CN115766210A - Power monitoring network security training method, device and system based on token attack - Google Patents

Abstract

The invention discloses an electric power monitoring network ampere training method, device and system based on token attack, wherein the electric power monitoring network ampere training method comprises the steps of receiving an encrypted token sent by a captain or a team member through a token transmission channel, wherein the token only contains the current calling times of random numbers of the captain or the team member and the next team member IP address for obtaining the token; and decrypting the received token, fetching the attack password and the password from the attack dictionary according to a decryption result, and performing trial login on the attack target machine based on the attack password and the password. The invention changes the one-to-one password attack and defense in the prior art into many-to-one password attack and defense, and the flow of multi-person attack is the same as that of one-person attack, thereby increasing the difficulty of the defender in perceiving the attack.

Description

Power monitoring network security training method, device and system based on token attack

technical field

The invention belongs to the technical field of power system security, and in particular relates to a token attack-based power monitoring network security training method, device and system.

Background technique

The power monitoring network is divided into the production area and the information service area. The production area and the information service area are physically separated by forward and reverse safety isolation devices. The production area is divided into I area and II area according to the safety level. Physical isolation is carried out through forward and reverse safety isolation devices, and domestic commercial encryption algorithms are used to realize two-way identity authentication and data encryption of communication links, ensuring link communication security. It can be seen that the power monitoring network security training in the prior art mostly focuses on the improvement of the security capabilities of members in each area, especially the improvement of the ability to select passwords.

The training of password attack and defense capabilities first needs to improve the ability of the attacker. The current methods of attacking passwords are mostly point-to-point repeated attacks, which are easy to be discovered by the defender.

Token technology is widely used in the current network, such as when a server is authenticated, the server sends an authentication token, which is also stored in the database. When a subsequent request is sent by the same user, instead of sending the username and password, this authentication token is sent in the request packet, which is verified against the validity and authenticity of the token stored in the database. There are also many mechanisms for token-based authentication such as JSON Web Tokens (JWT) and OAuth tokens. However, the existing tokens are only data messages in a certain format, which is clear code information, which can be easily deciphered by network attackers, so that corresponding tokens can be forged to destroy information communication.

Contents of the invention

In view of the above problems, the present invention proposes a token attack-based power monitoring network security training method, device and system, which evolves the one-to-one password attack and defense in the prior art into a many-to-one password attack and defense, and multiple people attack The process is the same as the one-person attack process, which increases the difficulty for the defender to detect the attack.

In order to achieve the above-mentioned technical purpose and achieve the above-mentioned technical effect, the present invention is realized through the following technical solutions:

In the first aspect, the present invention provides a token attack-based power monitoring network security training method, including:

Receive the encrypted token sent by the captain or team member through the token transmission channel, the token contains and only includes the number of current calls of the captain or team member's random number and the IP address of the next player to obtain this token;

The received token is decrypted, and the attack password and password are obtained from the attack dictionary according to the decryption result, and the attack target machine is tentatively logged in based on the attack password and password.

Optionally, the power monitoring network security training method also includes:

If the tentative login fails, add 1 to the current random number calls of the captain or team member as the current random number calls, and perform address pairing in the token transmission channel according to the local IP address to find the next one to obtain this The IP address of the team member of the token, and then generate the encrypted token and send it to the corresponding team member.

Optionally, the power monitoring network security training method also includes:

If the tentative login fails, the attack on the target machine is completed.

Optionally, the token transmission channel is a circular queue, including the captain and the IP addresses of each team member, and each IP address is arranged in sequence.

Optionally, the method for obtaining the attack password and password includes:

Decrypt the received token to obtain the current call times of the random number in the token and the IP address of the next team member to obtain this token;

Utilize the IP address of this machine to compare with the IP address of the next team member who obtains the token;

When the comparison result is that the two are consistent, use the current number of calls of the random number in the token to subtract the current number of calls of the random number itself to obtain the number of times R _n that needs to call the rand function continuously;

Based on the random number seed, after calling the rand function R _n + 1 times continuously, a random number A is obtained; the random number seeds of the team leader and each team member are the same;

Perform remainder processing on the random number A, take the number of the attack dictionary as the modulus, obtain the index of the attack dictionary, and obtain the attack password and password from the attack dictionary.

