New energy power plant network access security protection system based on PCFT security framework

Abstract

The invention relates to the technical field of power plant network access, and discloses a PCFT security framework-based new energy power plant network access security protection system, which comprises a security partition system, a firewall and logic isolation system, an encryption and authentication system, a PCFT security framework, an intrusion detection and host equipment reinforcement system and a security management platform, the security partition system is in communication connection with the firewall and logic isolation system, the firewall and logic isolation system is in communication connection with the encryption and authentication system, and the encryption and authentication system is in communication connection with the PCFT security framework. Therefore, the process of manually processing each resource access control is simplified, the PCFT security framework is used, the security of the system can be effectively improved, security vulnerabilities are reduced, the security management process is simplified, the availability, integrity and confidentiality of the system are ensured, and data are prevented from being modified or disclosed without authorization.

Description

Technical Field

[0001] The present invention relates to the technical field of power plant network access, and in particular to a new energy power plant network access security protection system based on a PCFT security framework. Background Art

[0002] The network access security protection system for new energy power plants ensures the information security and data integrity of new energy power plants during their access to the power grid, and prevents unauthorized access, data leakage, and potential network security threats. The network access security protection system for new energy power plants uses a variety of technologies and measures to ensure the information security and data integrity of power plants during their access to the power grid, and prevents unauthorized access, data leakage, and potential network security threats, thereby improving the safety and stability of the entire power system.

[0003] The existing system may result in the network access security protection system of new energy power plants being unable to effectively respond to complex network security threats. At the same time, the lack of unified security standards and frameworks may lead to an incomplete network access security protection system for new energy power plants. Summary of the invention

[0004] The purpose of the present invention is to provide a new energy power plant network access security protection system based on the PCFT security framework in order to solve the above problems, thereby solving the problems mentioned in the background technology.

[0005] In order to solve the above problems, the present invention provides a technical solution:

[0006] The network access security protection system for new energy power plants based on the PCFT security framework includes a security partitioning system, a firewall and logical isolation system, an encryption and authentication system, a PCFT security framework, an intrusion detection and host device reinforcement system and a security management platform. The security partitioning system is communicatively connected to the firewall and logical isolation system, the firewall and logical isolation system is communicatively connected to the encryption and authentication system, the encryption and authentication system is communicatively connected to the PCFT security framework, the PCFT security framework is communicatively connected to the intrusion detection and host device reinforcement system, and the intrusion detection and host device reinforcement system is communicatively connected to the security management platform.

[0007] As a preferred solution of the present invention, the security partition system includes a network security module, a terminal security module, an application security module, a system security module and a data security module;

[0008] Network security module: including network classification, domain name protection, traffic monitoring, access control, branch structure, remote office, covert channel, high-risk port, etc.;

[0009] Terminal security module: involves terminal access, patch management, media management, illegal external connections, cloud desktop, file fingerprint, EDR, malicious code detection and terminal tracing;

[0010] Application security module: including application access control, application data protection, application log audit, etc. Application security focuses on protecting applications from unauthorized access or modification;

[0011] System Security Module: Application security focuses on protecting applications from unauthorized access or modification;

[0012] Data security module: including data encryption, data backup, data recovery, data access control and data auditing, etc.

[0013] As a preferred solution of the present invention, the firewall and logic isolation system includes a firewall unit and a logic isolation unit; the firewall unit includes a filtering module, a state detection module and an application layer gateway;

[0014] Filter module: Checks the header information of each incoming and outgoing data packet, including source IP address, destination IP address, source port, destination port, protocol type, and flag bits of the data packet;

[0015] Stateful Inspection Module: Tracks the state information of each network connection, not just individual packets. When a new connection request arrives, the firewall checks whether the request complies with the security policy.

[0016] Application layer gateway: Parses and inspects data content in application layer protocols, and detects and blocks protocol-specific attacks, including FTP, SMTP, HTTP, etc.

