks exist, and generating a risk assessment result; if the risk assessment result indicates that the system design strategy has risks, acquiring several items to be tested from the system design strategy; determining whether the items to be tested meet preset safety testing standards, and obtaining safety testing results; verifying the safety testing of the items to be tested according to preset test cases, and generating safety test results; performing a safety assessment based on at least one of the safety testing results, safety test results, and risk assessment results, and generating a safety assessment report for the nuclear power plant control system. By implementing the method of this invention, the problem of the inability to effectively detect and assess the safety of nuclear power plant control systems in the prior art can be solved.

Description

Technical Field

[0001] This invention relates to the technical field of nuclear power safety, and in particular to a safety detection method, device, equipment and medium for a nuclear power plant control system. Background Technology

[0002] With the continuous evolution and breakthroughs in digital and intelligent technologies, intelligent control systems, with their significant advantages in stability, reliability, accuracy, and ease of maintenance, have gradually emerged in the nuclear power industry control field, replacing traditional analog equipment. Under this development trend, the widespread application of intelligent systems and equipment in the design and development stages of nuclear power plants, as well as in the upgrading and renovation of existing nuclear power plants, has become an inevitable trend. However, given the extreme importance of nuclear power plant safety, ensuring the information security of intelligent control systems and their security in practical applications has become a critical issue that urgently needs to be addressed. Unfortunately, current technological advancements have not yet proposed specific and feasible operational methods for security prevention and in-depth analysis of intelligent control systems in nuclear power plants, which makes it impossible to objectively and effectively detect and evaluate the security of nuclear power plant control systems. Summary of the Invention

[0003] This invention provides a method, apparatus, equipment, and medium for safety detection of nuclear power plant control systems, aiming to solve the problem that existing technologies cannot effectively detect and evaluate the safety of nuclear power plant control systems.

[0004] In a first aspect, embodiments of the present invention provide a safety testing method for a nuclear power plant control system, comprising: acquiring a system design strategy of the nuclear power plant control system; performing risk analysis on the system design strategy to determine whether a risk exists, and generating a risk assessment result; if the risk assessment result indicates that the system design strategy has a risk, acquiring a plurality of items to be tested in the system design strategy; determining whether the items to be tested meet a preset safety testing standard, and acquiring a safety testing result; verifying the safety testing of the items to be tested according to preset test cases, and generating a safety test result; performing a safety assessment based on at least one of the safety testing result, the safety test result, and the risk assessment result, and generating a safety assessment report for the nuclear power plant control system.

[0005] Secondly, embodiments of the present invention also provide a safety testing device for a nuclear power plant control system, comprising: a risk analysis unit, configured to acquire the system design strategy of the nuclear power plant control system, perform risk analysis on the system design strategy to determine whether a risk exists, and generate a risk assessment result; an acquisition unit, configured to acquire a plurality of items to be tested in the system design strategy if the risk assessment result indicates that the system design strategy has a risk; a judgment unit, configured to determine whether the items to be tested meet a preset safety testing standard and acquire a safety testing result; a testing unit, configured to perform safety testing on the items to be tested according to preset test cases and generate a safety test result; and an evaluation unit, configured to perform a safety evaluation based on at least one of the safety testing result, the safety test result, and the risk assessment result, and generate a safety evaluation report for the nuclear power plant control system.

[0006] Thirdly, embodiments of the present invention also provide a computer device, which includes a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the above-described method.

[0007] Fourthly, embodiments of the present invention also provide a computer-readable storage medium storing a computer program, the computer program including program instructions that, when executed by a processor, can implement the above-described method.

[0008] This invention provides a safety testing method, apparatus, equipment, and medium for a nuclear power plant control system. The method includes: acquiring the system design strategy of the nuclear power plant control system; performing a risk analysis on the system design strategy to determine if any risks exist and generating a risk assessment result; if the risk assessment result indicates that the system design strategy has risks, acquiring several items to be tested from the system design strategy; determining whether the items to be tested meet preset safety testing standards and obtaining safety testing results; verifying the safety testing of the items to be tested according to preset test cases and generating safety test results; and performing a safety assessment based on at least one of the safety testing results, the safety test results, and the risk assessment results to generate a safety assessment report for the nuclear power plant control system. This invention provides a comprehensive safety analysis of the intelligent control system within a nuclear power plant. This addresses the problem of existing technologies being unable to effectively detect and assess the safety of nuclear power plant control systems. Furthermore, it offers a guiding method, operational guidelines, and platform for the safety analysis process of nuclear power plant control systems, thereby improving the standardization and automation of safety analysis and providing technical support for information security assessments in nuclear power plants. Attached Figure Description

[0009] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0010] Figure 1 A flowchart illustrating the safety detection method for a nuclear power plant control system provided in an embodiment of the present invention;

[0011] Figure 2 This is a schematic diagram of a sub-process of the safety detection method for a nuclear power plant control system provided in an embodiment of the present invention;

[0012] Figure 3 This is a schematic diagram of a sub-process of the safety detection method for a nuclear power plant control system provided in an embodiment of the present invention;

[0013] Figure 4 This is a schematic diagram of a sub-process of the safety detection method for a nuclear power plant control system provided in an embodiment of the present invention;

[0014] Figure 5This is a schematic diagram of a sub-process of the safety detection method for a nuclear power plant control system provided in an embodiment of the present invention;

[0015] Figure 6 This is a schematic diagram of a sub-process of the safety detection method for a nuclear power plant control system provided in an embodiment of the present invention;

[0016] Figure 7 This is a schematic diagram of a sub-process of the safety detection method for a nuclear power plant control system provided in an embodiment of the present invention;

[0017] Figure 8 This is a schematic diagram of a sub-process of the safety detection method for a nuclear power plant control system provided in an embodiment of the present invention;

[0018] Figure 9 This is a schematic diagram of a sub-process of the safety detection method for a nuclear power plant control system provided in an embodiment of the present invention;

[0019] Figure 10 This is a schematic block diagram of a safety detection device for a nuclear power plant control system provided in an embodiment of the present invention.

