Test system and method suitable for city railway CTCS key management

Abstract

The invention discloses a test system and method suitable for city railway CTCS key management. The system comprises a test control system and a simulation test support system. The test control system is connected with real equipment; the test control system is composed of an interface unit, a test engine, a simulation unit, a password unit and an operation terminal, and has a virtual-real combined test capability; the test control system is externally connected with a real device through an interface unit. According to the device testing system, the tested device can be connected into the testing system, other real devices can also be connected into the testing system, a real device testing environment is formed, and the whole testing process is controlled through the testing system; and the simulation test support system comprises a virtualized cloud platform and a physical industrial personal computer, and provides network environment and computing resource support for the test control system. According to the invention, the test and verification work of the city railway CTCS key management system equipment is realized, the test process is standardized, the automatic test and verification process is realized, and a reliable test scheme is provided.

Description

Technical Field

[0001] The present invention relates to the technical field of high-speed railway and urban rail train operation control, and more particularly to a test system and method suitable for urban rail CTCS key management. Background Art

[0002] The Chinese Train Control System (CTCS) is one of the core technologies for ensuring railway transportation safety. The effective operation of the CTCS relies on reliable, secure, and efficient train-ground data exchange. High-level CTCS systems utilize wireless networks for bidirectional information exchange between trains and the ground. For example, CTCS-3 and CTCS-N train control systems utilize GSM-R wireless networks, with LTE or 5G wireless networks potentially being adopted in the future. According to GB / T 24339.2, which covers security-related communication requirements in open transmission systems, systems based on open networks must be protected against corruption and spoofing threats to ensure the authenticity and integrity of critical information exchanged between trains and the ground. Ground and onboard signaling equipment utilize encryption technology to ensure the authenticity and integrity of messages exchanged between the two parties. During each secure communication, both communicating parties authenticate their identities using an authentication key (KMAC). A session key (KSMAC) is generated based on the authentication key and used to symmetrically encrypt train-ground messages.

[0003] Currently, key management for the domestic CTCS system primarily relies on a Key Management Center (KMC), which is responsible for generating and managing keys for all safety signaling devices along the route and distributing them offline. Offline key distribution is divided into two levels. The first level distributes written transmission keys and encrypted authentication keys to signaling vendors. These keys are stored offline on removable media, and the authentication keys are then decrypted using the vendor's respective key file generation tool. In the second level, each vendor uses its own dedicated key file generation tool to convert the authentication keys into a key format file specific to the corresponding signaling device. This level of transmission is device-specific. The converted key format files are mostly distributed in plaintext or as simple variations of plaintext, with a few protected by the 3DES algorithm. This offline key distribution process carries the risk of key loss and leakage.

[0004] As a crucial component of urban agglomeration transportation, the train control system for intercity rail must balance the national railway CTCS standards with the specific needs of urban rail transit. To this end, the intercity rail CTCS key management system incorporates key management concepts from the national railway system, using commercial cryptographic algorithms. This system comprises a KMC, KMAC devices (such as TSRS, RBC, ATP / ATO), and Certificate Authority (CA) equipment. The KMC manages KMAC devices and KMACs based on instructions from key management personnel. KMAC devices manage KMACs based on instructions from the KMC and facilitate train-to-ground communications. The CA manages digital certificates for KM devices. KMAC devices include the Temporary Speed ​​Restriction Server (TSRS), Radio Block Center (RBC), and Automatic Train Protection (ATP) / Automatic Train Operation (ATO) equipment.

[0005] However, current research focuses primarily on key generation and usage, lacking systematic support for testing and verification of key management functions. For example, key issues such as whether key distribution processes are compliant, whether key storage capacity meets standards, and whether the system's anti-attack capabilities are sufficient lack laboratory-grade testing platforms and standardized testing methods.

[0006] The existing testing technology has the following major problems:

[0007] 1. Offline testing relies on manual operation: Verification of key management functions requires manual device configuration and key injection, which is inefficient and prone to human error.

[0008] 2. Incomplete test coverage: Existing simulation platforms focus on communication function verification and ignore the testing requirements of the entire key management lifecycle (such as key destruction and status query);

[0009] 3. Insufficient security attack simulation: The system lacks the ability to automatically simulate disguised attacks (such as man-in-the-middle attacks and DDoS attacks), making it difficult to assess the system's actual risk resistance.

[0010] 4. Lack of performance indicator verification: Key performance parameters such as key storage limit and device management scale lack quantitative testing methods.