[0017] As a preferred solution of the present invention, the logic isolation unit includes a virtual private network module, an intrusion detection and defense module and a load balancing module;

[0018] Virtual Private Network Module: Through encryption and tunneling technology, it ensures the confidentiality and integrity of data during transmission, and is used in scenarios such as remote office, cross-regional network connection, and secure access to internal network resources;

[0019] Intrusion detection and prevention module: used to detect and prevent intrusions in the network, monitor network traffic and system logs, identify potential intrusions and issue alarms;

[0020] Load balancing module: used to distribute network traffic to multiple servers, intelligently distribute requests to the most suitable server based on factors such as network traffic, server load and health status.

[0021] As a preferred solution of the present invention, the encryption and authentication system includes a trusted terminal security module, a dual-factor access module, a mobile media control module and a dedicated isolation device;

[0022] Trusted terminal security module: By deploying a trusted terminal security module in the power grid dispatching center or substation, data authentication registration, status monitoring, security policy and security audit management can be achieved;

[0023] Two-factor access module: used to identify illegal login behaviors through a two-factor authentication mechanism;

[0024] Mobile media control module: access control for external access devices such as USB flash drives, as well as other security protection functions such as access control and baseline verification;

[0025] Special isolation equipment: Add a firewall between the control area and the non-control area to achieve logical isolation, and add special isolation equipment at the management information area and the public network access boundary to achieve physical isolation.

[0026] As a preferred solution of the present invention, the PCFT security framework includes a network security system, a security model, a PDRR model and a P2DR model;

[0027] Network security system: It is composed of various network security units according to certain rules to jointly achieve the goal of network security.

[0028] Security model: including BLP confidentiality model and BiBa integrity model, etc., used to prevent the spread and modification of unauthorized information;

[0029] PDRR model: It consists of four parts: protection, detection, response, and recovery. It adopts all possible measures to protect the security of networks, systems, and information, evaluates the security status through detection technology, and establishes an emergency response mechanism.

[0030] P2DR model: includes four parts: policy, protection, detection and response. It implements protection, detection and response measures according to the security strategy generated by risk analysis.

[0031] As a preferred solution of the present invention, the intrusion detection and host device reinforcement system includes an event generator, an event analyzer, an event database and a response unit;

[0032] Event generators: responsible for obtaining events from the entire computing environment, such as network packets or system log information, and providing these events to other parts of the system;

[0033] Event Analyzer: Analyzes the acquired events and generates analysis results. By synchronizing, sorting, organizing and classifying the original data, it extracts system activity features or patterns to judge normal and abnormal behaviors.

[0034] Event database: a place to store various intermediate and final data, which can be a complex database or a simple text file;

[0035] Response unit: Takes action based on the analysis results, such as severing the connection, changing file attributes, or alerting the administrator.

[0036] The beneficial effects of the present invention are: by setting up a PCFT security framework, access restrictions on resources are implemented, thereby simplifying the process of manually handling access control of each resource. Using the PCFT security framework, the security of the system can be effectively improved, security vulnerabilities can be reduced, and the security management process can be simplified to ensure the availability, integrity and confidentiality of the system and prevent data from being modified or disclosed without authorization. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] For ease of explanation, the present invention is described in detail with reference to the following specific implementations and the accompanying drawings.

[0038] Figure 1 It is a flow chart of the network access safety protection system of the new energy power plant of the present invention. DETAILED DESCRIPTION

[0039] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0040] Embodiment 1:

[0041] The present invention provides a technical solution: a network access security protection system for a new energy power plant based on a PCFT security framework, including a security partitioning system, a firewall and logical isolation system, an encryption and authentication system, a PCFT security framework, an intrusion detection and host device reinforcement system and a security management platform, the security partitioning system and the firewall and logical isolation system are communicated and connected, the firewall and logical isolation system and the encryption and authentication system are communicated and connected, the encryption and authentication system and the PCFT security framework are communicated and connected, the PCFT security framework and the intrusion detection and host device reinforcement system are communicated and connected, and the intrusion detection and host device reinforcement system and the security management platform are communicated and connected.