[0020] Figure 11 A schematic block diagram of a computer device provided for an embodiment of the present invention. Detailed Implementation

[0021] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0022] It should be understood that, when used in this specification and the appended claims, the terms "comprising" and "including" indicate the presence of the described features, integrals, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.

[0023] It should also be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the invention. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0024] It should also be further understood that the term "and / or" as used in this specification and the appended claims refers to any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0025] Please see Figure 1 , Figure 1 This is a flowchart illustrating a safety detection method for a nuclear power plant control system provided in an embodiment of the present invention. The safety detection method for a nuclear power plant control system in this embodiment can be applied to the safety detection of intelligent control systems within a nuclear power plant. This method can effectively protect the intelligent control systems and intelligent equipment within a nuclear power plant, solving the problem that existing technologies cannot effectively detect and evaluate the safety of nuclear power plant control systems.

[0026] Figure 1 This is a flowchart illustrating a safety testing method for a nuclear power plant control system provided in an embodiment of the present invention. As shown in the figure, the method includes the following steps S110-S150.

[0027] S110. Obtain the system design strategy of the nuclear power plant control system, perform risk analysis on the system design strategy to determine whether there is a risk, and generate risk assessment results.

[0028] In this embodiment, the nuclear power plant control system is a complex algorithm and architecture control system within the nuclear power plant, incorporating intelligent sensing, computing, human-computer interaction, and learning. It is understood that a nuclear power plant may include multiple intelligent control systems, and this invention provides a method for safety detection of one of these control systems. The system design strategy is a system design document, which includes all design schemes and implementation methods for the control system. A risk analysis is performed on the system design strategy to determine the existence of risks and generate a risk assessment result. Specifically, based on the system design strategy, information on interfaces in the control system that can connect to external systems is obtained. These interfaces include hard-wired interfaces and network communication interfaces. The presence of risks associated with these hard-wired interfaces and network communication interfaces is determined to generate corresponding risk assessment results. For example, if the system design strategy indicates that the intelligent system only includes hard-wired interfaces, a risk assessment result indicating that the control system has no risks can be generated. This is because hard-wired interfaces connect different parts of electronic devices via wires, such as AI / AO (analog input / output) and DI / DO (digital input / output) interfaces, making the probability of risk extremely low. Therefore, a risk assessment result indicating that the control system has no risks can be generated. By performing risk analysis on the system design strategy to determine the existence of risks, the system design can be identified, and unnecessary safety checks can be avoided.

[0029] In one embodiment, such as Figure 2 As shown, step S110 further includes steps S111-S113.

[0030] S111. Detect whether there is a network communication interface for connecting to the outside in the system design strategy;

[0031] S112. If it exists, determine whether the network communication interface is a remote access interface or a redundant interface. If it is one of the interfaces, generate a safety assessment report that the control system has a high risk. The redundant interface is an interface that is not used and is not disabled.

[0032] S113. If the network communication interface is not the remote access interface or the redundant interface, a risk assessment result is generated indicating that the network communication interface has a risk.

[0033] In this embodiment, the network communication interface is an interface for data communication via network protocol. The system design strategy detects whether there are external network communication interfaces or hard-wired interfaces in the system design. If only hard-wired interfaces exist, no further judgment is needed; a risk assessment result without risk is directly generated, and a safety assessment is performed to generate a safety assessment report for the nuclear power plant control system. If the network communication interface exists, it indicates a safety hazard in the control system. Further detection is then performed to determine whether the network communication interface is a remote access interface or a redundant interface. The remote access interface is an interface that allows users or administrators to remotely access and control servers or other devices via a network. Such interfaces typically provide the same permissions and functions as local access, allowing users and administrators to perform various operations without physical contact with the device. Redundant interfaces are those that are neither used nor disabled; for example, interfaces that are factory-installed on the equipment corresponding to the intelligent control system but are not used in practice and are not physically disabled. If the network communication interface is either a remote access interface or a redundant interface, a high-risk security assessment report is directly generated for the control system. If it is neither a remote access interface nor a redundant interface, a risk assessment result for the network communication interface is generated, and further judgment is made on the intelligent control system with potential risks. A preliminary risk analysis of the control system is conducted based on the system design strategy to facilitate further judgment based on the analysis results.

[0034] S120. If the risk assessment results show that the system design strategy has risks, then obtain several items to be tested in the system design strategy.

[0035] In this embodiment, if the risk assessment result indicates that the system design strategy has risks, further testing is performed on the control system. Specifically, several system design items and several method design items from the system design strategy are obtained. The item to be tested is the smallest design item after the system design document content is converted into design items. Specifically, the item to be tested refers to the smallest component in a system or product that can independently achieve a certain function or possess a certain characteristic. The items to be tested include software / hardware system design items, requirement items, component design items, and method design items. For example, a module, a class, an interface, or a database table are software component design items, while a circuit board or a camera device are hardware component design items. The system design strategy can be optimized by using a security analysis object module to obtain several items to be detected. This module needs to provide the object type of each item, the encoding and content input by the analysis operator, the content and time of modifications made by the operator to each item, and the requirement to immediately update the corresponding content in the parent item after an update is detected. Furthermore, after an update is detected, the module should return to the node where the item first appeared and re-obtain the item. The specific analysis method is not limited, as long as it meets the above requirements; for example, it can be implemented using Java or similar functional code. By performing layer-by-layer security checks on the control system when risks exist, accurate detection results can be obtained.

[0036] S130. Determine whether the item to be detected meets the preset security detection standard and obtain the security detection result.