[0011] These issues prevent the reliability and security of the CTCS key management system for urban rail transit from being fully verified before deployment, potentially leading to significant security risks such as key leakage and communication interruption. Therefore, a verification platform and methodology that supports both virtual and real-world integration and automated testing is urgently needed to comprehensively cover the testing requirements for key management functionality, performance, and security. Summary of the Invention

[0012] In view of this, the present invention provides a test system and method for CTCS key management suitable for urban rail transit, aiming to fill the technical gap in the field of testing and verification of CTCS key management system for urban rail transit, and provide technical guarantee for the efficient deployment and safe operation of the system.

[0013] In order to achieve the above object, the present invention adopts the following technical solutions:

[0014] In a first aspect, the present invention provides a test system for CTCS key management in urban rail, comprising: a test control system and a simulation test support system; the test control system is connected to real equipment; the real equipment includes a key management center, a certificate authorization device, a temporary speed limit server, a radio block center, and automatic train protection equipment and automatic train operation equipment;

[0015] Wherein, the test control system includes:

[0016] an interface unit configured to establish a communication connection between the simulation unit and the real device through a plurality of interfaces, and to provide interface data to the test engine;

[0017] The test engine is connected to the interface unit and calls the cryptographic unit; it is used to perform test logic control, network data monitoring and key synchronization operations of the entire test system;

[0018] a simulation unit, communicating with the real device through the interface unit, for generating a virtual KMAC device and interacting with the real device module for protocol consistency, and supporting fault injection;

[0019] The cryptographic unit is called by the test engine and simulation unit to implement key generation, secure storage encryption / decryption, and secure communication encryption / decryption functions;

[0020] Operation terminal, providing a human-computer interaction interface and supporting test sequence management, log recording and test result display;

[0021] The simulation test support system includes a virtualized cloud platform and a physical industrial computer, which provides network environment and computing resource support for the test control system.

[0022] Furthermore, the interface unit includes:

[0023] Ethernet interface module, used to connect real equipment with virtual ground equipment and provide a monitoring interface between the test engine and the Ethernet environment;

[0024] Wireless network interface module, used for wireless network interface between internal network environment and external network environment, including GSM-R network interface between real ATP / ATO and virtual ground equipment in simulation unit, virtual ATP / ATO and real ground equipment, and monitoring interface of test engine to GSM-R network environment;

[0025] An offline interface module configured to perform key injection operations through a USB storage medium.

[0026] Furthermore, the test engine includes:

[0027] The test control module is used to implement the test engine's control over the test process, issue instructions to the corresponding equipment according to the progress of the test sequence, promote the test, determine the data that needs to be monitored, and determine whether the test is completed;

[0028] The data capture module is used to monitor and capture the data required for testing in the network environment and analyze it, providing analysis results of the test data, or capturing, intercepting, and tampering with the data to implement fault injection;

[0029] The cryptographic unit calling module is used to call the functional interface of the cryptographic unit to implement the encryption and decryption functions of the ciphertext;

[0030] The key synchronization module is used to synchronize and store the keys issued by the key management system to each device, and is used for decryption after capturing ciphertext data.

[0031] Furthermore, the cryptographic unit includes:

[0032] A key generation module, used to generate keys required for secure communication;

[0033] A secure storage encryption / decryption module is used to perform encryption storage and decryption reading operations on key data in the storage medium;

[0034] The secure communication encryption / decryption module is used to encrypt and decrypt ciphertext during vehicle-ground communication.

[0035] Furthermore, the operation terminal includes:

[0036] The human-machine interface module is used to provide an interactive mode between the tester and the test platform, and to provide an interface for the tester's operation and various data displays;

[0037] The test device management module is used to manage the test devices connected to the test platform, including various real devices and simulated devices, and to implement the addition and deletion operations of connected real devices and simulated devices;

[0038] The test sequence query module is used to store and display the test sequences that comply with the test cases of the CTCS key management system for urban rail, allowing testers to select the required test sequence and execute it;

[0039] The logging module is used to record operations on the test platform, including operation time, operation content, and operation results.

[0040] In a second aspect, the present invention further provides a test method for urban rail CTCS key management, applying the test system for urban rail CTCS key management as described in any one of the first aspects, including:

[0041] S1. Connect real KMC devices, real CA devices, and KMAC devices to the test control system via Ethernet and wireless networks, and jointly establish a test environment based on the simulation test support system;

[0042] S2. Select a test sequence, including a system function test sequence, a performance test sequence, or an interface test sequence; or perform a camouflage attack test on the KMC;

[0043] S3. Based on the test engine, execute the automated test process for the selected test sequence;

[0044] S4. Inject fault test vectors based on test requirements; monitor and capture data packets and key changes during the test process to generate test data;

[0045] S5. Analyze the test data and generate a comprehensive test report including key synchronization status, response time, and attack defense capabilities.

