A method for verifying consistency of a trusted policy of an sis system and related equipment
By using an automated comparison method with Python and Selenium tools, the problem of inconsistent trusted policies in SIS systems was solved, achieving efficient and accurate policy consistency verification. It supports multiple objects and module combinations, reducing the difficulty of operation and maintenance.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- HUANENG POWER INT CO LTD RIZHAO POWER PLANT
- Filing Date
- 2026-02-28
- Publication Date
- 2026-06-05
AI Technical Summary
In existing technologies, the trust policies of SIS systems are prone to inconsistencies among the trust management platform, trust agent, and trust computing software, resulting in low verification efficiency, high error rates, and difficulty in locating the problem.
The system uses Python programs in conjunction with Selenium to automate the comparison process. It automatically obtains the total number and content of strategies for each object to be compared, and generates an analysis results report. It supports the selection of combinations of 2-3 objects and any module, and outputs the comparison process and structured reports in real time.
It significantly shortens the verification time per transaction, improves efficiency, reduces the difficulty of troubleshooting, supports adaptation to different operation and maintenance scenarios, and reduces redundancy and errors in manual operations.
Smart Images
Figure CN122151747A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of industrial control security technology, and more specifically to a method for verifying the consistency of a trusted policy in a SIS system, a device for verifying the consistency of a trusted policy in a SIS system, an electronic device, and a computer-readable storage medium. Background Technology
[0002] Safety Instrumented Systems (SIS) serve as the core of safety assurance in industrial production processes. Their trusted management system relies on the collaborative work of three components: trusted computing software on the endpoints, trusted agents, and a trusted management platform. The trusted computing software is responsible for local policy execution on the endpoints, the trusted agents handle policy data transfer and temporary storage, and the trusted management platform is responsible for global policy distribution and monitoring. However, in practical applications, inconsistencies in trusted policies among these three components can easily arise due to the following issues: 1. Packet loss during network transmission resulted in the policies issued by the trusted management platform not being fully synchronized to the trusted agent; 2. Abnormal read / write permissions in the trusted proxy database lead to errors in policy storage or forwarding; 3. An error occurred in the execution of underlying commands in the trusted computing software, causing a discrepancy between the local policy and the agent synchronization policy; 4. Operational errors during manual configuration (such as incorrect IP address input or port number exceeding the valid range).
[0003] In existing technologies, policy consistency verification often relies on manual comparison: operations and maintenance personnel need to log in to the trusted management platform to export policy files, access the trusted agent database to query data, execute commands on terminal devices to obtain local policies, and then manually compare each item. This has the following technical drawbacks: 1. Low efficiency: When the SIS system contains hundreds of terminal devices, a single comparison can take several hours; 2. Prone to errors: Manual comparison is difficult to avoid missing details such as policy numbers and effective times; 3. Difficult to locate: It can only find "inconsistent" results and cannot quickly determine whether the problem lies in the management platform, agent, or terminal software.
[0004] Therefore, a new technical solution is urgently needed to solve the above-mentioned technical problems. Summary of the Invention
[0005] This application is made in consideration of the above-mentioned problems. According to one aspect of this application, a method for verifying the consistency of a trusted policy in a SIS system is provided, which uses a Python program combined with the Selenium tool to achieve automated comparison, including the following steps: Start the verification tool; Input the target device information and the trusted management platform information; Select the objects to be compared and the trusted policy modules to be compared. The objects to be compared are at least two of trusted computing software, trusted agents, and trusted management platforms. The trusted policy modules are one or more of trusted boot, static trusted verification, dynamic trusted verification, trusted whitelist, process protection, and application access control. Automatically obtain the total number of policies and policy content of the target trusted policy module for each object to be compared; Perform policy comparison according to the trusted policy module and output the comparison process; Generate an analysis results report, which includes comparison results and directions for problem identification.
[0006] Optionally, the target device information includes: device IP address, SSH connection username, password, port, trusted proxy database path, database password, database tool path, and trusted computing software command directory; the trusted management platform information includes: platform IP address, business administrator login username, and password.
