CN115118509B - Substation secondary equipment debugging file authority detection method and safety control device - Google Patents

Abstract

A method for detecting the permission of debugging files of secondary equipment in a substation comprises a debugging tool, a security control device and a secondary equipment, wherein the security control device is connected in series between the debugging tool and the secondary equipment, and comprises the following steps: Step S1, the security control device performs identity permission detection on the debugging tool, if the identity permission detection passes, a data encryption transmission channel is established between the debugging tool and the security control device, and step S2 is executed; Step S2, the security control device extracts message features of the debugging file transmitted by the debugging tool, and matches the extracted feature information with the authorization information, if the match is consistent, the debugging file has been granted the transmission permission, and step S3 is executed, if the match is inconsistent, the message is intercepted and a log is recorded; Step S3, MAC address information of the debugging tool is matched to detect its address permission.

Description

Substation secondary equipment debugging file authority detection method and safety control device

Technical Field

The present invention belongs to the technical field of substation information security risk prevention and control, and specifically relates to a substation secondary equipment debugging file authority detection method and a security control device.

Background technique

In recent years, with the construction and development of the national power grid, intelligent technology has been gradually applied to the construction of the power grid, and the intelligence of the power grid has been gradually realized. Correspondingly, the construction scale of smart substations has gradually expanded, and power equipment has gradually been updated. The safe and stable operation of the secondary equipment of smart substations has become more and more important. The traditional secondary equipment maintenance method can no longer meet the requirements of the maintenance of secondary equipment in smart substations. It is very necessary to realize the status maintenance of secondary equipment to ensure the network security of the monitoring system during the maintenance of smart substations.

At present, the protection, automation and monitoring systems of substations have gradually been networked and digitized. The information exchange between secondary equipment such as protection devices, measurement and control devices, merging units, and intelligent terminals and station control layer equipment such as monitoring master stations and communication gateways, and even dispatching systems, is carried out on the same network. When configuring and upgrading the secondary equipment of smart substations, the debugging tools need to be directly connected to the secondary equipment. This access method without prevention and control measures has the potential risks of secondary system infection with Trojans and viruses, illegal external data connection, etc., which brings great security risks to the secondary system of substations and affects the safe and stable operation of the power grid.

With the acceleration of intelligentization of substations, network security risks are facing challenges. There are great security risks when debugging tools are directly connected to the secondary equipment network in the station. Therefore, corresponding debugging security management and control devices are developed for the debugging file permission detection of substation secondary equipment, which can improve the information security risk prevention and control capabilities of smart substation debugging tools connected to secondary equipment.

Summary of the invention

In order to solve the deficiencies in the prior art, the purpose of the present invention is to provide a method for detecting the debugging file permissions of substation secondary equipment and a security control device.

The present invention adopts the following technical solution.

A method for detecting the permission of debugging files of secondary equipment in a substation includes a debugging tool, a safety control device and a secondary equipment, wherein the safety control device is connected in series between the debugging tool and the secondary equipment. The method includes the following steps:

Step S1, the security control device performs identity and authority detection on the debugging tool. If the identity and authority detection passes, a data encryption transmission channel is established between the debugging tool and the security control device, and step S2 is executed;

Step S2, the security control device extracts message features from the debugging file transmitted by the debugging tool, and matches the extracted feature information with the authorization information. If the match is consistent, the debugging file has been granted transmission permission, and step S3 is executed. If the match is inconsistent, the message is intercepted and a log is recorded;

Step S3, matching the MAC address information of the debugging tool, detecting its address authority, and forwarding the debugging file described in step S2 to the secondary device after the address authority is passed.

