CN103034231A - Test bed method for industrial control equipment - Google Patents
Test bed method for industrial control equipment Download PDFInfo
- Publication number
- CN103034231A CN103034231A CN201210512919XA CN201210512919A CN103034231A CN 103034231 A CN103034231 A CN 103034231A CN 201210512919X A CN201210512919X A CN 201210512919XA CN 201210512919 A CN201210512919 A CN 201210512919A CN 103034231 A CN103034231 A CN 103034231A
- Authority
- CN
- China
- Prior art keywords
- test
- measurand
- industrial control
- dut
- data
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Landscapes
- Testing And Monitoring For Control Systems (AREA)
Abstract
The invention provides a test bed method for industrial control equipment. The test bed method comprises the following procedures: constructing test bed environment, carrying out mode and structure choosing on test objects DUT, arranging control structure of CTR, and carrying out a detecting test. Through several appointed models and structures and the introduction of a start data source module, the test bed method for the industrial control equipment can achieve the overall simulation of the environment of an industrial control system and the centralized control of units under test, and achieves the central detection and simulation experiment carried out on the industrial control equipment.
Description
Technical field
The invention belongs to industrial control field, be specifically related to a kind of test envelope method for industrial control equipment.
Background technology
In recent years, the industrial control system information security events takes place frequently, and becomes the important target of attack of hacker and country " information war ", faces larger security threat.Especially 2010, " shake net " virus attack Iran nuclear power station, virus is attacked the SIMATIC WinCC of data acquisition and monitoring system of Siemens Company, causing nuclear power station to be postponed starts, cause the common concern of international community, also impelled the industrial control system information security to become the topic of national governments, common people's extensive concern.The attack technology of grasping from the current network hacker, the assailant who has the malice attempt can utilize the security breaches of some large-scale production systems to obtain the control of all power equipments, in case these controls are grasped by bad intention hacker, causing paralysis attacks, to the production of these national basis industries be sustained a great loss, industrial control system safety has become national safety direct bearing, is just becoming the cyberspace strategic high ground of countries in the world sharp fight.
The situation is tense in the industrial control system information security management, and compared with developed countries, some regional industry control system information securities are faced with severeer situation, and at first product production domesticization ratio is on the low side, has non-controllable risk; The second, product puts undue emphasis on efficient, lacks necessary Security Assurance Mechanism; The 3rd, enterprise payes attention to not enough to the industrial control system information security, be difficult to successfully manage many security threats.In order to strengthen the information security of industrial control system, on September 29th, 2011, the Ministry of Industry and Information Technology printed and distributed " about strengthening the notice of industrial control system information security management ", require conscientiously to strengthen the industrial control system information security management, to ensure commercial production security of operation, economic security of the country and people life property safety.
Electrical network is not also set up complete security evaluation method and the system for the electrical network industrial control system of a cover.Therefore, set up the safety test environment of industrial control system, and method of testing research is very important.Simultaneously, carrying out of the appearance of " about strengthening the notice of industrial control system information security management " and related request will impel the industrial control system safety construction day by day to obtain paying attention at electric power, for Information Security Industry brings new opportunity to develop, space, industrial control system security evaluation service market will be expanded.This project is carried out " about strengthening the notice of industrial control system information security management " to strengthening every specific requirement of information security test and appraisal work, on the basis of existing computer system security evaluation system, set up electrical network industrial control system security evaluation system and platform, research electrical network industrial control system security evaluation gordian technique is for security evaluation, the security breaches of carrying out electrical network industrial control system key equipment, critical system, key protocol etc. detect, security risk assessment is taken a firm foundation.
