Power Internet of Things communication security protection system, method and readable storage medium

Abstract

The present invention discloses a power Internet of Things communication security protection system, method and readable storage medium, the system includes: a sub-center server, a key management server and a traffic buffer pool; the sub-center server is used to transmit the key pair to the key management server through a one-way transmission device; the traffic buffer pool is used to mirror the traffic of the sub-center server and the switch connected to the sub-center server, call the public and private key pairs of the key management server to decrypt the traffic, and output the decrypted traffic to the switch. The present invention realizes a centralized network security audit function by adopting a system framework of unified collection, diversion processing and centralized analysis, combined with the needs of encrypted networks in the power Internet of Things; through a bypass networking architecture system, one-way communication with the original encrypted network is realized, and slice-based traffic analysis is performed using cryptographic information, so that traditional traffic monitoring products can be directly applied to encrypted networks.

Description

Technical Field

[0001] The present invention relates to the field of network security protection technology, and in particular to a power Internet of Things communication security protection system, method and readable storage medium. Background Art

[0002] In the electric power industry, a large number of intelligent sensing devices have been widely used in power generation, transmission, substation, distribution and power consumption. In particular, power grid management units at all levels are inevitably faced with the problem of confirming the accuracy of the working information reported by various related equipment in the secondary system of the power plant, the long-distance transmission system, the substation system, the distribution network at all levels and the final power consumption system. In this environment, although access security has been solved and illegal device access has been eliminated, it still cannot prevent hackers from using existing equipment and existing communication protocols to send destructive industrial control commands, thereby causing chaos in the power distribution of the entire network, resulting in equipment damage and power outages.

[0003] In order to solve the above problems, the current means are mainly to slice the same network link according to different device types, so as to achieve network protection required by different applications. However, from the perspective of information security, the network logic of different slices is different from each other. If traditional security protection methods are used to conduct drainage and traffic auditing in each slice, it will inevitably lead to a large amount of equipment waste. At the same time, the existing mainstream traffic monitoring systems and products are often only based on transparent and open traffic, and cannot be applied to encrypted networks, so they have strong limitations. Summary of the invention

[0004] The purpose of the present invention is to provide a power Internet of Things communication security protection system, method and readable storage medium to solve the problems of high cost and limited applicable scenarios in the security protection methods for the power Internet of Things in the prior art.

[0005] To achieve the above object, the present invention provides a power Internet of Things communication security protection system, comprising:

[0006] Sub-center servers, key management servers and traffic buffer pools;

[0007] The sub-center server is used to transmit the key pair to the key management server through a one-way transmission device;

[0008] The traffic buffer pool is used to mirror the traffic between the sub-center server and the switch connected to the sub-center server, call the public and private keys of the key management server to decrypt the traffic, and output the decrypted traffic to the switch;

[0009] The key management server includes: an access control management module, a public key management module and a private key management module; the access control management module is used to receive a call request through a key query interface, and call a public key or a private key from the public key management module or the private key management module according to the call request.

[0010] Further, preferably, the flow buffer pool comprises:

[0011] A key query and decryption module, used to call the public and private keys of the key management server to decrypt traffic;

[0012] The traffic analysis framework is used to dynamically distribute the decrypted traffic to the interface of the traffic mirror exchange response for the engine to perform traffic analysis.

[0013] Furthermore, as a preferred embodiment, the flow buffer pool further includes:

[0014] The alarm management system is used to manage the engine, including configuring policies for the engine and collecting alarm logs from the engine, and providing emergency response and management work logs based on the alarm logs.

[0015] Further, preferably, the unidirectional transmission device includes a unidirectional firewall.

[0016] The present invention also provides a method for protecting the security of power Internet of Things communications, comprising:

[0017] caching the encrypted traffic, which is input to the sub-center server;

[0018] Applying for a key from a key management server, and decrypting the encrypted traffic according to the key; wherein applying for a key from a key management server includes: applying for a key from a key management server of a superior sub-center or a local key management server;

[0019] The decrypted traffic is input to the switch so that the switch sends the decrypted traffic to the engine for traffic analysis according to the traffic analysis framework.

[0020] Further, as a preference, after inputting the decrypted traffic into the switch so that the switch sends the decrypted traffic to the engine for traffic analysis according to the traffic analysis framework, it also includes:

[0021] Determine whether there is an alarm event in the analysis result; when there is an alarm event in the analysis result, report it to the traffic buffer pool.

[0022] Furthermore, as a preferred embodiment, if the application for a key to the key management server of the superior sub-center is unsuccessful, the application is reported to the traffic buffer pool to set automatic or manual access control.

[0023] The present invention also provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the electric power Internet of Things communication security protection system as described in any one of the above items is implemented.