Optionally, the encrypted token is obtained through the following steps:

Select the discrete Gaussian distribution parameters μ and σ to construct the discrete Gaussian distribution curve, where μ is the mean and σ is the variance;

Take each byte of the token in turn, and use the value of the obtained byte plus the value of the discrete Gaussian distribution parameter σ as the value of the sub-Gaussian random variable to map each byte of the token to a discrete Gaussian random vector On, obtain the discrete real number points on the discrete Gaussian distribution curve corresponding to each byte;

The storage sequence composed of each discrete real number point is used as the encrypted token.

Optionally, decrypting the received token includes the following steps:

Select the discrete Gaussian distribution parameters μ and σ to construct the discrete Gaussian distribution curve;

Based on the discrete Gaussian distribution curve, the coordinate discrete point on the X-axis corresponding to each discrete real number point in the storage sequence is obtained, and the discrete Gaussian distribution parameter σ is subtracted from the coordinate discrete point to restore the current call times of the random number in the token .

Optionally, the σ>150.

In a second aspect, the present invention provides a token attack-based power monitoring network security training device, comprising:

The receiving module is used to receive the encrypted token sent by the captain or team member through the token transmission channel. The token contains and only includes the number of times the captain or player’s random number is currently called and the IP of the next player who gets the token address;

The attack module is used to decrypt the received token, and obtain the attack password and password from the attack dictionary according to the decryption result, and perform tentative login to the attack target machine based on the attack password and password.

In a third aspect, the present invention provides a token attack-based power monitoring network security training system, including a storage medium and a processor;

The storage medium is used to store instructions;

The processor is configured to operate according to the instructions to perform the method according to any one of the first aspects.

Compared with prior art, the beneficial effect of the present invention:

The present invention evolves the one-to-one password attack and defense in the prior art into many-to-one password attack and defense, and the process of multi-person attack is the same as that of one-person attack, which increases the difficulty for the defender to detect being attacked, and not only improves the password attack and defense The level of offense in the exercise also presents technical challenges to password defenders.

Description of drawings

In order to make the content of the present invention easier to understand clearly, the present invention will be described in further detail below according to specific embodiments in conjunction with the accompanying drawings, wherein:

FIG. 1 is a flowchart of a token attack-based power monitoring network security training method according to an embodiment of the present invention.

Detailed ways

In order to make the object, technical solution and advantages of the present invention more clear, the present invention will be further described in detail below in conjunction with the examples. It should be understood that the specific embodiments described here are only used to explain the present invention, and are not intended to limit the protection scope of the present invention.

The application principle of the present invention will be described in detail below in conjunction with the accompanying drawings.

Example 1

An embodiment of the present invention provides a token attack-based power monitoring network security training method, including the following steps:

(1) Receive the encrypted token sent by the captain or team member through the token transmission channel, the token contains and only includes the number of times the captain or team member’s random number is currently called and the IP address of the next player to obtain this token;

(2) Decrypt the received token, and obtain the attack password and password from the attack dictionary according to the decryption result, and perform tentative login to the attack target machine based on the attack password and password.

In a specific implementation manner of the embodiment of the present invention, the power monitoring network security training method further includes:

If the tentative login fails, add 1 to the current random number calls of the captain or team member as the current random number calls, and perform address pairing in the token transmission channel according to the local IP address to find the next one to obtain this The IP address of the team member of the token, and then generate the encrypted token and send it to the corresponding team member.

If the tentative login fails, the attack on the target machine is completed.

In a specific implementation manner of the embodiment of the present invention, the token transmission channel is a circular queue, including the captain and the IP addresses of each team member, and each IP address is arranged in sequence.