Identity authority detection is a three-factor identity authentication of the debugging tool by the security control device, which is "certificate + PIN code + user name / password". The authentication process includes: inserting the Ukey with the certificate into the debugging tool; inputting the PIN code and user name / password on the debugging tool in sequence; the security control device detects whether the PIN code and user name / password are correct, and detects whether the certificate is expired and whether the certificate code is correct; and obtains the authentication result based on the certificate + PIN code + user name / password information;

The authentication results are as follows:

If the PIN code or user name/password is entered incorrectly more than 3 times in a row, the identity authority detection fails, and the input is prohibited for a set period of time, and a channel establishment failure warning is issued;

If the certificate stored in the UKey is expired or incorrectly encoded, the identity permission detection fails and the debugging tool is denied access to the secondary device;

If the certificate, PIN code, and username/password authentication are passed, the identity authority detection is passed.

The data encryption channel is an SSLVPN data encryption channel, which is encrypted using a block encryption algorithm.

The SSLVPN data encryption transmission channel takes over all application traffic of the debugging tool by building a virtual network card. After the SSLVPN data encryption transmission channel is established, the debugging tool disables the wireless network card, and the security control device performs global proxy forwarding on the debugging files of the debugging tool.

The authorization information includes the debugging file name, debugging file size, debugging file MD5 value, staff name, staff contact number, secondary equipment manufacturer, debugging time, transmission protocol, secondary equipment name, secondary equipment model, secondary equipment service port, security control device number, debugging tool brand, debugging tool model, debugging tool user name, and debugging tool mac.

Message feature extraction includes: obtaining the hexadecimal feature string of the communication protocol message of the manufacturer of the secondary equipment to be debugged; analyzing and cutting the feature string to obtain the keywords of the manufacturer's protocol message; filtering, extracting, splitting, splicing and transcoding the message according to the keywords to obtain feature information.

The characteristic information includes the debugging file name, debugging file size, debugging file MD5 value and characteristic code flow information, wherein the characteristic code flow information is the characteristic code flow information calculated by the standard hash algorithm based on the authorization information in step 1.

Step S3 includes:

S301, collecting the MAC address of the debugging tool;

S302, matching the MAC address with the stored authorization information, if the match fails, intercepting the message, blocking the session, and giving an interface pop-up box warning, if the match succeeds, executing S303;

S303, forwarding the message proxy to the secondary device.

The MAC address is the MAC address of the Ethernet card.

Substation secondary equipment debugging file permission detection security control device based on substation secondary equipment debugging file permission detection method,

The security management and control device includes an identity authority detection module, a transmission authority detection module, a storage module, a file authority detection module and an address authority detection module;

The identity and permission detection module is used to perform identity and permission detection on the debugging tool;

The transmission permission detection module is used to extract message features from the debugging file and determine whether the feature information matches the authorization information. If they match, the transmission permission is passed;

The storage module is used to store authorization information;

The file permission detection module is used to read and analyze the messages flowing through the security control device, obtain the required file information, and match the obtained file information with the local authorization information of the security control device;

The address authority detection module is used to determine whether the MAC address of the debugging tool matches the authorization information.

The beneficial effect of the present invention is that compared with the prior art, the present invention adds a debugging file permission detection security management device in the connection between the debugging tool and the substation secondary equipment, which improves the security and stability in the transmission process, keeps the system running continuously, reliably and normally, and adds the permission detection of the debugging file, so that the security audit of the debugging tool and the substation secondary equipment is more reliable, which can effectively reduce the security risks of the power network.

The beneficial effects of the present invention also include:

(1) Establish a data encryption transmission channel to protect the security of data during network transmission and prevent power grid data from being intercepted and stolen;

(2) Extract message features and match authorization information of debug files to prevent illegal files from obtaining transmission permissions.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is a flowchart of authority detection of a substation secondary equipment debugging tool of the present invention;

FIG. 2 is a connection diagram of a method for detecting file transmission permissions of a substation debugging tool according to the present invention.