[0024] Compared with the prior art, the beneficial effects of the present invention are:

[0025] The present invention discloses a power Internet of Things communication security protection system, method and readable storage medium, the system comprising: a sub-center server, a key management server and a traffic buffer pool; the sub-center server is used to transmit a key pair to the key management server through a unidirectional transmission device; the traffic buffer pool is used to mirror the traffic of the sub-center server and the switch connected to the sub-center server, call the public and private key pairs of the key management server to decrypt the traffic, and output the decrypted traffic to the switch.

[0026] The electric power Internet of Things communication security protection system provided by the present invention forms a system framework of unified collection, diversion processing and centralized analysis in a slicing protection environment, combines the needs of the encrypted network in the electric power Internet of Things, adds transparent encryption and decryption functions, and forms a safe and customizable flow analysis system, thereby realizing a centralized network security audit function in the slice network. At the same time, by designing a bypass networking architecture system, one-way communication with the original encrypted network can be achieved, and slice-based flow analysis can be performed using cryptographic information, so that traditional flow monitoring products can be directly applied to encrypted networks, which is particularly suitable for the electric power Internet of Things formed by massive equipment in the power industry, that is, a flow monitoring security system can be quickly established under this framework using traditional equipment. The present invention not only prevents hackers from using existing equipment and existing communication protocols to send destructive industrial control instructions, but also avoids equipment damage and power outages caused by chaos in the power distribution of the entire network, which is conducive to maintaining the stability of the power grid system. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] In order to more clearly illustrate the technical solution of the present invention, the drawings required for use in the implementation mode will be briefly introduced below. Obviously, the drawings described below are only some implementation modes of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0028] Figure 1 It is a structural diagram of a power Internet of Things communication security protection system provided by a certain embodiment of the present invention;

[0029] Figure 2 It is a structural diagram of a power Internet of Things communication security protection system provided by another embodiment of the present invention;

[0030] Figure 3 yes Figure 1 A schematic diagram of the structure of the submodules of the medium flow buffer pool;

[0031] Figure 4 yes Figure 1 A schematic diagram of the structure of the submodules of the key management server;

[0032] Figure 5 It is a flowchart of a method for protecting the security of power Internet of Things communications provided by a certain embodiment of the present invention;

[0033] Figure 6 It is a flow chart of a method for protecting the communication security of the electric power Internet of Things provided by another embodiment of the present invention. DETAILED DESCRIPTION

[0034] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0035] It should be understood that the step numbers used in this document are only for convenience of description and are not intended to limit the order in which the steps are executed.

[0036] It should be understood that the terms used in the present specification are only for the purpose of describing specific embodiments and are not intended to limit the present invention. As used in the present specification and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include plural forms.

[0037] The terms “include” and “comprising” indicate the presence of described features, integers, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or combinations thereof.

[0038] The term "and / or" means and includes any and all possible combinations of one or more of the associated listed items.

[0039] See also Figure 1 , a certain embodiment of the present invention provides a power Internet of Things communication security protection system. Figure 1 As shown, the power Internet of Things communication security protection system includes the following modules:

[0040] Sub-center server 01, key management server 02 and traffic buffer pool 03;

[0041] The sub-center server 01 is used to transmit the key pair to the key management server 02 through a one-way transmission device;

[0042] The traffic buffer pool 03 is used to mirror the traffic between the sub-center server 01 and the switch connected to the sub-center server 01, call the public and private key pairs of the key management server 02 to decrypt the traffic, and output the decrypted traffic to the switch.

[0043] It should be noted that the power Internet of Things communication security protection system in this embodiment adopts an expandable service network system. After expansion, the connection mode of each device is as follows: Figure 2 shown.

[0044] On the basis of the in-depth protection of the power Internet of Things for access to massive sensing devices, a key management server 02 is provided for each sub-center server 01, which is connected to the sub-center server 01 through a one-way transmission device. In the device registration process, the sub-center server 01 generates a key pair for the communication agent, which is synchronously sent to the key management server 02 through a one-way security device.

[0045] In an optional embodiment, the unidirectional security device adopts a unidirectional network gate.

[0046] Furthermore, the traffic buffer pool 03 in this embodiment is in the network under the jurisdiction of the sub-center server 01. Through traffic mirroring, the traffic passing through the sub-center server 01 and the switches of the subordinate connection devices is mirrored and first enters the traffic buffer pool 03 for cache. The traffic buffer pool 03 captures the communication pair information in the communication header, parses the ID and encryption method of the two communicating parties, and then calls the public and private key pairs in the key management server 02 to decrypt the traffic. After the decryption is completed, it is output to the traffic switch for subsequent products to work.

[0047] See also Figure 3 In a specific embodiment, the traffic buffer pool 03 further includes the following submodules:

[0048] The key query and decryption module 031 is used to call the public and private keys of the key management server 02 to decrypt traffic;

[0049] The traffic analysis framework 032 is used to dynamically distribute the decrypted traffic to the interface of the traffic mirror exchange response for the engine to perform traffic analysis.