[0007] Optionally, the methods for automatically obtaining policy content include: The trusted computing software calls underlying commands to obtain policy data. These underlying commands include btmv_check-v, atmv_check-F, dtmv_check-F, dtmv_check-l, atmv_check-W, atmv_check-l, and atmv_check-c. Connect to the trusted agent's SQLite database and query policy data using SQL statements; Use the Selenium tool to log in to the Trusted Management Platform and retrieve policy data by locating page elements.
[0008] Optionally, when there are three objects to be compared, the comparison and problem localization include: The strategies of trusted computing software and trusted management platform, trusted computing software and trusted agent, and trusted agent and trusted management platform are compared in turn. If the strategies of the three are consistent, then no anomaly is determined; if the trusted agent is consistent with the trusted computing software but different from the management platform, then the problem is located in the management platform; if the trusted agent is consistent with the management platform but different from the trusted computing software, then the problem is located in the trusted agent; if all three are different, then the trusted agent should be prioritized for identification.
[0009] Optionally, the method further includes: Check if the Python version in the current runtime environment is no lower than 3.6 and the Selenium tool version is no lower than 3.141.0; Verify the network connectivity of the target device's IP address using the ping command or TCP connection test; Verify the accessibility of the trusted management platform's IP address through HTTP / HTTPS request testing; If any test item fails, the corresponding failure message will be output and subsequent steps will be terminated. The verification tool will be restarted after the user has investigated the issue.
[0010] Optionally, the method further includes: verifying the validity of the target device information and the trusted management platform information, achieved through the following means: Verify that the device's IP address conforms to the IPv4 / IPv6 standard format; Verify that the SSH port number is within the valid range of 1-65535; Verify that the trusted proxy database path exists on the target device and has read and write permissions; Verify that the username and password are not empty; If any information is invalid, output the specific error and pause until valid information is input.
[0011] Optionally, the output comparison process includes: Displays the name of the currently compared trusted strategy module in real time; Update the number of strategies compared, the number of remaining strategies, and the consistency rate; For inconsistent strategies, output their number, strategy type, and difference field in each object to be compared.
[0012] Secondly, a SIS system trusted policy consistency verification device is also provided, comprising: The tool startup module is used to trigger the startup of the verification tool; The information input module is used to receive information related to the target device and information related to the trusted management platform; The object selection module is used to select the object to be compared and the trusted policy module to be compared. The object to be compared is at least two of trusted computing software, trusted agent, and trusted management platform. The trusted policy module is one or more of trusted startup, static trusted verification, dynamic trusted verification, trusted whitelist, process protection, and application access control. The strategy acquisition module is used to automatically acquire the total number and content of the target trusted strategy modules for each comparison object; The comparison and analysis module is used to perform policy comparison according to the trusted policy module and output the comparison process. The report generation module is used to generate analysis result reports, which include comparison results and directions for problem identification.
[0013] Thirdly, an electronic device is also provided, comprising: At least one processor; At least one memory for storing at least one program; When at least one program is executed by at least one processor, the at least one processor implements the SIS system trusted policy consistency verification method as described above.
[0014] Fourthly, a computer-readable storage medium is also provided, which stores a computer program that, when executed by a processor, implements the SIS system trusted policy consistency verification method as described above.
[0015] Based on the above technical solution, the entire process is automated using Python and Selenium, replacing manual operations and significantly reducing the time required for each verification, thus significantly improving efficiency. Furthermore, it supports combinations of 2-3 objects and any module, adapting to different operational scenarios and avoiding unnecessary redundant comparisons. Finally, it outputs the comparison process and structured reports in real time, eliminating the need for manual recording by operations personnel. This allows them to quickly grasp inconsistent modules and the general direction of anomalies, reducing the difficulty of troubleshooting.
[0016] The above description is only an overview of the technical solution of this application. In order to better understand the technical means of this application and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this application more obvious and understandable, the following are specific embodiments of this application. Attached Figure Description
[0017] The above and other objects, features, and advantages of this application will become more apparent from the more detailed description of the embodiments of this application in conjunction with the accompanying drawings. The accompanying drawings are used to provide a further understanding of the embodiments of this application and form part of the specification. They are used together with the embodiments of this application to explain this application and do not constitute a limitation thereof. In the accompanying drawings, the same reference numerals generally represent the same components or steps.