In a specific implementation manner of the embodiments of the present invention, the method for obtaining the attack password and password includes:

Decrypt the received token to obtain the current call times of the random number in the token and the IP address of the next team member to obtain this token;

Utilize the IP address of this machine to compare with the IP address of the next team member who obtains the token;

When the comparison result is that the two are consistent, use the current number of calls of the random number in the token to subtract the current number of calls of the random number itself to obtain the number of times R _n that needs to call the rand function continuously;

Based on the random number seed, after calling the rand function R _n + 1 times continuously, a random number A is obtained; the random number seeds of the team leader and each team member are the same;

Perform remainder processing on the random number A, take the number of the attack dictionary as the modulus, obtain the index of the attack dictionary, and obtain the attack password and password from the attack dictionary.

In a specific implementation manner of the embodiments of the present invention, the encrypted token is obtained through the following steps:

Select the discrete Gaussian distribution parameters μ and σ to construct the discrete Gaussian distribution curve, μ is the mean value, and σ is the variance; in the specific implementation process, because the range represented by a byte is 0--255, after taking it greater than 150, use this The value is the center, the left minimum is 150-125, and the right maximum is 150+125, which can be distributed in the section with the steepest slope. For this reason, the σ>150;

Take each byte of the token in turn, and use the value of the obtained byte plus the value of the discrete Gaussian distribution parameter σ as the value of the sub-Gaussian random variable to map each byte of the token to a discrete Gaussian random vector On, obtain the discrete real number points on the discrete Gaussian distribution curve corresponding to each byte;

The storage sequence composed of each discrete real number point is used as the encrypted token.

In a specific implementation manner of the embodiments of the present invention, decrypting the received token includes the following steps:

Select the discrete Gaussian distribution parameters μ and σ to construct the discrete Gaussian distribution curve;

Based on the discrete Gaussian distribution curve, the coordinate discrete point on the X-axis corresponding to each discrete real number point in the storage sequence is obtained, and the discrete Gaussian distribution parameter σ is subtracted from the coordinate discrete point to restore the current call times of the random number in the token .

The token attack-based electric power monitoring network security training method of the embodiment of the present invention will be described in detail below in conjunction with a specific implementation manner.

For the security training of the power monitoring network, the network environments of Zone I, Zone II and Zone III are constructed in the local area network. In Zone I or Zone II, a team is used to attack a node in Zone II or Zone I cooperatively. The specific attack process is shown in Figure 1:

1. Captain creates a team

The captain first creates a training attack name for this coordinated attack, and subscribes to the message with the subject of the attack name;

Download data containing a large number of attack dictionaries from the Internet, and store them in the captain's local memory instead of the public database to prevent leakage.

Use the "fixed reference value" as a parameter to call the srand function to complete the setting of the random number seed, and set the number of times the random number is currently called to 0.

2. Players join the team

After the player program is started, publish the online message with the subject of attack, and subscribe to the message with the subject of the attack dictionary and the message with the subject of "fixed reference value".

Use the "fixed reference value" as a parameter to call the srand function to complete the setting of the random number seed to ensure that the team members and the captain have the same random number seed, and set the number of times the random number is currently called to 0.

3. Build a token transfer channel

Whenever a team member publishes an online message, the team leader obtains the online information of the team member by subscribing, and stores the team member's IP address in the memory pool. When all the team members are online, a token transmission channel is generated based on the IP addresses of all the team members.

When all players are online, the team leader publishes the attack dictionary in the local memory through a message with the theme of the attack dictionary; and continues to publish the token transmission channel with a message with the theme of the token transmission channel. Team members receive these two pieces of data by subscribing to the message with the subject of the attack dictionary and the message with the subject of the token transmission channel, and construct the same attack dictionary data as the captain in the local memory, as well as the token transmission channel.

4. Token Generation Process

The captain first creates a token through the program. The token contains and only contains the number of times the random number is currently called and the next IP address to obtain this token. And the captain selects the value of the discrete Gaussian distribution parameters μ and σ (greater than 150) for token encryption and decryption, and releases them with the theme of "Discrete Gaussian distribution parameters". Each team member receives these two parameters under the theme of "Discrete Gaussian Distribution Parameters".

5. Token transfer process

5.1 Token transfer sending process

First perform address pairing in the token transmission channel according to the local IP address (from the perspective of the data structure, the token transmission channel is a circular queue), and after finding it, combine the subsequent IP address with the current number of calls of the local random number is an octet string of 8 bytes, and then call the token encryption function.