[0042] Embodiment 2:

[0043] The security partition system includes network security module, terminal security module, application security module, system security module and data security module; network security module: including network classification, domain name protection, traffic monitoring, access control, branch structure, remote office, covert channel, high-risk port, etc., to protect the network system from unauthorized access or attack, and ensure the confidentiality, integrity and availability of data; terminal security module: involving terminal access, patch management, media management, illegal external connection, cloud desktop, file fingerprint, EDR, malicious code detection and terminal tracing, to protect terminal devices from unauthorized access or infection with malware, and ensure the stability of the terminal. Stable and safe operation; Application security module: including application access control, application data protection, application log audit, etc. Application security focuses on protecting applications from unauthorized access or modification, ensuring the integrity and confidentiality of application data; System security module: Application security focuses on protecting applications from unauthorized access or modification, ensuring the stable operation of the operating system and database, and preventing unauthorized access and data leakage; Data security module: including data encryption, data backup, data recovery, data access control and data audit, etc., protecting the confidentiality, integrity and availability of data, and preventing data from unauthorized access or tampering.

[0044] The safety zoning rules of the power monitoring system divide the system into the production control area and the management information area. The production control area is further divided into the control area (safety area I) and the non-control area (safety area II), and the management information area is divided into the production management area (safety area III) and the management information area (safety area IV). Each area takes different safety measures according to its function and importance to ensure the stability and safety of the power system. In automotive electronic systems, the "safety zoning" concept in the ISO26262 standard divides the system into different subsystems or components, each of which has independent safety functions and performance to control the propagation of faults and limit potential hazards. This partition ensures the redundancy and fault tolerance of the system and improves the overall safety.

[0045] Embodiment 3:

[0046] The firewall and logical isolation system includes a firewall unit and a logical isolation unit; the firewall unit includes a filtering module, a state detection module and an application layer gateway; the filtering module: checks the header information of each incoming and outgoing data packet, including the source IP address, destination IP address, source port, destination port, protocol type, and the flag bit of the data packet, etc. It has a fast processing speed and has little impact on system performance, but it cannot deeply understand the content of the data packet and may not be able to effectively prevent some complex application layer attacks; the state detection module: tracks the state information of each network connection, not just a single data packet. When a new connection request arrives, the firewall will check whether the request complies with the security policy; the application layer gateway: parses and checks the data content in the application layer protocol, detects and blocks protocol-specific attacks, including FTP, SMTP, HTTP, etc., and It performs deep filtering and inspection on certain application layer protocols to improve the security of the network; the logical isolation unit includes a virtual private network module, an intrusion detection and prevention module, and a load balancing module; the virtual private network module: through encryption and tunneling technology, it ensures the confidentiality and integrity of data during transmission, and is used in scenarios such as remote office, cross-regional network connection, and secure access to internal network resources; the intrusion detection and prevention module: is used to detect and prevent intrusions in the network, monitor network traffic and system logs, identify potential intrusions and issue alarms, and can promptly detect and respond to threats in the network to improve the security of the network; the load balancing module: is used to distribute network traffic to multiple servers, and intelligently distributes requests to the most suitable server based on factors such as network traffic, server load, and health status, inspects and filters traffic, and provides a certain degree of security protection.

[0047] Embodiment 4:

[0048] The encryption and authentication system includes a trusted terminal security module, a two-factor access module, a mobile media control module and a dedicated isolation device; Trusted terminal security module: By deploying a trusted terminal security module in the power grid dispatching center or substation, the authentication registration, status monitoring, security policy and security audit management of the data are realized, the encryption and authentication functions of the data are realized, and the security of data transmission is ensured; Two-factor access module: It is used to identify illegal login behaviors, and through the two-factor authentication mechanism, the security of the system is improved to prevent unauthorized access; Mobile media control module: Access control of external access devices such as USB flash drives, as well as other security protection functions such as access control and baseline verification, ensure the access security of mobile media; Dedicated isolation equipment: Add a firewall between the control area and the non-control area to achieve logical isolation, and add a dedicated isolation device at the management information area and the public network access boundary to achieve physical isolation, ensuring that the public network is only connected to the management information area.