[0018] Figure 1 A schematic flowchart of a SIS system trusted policy consistency verification method according to an embodiment of this application is shown; Figure 2 A schematic block diagram of a SIS system trusted policy consistency verification apparatus according to an embodiment of this application is shown; Figure 3 A schematic block diagram of an electronic device according to one embodiment of this application is shown. Detailed Implementation
[0019] To make the objectives, technical solutions, and advantages of this application more apparent, exemplary embodiments according to this application will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of this application, and not all embodiments of this application. It should be understood that this application is not limited to the exemplary embodiments described herein. Based on the embodiments of this application described herein, all other embodiments obtained by those skilled in the art without inventive effort should fall within the protection scope of this application.
[0020] In order to at least partially solve the above-mentioned technical problems, an embodiment of this application provides a method for identifying myocardial motion abnormalities. Figure 1 A schematic flowchart of a SIS system trusted policy consistency verification method 100 according to an embodiment of this application is shown. Figure 1 As shown, method 100 may include, but is not limited to, the following steps S110, S120, S130, S140, S150 and S160.
[0021] Step S110: Start the verification tool.
[0022] For example, launch a trusted policy consistency verification tool developed in Python. This tool integrates the Selenium component and has automated functions for policy data collection, comparison, and report generation.
[0023] Optionally, after starting the verification tool, the tool automatically performs a pre-detection of the environment: Python version detection: The tool automatically executes the system command (Windows: python --version; Linux / macOS: python3 --version), captures the output (such as "Python3.8.10"), and extracts the version number (3.8.10). Selenium version detection: The tool obtains version information and extracts the version number (e.g., "3.141.0") through Python's pip package management command (pip show selenium). If both Python version ≥ 3.6 and Selenium version ≥ 3.141.0, the test is considered passed; if either condition is not met, the test is considered failed. In this case, a specific failure message can be output, in the format of "[Test Item]: [Current Status], [Requirement], [Suggested Action]" - for example, "Python version test: Current version 3.5, requires ≥ 3.6, it is recommended to execute 'pip install --upgradepython' to upgrade" or "Selenium version test: Current version 3.0, requires ≥ 3.141.0, it is recommended to execute 'pip install selenium==3.141.0' to install the specified version".
[0024] Network connectivity test: Automatically performs a network connectivity test based on the target device's IP address. Windows environment: Executes `ping -n3 [target IP]` (sends 3 ICMP request packets); Linux / macOS environment: Execute ping -c3 [target IP] (sends 3 ICMP request packets); If the ICMP protocol is blocked by the firewall (ping test fails), the tool automatically switches to TCP port testing: it attempts to establish a TCP connection with the target device's SSH port (default 22, or a port temporarily entered by the user) to check if the port is open. Specific criteria for judgment are: a ping test packet loss rate < 100% (i.e., at least one packet receives a response), or a TCP port test showing "port open," indicating a pass; if both fail, it is considered a failure. In this case, a specific failure message can be output, such as "Target device network connectivity test: IP=192.168.3.100, ping test packet loss rate 100%, TCP port 22 connection failed. It is recommended to check the device's firewall rules or confirm the IP address is correct."
[0025] Platform accessibility detection: Based on the trusted management platform IP address, automatically construct HTTP / HTTPS requests (HTTP by default, switch if the platform is configured with HTTPS), for example, send a GET request to "http: / / [platform IP]:[port] / login" (timeout is set to 5 seconds to avoid long waiting time); Capture request and response status codes (such as 200, 404, 500, and timeout). Specifically, a response status code of 200 (indicating normal page access) is considered a pass; a status code of 404 (page not found), 500 (internal server error), or timeout is considered a fail. In this case, output a specific failure message, such as "Trusted Management Platform Accessibility Detection: IP=192.168.3.200, HTTP request timed out (5 seconds). It is recommended to check the platform server's running status or port configuration."
[0026] If all three tests pass, proceed to the information input stage; if any test fails, immediately terminate all subsequent steps, leaving only the "Retest" button available. Users can click to re-execute the environment test after troubleshooting to avoid continuing an invalid process.
