CN110516441A - A security protection detection system for intelligent mining terminals - Google Patents

Abstract

The invention discloses a safety protection detection system for an intelligent mining terminal, which is characterized in that it includes: a scanning detection module for scanning and detecting the intelligent mining terminal according to scanning rules and judging the scanning result; a port detection module , used to detect the data and messages of the intelligent terminal port; run the security detection module, used to simulate the business operation, and judge whether the event actually reported by the intelligent terminal is consistent with the expected trigger event of the business operation; the console detection module, It is used to detect whether the operation of connecting and exiting the console is correct, and simulates various security accidents and attacks through the detection scheme stored in the detection system, and then detects whether the security protection function of the smart terminal is effective and reliable.

Description

A security protection detection system for intelligent mining terminals

technical field

The invention relates to the field of security protection of intelligent mining terminals, in particular to a security detection system for intelligent mining terminals.

Background technique

State Grid’s centralized bidding model has been implemented for many years, and the mining products have entered a critical operation and maintenance period. After extensive research, the State Grid Metrology Center found that there are potential safety hazards in the on-site operation of smart mining terminals, especially the lack of security protection measures for network ports and local communication ports. , there are security risks that are vulnerable to illegal attacks. In this context, how to eliminate and prevent the above security risks, ensure a more stable and safe operation of the smart grid, and ensure the information security of users at all levels of the smart grid has become a serious problem facing the entire smart grid industry.

Contents of the invention

The invention provides a safety protection detection system of an intelligent mining terminal, which is used to solve the problem of safety protection of the intelligent mining terminal.

The present invention provides a safety protection detection system for intelligent mining terminals, which is characterized in that it includes:

The scanning detection module is used to scan and detect the intelligent user terminals according to the scanning rules, and judge the scanning results;

The port detection module is used to detect the data and messages of the intelligent terminal port;

Run the safety detection module, which is used to simulate business operations, and judge whether the events actually reported by the smart mining terminal are consistent with the expected trigger events of business operations;

The console detection module is used to detect whether the operation of connecting and exiting the console is correct.

Preferably, the detection content of the scanning detection module includes: intelligent user terminal vulnerability scanning, weak password detection, and Ethernet remote service open information detection.

Preferably, the scanning detection module is used to scan and detect the intelligent user terminal according to the scanning rules, and judge the scanning results, including:

Start the corresponding scanning service according to the scanning detection use case, and one scanning service corresponds to one scanning rule;

Scan and detect smart mining terminals according to the scanning rules, and judge the scanning results;

The final detection result is judged according to the sub-detection results.

Preferably, the port detection module, its detection content includes: intelligent user terminal 232 port monitoring, intelligent user terminal maintenance 485 port monitoring, intelligent user terminal SSH port monitoring, intelligent user terminal infrared port monitoring, intelligent user terminal monitoring Terminal USB secure access.

Preferably, the port detection module is used to detect the data and packets of the intelligent terminal port, including:

Perform port unauthorized and illegal data detection;

Carry out legal data detection of port unauthorized non-safety authentication and authorization;

Perform port unauthorized security authentication message detection;

Perform port authorization legal data detection;

Perform port authorization automatic shutdown detection.

Preferably, the safety detection module is operated, and its detection content includes: intelligent terminal liquid crystal password setting, Ethernet remote port opening detection, intelligent terminal outreach information, intelligent terminal password change detection, key file directory change, intelligent Use terminal hazard operation information.

Preferably, the operation safety detection module is used for simulating business operations, and judging whether the event actually reported by the smart user terminal is consistent with the expected triggering event of the business operation, including:

Authorize the smart terminal console and log in to the console;

Simulate business operations in the console based on the detected sub-items;

Determine whether the event actually reported by the smart user terminal is consistent with the expected trigger event of the business operation.