[0046] Furthermore, in step S3, the system function test includes:

[0047] Key lifecycle management verification steps, which sequentially perform closed-loop testing of key generation, storage, distribution, use, and destruction; including fault injection operations; the fault injection operations include: tampering with data packet content, intercepting data packets, or modifying the key validity period;

[0048] Permission management verification steps, testing the operation permission management isolation function through multi-level user accounts;

[0049] Log audit verification steps to check the integrity of operation logs and compliance with storage cycles.

[0050] Furthermore, in step S3, the system performance test includes: automatically testing the key storage upper limit, device management quantity upper limit and response time of the key management system equipment.

[0051] Furthermore, in step S3, the system interface test includes:

[0052] Check the communication interface data between devices in the key management system for verification;

[0053] In the system interface test sequence, the test engine captures the corresponding data packets in the network and compares them with the data format specified in the technical conditions or specifications.

[0054] Furthermore, in step S3, the anti-counterfeiting attack test includes:

[0055] Masquerade device generation and illegal access: The simulation unit generates a virtual KMAC device with an illegal certificate and initiates a connection request to the KMC under test;

[0056] Man-in-the-middle attack simulation: The disguised device establishes communication links with the KMC and the real KMAC device at the same time, tampering with or stealing the interactive data;

[0057] DDoS attack simulation: Multiple camouflaged devices are generated through the virtualized cloud platform, which initiate high-frequency connection requests to the KMC to test the system's stress resistance.

[0058] Attack result determination: Check whether illegal connections are blocked through the KMC maintenance interface, and analyze the integrity of the attack events recorded in the log.

[0059] It can be seen from the above technical solutions that compared with the prior art, the present invention has the following technical advantages:

[0060] The present invention can realize the test and verification work of the CTCS key management system equipment of the urban rail transit, standardize the test process, realize the automated test and verification process, and provide a reliable test solution for the CTCS key management system of the urban rail transit. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0062] Figure 1 This is a schematic diagram of the overall architecture of the CTCS key management system for urban rail.

[0063] Figure 2This is a test system architecture diagram for CTCS key management for urban rail provided by the present invention.

[0064] Figure 3 This is a module interaction diagram of the test system for CTCS key management in urban rail provided by the present invention.

[0065] Figure 4 This is a flow chart of the system function test provided by the present invention.

[0066] Figure 5 This is a flow chart of the system performance test provided by the present invention.

[0067] Figure 6 This is a flow chart of the system interface test provided by the present invention.

[0068] Figure 7 This is a flow chart of the anti-masquerade attack test provided by the present invention. DETAILED DESCRIPTION

[0069] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0070] First, the technical terms involved in the present invention are explained as follows:

[0071] CTCS (Chinese Train Control System): Chinese Train Control System;

[0072] KMS (Key Management System): Key management system;

[0073] KMAC (Key Management Authentication Center): Key Management Authentication Center, responsible for key generation, distribution and identity authentication;

[0074] KSMAC (Session Key for Message Authentication Code): Session key, used for integrity verification and encryption of vehicle-ground communication messages;

[0075] KMC (Key Management Centre): Key Management Center, responsible for the full life cycle management of keys;

[0076] CA (Certificate Authority): Certificate authority device, responsible for issuing and managing digital certificates;

[0077] TSRS (Temporary Speed ​​Restriction Server): Temporary speed restriction server;

[0078] RBC (Radio Block Centre): Radio Block Center;

[0079] ATP (Automatic Train Protection): Train overspeed protection equipment;

[0080] ATO (Automatic Train Operation): automatic train operation equipment;

[0081] DDoS (Distributed Denial of Service): Distributed denial of service attack.

[0082] like Figure 1 As shown in the figure, the CTCS key management system of the urban rail transit uses KMC to realize the centralized management of the keys of the urban rail transit train control equipment (KMAC equipment), including key generation, online / offline distribution, addition, deletion, modification and query functions; CA is used to realize the network access credential management of KMS equipment (including KMC and KMAC equipment), including the generation, distribution and verification of digital certificates; KMAC equipment establishes a secure connection with the corresponding equipment based on the key distributed by KMC to realize the secure interaction of train control system data.

[0083] The CTCS key management system for urban rail transit involves a large number of new technologies and equipment related to key management functions, necessitating testing and verification of the key management system's overall functionality. As a full-lifecycle management system for key generation, storage, distribution, verification, use, query, backup, recovery, deletion, destruction, and archiving, the key management system plays a crucial role in the key function module. Related equipment must undergo thorough testing and verification to demonstrate that it meets functional requirements and performance indicators before it can be put into use.