[0027] This allows for early identification of version, network, and platform issues, preventing subsequent steps from being interrupted due to the underlying environment. It significantly improves the continuity of the verification process and can directly output specific failure prompts, eliminating the need for maintenance personnel to check the code, network, and equipment one by one, thus significantly shortening the troubleshooting time.
[0028] Step S120: Input the relevant information of the target device and the relevant information of the trusted management platform.
[0029] For example, users can input two types of information through the tool's visual interface. Target device information: device IP address, SSH connection username / password / port (1-65535), trusted agent's SQLite database path (e.g., / opt / trust_agent / db / policy.db), database password, database tool path (e.g., / usr / bin / sqlite3), and trusted computing software command directory (e.g., / opt / trust_software / bin). Trusted management platform information: platform IP address and business administrator login username / password.
[0030] After the above information is entered, the tool can establish the following connections based on the specified parameters: remotely access the target device via “device IP + SSH parameters”, access the proxy database via “trusted proxy database path + database tool path + database password”, call underlying commands via “trusted computing software command directory”, and log in to the management platform via “platform IP + business administrator account”.
[0031] This clearly defines 6 types of target device parameters and 2 types of platform parameters, eliminating the need for users to manually determine the required information dimensions and reducing connection failures caused by missing critical information such as "SSH port" and "database password." Limiting "business administrator login information" prevents users from mistakenly entering low-privilege accounts (such as read-only guest accounts), ensuring the tool can access the management platform's policy data normally and reducing the probability of verification interruptions. The standardized information structure is adaptable to SIS target devices and management platforms from different vendors; as long as the information is entered according to the defined dimensions, the tool is universally applicable, requiring no adjustments to the input logic for different devices / platforms.
[0032] Step S130: Select the object to be compared and the trusted policy module to be compared. The object to be compared is at least two of trusted computing software, trusted agent, and trusted management platform. The trusted policy module is one or more of trusted boot, static trusted verification, dynamic trusted verification, trusted whitelist, process protection, and application access control.
[0033] For example, users can make two selections on the tool interface: Selection of comparison objects: Select at least two of the three objects, "Trusted Computing Software, Trusted Agent, and Trusted Management Platform", as comparison subjects (e.g., select "Trusted Computing Software + Trusted Agent" or "Trusted Computing Software + Trusted Agent + Trusted Management Platform"). Selection of Trusted Policy Modules to be Compared: Select one or more of the six commonly used trusted policy modules in SIS systems as comparison units (e.g., select "Static Trusted Verification + Dynamic Trusted Verification").
[0034] Step S140: Automatically obtain the total number of policies and policy content of the target trusted policy modules of each object to be compared.
[0035] For example, for different objects to be compared, corresponding automated methods can be used to obtain the strategy data of a specified module, specifically including: Trusted computing software policy acquisition: The tool connects to the target device via SSH protocol, automatically switches to the command directory of the trusted computing software, executes the software's underlying commands (such as executing btmv_check-v for the trusted startup module, executing atmv_check-F for the static trusted verification module, etc.), captures the command output results, and parses them to obtain the total number of policies of the target module (such as "a total of 18 trusted whitelist policies") and the specific content of each policy (such as "policy ID: WL003, allowed process: / usr / bin / java, effective time: 2025-01-01"). Trusted proxy policy acquisition: The tool calls a database tool (such as sqlite3) to connect to the trusted proxy's SQLite database and executes a preset SQL query statement (such as for the process protection module: SELECT policy_id, protect_process, priority FROM process_protect WHERE module='process_guard'). The total number and content of policies for the target module are extracted from the query results. Retrieving Trusted Management Platform Policies: The tool starts the Selenium component, automatically opens a browser and accesses the Trusted Management Platform IP address. Users enter their username and password to log in. Using Selenium's page element location functions (such as XPath and CSS selectors), the tool finds the table data of the target policy module (such as the policy table of the application access control module), counts the number of rows in the table to obtain the total number of policies, and extracts the table fields (such as policy ID, controlled application path, and access permissions) row by row to obtain the content of each policy.