The present invention provides a safety protection detection system for intelligent mining terminals. Through the cooperation of the detection system and the detection platform, various security accidents and attacks are simulated through the detection scheme stored in the detection system, and then the security protection of intelligent mining terminals is detected. function is effective and reliable.

Description of drawings

FIG. 1 is a functional architecture diagram of a security detection system for a smart mining terminal provided by an embodiment of the present invention;

Fig. 2 is the structure of the information database table of the intelligent user terminal involved in the embodiment of the present invention;

Fig. 3 is the table structure of the table body station database involved in the embodiment of the present invention;

Fig. 4 is the table structure of the public detection parameter database involved in the embodiment of the present invention;

Fig. 5 is the table structure of the test scheme library involved in the embodiment of the present invention;

Fig. 6 is a schematic diagram of the structure of a security protection detection scheme for a smart user terminal according to an embodiment of the present invention.

Detailed ways

In the following description, numerous specific details are set forth in order to provide a thorough understanding of the application. However, the present invention can be implemented in many other ways different from those described here, and those skilled in the art can make similar extensions without violating the connotation of the present invention, so the present invention is not limited by the specific implementations disclosed below.

Fig. 1 is a functional framework diagram of a safety protection detection system of a smart user terminal provided by the present invention. It can be seen from the figure that the safety protection detection system of a smart user terminal includes: scanning detection, port detection, and operation safety detection , Console detection.

The scanning detection module is used to scan and detect the intelligent user terminals according to the scanning rules, and judge the scanning results;

The port detection module is used to detect the data and messages of the intelligent terminal port;

Run the safety detection module, which is used to simulate business operations, and judge whether the events actually reported by the smart mining terminal are consistent with the expected trigger events of business operations;

The console detection module is used to detect whether the operation of connecting and exiting the console is correct.

Scanning detection module, its detection content includes: intelligent user terminal vulnerability scanning, weak password detection, Ethernet remote service open information detection. The scanning detection module is used to scan and detect the smart terminal according to the scanning rules, and judge the scanning results, including: start the corresponding scanning service according to the scanning detection use case, and a scanning service corresponds to a scanning rule; Use the mining terminal to scan and detect, and judge the scanning results; judge the final detection results based on the sub-detection results.

Port detection module, the detection content includes: smart user terminal 232 port monitoring, smart user terminal maintenance 485 port monitoring, smart user terminal SSH port monitoring, smart user terminal infrared port monitoring, smart terminal USB security access . The port detection module is used to detect the data and messages of the intelligent terminal port, including: detection of port unauthorized and illegal data; detection of port unauthorized non-safety authentication and authorized legal data; port unauthorized security authentication Packet detection; detection of legal data of port authorization; detection of automatic shutdown of port authorization.

Run the security detection module, and its detection content includes: intelligent terminal LCD password setting, Ethernet remote port open detection, intelligent terminal outreach information, intelligent terminal password change detection, key file directory change, intelligent terminal Hazardous handling information. Run the security detection module, which is used to simulate business operations, and judge whether the event actually reported by the smart user terminal is consistent with the expected trigger event of the business operation, including: authorizing the console of the smart user terminal and logging in to the console; The subitem simulates the business operation; judges whether the event actually reported by the smart user terminal is consistent with the expected trigger event of the business operation.

Before using the system to detect the security protection of smart terminals, first of all, it is necessary to plan and design the process of security detection of smart terminals. Specifically, the process can include: testing of security functions of smart terminals The planning and construction of the preparation, the design of the test execution process of the security protection function of the intelligent application terminal, and the planning and design of the test result of the security protection function of the intelligent application terminal. The following will further illustrate the specific process of the security protection detection of the smart user terminal by combining the security protection detection system of the smart user terminal with this process.

S101. Planning and construction of test preparation for the security protection function of the smart application terminal.