[0084] Therefore, the embodiment of the present invention provides a test system for CTCS key management of urban rail, referring to Figure 2 As shown, it includes: a test control system and a simulation test support system. The test control system is connected to the real equipment; the real equipment includes a key management center KMC, a certificate authority device CA, a temporary speed limit server TSRS, a wireless block center RBC and an on-board KMAC device (real ATP / ATO).

[0085] The test control system consists of an interface unit, a test engine, a simulation unit, a cryptographic unit, and an operation terminal, and has the ability to test both virtual and real. The functions of each part are as follows:

[0086] The interface unit includes an Ethernet interface module, a wireless network interface module, and an offline interface module. The Ethernet interface module is used for the Ethernet interface between the platform's internal network environment and the external network environment, including the Ethernet interface between the real ground equipment (KMC, CA, TSRS, and RBC) and the virtual ground equipment (TSRS and RBC) in the simulation unit, as well as the test engine's monitoring interface for the Ethernet environment; the wireless network interface module is used for the wireless network interface between the platform's internal network environment and the external network environment, including the GSM-R network interface between the real ATP / ATO and the virtual ground equipment in the simulation unit, and between the virtual ATP / ATO and the real ground equipment, as well as the test engine's monitoring interface for the GSM-R network environment; the offline interface is a USB interface that provides a method of storing keys or digital certificates through a medium or manually injecting them. The interface unit is responsible for the interface function of the entire platform, has the function of exchanging information with external devices, connects external real devices with the platform's internal simulation equipment, and realizes the interface requirements of the test environment. At the same time, the interface unit is also responsible for providing interface data to the test engine for test control and execution.

[0087] The test engine is the core test logic unit of the test control system, responsible for implementing the core test logic of the entire test system and controlling the test execution process. The test engine consists of a test control module, a data capture module, a cryptographic unit call module, and a key synchronization module. The test control module controls the test process, issuing instructions to the corresponding devices based on the progress of the test sequence, driving the test, determining the data to be monitored, and determining test completion. The data capture module monitors and captures the data required for testing in the network environment, analyzes it, and provides test data analysis results. It can also capture, intercept, and tamper with data to implement fault injection. The cryptographic unit call module calls the cryptographic unit's functional interface to implement functions such as encryption and decryption of ciphertext. The key synchronization module synchronizes and stores the keys issued by the key management system to each device, and uses them for decryption after ciphertext data is captured. The test engine executes the corresponding test based on commands from the operator terminal and reports the test progress and results to the operator terminal. The test engine connects to the interface unit and calls the cryptographic unit, performing functions such as random number generation, key generation, encryption, decryption, signing, signature verification, data capture, random number analysis, and key synchronization.

[0088] The simulation unit is responsible for the operation of virtual train control equipment (TSRS, RBC) and virtual on-board equipment (ATP / ATO), simulating the access of KMAC equipment to the system under test, realizing the virtual device part of the simulation platform test environment, and having a fault injection function to simulate equipment failure conditions, such as storage key errors. According to the test requirements, there is no need for virtual devices to interface with each other, and they only interface with external real devices. The communication protocol is the same as the protocol between real devices and complies with the relevant technical conditions and specifications of the urban rail. By adding a virtual KMAC device to the simulation unit, system stress testing, performance testing, camouflage testing and other functions of the key management system can be realized. The simulation unit also needs to call the cryptographic unit to perform data encryption and decryption.

[0089] The cryptographic unit utilizes a hardware cryptographic module or device certified for commercial cryptography, including a key generation module, a secure storage encryption / decryption module, and a secure communication encryption / decryption module. The key generation module generates the keys required for secure communication. The secure storage encryption / decryption module stores ciphertext data or keys. This data requires encryption and protection, so encryption and decryption operations must be performed by the cryptographic unit during storage and reading. The secure communication encryption / decryption module encrypts and decrypts ciphertext during communication. The cryptographic unit is called by the test engine and simulation unit to implement key generation, secure storage encryption / decryption, and secure communication encryption / decryption, and is the core unit for the test system's key processing functions.

[0090] The operation terminal includes a human-machine interface module, a test device management module, a test sequence query module, and a logging module. The human-machine interface module provides a way for testers to interact with the test system, providing an interface for tester operations and various data displays. The test device management module manages the test devices connected to the test system, including various real and simulated devices, and enables the addition and removal of connected real and simulated devices. The test sequence query module stores and displays test sequences that comply with the test cases of the Urban Rail CTCS key management system. Testers can select the required test sequence to execute. The logging module records operations on the test system, including operation time, operation content, and operation results. For example, the time of device addition / deletion, the test device added / deleted, the result of device addition / deletion, the time of test sequence query, the time of test sequence execution, and the result of test sequence execution. The operation terminal implements human-machine interaction and features a human-machine interface. It is responsible for test device management, test sequence query, display of test progress and results, and test logging. It serves as the entry point for testers to operate the test system. Testers can control the key management system test through the operation terminal, observe the test process and results in real time, and query historical test results.