[0036] Therefore, the differentiated acquisition methods for the three types of comparison objects are clearly defined, which solves the deficiency of the existing solution that "can only collect a single object". The collection scope covers all comparison subjects, and the collection success rate is significantly improved. The data collected from the three channels are all converted into a unified format, which lays the foundation for module-by-module comparison and avoids comparison failure due to format differences. In addition, it supports custom database field mapping and Selenium positioning path, and can be adapted to the trusted computing software commands, proxy database structures and management platform page designs of different SIS vendors, which significantly improves universality.
[0037] Step S150: Perform policy comparison according to the trusted policy module and output the comparison process.
[0038] For example, the comparison operation is performed one by one according to the trusted policy module selected in step S130 above, and the comparison process is output in real time: Module switching prompt: When a new module comparison begins, the tool outputs "Current comparison module: [Module name]" (e.g., "Current comparison module: Dynamic Trusted Verification"). Strategy total count comparison: First, compare the total number of strategies for each object to be compared in the current module, and output "[Module Name]: Total number of object 1 = [Quantity], Total number of object 2 = [Quantity]" (e.g., "Dynamic Trusted Verification: Total number of trusted computing software = 22, Total number of trusted management platforms = 22"). Policy content comparison: If the total number is consistent, the tool compares the policy content item by item and outputs "Compared [number of compared items] / Total [number of items], consistency rate = [percentage]" (e.g., "Compared 15 / Total 22, consistency rate 68%"); if there are policies with inconsistent content, the tool outputs the difference information (e.g., "Policy ID: DT009, Trusted Computing Software Content: Monitoring Frequency = 5 minutes, Trusted Agent Content: Monitoring Frequency = 10 minutes, Difference Field: Monitoring Frequency").
[0039] Real-time output of module switching and progress data eliminates the need for maintenance personnel to guess the current status and avoids forcibly terminating the process due to the mistaken belief that the tool is stuck. Instant annotation of difference details allows for proactive troubleshooting of discovered differences without waiting for the entire module to complete.
[0040] Step S160: Generate an analysis results report, which includes comparison results and directions for problem identification.
[0041] For example, after all selected modules have been compared, a structured analysis results report can be automatically generated. The report should include at least the following: Basic information: verification execution time, target device IP address, selected comparison object, and trusted policy module to be compared; Comparison results: The total number of policies in each module is consistent (e.g., "Static Trusted Verification: Trusted Computing Software = 20 policies, Trusted Agent = 20 policies, total number consistent"), and the policy content is consistent (e.g., "Application Access Control: 16 policies consistent, 2 policies inconsistent"). Problem localization direction: For inconsistent modules, provide possible abnormal node prompts (such as "The process protection policies of the trusted agent and the trusted management platform are inconsistent. It is recommended to first check the agent data synchronization link").
[0042] Based on the above technical solution, the entire process is automated using Python and Selenium, replacing manual operations and significantly reducing the time required for each verification, thus significantly improving efficiency. Furthermore, it supports combinations of 2-3 objects and any module, adapting to different operational scenarios and avoiding unnecessary redundant comparisons. Finally, it outputs the comparison process and structured reports in real time, eliminating the need for manual recording by operations personnel. This allows them to quickly grasp inconsistent modules and the general direction of anomalies, reducing the difficulty of troubleshooting.
[0043] Optionally, the method may further include: verifying the validity of the target device information and the trusted management platform information, through the following means: Verify that the device's IP address conforms to the IPv4 / IPv6 standard format; Verify that the SSH port number is within the valid range of 1-65535; Verify that the trusted proxy database path exists on the target device and has read and write permissions; Verify that the username and password are not empty; If any information is invalid, output the specific error and pause until valid information is input.
[0044] Device IP address verification: For IPv4 addresses: The tool uses the regular expression ^((25[0-5]|2[0-4]\d|
[01] ?\d\d?)\.){3}(25[0-5]|2[0-4]\d|
[01] ?\d\d?)$ to verify the input format (e.g., "192.168.3.150" is valid, while "192.168.256.1" and "192.168.1" are not). For IPv6 addresses: the tool uses the regular expression ^([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}$ to verify (e.g., “2001:0db8:85a3:0000:0000:8a2e:0370:7334” is correct).