The planning and construction of smart application terminal security protection function test preparation mainly refers to the filing and configuration of the public parameters of the product under test, the test platform, and the test plan before the test. It includes constructing the file information of the smart mining terminal and its management library, constructing the detection table information of the smart mining terminal, constructing the public detection parameters of the smart mining terminal, and building a multi-level modular test plan and a test plan library. Let's take a certain smart terminal as an example to illustrate:

(1) Construct the file information of intelligent user-acquisition terminal and its information management database of intelligent user-acquisition terminal. The file information of the intelligent application terminal mainly refers to the parameter information that needs to be used in the detection process of the intelligent application terminal under test, including communication, protocol, scheme and other information. The specific content is shown in Figure 2.

(2) Construct an intelligent mining terminal to detect the station body information. Bench body station information mainly refers to the station parameter information of the test bench body that cooperates with the terminal test. The specific content is shown in Figure 3.

(3) Construct the public detection parameters of intelligent mining terminals. The public parameters mainly refer to the communication parameters between the detection system, the platform and the terminal. The specific content is shown in Figure 4.

(4) Construct multi-level modular test scheme and test scheme library. The specific content is shown in Figure 5.

S102. Design a test execution process for the security protection function of the intelligent application terminal.

Combined with the library table structure in S101 and the sub-modules in Figure 6, the test process steps of the security protection function of the intelligent application terminal are further explained:

(1) Taking "terminal vulnerability scanning" as an example, further explain the detection steps of the scanning detection module;

1.1) Start the corresponding scanning service according to the scanning detection use case, and a scanning detection use case corresponds to a scanning rule:

Refer to the table structure of the test plan library in Figure 5, read the use case number of "terminal vulnerability scanning" in the test plan library, that is, the second-level module number, and use this number information to start the corresponding scanning service in the program, and scan the intelligent application terminal security holes.

1.2) Scan and detect the smart mining terminal according to the scanning rules, and judge the scanning results;

1.2.1) Security vulnerabilities are divided into three levels: high-level, medium-level, and low-level.

1.2.2) If a high-risk vulnerability is detected in the smart user terminal, it is judged that the function of the smart user terminal fails to pass the test.

1.3) Judge the final detection result according to the sub-detection results.

(2) Taking "terminal 232 port monitoring" as an example, further explain the process steps of port detection:

2.1) Referring to the table structure of the test program library in Figure 5, read the use case number of "terminal 232 port monitoring" in the test program library, that is, the secondary module number, and use this number information to start the terminal 232 port monitoring and detection process in the program;

2.2) In the terminal 232 port monitoring and detection process, if the smart user terminal is not authorized, send illegal data to the smart user terminal through the detection system; if the terminal generates a "232 unauthorized event", it is determined that the sub-item is qualified, Otherwise, it is judged as unqualified;

2.3) In the terminal 232 port monitoring and detection process, in the case of unauthorized use of the intelligent terminal, the detection system sends non-safe authentication and authorized legal data to the intelligent terminal. If the terminal generates a "232 unauthorized event", The sub-item is judged to be qualified, otherwise it is judged to be unqualified;

2.4) In the terminal 232 port monitoring and detection process, if the smart user terminal is not authorized, the detection system sends a security authentication message to the smart user terminal for detection; if the terminal responds normally and does not generate "232 unauthorized event" , it is judged as qualified, otherwise it is judged as unqualified;

2.5) In the monitoring and detection process of the terminal 232 port, in the case of authorization to the smart user terminal, the detection system sends legal data detection to the smart user terminal; if the terminal responds normally and does not generate "232 unauthorized event", it is judged as Qualified, otherwise it is judged as unqualified;

2.6) In the terminal 232 port monitoring and detection process, in the case of authorizing the smart terminal for 5 minutes, wait 6 minutes and send any legal command. If the terminal generates "232 Unauthorized Event", it is judged as qualified, otherwise it is judged failed.