[0091] The test system control system interfaces with real devices (TSRS, RBC, ATP / ATO, KMC, CA) through interface units. This allows not only the device under test to be connected to the test system, but also other real devices to form a realistic device testing environment, allowing the test system to control the entire test process.

[0092] The simulation test support system provides underlying support for the platform's operation and testing. It delivers a software runtime environment through a virtualized cloud platform and physical industrial computers, and provides the network environment required for testing through local area networks (LANs), switches, and GSM-R networks. The virtualized cloud platform, using multiple servers, provides a stable, reliable, and hot-standby virtual machine runtime environment. Simulation equipment and various software can run on the virtual machines and communicate with external networks through the server's internal virtual LAN and the test system's interface units. Physical industrial computers provide a usable environment for software that must be installed on real machines (such as maintenance terminals and human-machine interfaces). The local area network, switches, and GSM-R network collectively provide the test system with the wired and wireless network environments required by real equipment and the test system.

[0093] The urban rail CTCS key management test system provided by the present invention is composed of a test control system and a simulation test support system. The core logic of the test process is controlled by a test engine to ensure the safe and efficient automatic execution of the test process. The test system has the function of testing and verifying the key management equipment, including but not limited to the equipment management function of the key management system, digital certificate management function, key management function (including key generation, storage, query and verification, destruction, deletion, use, distribution, archiving and key status management, etc.), authority management function, log recording and auditing function. The test system has the function of testing the system interface, performance indicators, security, and certificate management system of the equipment. It also has the function of equipment camouflage, which can simulate active attack tests on the key management system.

[0094] The interaction process of each module of the test system is as follows Figure 3 As shown in the figure. During the information exchange during the test process, the interface unit is responsible for completing the information exchange within and outside the platform, the real device and simulation units are responsible for forming the test equipment and simulation device environment, and the cryptographic unit is responsible for the operation of cryptographic-related functions. The information flow between the modules within these parts and the functions related to the test system is relatively simple, so it is described as a whole. In a complete test process, the interaction process of each module is as follows:

[0095] (1) The tester adds all the devices that need to be connected to the test in the test equipment management module through the human-machine interface.

[0096] (2) The tester uses the human-machine interface to query and select the required test sequence to execute in the test sequence query interface.

[0097] (3) The operation terminal sends the test sequence to be executed to the test engine.

[0098] (4) The test control module informs the data capture module of the data packets that need to be captured based on the monitoring targets set in the test sequence to be executed.

[0099] (5) The test control module sends fault injection instructions to the target simulation device and sends operation instructions to the target device according to the requirements of the test sequence to be executed.

[0100] (6) Business data is exchanged between each real device and the simulated device. During this process, the simulation unit calls the cryptographic unit to implement secure communication encryption / decryption of each simulated device.

[0101] (7) The data capture module continuously monitors the data packets in the interface unit and captures the required data packets for parsing. In this process, the module is called through the cryptographic unit to call the cryptographic unit's secure communication encryption / decryption and other cryptographic related functions.

[0102] (8) If the data interaction between devices involves a change in the key, the data capture module sends the relevant data to the key synchronization module, and the key synchronization module implements the test engine's synchronous modification and storage of the changed key.

[0103] (9) The data capture module returns the data packet analysis results that need to be monitored in the test to the test control module.

[0104] (10) The test control module returns the test results to the operation terminal based on the data monitoring results returned by the data capture module, and the log recording module records them.

[0105] (11) The tester queries the test results of the selected test sequence through the human-computer interface.

[0106] The test system for CTCS key management in urban rail transit provided by the present invention can be used for laboratory environment verification testing of the system, which helps to verify the functions of the key management system equipment, ensure that the equipment can meet the functional requirements of technical conditions and specifications, and can reduce the potential risks of the equipment before it is put into use to a certain extent, thereby achieving better economic and social benefits.