[0045] If the entered IP address matches the corresponding version of the regular expression, it is considered successful; otherwise, it fails. At this time, a red error message will be displayed next to the IP input box, such as "IPv4 format error (example: 192.168.3.150)" or "IPv6 format error (example: 2001:0db8:85a3::8a2e:0370:7334)". The process will pause and continue to the next step until the input format is correct.
[0046] SSH port number range verification: Obtain the port number entered by the user (must be an integer) and determine whether it is within the range of 1-65535 (the default SSH port in industrial sites is 22, and custom ports must also be within this range). Judgment criteria: If the port number is an integer between 1 and 65535, it is considered passed; if the input is not an integer (such as "abc") or the value is out of range (such as "0" or "65536"), it is considered failed. Failure handling: Immediately display error messages next to the port input box, such as "Port number must be an integer between 1 and 65535 (example: 22, 2222)" or "Port number cannot be a non-numeric (such as 'abc')", and pause the process until a valid port is entered.
[0047] Trusted proxy database path permission verification: Path Existence Detection: The tool checks whether the input path (such as " / opt / agent / db / policy.db") exists using operating system commands (Windows: exist[path]; Linux / macOS: test -e[path]). Read / write permission check: If the path exists, the tool checks permissions using the command (Windows: icacls[path]; Linux / macOS: ls -l[path]) to ensure that the currently running account of the tool has "read (r)" and "write (w)" permissions (e.g., in Linux, permissions "rw-r--r--" are acceptable, while "r--r--r--" are not). Judgment criteria: If the path exists and read / write permissions are available, the pass is granted; if either condition is not met, the pass is denied. Failure handling: Display error messages next to the path input box, such as "Database path does not exist (please confirm that the path is ' / opt / agent / db / policy.db')" or "The path is read-only and has no write permissions (it is recommended to execute 'chmod+w[path]' to grant permissions)". Pause the process until the path and permissions meet the requirements.
[0048] Username and password non-empty verification: Check whether the username and password fields entered by the user are "empty strings" (including the case where only spaces are entered); Judgment criteria: If both the username and password fields are non-empty strings (which can contain numbers, letters, and special characters, such as "sis_admin" or "SIS@2025"), the result is considered acceptable; if either field is empty, the result is considered unacceptable. Failure handling: Display error messages next to empty fields, such as "SSH username cannot be empty" or "Management platform password cannot be empty (cannot be just a space)", and pause the process until all usernames and passwords are not empty.
[0049] Therefore, by using four-fold verification to proactively intercept errors such as IP format and port range, erroneous information is prevented from entering subsequent processes, significantly reducing the verification process interruption rate. Error messages are directly related to specific issues, eliminating the need for maintenance personnel to trace back and investigate the cause of connection failures, thus significantly shortening troubleshooting time. In addition, verification is performed synchronously with input, providing real-time error feedback. This avoids users discovering problems and having to make corrections only after completing all information input, reducing repetitive operations and improving input efficiency.
[0050] According to a second aspect of this application, a SIS system trusted policy consistency verification device is also provided. Figure 2 A schematic block diagram of a SIS system trusted policy consistency verification apparatus 200 according to an embodiment of this application is shown. Figure 2 As shown, the device 200 may include: Tool startup module 210 is used to trigger the startup of the verification tool; Information input module 220 is used to receive information related to the target device and information related to the trusted management platform; The object selection module 230 is used to select the object to be compared and the trusted policy module to be compared. The object to be compared is at least two of trusted computing software, trusted agent, and trusted management platform. The trusted policy module is one or more of trusted startup, static trusted verification, dynamic trusted verification, trusted whitelist, process protection, and application access control. The strategy acquisition module 240 is used to automatically acquire the total number of strategies and the strategy content of the target trusted strategy module of each comparison object; The comparison and analysis module 250 is used to perform policy comparison according to the trusted policy module and output the comparison process. The report generation module 260 is used to generate an analysis result report, which includes comparison results and problem location directions.
[0051] According to a third aspect of this application, an electronic device is also provided. Figure 3 A schematic block diagram of an electronic device 300 according to one embodiment of this application is shown. Figure 3 As shown, the electronic device 300 may include: At least one processor 310; At least one memory 320 is used to store at least one program; When at least one program is executed by at least one processor 310, the at least one processor 310 implements the SIS system trusted policy consistency verification method as described above.
