Information security protection system for a power business environment management and control system

Abstract

This invention relates to an information security protection system for a power business environment management and control system, comprising an external network unit, a DMZ zone, a security zone, and an internal information network. The external network unit is connected to the DMZ zone via a secure access platform and to the security zone via a firewall. The security zone is connected to the internal information network via isolation equipment. The DMZ zone includes a front-end access service module, a mobile message push service module, and an instant messaging service module. The external network unit includes external users and internal users. The security zone includes a back-end access service module, a basic service module, a platform service module, and an application service module. The internal information network includes a platform database, a marketing database, a data acquisition module, a data middleware platform, and an operation service module. This invention effectively improves the information security protection level of the power business environment management and control system, ensuring reliable system operation and data security.

Description

Technical Field

[0001] This invention relates to the field of power safety, and in particular to an information security protection system for a power business environment management and control system. Background Technology

[0002] With the development of intelligent and digital technologies in power systems, various intelligent devices and systems need to connect to public networks for high-frequency data exchange via network channels. This data transmitted and exchanged through public networks is highly vulnerable to various known and unknown attack threats in the network environment, significantly increasing the probability of data leaks, tampering, and other security incidents. Currently, attack scenarios are typically constructed within the network environment to assess the data security performance during network communication. However, these methods cannot accurately identify network attack risks, nor can they dynamically adjust application data protection strategies based on risk identification results. Consequently, a high risk of data leakage and damage persists during data transmission and storage in the network environment, resulting in low data security. Summary of the Invention

[0003] To address the aforementioned problems, the present invention aims to provide an information security protection system for the power business environment management and control system, effectively improving the information security protection level of the power business environment management and control system and ensuring the reliable operation and data security of the system.

[0004] To achieve the above objectives, the present invention adopts the following technical solution:

[0005] An information security protection system for a power business environment management and control system includes an external network unit, a DMZ zone, a security zone, and an information intranet. The external network unit is connected to the DMZ zone through a secure access platform and to the security zone through a firewall. The security zone is connected to the information intranet through isolation devices. The DMZ zone includes a front-end access service module, a mobile message push service module, and an instant messaging service module. The external network unit includes external users and internal users. The security zone includes a back-end access service module, a basic service module, a platform service module, and an application service module. The information intranet includes a platform database, a marketing database, a data collection module, a data middleware platform, and an operation service module.

[0006] In this embodiment, the secure access platform implements two-factor authentication to ensure the authenticity of the user's identity and uses SSL / TLS protocol to encrypt communication to ensure the security of data transmission.

[0007] Furthermore, two-factor authentication is implemented as follows:

[0008] Users provide basic information during registration, including username, password, mobile phone number or email address;

[0009] The system sends a one-time verification code (OTP) to the user's provided mobile phone number or email address. The user needs to enter the received OTP to complete the registration.

[0010] The system records user information and generates and saves a secret key for generating subsequent OTPs;

[0011] During the user login phase, the user enters their username and password to complete the first step of identity verification.

[0012] After password verification, the system generates an OTP and sends it to the user's mobile phone or email address;

[0013] The user enters the received OTP, the system verifies whether the OTP is correct, and if correct, the login is completed;

[0014] Upon successful login, a short-lived login session is generated and bound to the user's client.

[0015] Furthermore, encryption using SSL / TLS ensures the security of data transmitted between the client and server, as detailed below:

[0016] Choose an SSL certificate issued by a trusted Certificate Authority (CA), generate a Certificate Signing Request (CSR), submit the application to the CA, and obtain the SSL certificate.

[0017] Install and configure SSL certificates on the server, including public key certificates, private keys, and CA intermediate certificates;

[0018] Configure the server to enable SSL / TLS for the web server and force the use of HTTPS for communication; set the SSL / TLS protocol version and cipher suite, configure HTTP Strict Transport Security (HSTS) to force clients to use HTTPS connections; implement a certificate binding mechanism to embed the public key in the application on the client side to prevent man-in-the-middle attacks.