Compare with conventional systems, industrial control system is the real-time of attention location system more, emphasize system survivability and reliability, thereby, the industrial control system security evaluation is at implementation principle, technological means is compared with the conventional systems security evaluation with Bearing performance form aspect and had certain difference: risk control is at first emphasized in (1) test and appraisal, because industrial control system often is in the state of running without interruption, any system failure all can cause heavy losses, security evaluation must be from project management and technical application level face, and the security evaluation implementation is reduced to minimum level to the issuable impact of normal operation of industrial control system and network; (2) assessment method is take analog simulation as main, and in conjunction with on-the-spot test and appraisal, core content as the conventional information security evaluation, information security leak and Analysis of Potential need to be walked around security of system mechanism, the possibility that authorization information security breaches and hidden danger exist, unavoidably can treat the confidentiality of examining system, integrality and availability damage, it is high directly to implement risk in production system, therefore, the industrial control system assessment method is with on-the-spot test and be that laboratory simulations combines, take laboratory simulations as main, set up industry control analog simulation environment by real data, and carry out on this basis the checking of leak and hidden danger; (3) the security evaluation coverage rate is wider, industrial control system is on the basis of conventional information security evaluation, more pay attention to because the social categories such as the economic loss that information security events causes, environmental pollution, personal injury often need the content of the aspects such as combined process flow process even supply chain to carry out security evaluation.
Be each parts, the experiment of safety equipment comprehensive safety property testing that realizes industrial control system, simultaneously also can be to the ingredient of system self, for example full test is carried out in RTU equipment, emulation main station system, simulation work station, network service etc., must set up the test envelope technology of a comprehensive multiple test environment of cover and method of testing, the integration test experiment that various industrial control equipments access behind the test envelopes and can realize being correlated with.
Summary of the invention
For the deficiencies in the prior art, the invention provides a kind of test envelope method for industrial control equipment, the pattern by multiple appointment or structure realize the integration of polytype testing apparatus, solve the problem of carrying out centralized detecting and emulation experiment for industrial control equipment.
The invention provides a kind of test envelope method for industrial control equipment, its improvements are that described method comprises the steps:
(1) makes up the test envelope environment;
(2) every kind of tested object DUT is carried out preference pattern and structure;
(3) control structure of deployment CTR;
(4) carry out test experience.
Wherein, the described structure test envelope of step (1) environment is the structural design according to industrial control system.
Wherein, described industrial control system comprises control module, Industry Control collecting device, industrial control system, Industry Control corollary system, data source module and measurand DUT;
Described control module is connected with described Industry Control collecting device, described industrial control system, described Industry Control corollary system and the data source module of being connected respectively;
Described Industry Control collecting device, described industrial control system, described Industry Control corollary system and the data source module of being connected are connected with measurand DUT respectively.
Wherein, step (2) pattern comprises direct-detection model and indirect detection model.
Wherein, described direct-detection model refers to that testing apparatus detects measurand DUT by test channel.
Wherein, described indirect detection model refers to that testing apparatus passes through the agent equipment that the data interface channel connects the series connection of at least one, communicating by letter with measurand DUT by agent equipment, detects.
Wherein, described structure comprises: converge the unit and converge unit communication by at least one parallel test cell and another; Two converge the unit more respectively with upper layer device and lower floor's equipment connection.
Wherein, the control structure of the described deployment of step (3) CTR is to dispose according to the described test envelope environment of step (1).
Wherein, the described test experience of step (4) refers to according to step (1) and step (3), described control module is controlled respectively described Industry Control collecting device, described industrial control system, described Industry Control corollary system and described data source module, carry out the data that sending and receiving simulates from described measurand DUT, and by described control module deal with data;
Described measurand DUT comprise between measurand DUT1, measurand DUT2, measurand DUT3, measurand DUT4 and the measurand DUT5 any one or a plurality of.
Wherein, the described test experience of step (4) refers to according to step (1) and step (3), described control module is controlled respectively described Industry Control collecting device, described industrial control system, described Industry Control corollary system and described data source module, carries out the data that sending and receiving simulates from described measurand DUT and passes to described control module; Any one of described Industry Control collecting device, described industrial control system, described Industry Control corollary system or a plurality of, and described control module carries out simultaneously data and processes, and judge the data result deviation.
Compared with the prior art, beneficial effect of the present invention is:
1, the present invention can be by model and the structure of certain several appointment, and introducing initial data source K, realize the integral body simulation of industrial control system environment and the centralized control of realization test cell, solve the problem of industrial control equipment being carried out centralized detecting and emulation experiment.