Detailed ways

The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

A method for detecting the permission of debugging files of secondary equipment in a substation comprises a debugging tool, a security control device and a secondary equipment, wherein the security control device is connected in series between the debugging tool and the secondary equipment, and the method comprises the following steps: Step S1, the security control device performs identity permission detection on the debugging tool, if the identity permission detection passes, an SSLVPN data encryption transmission channel is established between the debugging tool and the security control device, and step S2 is executed; Step S2, the security control device performs message feature extraction on the debugging file transmitted by the debugging tool, and matches the extracted feature information with the authorization information, if the match is consistent, the debugging file has been granted the transmission permission, and step S3 is executed, if the match is inconsistent, the message is intercepted and a log is recorded; Step S3, MAC address information matching is performed on the debugging tool to detect its address permission.

Identity authority detection is a three-factor identity authentication of the debugging tool by the security control device, which is "certificate + PIN code + user name / password". The authentication process includes: inserting the Ukey with the certificate into the debugging tool; inputting the PIN code and user name / password on the debugging tool in sequence; the security control device detects whether the PIN code and user name / password are correct, and detects whether the certificate is expired and whether the certificate code is correct; and obtains the authentication result based on the certificate + PIN code + user name / password information;

The authentication results are as follows:

If the PIN code or user name/password is entered incorrectly more than 3 times in a row, the identity authority detection fails, and the input is prohibited for a set period of time, and a channel establishment failure warning is issued;

If the certificate stored in the UKey is expired or incorrectly encoded, the identity permission detection fails and the debugging tool is denied access to the secondary device;

If the certificate, PIN code, and username/password authentication are passed, the identity authority detection is passed.

The data encryption channel is the SSLVPN data encryption channel, which is encrypted using a block encryption algorithm.

The SSLVPN data encryption transmission channel takes over all application traffic of the debugging tool by building a virtual network card. After the SSLVPN data encryption transmission channel is established, the debugging tool will actively disable the wireless network card, and the security control device will perform global proxy forwarding on the message data of the debugging tool.

The authorization information includes the debugging file name, debugging file size, debugging file MD5 value, staff name, staff contact number, secondary equipment manufacturer, debugging time, transmission protocol, secondary equipment name, secondary equipment model, secondary equipment service port, security control device number, debugging tool brand, debugging tool model, debugging tool user name, and debugging tool mac.

Message feature extraction includes: obtaining the hexadecimal feature string of the communication protocol message of the manufacturer of the secondary equipment to be debugged; analyzing and cutting the feature string to obtain the keywords of the manufacturer's protocol message; filtering, extracting, splitting, splicing and transcoding the message according to the keywords to obtain feature information.

The characteristic information includes the debugging file name, debugging file size, debugging file MD5 value and characteristic code flow information, wherein the characteristic code flow information is the characteristic code flow information calculated by the standard hash algorithm based on the authorization information in step 1.

Step S3 includes:

S301, collecting the MAC address of the debugging tool;

S302, matching the MAC address with the stored authorization information, if the match fails, intercepting the message, blocking the session, and giving an interface pop-up box warning, if the match succeeds, executing S303;

S303, forwarding the message proxy to the secondary device.

The MAC address is the MAC address of the Ethernet card.

Substation secondary equipment debugging file permission detection security control device based on substation secondary equipment debugging file permission detection method,

The security management and control device includes an identity authority detection module, a transmission authority detection module, a storage module, a file authority detection module and an address authority detection module; the identity authority detection module is used to perform identity authority detection on the debugging tool; the transmission authority detection module is used to extract message features of the debugging file and determine whether the feature information matches the authorization information. If they are consistent, the transmission authority is passed; the storage module is used to store the authorization information; the file authority detection module is used to read and analyze the messages flowing through the security management and control device, obtain the required file information, and match the information based on the obtained file information with the local authorization information of the security management and control device; the address authority detection module is used to determine whether the MAC address of the debugging tool matches the authorization information.

In the description of the embodiments of the present invention, the term "debugging tool" refers to a tool that is connected to the secondary equipment through the debugging port to perform data interaction such as file viewing and file transfer, or to carry out information security protection during the maintenance, configuration, and upgrade of the secondary equipment in the substation. It usually includes a dedicated debugging computer, debugging software, security management tools, etc.