[0107] Based on the same inventive concept, the present invention further provides a test method for CTCS key management for urban rail transit, using the test system for CTCS key management for urban rail transit as described in the above embodiment. The method includes:

[0108] S1. Connect real KMC devices, real CA devices, and KMAC devices to the test control system via Ethernet and wireless networks, and jointly establish a test environment based on the simulation test support system;

[0109] S2. Select a test sequence, including a system function test sequence, a performance test sequence, or an interface test sequence; or perform a camouflage attack test on the KMC;

[0110] S3. Based on the test engine, execute the automated test process for the selected test sequence;

[0111] S4. Inject fault test vectors based on test requirements; monitor and capture data packets and key changes during the test process to generate test data;

[0112] S5. Analyze the test data and generate a comprehensive test report including key synchronization status, response time, and attack defense capabilities.

[0113] In this embodiment, the test method allows the tester to select an appropriate test sequence. The specific test method process varies for different test items. The device under test can be tested in terms of system function, system performance, and system interface. The use of a combination of virtual and real testing methods provides testers with a full range of automatic tests covering system requirements, standardizes the test process, and simplifies the operations during the test. In addition, a spoof attack test can also be performed, providing testers with a way to verify the device under test's ability to resist spoof attacks. Relying on the test system of the above embodiment, this method is simple to implement and does not require reliance on a large number of real devices, saving resources required for the test environment.

[0114] 1. System function testing includes:

[0115] Key lifecycle management verification steps, which sequentially perform closed-loop testing of key generation, storage, distribution, use, and destruction; including fault injection operations; the fault injection operations include: tampering with data packet content, intercepting data packets, or modifying the key validity period;

[0116] Permission management verification steps, testing the operation permission management isolation function through multi-level user accounts;

[0117] Log audit verification steps to check the integrity of operation logs and compliance with storage cycles.

[0118] Specific system function test process, such as Figure 4As shown, system functions include basic key management, key generation, key storage, key query and verification, key destruction, key usage, key distribution, key deletion, key archiving, key status management, as well as user rights management, logging, and auditing. Testing these functions requires direct user interaction. Users must issue commands on the KMC device's maintenance interface and observe the responses of the key management system devices through the maintenance interface, or view data through the maintenance interface. After the user selects a system function test sequence and issues an execution command, the test system opens the device maintenance interface associated with the test sequence and prompts the user with the test content and required actions. Simultaneously, the test system monitors interface data status and captures corresponding data packets on the network. If the test sequence requires fault injection (e.g., tampering with KMAC key information, key identifiers, or expiration date format), the captured data packets are modified accordingly and sent back to the original target device.

[0119] Fault injection operations mainly fall into three categories:

[0120] (1) Tampering with the data packet content, such as tampering with the key ownership KMC device ID, key serial number, communication device ID, key validity period, key content, key length, etc. in the KMAC key information;

[0121] (2) Intercepting data packets, so that the operation commands of the device under test cannot be issued normally, or the device under test cannot receive the receipt of the operation commands;

[0122] (3) Send a fault injection command to the simulated device to make a certain function of the simulated device fail or become abnormal, such as instructing the simulated device to modify the validity period of the key it uses. Finally, the user checks the response of each device and confirms the final test results.

[0123] 2. System performance testing includes: automated testing of the key storage limit, device management limit, and response time of the key management system equipment.

[0124] System performance testing process is as follows Figure 5As shown in the figure, the system performance test primarily examines the response time, storage limits, and interface device limits of the key management system devices (including KMC, CA, and KMAC devices). After the user selects a system performance test sequence and issues an execution command, the test system automatically executes operations based on the test sequence requirements to test system performance. For example, when testing the upper limit of the number of KMC stored keys, the test system automatically issues key generation instructions to the KMC device until the number reaches the technical requirement. The operator terminal then opens the KMC device remote maintenance interface for the user to check the number of KMC stored keys and confirm the test results. Taking the upper limit of the number of KMC managed devices as an example, the test system's simulation unit automatically generates simulated TSRS, simulated RBCs, and simulated ATP / ATOs, and adds KMAC devices to the KMC device until the number reaches the technical requirement. The operator terminal then opens the KMC device remote maintenance interface for the user to confirm the number of KMAC devices managed by the KMC. This process is automatically executed by the test system, eliminating the need for testers to manually perform each operation individually, saving tester time when a large number of operations are required. The specific parameters of the performance indicators of each device in the urban rail CTCS key management system are shown in Table 1.

[0125] Table 1 Specific parameters of equipment performance indicators of the CTCS key management system for urban rail

[0126] Performance indicators Specific parameters The number of keys stored in the key management system >100,000 Number of digital certificates stored in the key management system >100,000 The number of KMAC devices that the key management system can manage >1000 Concurrent key management system certificate volume >100 Log storage time saved by the key management system >180 days Maximum number of keys stored in the vehicle KMAC device >200 Maximum number of keys stored in the ground KMAC device >1000 Log storage time saved by KMAC device >90 days

[0127] 3. System interface testing includes:

[0128] Check the communication interface data between devices in the key management system for verification;

[0129] In the system interface test sequence, the test engine captures the corresponding data packets in the network and compares them with the data format specified in the technical conditions or specifications.