2, the whole environment of the present invention is by abstract the forming of typical industry Control System NetWork structure, each testing apparatus and equipment under test are pressed the establishment of industrial control system environment, testing apparatus is positioned over the different piece of industrial control system by type, simultaneously interrelated according to the model structure of appointment, form function more specifically or the better test cell of performance.All test cells are controlled by CTR is unified by the model structure of appointment, so that whole test envelope can carry out combined test to the tested object in any industrial control system, comparing the traditional test technology can the mixed reality the transmission of data, so that emulation reality becomes possibility.
3, test environment of the present invention possesses an initial data source module, and producing simulating signal by the initial data source is that whole test envelope is introduced true external data, guarantees the integrality of industrial control equipment business processing.
4, the whole test envelope of the present invention is realized the dynamic change of whole test envelope by the real-time mode that increases and decreases A, C or increase and decrease in real time the inputoutput data value of A, C.
Description of drawings
Fig. 1 is the logical diagram that carries out direct-detection by A provided by the invention, is comprised of one or more A, B and DUT.
To be A provided by the invention carry out the logical diagram of indirect detection by C to Fig. 2, wherein has one or more A, B and DUT, wherein passes through several C and D.
Fig. 3 is the basic model that CTR provided by the invention controls, and is comprised of one or more CTR and several E and F.
Fig. 4 is the project organization of whole industrial control system test environment provided by the invention, also is the abstract structure of whole test envelope.
Fig. 5 is the basic structure of single E provided by the invention, is comprised of one or more M, uses N to be connected between upper layer equipment and the lower floor equipment; As M when being single, then N can not need.Wherein upper layer device and lower floor's equipment refer to the project organization by Fig. 4, the DUT that each E type connects or another kind E or K.
Embodiment
Below in conjunction with accompanying drawing the specific embodiment of the present invention is described in further detail.
A kind of test envelope method for industrial control equipment that present embodiment provides, its main treatment scheme is:
(1) makes up the test envelope environment
It, is disposed all kinds of testing elements such as the project organization by industrial control system test environment shown in Figure 4 according to the structural design of industrial control system by this project organization, wherein DUT is measurand.
Described industrial control system comprises control module, Industry Control collecting device, industrial control system, Industry Control corollary system, data source module and measurand DUT;
Described control module is connected by interface channel with described Industry Control collecting device, described industrial control system, described Industry Control corollary system and the data source module of being connected respectively;
Described Industry Control collecting device, described industrial control system, described Industry Control corollary system and the data source module of being connected are connected with measurand DUT1-DUT5 respectively, and each measurand DUT is connected with adjacent measurand DUT.
(2) every kind of tested object DUT is carried out preference pattern and structure
Different for survey object and test item, its pattern is according to the model of Fig. 1 and Fig. 2, A, C, the parts such as B, D are disposed in design, form test cell, wherein A and C can be also one or more true industrial control systems of one or more analog machines, final structure converges the unit and converges unit communication by at least one parallel test cell and another as shown in Figure 5; Two converge the unit more respectively with upper layer device and lower floor's equipment connection
Wherein: described direct-detection model refers to that testing apparatus detects measurand DUT by test channel.
Described indirect detection model refers to that testing apparatus passes through the agent equipment that the data interface channel connects the series connection of at least one, communicating by letter with measurand DUT by agent equipment, detects.
(3) control structure of deployment CTR
According to the control basic model of Fig. 3, E, F are disposed in design, CTR is set up, so that CTR can connect all E, and can control.