A method for detecting the permission of a debugging file of a substation secondary device disclosed in the present invention includes a debugging tool, a safety control device and a secondary device, wherein the safety control device is connected in series between the debugging tool and the secondary device, as shown in FIG1 , and the specific steps are as follows:

Step S1, the security control device performs identity and authority detection on the debugging tool. If the identity and authority detection passes, an SSLVPN data encryption transmission channel is established between the debugging tool and the security control device, and step S2 is executed;

The debugging tool performs SSLVPN identity authentication through a trusted authentication client, inserts the UKey containing the certificate into the debugging tool, and performs a three-factor identity authentication of the debugging tool using "certificate + PIN code + user name/password", and performs corresponding policy disposal according to the authentication result: Specifically, the identity authority detection is a three-factor identity authentication of the debugging tool using "certificate + PIN code + user name/password" by the security management and control device; the authentication process includes: inserting the Ukey containing the certificate into the debugging tool; entering the PIN code and user name/password in sequence on the debugging tool; the security management and control device detects whether the PIN code and user name/password are correct, and detects whether the certificate is expired and whether the certificate encoding is correct; and obtaining the authentication result based on the certificate + PIN code + user name/password information.

If the PIN code or user name/password is entered incorrectly more than 3 times in a row, the identity authority detection fails, and the input will be prohibited for 1 hour, and a channel establishment failure warning will be issued;

If the certificate stored in the UKey is expired or incorrectly encoded, it is considered that the identity permission detection has failed, and the security control device refuses access to the debugging tool;

If the identity authentication is passed, the identity permission detection is passed, and an SSLVPN encrypted channel is established between the debugging tool and the security control device to achieve network access for the debugging tool.

Since SSLVPN is used to establish a data encryption transmission channel between the debugging tool and the security control device, the national secret algorithm is used in the data encryption channel to ensure the secure transmission of the debugging tool data while realizing domestic cryptographic algorithm encryption.

The certificate is unique. To debug a secondary device, you need to use the corresponding manufacturer's certificate, and the certificate must correspond to the specific name and model of the secondary device. Because the certificate contains the unique identification content of the secondary device, the certificate authentication should be consistent with the manufacturer of the secondary device to be debugged in order to pass the verification, and only the corresponding manufacturer's equipment can be debugged to avoid unauthorized debugging by the debugging tool. The certificate is stored in UKey. Before performing identity authentication, insert the Ukey containing the certificate into the debugging tool.

The SSLVPN data encryption transmission channel takes over all application traffic of the debugging tool by building a virtual network card. As the SSLVPN data encryption transmission channel is established, the wireless network card will be actively disabled, and the debugging tool message data will be automatically forwarded by a global proxy to prevent secondary devices on the intranet from connecting to the outside through the debugging tool wireless hotspot, thereby achieving security protection between the internal and external networks.

Step S2, extracting message features from the debugging file transmitted by the debugging tool, and matching the extracted feature information with the authorization information. If the match is consistent, the debugging file has been granted transmission permission, and step S3 is executed. If the match is inconsistent, the message is intercepted and a log is recorded;

The authorization information includes the debugging file name, debugging file size, debugging file MD5 value, staff name, staff contact number, secondary equipment manufacturer, debugging time, transmission protocol, secondary equipment name, secondary equipment model, secondary equipment service port, control device number, debugging tool brand, debugging tool model, debugging tool user name, and debugging tool mac.

Message feature extraction includes obtaining the hexadecimal feature string of the manufacturer's communication protocol message of the secondary device to be debugged; analyzing and cutting the string to obtain the keywords of the manufacturer's protocol message; and filtering, extracting, splitting, splicing, and transcoding the message according to the keywords to obtain feature information.

The characteristic information includes the debugging file name, debugging file size, debugging file MD5 value and characteristic code flow information, wherein the characteristic code flow information is the characteristic code flow information calculated by the standard hash algorithm based on the authorization information in step 1.