[0037] In this embodiment, the security detection result is a detection result generated for the item to be detected. The system design strategy includes multiple items to be detected, including system design items (software / hardware), requirement items, component design items, and method design items. Each system design item requires one or more requirement items to implement, each requirement item requires one or more component design items to implement, and each component design item requires one or more method design items to implement. The system first determines whether the item to be detected meets a preset security detection standard. If it does, the requirement item is evaluated; if the requirement item meets the preset security detection standard, the component design item is evaluated, and so on, until the method design item is evaluated. Based on the judgment results at each stage, different security assessment reports are generated. For example, if the system design item does not meet the preset security testing standards, a security assessment report indicating a risk in the system design is generated, and related explanations are provided in the user manual. This explains that additional physical access control measures and management methods need to be provided by the user in the usage environment, or network security devices such as firewalls, intrusion detection, and traffic auditing need to be added to the device in the entire communication network to ensure the security of the intelligent control system. If the requirement item does not meet the preset security testing standards, a corresponding analysis problem description needs to be generated, and the process of obtaining the items to be tested is returned, allowing staff to supplement the design and generate a security testing report indicating that the system design item does not meet the preset security testing standards. By judging whether the items to be tested meet the preset security testing standards, security testing results are obtained, and the control system is subjected to security testing layer by layer, saving testing time while obtaining accurate testing results.

[0038] In one embodiment, such as Figure 3 As shown, step S130 includes steps S131-S133.

[0039] S131. Traverse the software system design entries and determine whether the software system design entries have preset software security attributes;

[0040] S132. If the total number of software system design items does not have the preset software security attribute, then determine whether the hardware system design items have the preset hardware security attribute.

[0041] S133. If the hardware system design items collectively possess the preset hardware security attributes, then the system design items are determined to meet the preset security detection standard.

[0042] In this embodiment, the system design entries constitute the entire control system. Therefore, the system design entries include corresponding software system design entries and hardware system design entries. A software design entry is the smallest software-level component capable of independently implementing a certain function or possessing a certain characteristic. For example, setting different types of access permissions or generating operation logs are software system design entries. A hardware system design entry is the smallest hardware-level component capable of independently implementing a certain function or possessing a certain characteristic. For example, a cabinet, lock, or monitoring equipment. It is understood that both software system design entries and hardware system design entries have corresponding software or hardware requirement entries, component design entries, and method design entries. The preset software security attributes are the attributes that the software system items should collectively possess to protect the safety of the nuclear power system. Specifically, in this embodiment, the preset software security attributes are integrity, confidentiality, availability, and auditability. When judging all software system design items, it can be determined whether the software system design items have technical designs to ensure integrity (such as CRC check, offline modification), technical designs to ensure data confidentiality (such as key encryption, private communication protocols, special communication fields, etc.), technical designs to ensure access authorization (such as access permissions for different personnel types), and technical designs to ensure auditability of the operation process (such as access control with personal identification code + password, personal identification code + operation record, etc.). If the software system design items collectively possess the above-mentioned software security attributes, then the system design items are determined to meet the preset security detection standards. If the software system design items do not collectively possess the preset software security attributes, then it is determined whether the hardware system design items possess the preset hardware security attributes. Specifically, it is determined whether the hardware system design items have technical designs to ensure that data is not tampered with (e.g., cabinet + lock), technical designs to ensure that data is not illegally obtained (e.g., physical access control measures such as cabinet + lock), technical designs to ensure that legitimate personnel can use the system (e.g., multi-layered cabinet, lock, and other physical protection), and technical measures to achieve auditability (e.g., cabinet + lock + alarm, video monitoring + motion capture alarm, etc.). If the hardware security attributes are collectively possessed, then the system design strategy is determined to meet the preset security detection standards, and relevant explanations are provided in the user manual. Users can then perform corresponding operations during physical access control through management means. Otherwise, relevant explanations are provided in the user manual, requiring users to provide additional physical access control measures in the usage environment in conjunction with management means, or to add network security devices such as firewalls, intrusion detection, and traffic auditing to the device in the entire communication network to ensure the security of the intelligent control system.By detecting whether the hardware system design items corresponding to the system meet the preset security detection standards when the total number of software system design items does not meet the security detection strategy, the control system can be completely and accurately detected.

[0043] In one embodiment, such as Figure 4 As shown, step S133 is followed by steps S134-S136.

[0044] S134. Associate the requirement items with the system design items according to the preset association method;

[0045] S135. Determine whether the associated requirement items can fulfill the system design items and whether they collectively possess the preset requirement security attributes.

[0046] S136. If the total number of the required items can fulfill the system design items and has the preset security attribute, then the required items are determined to meet the preset security detection standard.

[0047] In this embodiment, the requirement design item represents a specific functional or performance requirement. These requirements will be used to guide the design and implementation of software or hardware. Specifically, the requirement item is determined based on the minimum requirement unit in the software or hardware requirement document, and it is typically constructed based on the system design item. For example, if the system design item is to set different types of access permissions, the minimum requirement item is that different identification information needs to be set according to different personnel responsibilities and levels for access control. The requirement item and the system design item are associated according to a preset association method. Specifically, a mapping relationship can be established between the requirement item and the system design item based on their corresponding functions. The requirement item and the system design item are associated through this mapping relationship. The specific association method is not limited, as long as it can sufficiently associate the two. The process involves determining whether the associated requirement items can fulfill the system design item and whether they collectively possess preset security attributes. A system design item can be associated with one or more requirement items. The process also determines whether the associated requirement items can fulfill the system design item. For example, if the system design item is setting access permissions, the process determines whether the associated requirement items can fulfill this function. If they can, the requirement items collectively fulfill the system design item. Simultaneously, the process determines whether they collectively possess preset security attributes. These preset security attributes are attributes that the requirement items should collectively possess to protect the software / hardware security of the nuclear power system. Specifically, in this embodiment, these preset security attributes are integrity, confidentiality, availability, and auditability. For example, the process checks whether the software-related requirement design items include requirements for data integrity verification, data encryption, setting access permissions, and generating operation logs. If several requirement design items collectively possess the preset security attributes, the system design item is determined to meet the preset security testing standards. If not, a corresponding analysis problem description needs to be generated, and the process returns to the analysis object entry flow, allowing staff to supplement the design and generate a security testing report that does not meet the preset security testing standards. The hardware requirements are also assessed for completeness, confidentiality, availability, and auditability, using methods similar to those for the system design requirements. The goal is to determine whether all requirements collectively meet the pre-defined security attributes. By ensuring the system design requirements meet the standards before conducting security checks on the software and hardware requirements, the control system is progressively tested from the largest to the smallest detail. This ensures that each step of the control system testing is conducted at the same depth, guaranteeing the accuracy of the test results.