[0019] The client is configured to use a trusted SSL library (such as OpenSSL or Bouncy Castle) to support HTTPS and SSL certificate verification, check the server certificate chain to ensure that the certificate is not expired and is issued by a trusted CA, and configure the client to verify SSL / TLS to ensure that it can only connect to server endpoints that have SSL / TLS enabled.

[0020] Furthermore, the DMZ zone deploys multi-layered firewalls and sets access control policies to restrict direct external access to internal network resources; the front-end access service module is used for initial user authentication and legitimacy checks; the mobile message push service module ensures encryption and authentication of mobile client communication, prevents messages from being tampered with or intercepted, implements rate limiting and speed control, and prevents abuse and DoS attacks; the instant messaging service module implements message encryption to ensure communication security and uses trusted timestamps to prevent message replay attacks.

[0021] Furthermore, the security zone deploys an intrusion detection and prevention system to monitor and block malicious activities in real time; the back-end access service module is used for further identity authentication and authorization verification, and allocates permissions according to user roles through multi-level access control policies; the basic service module provides secure basic services, including DNS and NTP, and ensures their security through isolation and strong access control; the platform service module integrates support services, enterprise information services, standard services, and caching services; the application service module deploys digital monitoring applications for the business environment.

[0022] Furthermore, the information intranet uses a secondary data isolation device to prevent direct exchange of data between the internal and external networks, ensuring secure data transmission; the platform database and the marketing database employ transparent data encryption and column-level encryption to protect sensitive data, and a database firewall (DBF) is also deployed to monitor and audit database operations.

[0023] The acquisition module ensures the accuracy and security of data acquisition, encrypts the storage and transmission of acquired data, and configures log management tools to record all data acquisition and access operations; the data platform prevents the leakage of sensitive data during processing through data anonymization technology; the operation service module is used to implement high availability and disaster recovery solutions, ensure the continuous and stable operation of the system, monitor the system's operating status in real time, and ensure system security through log analysis and anomaly detection.

[0024] The present invention has the following beneficial effects:

[0025] 1. This invention effectively improves the information security protection level of the power business environment management and control system, ensuring the reliable operation of the system and data security;

[0026] 2. This invention adopts a multi-layered protection mechanism, including four layers: external network unit, DMZ zone, security zone and information intranet. Through layer-by-layer isolation and protection, the risk of attack on any single layer is reduced; the security between each layer is further enhanced by the setting of firewalls and isolation devices, ensuring that unauthorized access cannot directly enter the core information.

[0027] 3. This invention achieves centralized management of all business services and interfaces through the back-end access service module, basic service module, platform service module, and application service module of the security zone, which simplifies the system management and maintenance process, improves work efficiency, and effectively centralizes data storage and processing in the platform database, marketing database, and data platform in the information intranet, thereby enhancing data integration capabilities.

[0028] 4. The system architecture of this invention supports both external and internal users. It processes requests from external and internal users through a front-end access service module and a back-end access service module, respectively, providing customized access and services to meet the needs of different users. Attached Figure Description

[0029] Figure 1 This is a system architecture diagram of the present invention. Detailed Implementation

[0030] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments:

[0031] refer to Figure 1 In this embodiment, an information security protection system for a power business environment management and control system is provided, including an external network unit, a DMZ zone, a security zone, and an information intranet. The external network unit is connected to the DMZ zone through a secure access platform and to the security zone through a firewall. The security zone is connected to the information intranet through isolation devices. The DMZ zone includes a front-end access service module, a mobile message push service module, and an instant messaging service module. The external network unit includes external users and internal users. The security zone includes a back-end access service module, a basic service module, a platform service module, and an application service module. The information intranet includes a platform database, a marketing database, a data collection module, a data middleware platform, and an operation service module.