Specifically, the file permission detection module performs kernel-state reading and analysis on the messages flowing through the security control device, and obtains the required key file information by filtering, extracting, splitting, splicing, transcoding and other operations on the messages based on keywords, and matches the obtained key information with the local authorization information of the security control device. If the match is consistent, it proves that the debugging file has been granted transmission permission. If the matching results are different, the debugging file is unauthorized, and the message is intercepted and the log is recorded.

Among them, the acquisition of keywords is judged based on the hexadecimal characteristic value of the message traffic. For the analysis of private communication protocols of secondary devices of different manufacturers, the hexadecimal characteristic string of the manufacturer's communication protocol message is first obtained, and then the string is analyzed and trimmed at multiple levels to obtain the keyword characteristic value of the manufacturer's protocol message, and then the required information is obtained from the message traffic based on the keyword and matched with the locally stored authorization information.

Step S3, matching the MAC address information of the debugging tool to detect its address authority.

Step S3 specifically includes:

S301, collecting the MAC address of the debugging tool;

S302, matching the MAC address with the stored authorization information, if the match fails, intercepting the message, blocking the session, and giving an interface pop-up box warning, if the match succeeds, executing S303;

S303, forwarding the message proxy to the secondary device.

The security control device extracts the MAC address of the debugging tool connected through SSLVPN and matches it with the stored authorization information. If the match fails, the message is intercepted, the session is blocked, and an interface pop-up box is displayed to warn. If the match succeeds, it indicates that the debugging tool has been authorized and the message proxy is forwarded to the secondary device.

The MAC address must be the Ethernet card MAC address. The Ethernet MAC address is fixed, has higher security, and can effectively identify the uniqueness of the device.

This embodiment also provides a substation secondary equipment debugging file authority detection security management and control device,

The security control device includes an identity authority detection module, a transmission authority detection module, a storage module, a file authority detection module and an address authority detection module;

The identity and permission detection module is used to perform identity and permission detection on the debugging tool;

The transmission permission detection module is used to extract message features from the debugging file and determine whether the feature information matches the authorization information. If they match, the transmission permission is passed;

The storage module is used to store authorization information;

The file permission detection module is used to read and analyze the messages flowing through the security control device, obtain the required file information, and match the obtained file information with the local authorization information of the security control device;

The address authority detection module is used to determine whether the MAC address of the debugging tool matches the authorization information. The beneficial effect of the present invention is that, compared with the prior art, the present invention adds a security control device in the connection between the debugging tool and the substation secondary equipment, which improves the security and stability during the transmission process, keeps the system running continuously and reliably, and adds the authority detection of the debugging file, making the security audit of the debugging tool and the substation secondary equipment more reliable, which can effectively reduce the security risk of the power network.

The beneficial effects of the present invention also include:

(1) Establish a data encryption transmission channel to protect the security of data during network transmission and prevent power grid data from being intercepted and stolen;

(2) Extract message features and match authorization information of debugging files to prevent illegal files from obtaining transmission permissions.

The applicant of the present invention has made a detailed explanation and description of the implementation examples of the present invention in conjunction with the drawings in the specification. However, those skilled in the art should understand that the above implementation examples are only preferred implementation schemes of the present invention, and the detailed description is only to help readers better understand the spirit of the present invention, and it is not a limitation on the protection scope of the present invention. On the contrary, any improvements or modifications based on the inventive spirit of the present invention should fall within the protection scope of the present invention.

Claims (9)