[0048] In one embodiment, such as Figure 5 As shown, step S136 is followed by steps S137-S139.

[0049] S137. Associate the component design item with the requirement item according to the preset association method;

[0050] S138. Determine whether the associated component design items can fulfill the requirement items and whether they collectively possess the preset component security attributes.

[0051] S139. If the component design items can collectively fulfill the requirement items and possess the preset component security attributes, then the component design items are determined to meet the preset security detection standard.

[0052] In this embodiment, the component design entry represents a specific design element or component. These entries provide developers with detailed guidance on implementing the requirement entries. Specifically, the component entry is determined based on the smallest requirement unit in the software design document or hardware design document. One requirement entry corresponds to multiple component design entries. For example, if the requirement entry is to verify the identity of the visitor to ensure data security, then its corresponding component design entry could be a database storing user identities or a password lock for fingerprint verification. The component design entries are associated with the requirement entries according to the preset association method. The specific association method is the same as the association method between requirement entries and system design entries described above, and will not be repeated here. The system determines whether the associated component design items can fulfill the requirement item and whether they collectively possess the preset security attributes. That is, a requirement item can be associated with one or more component design items. The system determines whether the associated component design items can fulfill the requirement item. For example, if the requirement item is a function to set access permissions, the system determines whether the component design items can fulfill the requirement item. If the corresponding software design items collectively cannot fulfill the access permission setting, the system determines whether the hardware design items can fulfill it. If the hardware design items include a fingerprint-verified password lock to fulfill the access permission setting, the system determines that the component design items collectively fulfill the requirement item. Simultaneously, the system determines whether preset component security attributes are possessed. These preset component security attributes are attributes that the component design items should collectively possess to protect the software / hardware security of the nuclear power system. Specifically, in this embodiment, the preset component security attributes are integrity, confidentiality, availability, and auditability. For example, the system determines whether technical measures for integrity, confidentiality, availability, and auditability have been gradually implemented in the software / hardware design. Specific technical measures have been exemplified above for system design items and requirement items and will not be repeated here. By conducting safety checks on several component design items corresponding to the requirements items after the system design items and requirements items meet the standards, the control system can be subjected to safety checks at the same depth to ensure the accuracy of the test results.

[0053] In one embodiment, such as Figure 6 As shown, step S139 is followed by steps S1310-S1312.

[0054] S1310. Associate the method design entry with the component design entry according to the preset association method;

[0055] S1311. Determine whether the associated method design entries can implement the component design entries and whether they collectively possess the preset method security attributes;

[0056] S1312. If the total number of the method design items can realize the component design items and has the preset method security attribute, then the method design items are determined to meet the preset security detection standard.

[0057] In this embodiment, the method design entry is the smallest unit that implements the component design entry. For example, in software, the method design entry can be a function or method; in hardware, it can be a circuit board or component. The component entry is determined based on the smallest requirement unit in the software or hardware design file. One component design entry corresponds to multiple method design entries. For example, if the component design entry is a database storing personnel identities, its corresponding method design entry could be a data table storing personnel job titles, or a lock cylinder for fingerprint verification. The method design entry is associated with the component design entry according to the preset association method. The specific association method is the same as the association method between the requirement entry and the system design entry, and will not be repeated here. It is determined whether the associated method design entries can implement the component design entry and whether they collectively possess the preset method security attributes. That is, one component design entry can be associated with one or more method design entries. It is determined whether the associated method design entries can implement the component design entry. The determination process is similar to the process of determining whether the component design entry implements the requirement entry, and will not be repeated here. If the method design items collectively achieve the component design items, then it is determined whether they collectively possess preset method security attributes. These preset method security attributes are attributes that the method design items should collectively possess to protect the software / hardware security of the nuclear power system. Specifically, in this embodiment, the preset method security attributes are integrity, confidentiality, availability, and auditability. For example, it is determined whether technical measures for integrity, confidentiality, availability, and auditability have been progressively implemented in the software code or hardware design. By further performing security checks on the method design items after the system design items, requirement design items, and component design items meet the standards, the control system undergoes security checks at the same depth to ensure the accuracy of the test results.

[0058] S140. Perform security testing on the item to be tested according to the preset test cases, and generate security test results.

[0059] In this embodiment, the preset test cases are methods for testing the items to be tested. For example, for hardware-related items, the preset test cases describe how to test the entire hardware system to ensure that the various parts can work together correctly. Specifically, security tests are conducted on the items designed by the method, focusing on integrity, confidentiality, availability, and auditability, to determine whether the items to be tested can achieve the integrity, confidentiality, availability, and auditability they describe, and to generate corresponding security test results. It is important to note that the security test result for the items to be tested must be a pass. If it fails, subsequent security testing and evaluation will not be carried out, and the process will be paused, allowing operators to supplement the design so that the items to be tested can pass the security test. By conducting security tests on the items to be tested to determine whether the results described by the items can be achieved, it is possible to determine whether the entire control system can achieve the corresponding effect, thereby completing the security testing of the nuclear power plant control system.