[0032] In this embodiment, the secure access platform implements two-factor authentication to ensure the authenticity of the user's identity and uses SSL / TLS protocol to encrypt communication to ensure the security of data transmission.

[0033] In this embodiment, two-factor authentication is implemented as follows:

[0034] Users provide basic information during registration, including username, password, mobile phone number or email address;

[0035] The system sends a one-time verification code (OTP) to the user's provided mobile phone number or email address. The user needs to enter the received OTP to complete the registration.

[0036] The system records user information and generates and saves a secret key for generating subsequent OTPs;

[0037] During the user login phase, the user enters their username and password to complete the first step of identity verification.

[0038] After password verification, the system generates an OTP and sends it to the user's mobile phone or email address;

[0039] The user enters the received OTP, the system verifies whether the OTP is correct, and if correct, the login is completed;

[0040] Upon successful login, a short-lived login session is generated and bound to the user's client.

[0041] In this embodiment, SSL / TLS encryption is used to ensure the security of data transmitted between the client and the server, as detailed below:

[0042] Choose an SSL certificate issued by a trusted Certificate Authority (CA), generate a Certificate Signing Request (CSR), submit the application to the CA, and obtain the SSL certificate.

[0043] Install and configure SSL certificates on the server, including public key certificates, private keys, and CA intermediate certificates;

[0044] Configure the server to enable SSL / TLS for the web server and force the use of HTTPS for communication; set the SSL / TLS protocol version and cipher suite, configure HTTP Strict Transport Security (HSTS) to force clients to use HTTPS connections; implement a certificate binding mechanism to embed the public key in the application on the client side to prevent man-in-the-middle attacks.

[0045] The client is configured to use a trusted SSL library (such as OpenSSL or Bouncy Castle) to support HTTPS and SSL certificate verification, check the server certificate chain to ensure that the certificate is not expired and is issued by a trusted CA, and configure the client to verify SSL / TLS to ensure that it can only connect to server endpoints that have SSL / TLS enabled.

[0046] In this embodiment, a multi-layered firewall is deployed in the DMZ zone, and access control policies are set to restrict direct external access to internal network resources. The front-end access service module is used for preliminary user authentication and legitimacy checks. The mobile message push service module ensures encryption and authentication of mobile client communication, prevents messages from being tampered with or intercepted, implements rate limiting and speed control, and prevents abuse and DoS attacks. The instant messaging service module implements message encryption to ensure communication security and uses trusted timestamps to prevent message replay attacks.

[0047] In this embodiment, an intrusion detection and prevention system is deployed in the security zone to monitor and block malicious activities in real time; the back-end access service module is used for further identity authentication and authorization verification, and permissions are assigned according to user roles through multi-level access control policies; the basic service module provides secure basic services, including DNS and NTP, and ensures their security through isolation and strong access control; the platform service module integrates support services, enterprise information services, standard services, and caching services; and the application service module deploys a digital monitoring application for the business environment.

[0048] In this embodiment, the information intranet uses a secondary data isolation device to prevent direct exchange of data between the internal and external networks, ensuring secure data transmission. The platform database and the marketing database employ transparent data encryption and column-level encryption to protect sensitive data, and a database firewall (DBF) is also deployed to monitor and audit database operations.

[0049] The acquisition module ensures the accuracy and security of data acquisition, encrypts the storage and transmission of acquired data, and configures log management tools to record all data acquisition and access operations; the data platform prevents the leakage of sensitive data during processing through data anonymization technology; the operation service module is used to implement high availability and disaster recovery solutions, ensure the continuous and stable operation of the system, monitor the system's operating status in real time, and ensure system security through log analysis and anomaly detection.

[0050] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0051] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0052] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0053] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0054] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any other way. Any person skilled in the art may make changes or modifications to the above-disclosed technical content to create equivalent embodiments. However, any simple modifications, equivalent changes, and modifications made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the protection scope of the present invention.