5.2 Token Receiving Process

During the cyclic transmission of the token in the team composed of the captain and the team members, each time a member receives the token, he first calls the token decryption function to decrypt the token, and obtains the current number of calls of the sender's random number. Subtract the current calling times of your own random number to get the number of times R _n that needs to call the rand function continuously. After calling the rand function R _n + 1 times in a row, the last returned random number is processed as a remainder, and the number of attack dictionaries is taken as the modulus to obtain the index of the attack dictionary in the local memory, and the attack password is obtained from the attack dictionary and password. Finally, add 1 to the sender's current number of calls to the random number as the current number of calls to the sender's random number.

In the specific implementation process, the token is composed of 8 bytes, the first four bytes store the current call times of the random number, and the last four bytes store the IP address of the next team member who gets the token;

The token encryption process can be implemented in the following ways:

Select the center points μ and σ to construct the corresponding discrete Gaussian distribution curve, and take the curve on the right half of the distribution (that is, on the positive axis) as the mapping curve;

Take each byte of the 8 bytes of the token in turn, and use the value of the obtained byte plus the value of σ as the value of the sub-Gaussian random variable, thus mapping these 8 bytes to a discrete Gaussian random vector (the length of the vector is 8), thereby obtaining discrete real number points on 8 discrete Gaussian distribution curves, and sending the storage sequence (real number array of 8 elements) formed by these 8 discrete real number points as encrypted tokens.

The token decryption process can be implemented in the following ways:

After receiving the encrypted token, the receiver selects the center points μ and σ to construct the corresponding discrete Gaussian distribution curve, and obtains the corresponding X The coordinates of discrete points on the axis are x _i , and the value of σ is subtracted from x _i to restore the sender's original token data.

Combined with the curve characteristics of the above-mentioned discrete Gaussian distribution, when the X-axis takes the value of μ+σ, the slope of the nearby curve is relatively high, which can be well discretized, so that the Y-axis points corresponding to the integer points of the X-axis If the difference is large, you can use the Y-axis value to compare the floating-point numbers (for example, if the error is within 0.00000000001, the two floating-point numbers are considered equal), and find the corresponding integer point on the X-axis. And because the object of encryption and decryption is a byte, its value range is S[0,255], when σ is greater than 150, the distribution curve of the value in the range S is mapped to [μ+σ-125, μ+ σ+125] interval.

6. Attack process

The player who receives the token is activated to enter the attack state, and the player logs in tentatively to the attack target machine by decrypting the token and obtaining the attack password and password (that is, login information). If successful, the attack is successful, otherwise the team member starts the token production process and the token transmission process, and then enters the ready waiting state from the active state.

Example 2

Based on the same inventive concept as in Embodiment 1, the embodiment of the present invention provides a token attack-based power monitoring network security training device, including:

The receiving module is used to receive the encrypted token sent by the captain or team member through the token transmission channel. The token contains and only includes the number of times the captain or player’s random number is currently called and the IP of the next player who gets the token address;

The attack module is used to decrypt the received token, and obtain the attack password and password from the attack dictionary according to the decryption result, and perform tentative login to the attack target machine based on the attack password and password.

All the other parts are the same as in Example 1.

Example 3

Based on the same inventive concept as in Embodiment 1, the embodiment of the present invention provides a token attack-based power monitoring network security training system, including a storage medium and a processor;

The storage medium is used to store instructions;

The processor is configured to operate according to the instructions to execute the method according to any one of Embodiment 1.

The basic principles and main features of the present invention and the advantages of the present invention have been shown and described above. Those skilled in the industry should understand that the present invention is not limited by the above-mentioned embodiments. What are described in the above-mentioned embodiments and the description only illustrate the principle of the present invention. Without departing from the spirit and scope of the present invention, the present invention will also have Variations and improvements are possible, which fall within the scope of the claimed invention. The protection scope of the present invention is defined by the appended claims and their equivalents.