[0060] In one embodiment, such as Figure 7 As shown, step S140 includes steps S141-S142.

[0061] S141. Perform static code analysis on software method design entries that have the preset method security attributes and perform dynamic testing on them using the preset software test cases.

[0062] S142. Perform software system testing on the items associated with the software method design items that have passed dynamic testing using preset system test cases.

[0063] In this embodiment, the method design entries include software method design entries, such as a method or a function. It is understood that a method design entry can pass security testing when it collectively possesses the preset method security attributes. That is, a method design entry may possess only one property. For example, if there are three method design entries, where method design entry A possesses confidentiality, method design entry B possesses integrity and availability, and method design entry C possesses auditability, then the method design entries collectively possess the preset method security attributes. Therefore, when testing the software method design entries, testing is performed based on their possessed preset method security attributes. Specifically, for method design entry A, which possesses confidentiality, the correctness of its encryption algorithm, the correctness of the data packet structure containing encrypted fields, and the correctness of the encryption timing are tested. Furthermore, normal communication testing with correct decryption and dynamic testing with abnormal communication due to incorrect decryption are performed using corresponding software test cases. The component design items and system design items associated with method design item A are then subjected to software system testing using preset system test cases. Specifically, the confidentiality of method design item A is tested by constructing normal communication tests with correctly encrypted policy data packets and abnormal communication tests with incorrectly encrypted policy data packets. Similarly, static code analysis is performed on method design item B, which possesses both integrity and usability. During integrity analysis, the correctness of the algorithm, the correctness of the data packet structure including check bits, and the correctness of the verification timing are verified. The method design item is then verified using correct data and tampered data through corresponding software test cases. Finally, the component design items and system design items associated with method design item B are subjected to software system testing using preset system test cases. Specifically, normal communication tests with correctly constructed data packets and abnormal communication tests with incorrectly constructed data fields are performed, and the test results are obtained. During usability testing, the correctness of the access control policy and access control authorization partitions in the code are analyzed, and normal communication tests with correctly authorized access, abnormal communication tests with incorrectly authorized access, and communication tests exceeding the authorized access range are performed through corresponding software test cases. The component design items and system design items associated with method design item B are then subjected to software system testing using preset system test cases. The system testing method is the same as the dynamic testing method and will not be elaborated further. When performing static code analysis on the auditable method design item C, the correctness of the algorithm's logging function and the correctness of the non-repudiation markers for personnel and operations are analyzed. The correctness of the logging function and the correctness of the non-repudiation markers for personnel and operations are checked during both dynamic and system testing, and will not be elaborated further. Security testing is then performed on the software method design items to verify whether the planned effects can be accurately achieved.

[0064] In one embodiment, step S140 includes step S143.

[0065] S143. Perform hardware system testing on the hardware method design items with the preset method security attributes and their associated items using the preset system test cases.

[0066] In this embodiment, the method design items include hardware design items. The system test cases describe how to test the entire system to ensure it meets all requirements and that the various parts can work together correctly. The hardware method design items are tested for integrity, confidentiality, availability, and auditability using the preset system test cases. Specifically, the preset system test cases determine whether the hardware method design items have physical protective enclosures (e.g., metal cabinets) or whether the physical protection is equipped with access control methods (e.g., locks) to test integrity, confidentiality, and auditability. The preset system test cases also determine whether the hardware method design items have physical protective enclosures, whether the physical protection is equipped with access control methods, and whether the access control partitions are correct to test availability. Security testing of the control system hardware determines whether the software and hardware aspects of the system can jointly maintain the use of the control system.

[0067] S150. Conduct a safety assessment based on at least one of the safety detection results, the safety test results, and the risk assessment results, and generate a safety assessment report for the nuclear power plant control system.

[0068] In this embodiment, the safety assessment report is a specific inspection report generated after a safety assessment of the nuclear power plant. The safety assessment report displays the risks present in the nuclear power plant's control system, its safety assessment score, and any problems discovered during the analysis. The safety assessment is conducted based on at least one of the safety inspection results, the safety test results, and the risk assessment results. Specifically, if the risk assessment result indicates no risk, a safety assessment report with a perfect score and no risk is directly generated. If the risk assessment result indicates risk, a corresponding safety assessment report is generated based on the safety inspection results and the safety test results. By generating a safety assessment report for the nuclear power plant's control system based on the safety inspection results, the safety test results, and the risk assessment results, operators can clearly understand the assessment results of the nuclear power plant's control system and identify areas for improvement.

[0069] In one embodiment, such as Figure 8 As shown, step S150 includes steps S151-S153.

[0070] S151. Perform a security assessment on the items to be tested that have passed the security test based on the preset assessment items and the security test results, and obtain the corresponding assessment results;

[0071] S152. The evaluation results are summed up according to the weight ratio of each preset evaluation item to obtain a security evaluation score.

[0072] S153. Generate a safety assessment report for the control system based on the safety test results and the safety assessment score.