Claims

1. An information security protection system of a power business environment management system, characterized by, The system comprises an external network unit, a DMZ area, a security area and an information internal network; the external network unit is connected with the DMZ area through a secure access platform and is connected with the security area through a protective wall; the security area is connected with the information internal network through an isolation device; the DMZ area comprises a front access service module, a mobile message push service module and an instant communication service module; the external network unit comprises external users and internal users; the security area comprises a rear access service module, a basic service module, a platform service module and an application service module; the information internal network comprises a platform database, a marketing database, an acquisition module, a data center and a running service module; the secure access platform realizes two-factor authentication, ensures the authenticity of the user identity, and encrypts the communication through SSL / TLS protocol to ensure the safety of data transmission; the DMZ area deploys a multi-layer firewall, sets an access control policy and limits the direct access of the external to the internal network resources; the front access service module is used for the preliminary identity verification and legality check of the user; the mobile message push service module ensures the encryption and authentication of the mobile client communication, prevents the message from being tampered with or intercepted, realizes the flow limiting and rate limiting, and prevents the abuse and DoS attack; the instant communication service module implements message encryption to ensure the communication safety and uses a trusted timestamp to prevent the message replay attack; the security area deploys an intrusion detection and prevention system to monitor and block malicious activities in real time; the rear access service module is used for further identity authentication and authorization verification, and the user is allocated with the authority according to the user role through a multi-level access control policy; the basic service module provides safe basic services, including DNS and NTP, and ensures the safety thereof through isolation and strong access control; the platform service module integrates support services, enterprise information services, standard services and cache services; the application service module deploys a business environment digital monitoring application.

2. The information security protection system of the power business environment management system according to claim 1, wherein, The two-factor authentication is specifically as follows: The user provides basic information including a username, a password, a mobile phone number or an email address when registering; The system sends an one-time password OTP to the mobile phone number or the email address provided by the user, and the user needs to input the received OTP to complete the registration; The system records the user information and generates and saves a secret key for generating the subsequent OTP; In the user login stage, the user inputs the username and the password to perform the first step of identity verification; After the password verification, the system generates an OTP and sends it to the mobile phone or the email address of the user; The user inputs the received OTP, and the system verifies whether the OTP is correct, and if correct, the login is completed; After the login is successful, a short-term valid login session is generated and is bound to the client of the user.

3. The information security protection system of the power business environment management system according to claim 1, wherein The encryption through SSL / TLS ensures the safety of the data transmitted between the client and the server, and is specifically as follows: An SSL certificate issued by a trusted CA is selected, a certificate signing request CSR is generated, and an application is submitted to the CA to obtain the SSL certificate; The SSL certificate is installed and configured on the server, including a public key certificate, a private key and a CA intermediate certificate; The server configures a web server to enable SSL / TLS and force communication using HTTPS; sets the SSL / TLS protocol version and encryption suite, configures HTTP Strict Transport Security, forces the client to use an HTTPS connection; implements a certificate binding mechanism, and embeds the public key in the application on the client side to prevent man-in-the-middle attacks; The client configuration uses a trusted SSL library to support HTTPS and SSL certificate verification, checks the server certificate chain to ensure that the certificate is not expired and is issued by a trusted CA, and configures client verification SSL / TLS to ensure that only SSL / TLS-enabled server endpoints can be connected.

4. The information security protection system of the power business environment management system according to claim 1, wherein The information intranet uses data secondary isolation devices to avoid direct exchange of internal and external network data, ensuring safe data transmission; the platform database and marketing database use transparent data encryption and column-level encryption to protect sensitive data, and a database firewall is also deployed to monitor and audit database operations; the collection module ensures data collection accuracy and security, encrypts collected data for storage and transmission, and configures a log management tool to record all data collection and access operations; the data center: through data desensitization technology, prevent sensitive data from being leaked during processing; the running service module: implements high availability and disaster recovery solutions to ensure continuous and stable system operation, and monitors system operation in real time, ensures system security through log analysis and anomaly detection.

Images