[0130] System interface testing process is as follows Figure 6 As shown in the figure, the system interface test primarily verifies the communication interface data between devices in the key management system. During the system interface test sequence, the operating platform automatically performs operations such as key generation. The test engine captures corresponding data packets from the network, compares them with the data format specified in the technical requirements or specifications, and returns the comparison results to the operating terminal for display. Finally, the operating terminal directly displays to the user whether the captured data packet format is compliant and automatically displays the test results.

[0131] 4. Anti-counterfeiting attack tests include:

[0132] Masquerade device generation and illegal access: The simulation unit generates a virtual KMAC device with an illegal certificate and initiates a connection request to the KMC under test;

[0133] Man-in-the-middle attack simulation: The disguised device establishes communication links with the KMC and the real KMAC device at the same time, tampering with or stealing the interactive data;

[0134] DDoS attack simulation: Multiple camouflaged devices are generated through the virtualized cloud platform, which initiate high-frequency connection requests to the KMC to test the system's stress resistance.

[0135] Attack result determination: Check whether illegal connections are blocked through the KMC maintenance interface, and analyze the integrity of the attack events recorded in the log.

[0136] As the core device of the CTCS key management system of the urban rail transit, KMC is responsible for the full life cycle management of KMAC and needs to have certain anti-masquerade attack capabilities. The test system provides corresponding test methods to test the anti-masquerade attack capabilities of KMC devices. The process of one of the test sequences is as follows: Figure 7 As shown in the figure, the real KMC device under test is connected to the test system network via Ethernet and connected to the virtual device generated in the simulation unit. After the user executes the anti-masquerading attack test sequence, the simulation unit begins generating fake KMAC devices and attempting to connect to the KMC device. These fake KMAC devices use self-signed certificates, expired or revoked certificates, or attempt to masquerade as legitimate devices to communicate with the KMC device. Alternatively, they can use forged certificates to communicate simultaneously with the KMC device under test and other real KMAC devices, achieving a man-in-the-middle attack. The test engine monitors data packets in real time on the network and determines the anti-masquerading capabilities of the device under test based on whether the KMC responds to the fake device and the results of the packet analysis, such as whether communication is established and whether service data is exchanged. Furthermore, the simulation unit generates a large number of fake devices that initiate high-frequency and high-volume connection requests to the device under test, simulating a DDoS attack on the real device under test. The test system uses dedicated virtual machines on a virtualized cloud platform or dedicated physical industrial computers to provide an operating environment for the large number of fake devices generated during the sequence. The virtual machines and industrial computers used were load-tested and configured to support the required number of spoofing devices for a sufficient test duration. The KMC device's maintenance interface confirmed the device's operational status and key management functionality, providing test results for the device's attack resistance, and comprehensively assessing its ability to resist spoofing attacks.

[0137] The test method for CTCS key management in urban rail transit provided by the present invention can standardize the equipment testing process, reduce the workload of testers during the testing process, improve test efficiency, and reduce test errors caused by human factors.

[0138] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Reference can be made to the common and similar parts between the various embodiments. For the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple, and the relevant parts can be referred to the method description.

[0139] The above description of the disclosed embodiments is intended to enable one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be readily apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention is not limited to the embodiments shown herein but is intended to conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A test system for CTCS key management in urban rail transit, characterized in that: include: Test control system and simulation test support system; The test control system is connected to real equipment; the real equipment includes a key management center, a certificate authorization device, a temporary speed limit server, a wireless block center, an automatic train protection device, and an automatic train operation device; Wherein, the test control system includes: an interface unit configured to establish a communication connection between the simulation unit and the real device through a plurality of interfaces, and to provide interface data to the test engine; The test engine is connected to the interface unit and calls the cryptographic unit; it is used to perform test logic control, network data monitoring and key synchronization operations of the entire test system; a simulation unit, communicating with the real device through the interface unit, for generating a virtual KMAC device and interacting with the real device module for protocol consistency, and supporting fault injection; The cryptographic unit is called by the test engine and simulation unit to implement key generation, secure storage encryption / decryption, and secure communication encryption / decryption functions; Operation terminal, providing a human-computer interaction interface and supporting test sequence management, log recording and test result display; The simulation test support system includes a virtualized cloud platform and a physical industrial computer, which provides network environment and computing resource support for the test control system.