[0073] In this embodiment, the evaluation result assesses whether the control system has any risks and the acceptability of those risks. The security evaluation score is an overall score for the security coefficient of the control system. Security evaluations are performed on the items to be tested that have passed the security test based on preset evaluation items and the security test results, obtaining corresponding evaluation results. Specifically, security evaluations are performed on the component designs, requirements, system designs, etc., corresponding to the method design items that have passed the security test. The preset evaluation items are integrity evaluation, confidentiality evaluation, availability evaluation, and auditability evaluation. Specifically, the system design items that have passed the security test are evaluated based on the preset evaluation items. For example, there are three system design items, and the security test results show that: a) system design item a passed the security test, b) system design item b failed the security test due to lack of confidentiality, and c) system design item c failed the security test due to lack of auditability. When the preset evaluation items are used to conduct a security assessment based on the security test results, a score of 10 for integrity, 6 for confidentiality, 10 for auditability, and 6 for availability can be generated for the control system. The assessment results are then summed according to the weight ratio of each preset evaluation item to obtain the final security assessment score. Specifically, the final security assessment score = integrity score * a + confidentiality score * b + availability score * c + auditability score * d. A corresponding security assessment report is generated based on the score. For example, if the security assessment score is greater than the preset excellent score, a test report indicating that the security test result of the control system is satisfactory can be generated. The specific preset score dividing line and the gradient of the assessment result can be set according to specific needs and are not limited thereto. It should be noted that a system design item has one or more corresponding requirement items, a requirement item has multiple corresponding component design items, and a component design item also has multiple corresponding method design items. Therefore, if the requirement items, component design items, or method design items within a system design item do not collectively possess a certain security property, the system design item also does not possess its corresponding security property. By conducting security assessments on items that pass the security test based on preset assessment items and the corresponding security test results, a security assessment report is generated, thereby unifying the evaluation criteria and improving the standardization and automation of security prevention analysis.

[0074] In one embodiment, such as Figure 9 As shown, step S151 is followed by steps S1511-S1512.

[0075] S1511. Based on the preset evaluation items, perform a software security evaluation on the software system design items and their corresponding requirement items, component design items and software method design items, and obtain the software evaluation results.

[0076] S1512. Perform hardware security assessment on the hardware system design item and its corresponding requirement item, component design item and hardware method design item according to the preset assessment items, and obtain hardware assessment results.

[0077] In this embodiment, a security assessment is performed on the software system design items to be tested based on preset evaluation items (integrity assessment, confidentiality assessment, usability assessment, and auditability assessment). Specifically, each software system design item and its corresponding item is checked one by one to see if they meet the requirements of the preset evaluation items, thereby obtaining the security assessment result of the software system. For example, the security assessment result of software system design item A shows that it has preset software security attributes and meets the preset security testing standards, but its associated requirement item a lacks integrity, and the component design item corresponding to its associated requirement item c lacks confidentiality. In this case, the final assessment result of software system design item A will be affected by requirement items a and c, and the software assessment result shows that software system design item A lacks both integrity and confidentiality. The same method is used to perform hardware security assessment on hardware system design items and their corresponding requirement items, component design items, and hardware method design items to obtain hardware assessment results. The hardware assessment results and the software assessment results constitute the final assessment result. By conducting security assessments on the software and hardware items that have passed security tests based on preset assessment items and the corresponding security test results, a security assessment report is generated to provide a more comprehensive security assessment and improve the standardization and automation of security prevention and analysis.

[0078] Figure 10 This is a schematic block diagram of a safety detection device 200 for a nuclear power plant control system provided in an embodiment of the present invention. Figure 10 As shown, corresponding to the above-described safety testing method for nuclear power plant control systems, the present invention also provides a safety testing device for nuclear power plant control systems. This safety testing device includes a unit for performing the above-described safety testing method for nuclear power plant control systems, and the device can be configured in a desktop computer, tablet computer, laptop computer, or other terminal. For details, please refer to... Figure 10 The safety detection device of the nuclear power plant control system includes a risk analysis unit 210, an image acquisition unit 220, a judgment unit 230, a testing unit 240, and an evaluation unit 250.

[0079] The risk analysis unit 210 is used to obtain the system design strategy of the nuclear power plant control system, perform risk analysis on the system design strategy to determine whether there is a risk, and generate risk assessment results.

[0080] In one embodiment, the risk analysis unit 210 includes an interface detection unit, a first generation unit, and a second generation unit.

[0081] An interface detection unit is used to detect whether there is a network communication interface for connecting to the outside in the system design strategy;

[0082] The first generation unit is used to determine whether the network communication interface is a remote access interface or a redundant interface if it exists. If it is one of the interfaces, a safety assessment report on the high risk of the control system is generated. The redundant interface is an interface that is not used and is not disabled.

[0083] The second generation unit is used to generate a risk assessment result for the network communication interface if the network communication interface is not the remote access interface or the redundant interface.

[0084] The acquisition unit 220 is used to acquire several items to be tested in the system design strategy if the risk assessment result shows that the system design strategy has risks.

[0085] The judgment unit 230 is used to judge whether the item to be detected meets the preset security detection standard and obtain the security detection result.

[0086] In one embodiment, the judgment unit 230 includes a first judgment unit, a second judgment unit, and a first determination unit.

[0087] The first judgment unit is used to traverse the software system design entries and determine whether the software system design entries have preset software security attributes.

[0088] The second judgment unit is used to determine whether the hardware system design items have the preset hardware security attribute if the total number of software system design items does not have the preset software security attribute.

[0089] The first determination unit is used to determine that the system design items meet the preset security detection standard if the total number of hardware system design items has the preset hardware security attribute.

[0090] In one embodiment, the judgment unit 230 includes a first association unit, a third judgment unit, and a second determination unit.

[0091] The first association unit is used to associate the requirement item with the system design item according to a preset association method, wherein one system design item can be associated with one or more requirement items;

[0092] The third judgment unit is used to judge whether the associated requirement items can realize the system design items and whether they collectively possess the preset requirement security attributes.

[0093] The second determination unit is used to determine that if the total number of the requirement items can achieve the system design items and has the preset requirement security attributes, then the requirement items meet the preset security detection standard.

[0094] In one embodiment, the judgment unit 230 includes a second association unit, a fourth judgment unit, and a third determination unit.

[0095] The second association unit is used to associate the component design item with the requirement item according to the preset association method;

[0096] The fourth judgment unit is used to judge whether the associated component design items can realize the requirement items and whether they collectively possess the preset component security attributes;

[0097] The third determination unit is used to determine that if the component design items can collectively achieve the requirement items and have the preset component security attributes, then the component design items meet the preset security detection standard.