[0049] The power monitoring system is divided into production control area and management information area, and further divided into control area and non-control area according to the possible impact of business functions on primary equipment, to ensure that data interaction and access control in different areas meet security requirements. Through the collaborative work of these modules, the new energy power plant network access security protection system can realize data encryption transmission, identity authentication, access control and data isolation, thereby ensuring the safe operation of the power system.

[0050] Embodiment 5:

[0051] The PCFT security framework includes network security system, security model, PDRR model and P2DR model; Network security system: It is composed of various network security units according to certain rules to jointly achieve the goal of network security. It is holistic, collaborative, procedural and comprehensive, and can adapt to changes and needs in network security threats; Security model: It includes BLP confidentiality model and BiBa integrity model, etc., which are used to prevent the spread and modification of unauthorized information and ensure the information integrity and security of the system; PDRR model: It consists of four parts: protection, detection, response and recovery. It adopts all possible measures to protect the security of the network, system and information, evaluates the security status through detection technology, and establishes an emergency response mechanism; P2DR model: It includes four parts: policy, protection, detection and response. It implements protection, detection and response measures according to the security strategy generated by risk analysis.

[0052] Through these systems and models, the PCFT security framework can provide a comprehensive network security protection to ensure that the organization's network and information systems are protected from various security threats.

[0053] Embodiment 6:

[0054] The intrusion detection and host device reinforcement system includes an event generator, an event analyzer, an event database and a response unit; event generator: responsible for obtaining events from the entire computing environment, such as network data packets or system log information, and providing these events to other parts of the system, the data entry of the intrusion detection system, ensuring that the system can obtain enough data for analysis; event analyzer: analyze the obtained events and generate analysis results. By synchronizing, sorting, organizing and classifying the original data, the system activity characteristics or patterns are extracted to judge normal and abnormal behaviors. It is the core function of the intrusion detection system and ensures that the system can accurately judge whether there is an intrusion behavior; event database: a place to store various intermediate and final data, which can be a complex database or a simple text file, used to store analysis results and other related information, and support continuous learning and optimization of the system; response unit: react according to the analysis results, such as cutting off the connection, changing file attributes or alerting the administrator, and taking timely measures to prevent the continuation of the intrusion and reduce potential losses.

[0055] The host device hardening system usually also includes information collection, analysis and processing modules. These modules are responsible for collecting various relevant communication and system activity information from the network or host, forming an initial event record, and conducting detailed analysis and judgment. Once a potential security threat is discovered, the system will take corresponding measures according to predetermined strategies, including recording, alarming and countermeasures.

[0056] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. The network access security protection system for new energy power plants based on the PCFT security framework is characterized by: It includes a security partition system, a firewall and logical isolation system, an encryption and authentication system, a PCFT security framework, an intrusion detection and host device reinforcement system and a security management platform. The security partition system is communicatively connected to the firewall and logical isolation system, the firewall and logical isolation system is communicatively connected to the encryption and authentication system, the encryption and authentication system is communicatively connected to the PCFT security framework, the PCFT security framework is communicatively connected to the intrusion detection and host device reinforcement system, and the intrusion detection and host device reinforcement system is communicatively connected to the security management platform.