2. A test system for CTCS key management in urban rail transit according to claim 1, characterized in that: The interface unit includes: Ethernet interface module, used to connect real equipment with virtual ground equipment and provide a monitoring interface between the test engine and the Ethernet environment; Wireless network interface module, used for wireless network interface between internal network environment and external network environment, including GSM-R network interface between real ATP / ATO and virtual ground equipment in simulation unit, virtual ATP / ATO and real ground equipment, and monitoring interface of test engine to GSM-R network environment; An offline interface module configured to perform key injection operations through a USB storage medium.

3. The test system for CTCS key management of urban rail according to claim 1, characterized in that: The test engine includes: The test control module is used to implement the test engine's control over the test process, issue instructions to the corresponding equipment according to the progress of the test sequence, promote the test, determine the data that needs to be monitored, and determine whether the test is completed; The data capture module is used to monitor and capture the data required for testing in the network environment and analyze it, providing analysis results of the test data, or capturing, intercepting, and tampering with the data to implement fault injection; The cryptographic unit calling module is used to call the functional interface of the cryptographic unit to implement the encryption and decryption functions of the ciphertext; The key synchronization module is used to synchronize and store the keys issued by the key management system to each device, and is used for decryption after capturing ciphertext data.

4. The test system for CTCS key management of urban rail transit according to claim 1, characterized in that: The cryptographic unit comprises: A key generation module, used to generate keys required for secure communication; A secure storage encryption / decryption module is used to perform encryption storage and decryption reading operations on key data in the storage medium; The secure communication encryption / decryption module is used to encrypt and decrypt ciphertext during vehicle-ground communication.

5. The test system for CTCS key management of urban rail transit according to claim 1, characterized in that: The operation terminal includes: The human-machine interface module is used to provide an interactive mode between the tester and the test platform, and provides an interface for the tester's operation and various data displays; The test device management module is used to manage the test devices connected to the test platform, including various real devices and simulated devices, and to implement the addition and deletion operations of connected real devices and simulated devices; The test sequence query module is used to store and display the test sequences that comply with the test cases of the CTCS key management system for urban rail, allowing testers to select the required test sequence and execute it; The logging module is used to record operations on the test platform, including operation time, operation content, and operation results.

6. A test method for CTCS key management in urban rail transit, characterized in that: The test system for urban rail CTCS key management according to any one of claims 1 to 5 is applied, comprising: S1. Connect real KMC devices, real CA devices, and KMAC devices to the test control system via Ethernet and wireless networks, and jointly establish a test environment based on the simulation test support system; S2. Select a test sequence, including a system function test sequence, a performance test sequence, or an interface test sequence; or perform a camouflage attack test on the KMC; S3. Based on the test engine, execute the automated test process for the selected test sequence; S4. Inject fault test vectors based on test requirements; monitor and capture data packets and key changes during the test process to generate test data; S5. Analyze the test data and generate a comprehensive test report including key synchronization status, response time, and attack defense capabilities.

7. A test method for CTCS key management in urban rail transit according to claim 6, characterized in that: In step S3, the system function test includes: Key lifecycle management verification steps, which sequentially perform closed-loop testing of key generation, storage, distribution, use, and destruction; including fault injection operations; the fault injection operations include: tampering with data packet content, intercepting data packets, or modifying the key validity period; Permission management verification steps, testing the operation permission management isolation function through multi-level user accounts; Log audit verification steps to check the integrity of operation logs and compliance with storage cycles.

8. The test method for CTCS key management in urban rail transit according to claim 6, characterized in that: In step S3, the system performance test includes: automatically testing the key storage limit, device management quantity limit and response time of the key management system equipment.

9. The test method for CTCS key management in urban rail transit according to claim 6, characterized in that: In step S3, the system interface test includes: Check the communication interface data between each device in the key management system for verification; In the system interface test sequence, the test engine captures the corresponding data packets in the network and compares them with the data format specified in the technical conditions or specifications.

10. The test method for CTCS key management in urban rail transit according to claim 6, characterized in that: In step S3, the anti-counterfeiting attack test includes: Masquerade device generation and illegal access: The simulation unit generates a virtual KMAC device with an illegal certificate and initiates a connection request to the KMC under test; Man-in-the-middle attack simulation: The disguised device establishes communication links with the KMC and the real KMAC device at the same time, tampering with or stealing the interactive data; DDoS attack simulation: Multiple camouflaged devices are generated through the virtualized cloud platform, which initiate high-frequency connection requests to the KMC to test the system's stress resistance. Attack result determination: Check whether illegal connections are blocked through the KMC maintenance interface, and analyze the integrity of the attack events recorded in the log.

Images