(4) comprehensive detection experiment
According to the structure of Fig. 4, dispose DUT, wherein DUT can deployment and DUT1, DUT2, DUT3, DUT4 and DUT5 in one or more positions.CTR control K, J, I, G Reality simulation equipment, the data of K, J, I, the test of G sending and receiving so that really environment as the industrial control condition of true operation, but the equal non-True Data of all data.Any one or a plurality of E or K directly send to adjacent DUT with these type of data, so that data communication device is crossed DUT equipment, send to the E of some or a plurality of appointments after the processing through DUT equipment, all E that transmit and receive data process data, generate the result data summary info and send to CTR, processed by the CTR intensive data, and then judge detection that DUT experiences or the result of experimental project; Simultaneously, in addition other E or K, can not do any action, also can directly simulated data be sent to the E that closes on, form after treatment real or approach and control really data, and by E the correlation results data summary info is sent to CTR, in order to compare with result data summary info through DUT, judge deviation between the two.
Of the present invention being defined as follows:
A: basic test equipment, the selectivitys combination of carrying out for certain test that is consisted of by one or more testing apparatuss one or more.
DUT: tested destination object, can be an equipment under test or software, also can be the set that a plurality of equipment under tests or software form.
B: connect the test channel of DUT, import one or more that spread out of action of test data to DUT are provided.
C: agent equipment, between A and DUT, provide test agent or test function to strengthen or the test decay, this equipment can for one or more, can be the equipment such as signal amplifier, flow controller, in order to test specification or the power of test that enlarges A on the same data path.
D: between the agent equipment or with the data interface channel of other equipment.
E: a kind of by test cell M and converge the assembled unit that unit N forms, can be J, I, G several types.
K: the data source module, for whole Industry Control test environment provides the input and output of simulating signal, its final external outgoi8ng data that imports into is simulating signal.
J:E's is a kind of, and the simulation of one or more Industry Control collecting devices is provided, and this Industry Control collecting device includes but not limited to that industry control gathers RTU equipment, on-pole switch PTU equipment etc.
I:E's is a kind of, and the simulation of one or more industrial control systems is provided, and this industrial control system includes but not limited to distribution automation system, power transformation automation system etc.
G:E's is a kind of, and the simulation of one or more Industry Control corollary systems is provided, and this Industry Control corollary system includes but not limited to production management system, dispatching management information system etc.
CTR: control module provides the monitoring to one or more E.
Interface channel between F:CTR and each E.
M: test cell, by A and C or only A form according to Fig. 1 or model shown in Figure 2, wherein do not comprise DUT.
N: converge the unit, be responsible for the converging of external inputoutput data of each M among the E, so that each M all can DUT or CTR communication and guaranteed quality and the precision of this communication.
Test envelope: a kind of Reality simulation environment or system realize the test environment of centralized detecting or emulation experiment.
Should be noted that at last: above embodiment is only in order to illustrate that technical scheme of the present invention is not intended to limit, although with reference to above-described embodiment the present invention is had been described in detail, those of ordinary skill in the field are to be understood that: still can make amendment or be equal to replacement the specific embodiment of the present invention, and do not break away from any modification of spirit and scope of the invention or be equal to replacement, it all should be encompassed in the middle of the claim scope of the present invention.
Claims (10)
1. a test envelope method that is used for industrial control equipment is characterized in that described method comprises the steps:
(1) makes up the test envelope environment;
(2) every kind of tested object DUT is carried out preference pattern and structure;
(3) control structure of deployment CTR;
(4) carry out test experience.
2. test envelope method as claimed in claim 1 is characterized in that, the described structure test envelope of step (1) environment is the structural design according to industrial control system.
3. test envelope method as claimed in claim 2 is characterized in that, described industrial control system comprises control module, Industry Control collecting device, industrial control system, Industry Control corollary system, data source module and measurand DUT;
Described control module is connected with described Industry Control collecting device, described industrial control system, described Industry Control corollary system and the data source module of being connected respectively;
Described Industry Control collecting device, described industrial control system, described Industry Control corollary system and the data source module of being connected are connected with measurand DUT respectively.
4. test envelope method as claimed in claim 1 is characterized in that, step (2) pattern comprises direct-detection model and indirect detection model.
5. test envelope method as claimed in claim 4 is characterized in that, described direct-detection model refers to that testing apparatus detects measurand DUT by test channel.