Claims (10)

1. An ampere training method for a power monitoring network based on token attack is characterized by comprising the following steps:

receiving an encrypted token sent by a captain or a team member through a token transmission channel, wherein the token only contains the current calling times of the random number of the captain or the team member and the next IP address of the team member for obtaining the token;

and decrypting the received token, fetching the attack password and the password from the attack dictionary according to a decryption result, and performing trial login on the attack target machine based on the attack password and the password.

2. The method for Ampere training of the power monitoring network based on the token attack as claimed in claim 1, wherein: the electric power monitoring network ampere training method further comprises the following steps:

if the trial login fails, taking the value obtained by adding 1 to the current calling times of the random number of the team leader or the team member as the current calling times of the random number of the team member, carrying out address pairing in a token transmission channel according to the IP address of the machine, finding the next team member IP address for obtaining the token, further generating the encrypted token, and sending the encrypted token to the corresponding team member.

3. The method for Ampere training of a Power monitoring network based on token attack according to claim 1 or 2, wherein: the ampere training method for the power monitoring network further comprises the following steps:

and if the tentative login fails, completing the attack on the attack target machine.

4. The method for Ampere training of the power monitoring network based on the token attack as claimed in claim 1, wherein: the token transmission channel is a circular queue and comprises a queue length and IP addresses of all the team members, and all the IP addresses are arranged in sequence.

5. The method for Ampere training of the power monitoring network based on the token attack as claimed in claim 1, wherein: the method for acquiring the attack password and the password comprises the following steps:

decrypting the received token to obtain the current calling times of the random number in the token and the next team member IP address for obtaining the token;

comparing the IP address of the local machine with the IP address of the next team member for obtaining the token;

when the comparison result shows that the random number and the random number are consistent, subtracting the current calling frequency of the random number from the current calling frequency of the random number in the token to obtain the frequency R of continuously calling the rand function _n ；

Continuously calling rand function R based on random number seed _n Obtaining a random number A after +1 times; the captain and the random number seeds of all the team members are the same;

and (4) carrying out remainder processing on the random number A, taking the number of the attack dictionary as a modulus, obtaining an index serving as the attack dictionary, and taking the attack password and the password from the attack dictionary.

6. The method for Ampere training of the power monitoring network based on the token attack as claimed in claim 1, wherein: the encrypted token is obtained by the following steps:

selecting discrete Gaussian distribution parameters mu and sigma to construct a discrete Gaussian distribution curve, wherein mu is a mean value, and sigma is a variance;

sequentially taking each byte of the token, and mapping each byte of the token to a discrete Gaussian random vector by taking the value of the taken byte plus the value of the discrete Gaussian distribution parameter sigma as the value of a sub-Gaussian random variable to obtain a discrete real number point on a discrete Gaussian distribution curve corresponding to each byte;

and taking the storage sequence formed by the discrete real number points as the encrypted token.

7. The method for Ampere training of a Power monitoring network based on token attack according to claim 6, wherein: decrypting the received token comprises the steps of:

selecting discrete Gaussian distribution parameters mu and sigma to construct a discrete Gaussian distribution curve;

and obtaining a coordinate discrete point on an X axis corresponding to each discrete real number point in the storage sequence based on the discrete Gaussian distribution curve, and reducing the current calling times of the random number in the token by subtracting a discrete Gaussian distribution parameter sigma from the coordinate discrete point.

8. The method for Ampere training of a Power monitoring network based on token attack according to claim 6, wherein: the σ >150.

9. An electric power monitoring network ampere training device based on token attack is characterized by comprising:

the receiving module is used for receiving the encrypted token sent by the captain or the team member through the token transmission channel, wherein the token only contains the current calling times of the random number of the captain or the team member and the next IP address of the team member for obtaining the token;

and the attack module is used for decrypting the received token, fetching an attack password and a password from the attack dictionary according to a decryption result, and performing trial login on the attack target machine based on the attack password and the password.

10. The utility model provides a power monitoring network ampere training system based on token attacks which characterized in that: comprising a storage medium and a processor;

the storage medium is used for storing instructions;

the processor is configured to operate in accordance with the instructions to perform the steps of the method according to any one of claims 1-8.

Images