[0098] In one embodiment, the judgment unit 230 includes a third association unit, a fifth judgment unit, and a fourth determination unit.

[0099] The third association unit is used to associate the method design item with the component design item according to the preset association method;

[0100] The fifth judgment unit is used to determine whether the associated method design entries can implement the component design entries and whether they collectively possess the preset method security attributes.

[0101] The fourth determination unit is used to determine that if the total number of the method design items can realize the component design items and has the preset method security attribute, then the method design items meet the preset security detection standard.

[0102] The test unit 240 is used to perform security tests on the item to be tested according to preset test cases and generate security test results.

[0103] In one embodiment, the test unit 240 includes an analysis unit and a software test unit.

[0104] The analysis unit is used to perform static code analysis on software method design entries that have the preset method security attributes and to perform dynamic testing on them using the preset software test cases;

[0105] The software testing unit is used to perform software system testing on the items associated with the software method design items that have passed dynamic testing, using preset system test cases.

[0106] In one embodiment, the test unit 240 includes a hardware test unit.

[0107] The hardware testing unit is used to perform hardware system testing on hardware method design items and their associated items that have the preset method security attributes using the preset system test cases.

[0108] The evaluation unit 250 is used to perform a safety assessment based on at least one of the safety detection results, the safety test results, and the risk assessment results, and generate a safety assessment report for the nuclear power plant control system.

[0109] In one embodiment, the evaluation unit 250 includes an evaluation subunit, a totaling unit, and a reporting unit.

[0110] The evaluation subunit is used to perform a security evaluation on the item to be tested that has passed the security test based on preset evaluation items and the security test results, and to obtain the corresponding evaluation results.

[0111] The totaling unit is used to sum the evaluation results according to the weight ratio of each preset evaluation item to obtain a security evaluation score.

[0112] The reporting unit is used to generate a safety assessment report for the control system based on the safety detection results and the safety assessment score.

[0113] In one embodiment, the evaluation unit 250 includes a software evaluation unit and a hardware evaluation unit.

[0114] The software evaluation unit is used to perform software security evaluation on the software system design items and their corresponding requirement items, component design items and software method design items according to the preset evaluation items, and to obtain software evaluation results.

[0115] The hardware evaluation unit is used to perform hardware security evaluation on the hardware system design items and their corresponding requirement items, component design items and hardware method design items according to the preset evaluation items, and obtain hardware evaluation results.

[0116] It should be noted that those skilled in the art can clearly understand that the specific implementation process of the safety detection device 200 and each unit of the above-mentioned nuclear power plant control system can be referred to the corresponding description in the foregoing method embodiments. For the sake of convenience and brevity, it will not be repeated here.

[0117] The safety detection device of the aforementioned nuclear power plant control system can be implemented as a computer program, which can, for example... Figure 11 It runs on the computer device shown.

[0118] Please see Figure 11 , Figure 11 This is a schematic block diagram of a computer device provided in an embodiment of this application. The computer device 500 can be a terminal or a server. The terminal can be an electronic device with communication functions, such as a smartphone, tablet, laptop, desktop computer, personal digital assistant, or wearable device. The server can be a standalone server or a server cluster composed of multiple servers.

[0119] See Figure 11 The computer device 500 includes a processor 502, a memory, and a network interface 505 connected via a system bus 501. The memory may include a non-volatile storage medium 503 and internal memory 504.

[0120] The non-volatile storage medium 503 may store an operating system 5031 and a computer program 5032. The computer program 5032 includes program instructions that, when executed, cause the processor 502 to perform a safety detection method for a nuclear power plant control system.

[0121] The processor 502 provides computing and control capabilities to support the operation of the entire computer device 500.

[0122] The internal memory 504 provides an environment for the operation of the computer program 5032 in the non-volatile storage medium 503. When the computer program 5032 is executed by the processor 502, the processor 502 can execute a safety detection method for a nuclear power plant control system.

[0123] This network interface 505 is used for network communication with other devices. Those skilled in the art will understand that... Figure 11 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device 500 to which the present application is applied. The specific computer device 500 may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0124] The processor 502 is used to run a computer program 5032 stored in a memory to implement the steps of the above method.

[0125] It should be understood that in the embodiments of this application, the processor 502 may be a central processing unit (CPU), or it may be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor.

[0126] It will be understood by those skilled in the art that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program includes program instructions and can be stored in a storage medium, which is a computer-readable storage medium. The program instructions are executed by at least one processor in the computer system to implement the process steps of the embodiments of the above methods.

[0127] Therefore, the present invention also provides a storage medium. This storage medium can be a computer-readable storage medium. The storage medium stores a computer program, wherein the computer program includes program instructions. When executed by a processor, the program instructions cause the processor to perform the steps of the method described above.

[0128] The storage medium can be any computer-readable storage medium capable of storing program code, such as a USB flash drive, portable hard drive, read-only memory (ROM), magnetic disk, or optical disk.

[0129] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0130] In the several embodiments provided by this invention, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For example, the division of each unit is merely a logical functional division, and there may be other division methods in actual implementation. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed.

[0131] The steps in the method of this invention can be adjusted, merged, or reduced in order according to actual needs. The units in the device of this invention can be merged, divided, or reduced according to actual needs. Furthermore, the functional units in the various embodiments of this invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0132] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, a terminal, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention.