6. test envelope method as claimed in claim 4 is characterized in that, described indirect detection model refers to that testing apparatus passes through the agent equipment that the data interface channel connects the series connection of at least one, communicating by letter with measurand DUT by agent equipment, detects.
7. test envelope method as claimed in claim 1 is characterized in that, described structure comprises: converge the unit and converge unit communication by at least one parallel test cell and another; Two converge the unit more respectively with upper layer device and lower floor's equipment connection.
8. test envelope method as claimed in claim 1 is characterized in that, the control structure of the described deployment of step (3) CTR is to dispose according to the described test envelope environment of step (1).
9. test envelope method as claimed in claim 1, it is characterized in that, the described test experience of step (4) refers to according to step (1) and step (3), described control module is controlled respectively described Industry Control collecting device, described industrial control system, described Industry Control corollary system and described data source module, carry out the data that sending and receiving simulates from described measurand DUT, and by described control module deal with data;
Described measurand DUT comprise between measurand DUT1, measurand DUT2, measurand DUT3, measurand DUT4 and the measurand DUT5 any one or a plurality of.
10. test envelope method as claimed in claim 1, it is characterized in that, the described test experience of step (4) refers to according to step (1) and step (3), described control module is controlled respectively described Industry Control collecting device, described industrial control system, described Industry Control corollary system and described data source module, carries out the data that sending and receiving simulates from described measurand DUT and passes to described control module; Any one of described Industry Control collecting device, described industrial control system, described Industry Control corollary system or a plurality of, and described control module carries out simultaneously data and processes, and judge the data result deviation.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201210512919.XA CN103034231B (en) | 2012-12-04 | 2012-12-04 | A kind of test envelope method for industrial control equipment |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201210512919.XA CN103034231B (en) | 2012-12-04 | 2012-12-04 | A kind of test envelope method for industrial control equipment |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN103034231A true CN103034231A (en) | 2013-04-10 |
| CN103034231B CN103034231B (en) | 2015-08-05 |
Family
ID=48021210
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201210512919.XA Active CN103034231B (en) | 2012-12-04 | 2012-12-04 | A kind of test envelope method for industrial control equipment |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN103034231B (en) |
Cited By (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106647714A (en) * | 2017-01-04 | 2017-05-10 | 上海云剑信息技术有限公司 | Industrial control system general character safety technology test bed |
| CN111751707A (en) * | 2020-06-28 | 2020-10-09 | 芯佰微电子（北京）有限公司 | Test circuit and chip |
| CN112291239A (en) * | 2020-10-29 | 2021-01-29 | 东北大学 | Network physical model facing SCADA system and intrusion detection method thereof |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2004095040A1 (en) * | 2003-03-21 | 2004-11-04 | Intel Corporation | Automated circuit board test actuator system |
| CN101110713A (en) * | 2007-09-05 | 2008-01-23 | 中国科学院上海微系统与信息技术研究所 | Information anastomosing system performance test bed based on wireless sensor network system |
| WO2008149153A1 (en) * | 2007-06-05 | 2008-12-11 | Astrium Limited | Remote testing system and method |
| WO2012033484A1 (en) * | 2010-09-07 | 2012-03-15 | Verigy (Singapore) Pte. Ltd. | Systems, methods and apparatus using virtual appliances in a semiconductor test environment |
-
2012
- 2012-12-04 CN CN201210512919.XA patent/CN103034231B/en active Active
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2004095040A1 (en) * | 2003-03-21 | 2004-11-04 | Intel Corporation | Automated circuit board test actuator system |
| WO2008149153A1 (en) * | 2007-06-05 | 2008-12-11 | Astrium Limited | Remote testing system and method |
| CN101110713A (en) * | 2007-09-05 | 2008-01-23 | 中国科学院上海微系统与信息技术研究所 | Information anastomosing system performance test bed based on wireless sensor network system |