1. A method for detecting the authority of debugging files of secondary equipment in a substation, characterized in that it comprises a debugging tool, a safety control device and a secondary equipment, wherein the safety control device is connected in series between the debugging tool and the secondary equipment, and the method comprises the following steps: Step S1, the security control device performs identity and authority detection on the debugging tool, and the identity and authority detection is a three-factor identity authentication of the debugging tool by the security control device: "certificate + PIN code + user name / password"; if the identity and authority detection passes, a data encryption transmission channel is established between the debugging tool and the security control device, and step S2 is executed; Step S2, the security control device extracts message features from the debugging file transmitted by the debugging tool, and matches the extracted feature information with the authorization information. If the match is consistent, the debugging file has been granted transmission permission, and step S3 is executed. If the match is inconsistent, the message is intercepted and a log is recorded; The message feature extraction includes: obtaining a hexadecimal feature string of the manufacturer's communication protocol message of the secondary device to be debugged; analyzing and cutting the feature string to obtain keywords of the manufacturer's protocol message; screening, extracting, splitting, splicing, and transcoding the message according to the keywords to obtain feature information; Step S3, matching the MAC address information of the debugging tool, detecting its address authority, and forwarding the debugging file described in step S2 to the secondary device after the address authority is passed. 2. A method for detecting the authority of a substation secondary equipment debugging file according to claim 1, characterized in that: The authentication process includes: inserting the Ukey containing the certificate into the debugging tool; inputting the PIN code and username/password in sequence on the debugging tool; the security control device detects whether the PIN code and username/password are correct, and detects whether the certificate is expired and whether the certificate encoding is correct; and obtaining the authentication result based on the certificate + PIN code + username/password information; The authentication results are as follows: If the PIN code or user name/password is entered incorrectly more than 3 times in a row, the identity authority detection fails, and the input is prohibited for a set period of time, and a channel establishment failure warning is issued; If the certificate stored in the UKey is expired or incorrectly encoded, the identity permission detection fails and the debugging tool is denied access to the secondary device; If the certificate, PIN code, and username/password authentication are passed, the identity authority detection is passed. 3. A method for detecting the authority of a substation secondary equipment debugging file according to claim 1, characterized in that: The data encryption channel is the SSLVPN data encryption channel, which is encrypted using a block encryption algorithm. 4. A method for detecting the authority of a substation secondary equipment debugging file according to claim 3, characterized in that: The SSLVPN data encryption transmission channel takes over all application traffic of the debugging tool by building a virtual network card. After the SSLVPN data encryption transmission channel is established, the debugging tool disables the wireless network card, and the security control device performs global proxy forwarding on the message data of the debugging tool. 5. A method for detecting the authority of a substation secondary equipment debugging file according to claim 1, characterized in that: The authorization information includes the debugging file name, debugging file size, debugging file MD5 value, staff name, staff contact number, secondary equipment manufacturer, debugging time, transmission protocol, secondary equipment name, secondary equipment model, secondary equipment service port, security control device number, debugging tool brand, debugging tool model, debugging tool user name, and debugging tool mac. 6. A method for detecting the authority of a substation secondary equipment debugging file according to claim 5, characterized in that: The characteristic information includes the debugging file name, debugging file size, debugging file MD5 value and characteristic code flow information, wherein the characteristic code flow information is the characteristic code flow information calculated by the standard hash algorithm based on the authorization information in step 1. 7. A method for detecting the authority of a substation secondary equipment debugging file according to claim 1, characterized in that: The step S3 comprises: S301, collecting the MAC address of the debugging tool; S302, matching the MAC address with the stored authorization information, if the match fails, intercepting the message, blocking the session, and giving an interface pop-up box warning, if the match succeeds, executing S303; S303, forwarding the debugging file proxy to the secondary device. 8. A method for detecting the authority of a substation secondary equipment debugging file according to claim 7, characterized in that: The MAC address is the Ethernet card MAC address. 9. A substation secondary equipment debugging file authority detection security management and control device based on the substation secondary equipment debugging file authority detection method according to any one of claims 1 to 8, characterized in that: The security control device includes an identity authority detection module, a transmission authority detection module, a storage module, a file authority detection module and an address authority detection module; The identity authority detection module is used to perform identity authority detection on the debugging tool; The transmission permission detection module is used to extract message features from the debugging file and determine whether the feature information matches the authorization information. If they match, the transmission permission is passed; The storage module is used to store authorization information; The file permission detection module is used to read and analyze the messages flowing through the security control device, obtain the required file information, and match the obtained file information with the local authorization information of the security control device; The address authority detection module is used to determine whether the MAC address of the debugging tool matches the authorization information.