[0133] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in the present invention, and these modifications or substitutions should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A safety detection method for a nuclear power plant control system, characterized in that, include: The system design strategy of the nuclear power plant control system is obtained, a risk analysis is performed on the system design strategy to determine whether there are any risks, and a risk assessment result is generated. If the risk assessment results show that the system design strategy has risks, then obtain several items to be tested in the system design strategy; The process involves determining whether the item to be tested meets a preset security testing standard and obtaining a security testing result. The item to be tested includes system design items and requirement items. The system design items include software system design items and hardware system design items. The step of determining whether the item to be tested meets the preset security testing standard includes: traversing the software system design items and determining whether each software system design item possesses a preset software security attribute; if all software system design items do not possess the preset software security attribute, then determining whether the hardware system design items possess a preset hardware security attribute; if all hardware system design items possess the preset hardware security attribute, then determining that the system design item meets the preset security testing standard; associating the requirement items with the system design items according to a preset association method, wherein one system design item is associated with one or more requirement items; determining whether the associated requirement items can implement the system design item and whether they collectively possess a preset requirement security attribute; if all requirement items can implement the system design item and possess the preset requirement security attribute, then determining that the requirement item meets the preset security testing standard. The security test is performed on the item to be tested according to the preset test cases, and the security test results are generated. A safety assessment is conducted based on at least one of the safety inspection results, the safety test results, and the risk assessment results, and a safety assessment report for the nuclear power plant control system is generated.

2. The method according to claim 1, characterized in that, The step of performing risk analysis on the system design strategy to determine whether there is any risk includes: Detect whether the system design strategy contains a network communication interface that connects to the outside world; If it exists, determine whether the network communication interface is a remote access interface or a redundant interface. If it is one of these interfaces, generate a safety assessment report that the control system has a high risk. The redundant interface is an interface that is neither used nor disabled. If the network communication interface is not the remote access interface or the redundant interface, a risk assessment result is generated indicating that the network communication interface has a risk.

3. The method according to claim 1, characterized in that, The items to be tested include component design items. After determining that the requirement items meet the preset security testing standards, the steps include: The component design item is associated with the requirement item according to the preset association method; Determine whether the associated component design items can fulfill the requirement items and whether they collectively possess the preset component security attributes; If the component design items collectively fulfill the requirement items and possess the preset component security attributes, then the component design items are determined to meet the preset security detection standard.

4. The method according to claim 3, characterized in that, The items to be tested include method design items. After the step of determining that the component design items meet the preset security testing standards, the following steps are included: The method design entries are associated with the component design entries according to the preset association method; Determine whether the associated method design entries can implement the component design entries and whether they collectively possess the preset method security attributes; If the total number of method design items can achieve the component design items and possess the preset method security attributes, then the method design items are determined to meet the preset security detection standard.

5. The method according to claim 4, characterized in that, The method design items include software method design items, and the preset test case verification includes preset software test cases and preset system test cases. The step of performing security testing on the items to be tested according to the preset test case verification includes: Static code analysis is performed on software method design entries that possess the preset method security attributes, and dynamic testing is conducted on them using the preset software test cases; Software system testing is performed on the items associated with the software method design items that have passed dynamic testing by using pre-set system test cases.

6. The method according to claim 5, characterized in that, The method design items include hardware method design items, and the step of performing security testing on the items to be tested according to preset test cases includes: Hardware system testing is performed on hardware method design entries and their associated entries that possess the preset method security attributes using the preset system test cases.

7. The method according to claim 6, characterized in that, The steps for conducting a safety assessment based on the safety inspection results and the safety test results, and generating a safety assessment report for the nuclear power plant control system, include: Based on the preset evaluation items and the security test results, a security evaluation is performed on the items to be tested that have passed the security test, and the corresponding evaluation results are obtained; The evaluation results are summed up according to the weight ratio of each preset evaluation item to obtain a security evaluation score. A safety assessment report for the control system is generated based on the safety test results and the safety assessment score.

8. The method according to claim 7, characterized in that, The step of performing a security assessment on the items to be tested that have passed the security test based on preset assessment items and the security test results, and obtaining the corresponding assessment results, includes: Based on the preset evaluation items, a software security evaluation is performed on the software system design items and their corresponding requirement items, component design items and software method design items to obtain the software evaluation results; Hardware security assessments are performed on the hardware system design items and their corresponding requirement items, component design items, and hardware method design items based on the preset assessment items, and hardware assessment results are obtained.

9. A safety detection device for a nuclear power plant control system, characterized in that, include: The risk analysis unit is used to obtain the system design strategy of the nuclear power plant control system, perform risk analysis on the system design strategy to determine whether there is a risk, and generate risk assessment results. The acquisition unit is used to acquire several items to be detected in the system design strategy if the risk assessment result shows that the system design strategy has a risk; A judgment unit is used to determine whether the item to be tested meets a preset security detection standard and obtain a security detection result. The item to be tested includes system design items and requirement items. The system design items include software system design items and hardware system design items. The step of determining whether the item to be tested meets the preset security detection standard includes: traversing the software system design items and determining whether the software system design items have preset software security attributes; if the software system design items do not have the preset software security attributes in total, then determining whether the hardware system design items have preset hardware security attributes; if the hardware system design items have the preset software security attributes in total, then determining whether the hardware system design items have the preset hardware security attributes. If the system design item meets the preset security testing standard, then the system design item is determined to meet the preset security testing standard. The system design item is associated with the requirement item according to a preset association method, wherein one system design item is associated with one or more requirement items. It is determined whether the associated requirement items can implement the system design item and whether they collectively possess the preset requirement security attribute. If the requirement items collectively implement the system design item and possess the preset requirement security attribute, then the requirement item is determined to meet the preset security testing standard. A testing unit is used to perform security testing on the item to be tested according to preset test cases and generate security test results. An evaluation unit is used to perform a safety assessment based on at least one of the safety inspection results, the safety test results, and the risk assessment results, and generate a safety assessment report for the nuclear power plant control system.

10. A computer device, characterized in that, The computer device includes a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the method as described in any one of claims 1-8.

11. A computer-readable storage medium, characterized in that, The storage medium stores a computer program, which includes program instructions that, when executed by a processor, can implement the method as described in any one of claims 1-8.

Images