| WO2012033484A1 (en) * | 2010-09-07 | 2012-03-15 | Verigy (Singapore) Pte. Ltd. | Systems, methods and apparatus using virtual appliances in a semiconductor test environment |
Non-Patent Citations (1)
| Title |
|---|
| 彭勇等: "工业控制系统信息安全研究进展", 《清华大学学报（自然科学版）》 * |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106647714A (en) * | 2017-01-04 | 2017-05-10 | 上海云剑信息技术有限公司 | Industrial control system general character safety technology test bed |
| CN106647714B (en) * | 2017-01-04 | 2018-11-09 | 上海云剑信息技术有限公司 | Industrial control system general character safe practice test envelope |
| CN111751707A (en) * | 2020-06-28 | 2020-10-09 | 芯佰微电子（北京）有限公司 | Test circuit and chip |
| CN112291239A (en) * | 2020-10-29 | 2021-01-29 | 东北大学 | Network physical model facing SCADA system and intrusion detection method thereof |
Also Published As
| Publication number | Publication date |
|---|---|
| CN103034231B (en) | 2015-08-05 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN110401661B (en) | Network security target range system of electric power monitoring system | |
| CN209607185U (en) | A kind of electric power monitoring system network safety prevention experience system | |
| Qassim et al. | A survey of scada testbed implementation approaches | |
| CN105678040B (en) | Power SCADA system virus analysis test envelope | |
| CN106790034A (en) | A kind of internet of things equipment certification and the method for secure accessing | |
| Khan et al. | The cyberphysical power system resilience testbed: Architecture and applications | |
| CN103034231B (en) | A kind of test envelope method for industrial control equipment | |
| Wu et al. | Enterprise Digital Intelligent Remote Control System Based on Industrial Internet of Things | |
| CN103346497B (en) | Intelligent substation electrical virtual circuit isolation method and system | |
| CN105258792A (en) | Stationing type environmental noise analytic system | |
| Sarkar et al. | A cybersecurity assessment framework for virtual operational technology in power system automation | |
| CN107171830A (en) | Power information physical hardware is in ring security simulation test platform | |
| CN107942724B (en) | Information security protection simulation verification platform for industrial key infrastructure | |
| CN112398830A (en) | Information security system and method with anti-attack function | |
| Huang et al. | A multi-agent-based distributed intrusion detection system | |
| CN104836329B (en) | Local-level dispatch supporting system capable of improving analyzing and processing capability of dispatcher during accident generation | |
| CN106789274A (en) | Intelligent substation security test system and method | |
| CN106789275A (en) | Transmission Network of Power System security test system and method | |
| CN115134127A (en) | Electric power monitoring network safety test system | |
| CN104915762A (en) | Safe control method and platform based on electrical secondary system of nuclear power station | |
| Wei et al. | A network security situation awareness model for electric vehicle shared charging pile system | |
| Shu et al. | Research on construction technology of network security shooting range for power monitoring system | |
| Hernández Jiménez et al. | Towards a cyber defense framework for scada systems based on power consumption monitoring | |
| CN106647714B (en) | Industrial control system general character safe practice test envelope | |
| Wei | Research on the construction of network security attack and defense range system in power monitoring system |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant | ||
| C41 | Transfer of patent application or patent right or utility model | ||
| TR01 | Transfer of patent right |
Effective date of registration: 20160427 Address after: 100192 Beijing city Haidian District Qinghe small Camp Road No. 15 Patentee after: China Electric Power Research Institute Patentee after: State Grid Smart Grid Institute Patentee after: State Grid Corporation of China Address before: 100192 Beijing city Haidian District Qinghe small Camp Road No. 15 Patentee before: China Electric Power Research Institute Patentee before: State Grid Corporation of China |
|
| C56 | Change in the name or address of the patentee | ||
| CP01 | Change in the name or title of a patent holder |
Address after: 100192 Beijing city Haidian District Qinghe small Camp Road No. 15 Patentee after: China Electric Power Research Institute Patentee after: GLOBAL ENERGY INTERCONNECTION RESEARCH INSTITUTE Patentee after: State Grid Corporation of China Address before: 100192 Beijing city Haidian District Qinghe small Camp Road No. 15 Patentee before: China Electric Power Research Institute Patentee before: State Grid Smart Grid Institute Patentee before: State Grid Corporation of China |