2. According to claim 1, the new energy power plant network access security protection system based on the PCFT security framework is characterized in that: The security partition system includes a network security module, a terminal security module, an application security module, a system security module and a data security module; Network security module: including network classification, domain name protection, traffic monitoring, access control, branch structure, remote office, covert channel, high-risk port, etc.; Terminal security module: involves terminal access, patch management, media management, illegal external connections, cloud desktop, file fingerprint, EDR, malicious code detection and terminal tracing; Application security module: including application access control, application data protection, application log audit, etc. Application security focuses on protecting applications from unauthorized access or modification; System Security Module: Application security focuses on protecting applications from unauthorized access or modification; Data security module: including data encryption, data backup, data recovery, data access control and data auditing, etc.

3. According to claim 1, the new energy power plant network access security protection system based on the PCFT security framework is characterized in that: The firewall and logic isolation system includes a firewall unit and a logic isolation unit; the firewall unit includes a filtering module, a state detection module and an application layer gateway; Filter module: Checks the header information of each incoming and outgoing data packet, including source IP address, destination IP address, source port, destination port, protocol type, and flag bits of the data packet; Stateful Inspection Module: Tracks the state information of each network connection, not just individual packets. When a new connection request arrives, the firewall checks whether the request complies with the security policy. Application layer gateway: Parses and inspects data content in application layer protocols, and detects and blocks protocol-specific attacks, including FTP, SMTP, HTTP, etc.

4. According to claim 3, the new energy power plant network access security protection system based on the PCFT security framework is characterized in that: The logic isolation unit includes a virtual private network module, an intrusion detection and defense module and a load balancing module; Virtual Private Network Module: Through encryption and tunneling technology, it ensures the confidentiality and integrity of data during transmission, and is used in scenarios such as remote office, cross-regional network connection, and secure access to internal network resources; Intrusion detection and prevention module: used to detect and prevent intrusions in the network, monitor network traffic and system logs, identify potential intrusions and issue alarms; Load balancing module: used to distribute network traffic to multiple servers, intelligently distribute requests to the most suitable server based on factors such as network traffic, server load and health status.

5. According to claim 1, the network access security protection system for new energy power plants based on the PCFT security framework is characterized in that: The encryption and authentication system includes a trusted terminal security module, a dual-factor access module, a mobile media management and control module, and a dedicated isolation device; Trusted terminal security module: By deploying a trusted terminal security module in the power grid dispatching center or substation, data authentication registration, status monitoring, security policy and security audit management can be achieved; Two-factor access module: used to identify illegal login behaviors through a two-factor authentication mechanism; Mobile media control module: access control for external access devices such as USB flash drives, as well as other security protection functions such as access control and baseline verification; Special isolation equipment: Add a firewall between the control area and the non-control area to achieve logical isolation, and add special isolation equipment at the management information area and the public network access boundary to achieve physical isolation.

6. The network access security protection system for new energy power plants based on the PCFT security framework according to claim 1 is characterized in that: The PCFT security framework includes a network security system, a security model, a PDRR model and a P2DR model; Network security system: It is composed of various network security units according to certain rules to jointly achieve the goal of network security. Security model: including BLP confidentiality model and BiBa integrity model, etc., used to prevent the spread and modification of unauthorized information; PDRR model: It consists of four parts: protection, detection, response, and recovery. It adopts all possible measures to protect the security of networks, systems, and information, evaluates the security status through detection technology, and establishes an emergency response mechanism. P2DR model: includes four parts: policy, protection, detection and response. It implements protection, detection and response measures according to the security strategy generated by risk analysis.

7. The network access security protection system for new energy power plants based on the PCFT security framework according to claim 1 is characterized in that: The intrusion detection and host device hardening system includes an event generator, an event analyzer, an event database, and a response unit; Event generators: responsible for obtaining events from the entire computing environment, such as network packets or system log information, and providing these events to other parts of the system; Event Analyzer: Analyzes the acquired events and generates analysis results. By synchronizing, sorting, organizing and classifying the original data, it extracts system activity features or patterns to judge normal and abnormal behaviors. Event database: a place to store various intermediate and final data, which can be a complex database or a simple text file; Response unit: Takes action based on the analysis results, such as severing the connection, changing file attributes, or alerting the administrator.

Images