[0052] According to a fourth aspect of this application, a computer-readable storage medium is also provided, which stores a computer program that, when executed by a processor, implements the SIS system trusted policy consistency verification method as described above. The storage medium may, for example, include a storage component of a tablet computer, a hard disk of a personal computer, a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a portable compact disc read-only memory (CD-ROM), a USB memory, or any combination of the above storage media. The computer-readable storage medium may be any combination of one or more computer-readable storage media.
[0053] Those skilled in the art can understand the specific implementation schemes and beneficial effects of the above-mentioned SIS system trusted policy consistency verification device, electronic device and computer-readable storage medium by reading the relevant description of the SIS system trusted policy consistency verification method. For the sake of brevity, they will not be described in detail here.
[0054] Although exemplary embodiments have been described herein with reference to the accompanying drawings, it should be understood that the above exemplary embodiments are merely illustrative and are not intended to limit the scope of this application. Various changes and modifications can be made therein by those skilled in the art without departing from the scope and spirit of this application. All such changes and modifications are intended to be included within the scope of this application as claimed in the appended claims.
[0055] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.
[0056] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another device, or some features may be ignored or not executed.
[0057] Numerous specific details are set forth in the specification provided herein. However, it will be understood that embodiments of this application may be practiced without these specific details. In some instances, well-known methods, structures, and techniques have not been shown in detail so as not to obscure the understanding of this specification.
[0058] Similarly, it should be understood that, in order to streamline this application and aid in understanding one or more of the various inventive aspects, features of this application may sometimes be grouped together in a single embodiment, figure, or description thereof in the description of exemplary embodiments of this application. However, this approach should not be construed as reflecting an intention that the claimed application requires more features than are expressly recited in each claim. Rather, as reflected in the corresponding claims, its inventive point lies in solving the corresponding technical problem with features fewer than all features of a single disclosed embodiment. Therefore, the claims following the detailed description are hereby expressly incorporated into that detailed description, wherein each claim itself is a separate embodiment of this application.
[0059] Those skilled in the art will understand that, apart from the mutual exclusion of features, all features disclosed in this specification (including the accompanying claims, abstract, and drawings) and all processes or elements of any method or apparatus so disclosed may be combined in any combination. Unless otherwise expressly stated, each feature disclosed in this specification (including the accompanying claims, abstract, and drawings) may be replaced by an alternative feature that serves the same, equivalent, or similar purpose.
[0060] Furthermore, those skilled in the art will understand that although some embodiments described herein include certain features but not others included in other embodiments, combinations of features from different embodiments are intended to be within the scope of this application and form different embodiments. For example, in the claims, any one of the claimed embodiments can be used in any combination.
[0061] The various component embodiments of this application can be implemented in hardware, or as software modules running on one or more processors, or a combination thereof. Those skilled in the art will understand that microprocessors or digital signal processors (DSPs) can be used in practice to implement some or all of the functions of some modules in the SIS system trusted policy consistency verification apparatus according to embodiments of this application. This application can also be implemented as an apparatus program (e.g., a computer program and computer program product) for performing part or all of the methods described herein. Such an implementation of this application can be stored on a computer-readable medium, or can be in the form of one or more signals. Such signals can be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.
[0062] It should be noted that the above embodiments are illustrative of this application and not restrictive, and that those skilled in the art can devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses should not be construed as limiting the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. This application can be implemented by means of hardware comprising several different elements and by means of a suitably programmed computer. In the unit claims enumerating several means, several of these means may be embodied by the same item of hardware. The use of the words first, second, and third, etc., does not indicate any order. These words can be interpreted as names.
[0063] The above description is merely a specific embodiment or illustration of the embodiments of this application. The scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. The scope of protection of this application shall be determined by the scope of the claims.