(3) Taking "password change detection" as an example, further explain the process steps of running security detection:

3.1) Referring to the table structure of the test plan library in Figure 5, read the use case number of "password change detection" in the test plan library, that is, the second-level module number, and use this number information to start the password change detection process in the program;

3.2) Authorize the console of the smart user terminal through the detection system, and log in to the console of the smart user terminal;

3.3) Perform password change operations in the console according to the detected sub-items;

3.4) If a "password change" event occurs, it is judged as qualified, otherwise it is judged as unqualified.

(4) Taking "the terminal successfully logs in to the console [network port]" as an example, further explain the process steps of the console detection:

4.1) Referring to the table structure of the test plan library in Figure 5, read the use case number of "the terminal logs in to the console successfully [network port]" in the test plan library, that is, the second-level module number, and use this number information to start the terminal login in the program The console successfully detects the [network port] process.

4.2) Through the detection system, connect the smart mining terminal to the console operation, if a "console login successful" event occurs, it is judged as qualified, otherwise it is judged as unqualified;

4.3) Execute the operation of exiting the console through the detection system. If the "console exits successfully" event occurs, it is judged as qualified, otherwise it is judged as unqualified.

S103. Planning and design of detection results of the security protection function of the smart application terminal.

The present invention provides a safety protection detection system for intelligent mining terminals. Through the cooperation of the detection system and the detection platform, various security accidents and attacks are simulated through the detection scheme stored in the detection system, and then the security protection of intelligent mining terminals is detected. function is effective and reliable.

Claims (7)

1. a kind of intelligence safety protection detection for adopting terminal characterized by comprising

Scanning Detction module for being scanned detection with terminal is adopted to intelligence according to scanning rule, and carries out scanning result Judgement；

Port detecting module, for being detected to intelligence with the data and message for adopting terminal prot；

Operational safety detection module is operated for analog service, judges intelligence with adopting the practical reported event of terminal and business operation It is expected that whether trigger event is consistent；

Console detection module, for detecting connection and whether exit consing correct.

2. system according to claim 1, which is characterized in that the Scanning Detction module, detection content include: intelligence With adopt terminal vulnerability scanning, weak passwurd detection, Ethernet remote service opening imformation detection.

3. system according to claim 1, which is characterized in that the Scanning Detction module, for according to scanning rule pair Intelligence is scanned detection with adopting terminal, and judges scanning result, comprising:

Start corresponding scan service, the corresponding scanning rule of a scan service according to Scanning Detction use-case；

Detection is scanned with terminal is adopted to intelligence according to scanning rule, and scanning result is judged；

Final testing result is judged according to sub- testing result.

4. system according to claim 1, which is characterized in that the port detecting module, detection content include: intelligence With adopting the monitoring of 232 port of terminal, intelligence with adopting the monitoring of 485 port of terminal maintenance, intelligence with adopting the port terminal SSH monitoring, intelligent With adopting the monitoring of terminal infrared port, intelligence with adopting terminal USB secure accessing.

5. system according to claim 1, which is characterized in that the port detecting module, for intelligence with adopting terminal The data and message of port are detected, comprising:

Carry out the detection of port unauthorized invalid data；

Carry out the valid data detection of the non-security certification of port unauthorized and authorization；

Carry out port unauthorized safety certification packet check；

Carry out port authorization valid data detection；

It carries out port authorization and detection is automatically closed.

6. system according to claim 1, which is characterized in that operational safety detection module, detection content include: intelligence With adopt the setting of terminal liquid crystal password, Ethernet remote port opens detection, intelligence is with adopting terminal external connection information, intelligence with adopting terminal Password change detection, the change of critical file catalogue, intelligence are with adopting terminal risky operation information.

7. system according to claim 1, which is characterized in that the operational safety detection module is grasped for analog service Make, judge intelligence with adopt the practical reported event of terminal and business operation expection trigger event it is whether consistent, comprising:

Intelligence is carried out with adopting terminal console authorization, and logs in console；

According to detection subitem analog service operation inside console；

Judge intelligence with adopt the practical reported event of terminal and business operation expection trigger event it is whether consistent.