Claims
1. A method for verifying the consistency of a trusted policy in a SIS system, characterized in that, The automated comparison is achieved using a Python program in conjunction with the Selenium tool, including the following steps: Start the verification tool; Input the target device information and the trusted management platform information; Select the object to be compared and the trusted policy module to be compared. The object to be compared is at least two of trusted computing software, trusted agent, and trusted management platform. The trusted policy module is one or more of trusted boot, static trusted verification, dynamic trusted verification, trusted whitelist, process protection, and application access control. Automatically obtain the total number of policies and policy content of the target trusted policy module for each object to be compared; Perform policy comparison according to the trusted policy module and output the comparison process; Generate an analysis results report, which includes comparison results and directions for problem identification.
2. The SIS system trusted policy consistency verification method as described in claim 1, characterized in that, The target device information includes: device IP address, SSH connection username, password, port, trusted proxy database path, database password, database tool path, and trusted computing software command directory; the trusted management platform information includes: platform IP address, business administrator login username, and password.
3. The SIS system trusted policy consistency verification method as described in claim 1, characterized in that, The methods for automatically obtaining the policy content include: The trusted computing software calls underlying commands to obtain policy data, including btmv_check-v, atmv_check-F, dtmv_check-F, dtmv_check-l, atmv_check-W, atmv_check-l, and atmv_check-c. Connect to the trusted agent's SQLite database and query policy data using SQL statements; Use the Selenium tool to log in to the Trusted Management Platform and retrieve policy data by locating page elements.
4. The SIS system trusted policy consistency verification method as described in claim 1, characterized in that, When there are three objects to be compared, the comparison and problem localization include: The strategies of trusted computing software and trusted management platform, trusted computing software and trusted agent, and trusted agent and trusted management platform are compared in turn. If the strategies of the three are consistent, then no anomaly is determined; if the trusted agent is consistent with the trusted computing software but different from the management platform, then the problem is located in the management platform; if the trusted agent is consistent with the management platform but different from the trusted computing software, then the problem is located in the trusted agent; if all three are different, then the trusted agent is prioritized for identification.
5. The SIS system trusted policy consistency verification method as described in any one of claims 1-4, characterized in that, The method further includes: Check if the Python version in the current runtime environment is no lower than 3.6 and the Selenium tool version is no lower than 3.141.0; Verify the network connectivity of the target device's IP address using the ping command or TCP connection test; Verify the accessibility of the trusted management platform's IP address through HTTP / HTTPS request testing; If any test item fails, the corresponding failure message will be output and subsequent steps will be terminated. The verification tool will be restarted after the user has investigated the issue.
6. The SIS system trusted policy consistency verification method as described in claim 1, characterized in that, The method further includes: verifying the validity of the target device information and the trusted management platform information, achieved through the following means: Verify that the device's IP address conforms to the IPv4 / IPv6 standard format; Verify that the SSH port number is within the valid range of 1-65535; Verify that the trusted proxy database path exists on the target device and has read and write permissions; Verify that the username and password are not empty; If any information is invalid, output the specific error and pause until valid information is input.
7. The SIS system trusted policy consistency verification method as described in claim 1, characterized in that, The output comparison process includes: Displays the name of the currently compared trusted policy module in real time; Update the number of strategies compared, the number of remaining strategies, and the consistency rate; For inconsistent strategies, output their number, strategy type, and difference field in each object to be compared.
8. A trust policy consistency verification device for a SIS system, characterized in that, include: The tool startup module is used to trigger the startup of the verification tool; The information input module is used to receive information related to the target device and information related to the trusted management platform; The object selection module is used to select the object to be compared and the trusted policy module to be compared. The object to be compared is at least two of trusted computing software, trusted agent, and trusted management platform. The trusted policy module is one or more of trusted startup, static trusted verification, dynamic trusted verification, trusted whitelist, process protection, and application access control. The strategy acquisition module is used to automatically acquire the total number and content of the target trusted strategy modules for each comparison object; The comparison and analysis module is used to perform policy comparison according to the trusted policy module and output the comparison process. The report generation module is used to generate analysis result reports, which include comparison results and problem location directions.
9. An electronic device, characterized in that, include: At least one processor; At least one memory for storing at least one program; When the at least one program is executed by the at least one processor, the at least one processor implements the SIS system trusted policy consistency verification method as described in any one of claims 1-7.
10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the SIS system trusted policy consistency verification method as described in any one of claims 1-7.