[0050] The alarm management system 033 is used to manage the engine, including configuring policies for the engine and collecting alarm logs from the engine, and providing emergency response and management work logs based on the alarm logs.

[0051] It should be noted that, in this embodiment, the traffic analysis framework 032 is a management system for a traffic switch group, which is responsible for dynamically allocating the traffic after slice decryption to the interface of the traffic mirror exchange response according to the current working status of the traffic switch and the engine, so as to provide traffic analysis for the subsequent analysis engine. The alarm management system 033 is a unified management system for all engines, which can configure the single engine strategy for the subordinate engines, collect and summarize the alarm logs of the engines, and provide emergency response and disposal for workflow standardization and work log recording to form a disposal knowledge base.

[0052] See also Figure 4 In a specific embodiment, the key management server 02 further includes the following submodules:

[0053] Access control management module 021, public key management module 022 and private key management module 023;

[0054] The access control management module 021 is used to receive a call request through a key query interface, and call a public key or a private key from the public key management module 022 or the private key management module 023 according to the call request.

[0055] In summary, the electric power Internet of Things communication security protection system provided by the embodiment of the present invention realizes a centralized network security audit function by adopting a system framework of unified collection, diversion processing and centralized analysis, combined with the needs of encrypted networks in the electric power Internet of Things; through a bypass networking architecture system, one-way communication with the original encrypted network is realized, and cryptographic information is used for slice-based traffic analysis, so that traditional traffic monitoring products can be directly applied to encrypted networks.

[0056] See also Figure 5 In one embodiment of the present invention, a method for protecting the communication security of the power Internet of Things is also provided, comprising steps S10 to S30. Figure 5 As shown, the contents of each step are as follows:

[0057] S10, caching the encrypted traffic, where the encrypted traffic is input from the sub-center server 01;

[0058] S20, applying for a key from the key management server 02, and decrypting the encrypted traffic according to the key;

[0059] S30, inputting the decrypted traffic into the switch, so that the switch sends the decrypted traffic to the engine for traffic analysis according to the traffic analysis framework 032.

[0060] See also Figure 6 In another embodiment, after inputting the decrypted traffic into the switch so that the switch sends the decrypted traffic to the engine for traffic analysis according to the traffic analysis framework 032, it also includes:

[0061] Determine whether there is an alarm event in the analysis result; when there is an alarm event in the analysis result, report it to the traffic buffer pool 03.

[0062] like Figure 6 As shown, in an optional implementation manner, applying for a key from the key management server 02 includes:

[0063] Apply for a key from the key management server 02 of the superior sub-center or the local key management server 02.

[0064] Furthermore, if the application for a key to the key management server 02 of the superior sub-center is unsuccessful, a report is made to the traffic buffer pool 03 to set automatic or manual access control.

[0065] It should be noted that in this embodiment, the flow buffer pool 03 is used as the execution subject for explanation: first, the sub-flow center enters the flow buffer pool 03, and then the flow buffer pool 03 caches the encrypted flow and applies for the key from the local key management server 02 or the key management server 02 of the upper sub-center. When the key management server 02 finds the key pair, the flow buffer pool 03 calls the key pair to decrypt the cached encrypted flow, and then puts it into the decrypted flow cache area of ​​the flow buffer pool 03. Then the flow buffer pool 03 outputs the decrypted flow to the switch, preferably the TAP switch, and can delete the previously cached encrypted flow data and decrypted flow data. Then, the TAP switch will send the decrypted flow to the analysis engine according to the flow analysis framework 032, so that the analysis engine can perform flow analysis. During the analysis process, if an alarm event is found, it will be reported to the buffer flow pool of the upper sub-center until the central server receives the alarm event, and then the upper flow buffer pool 03 will feedback the alarm event to the situation awareness system through the one-way network switch. In addition, when the traffic buffer pool 03 fails to apply for calling the key pair, it will also report to the buffer traffic pool of the superior sub-center until the central server receives the report information. Then the superior traffic buffer pool 03 will feed back the report information to the situation awareness system through the one-way network gate to realize automatic or manual access control.

[0066] It can be understood that based on the power Internet of Things communication security protection method system provided in the above-mentioned embodiment, the power Internet of Things communication security protection method provided in the embodiment of the present invention, by adopting a system framework of unified collection, diversion processing and centralized analysis, combined with the encryption network needs in the power Internet of Things, realizes a centralized network security audit function; through a bypass networking architecture system, one-way communication with the original encrypted network is realized, and cryptographic information is used for slice-based traffic analysis, so that traditional traffic monitoring products can be directly applied to encrypted networks.

[0067] In an exemplary embodiment, a computer-readable storage medium including a computer program is also provided, and when the computer program is executed by a processor, the steps of the power Internet of Things communication security protection system as described in any of the above embodiments are implemented. For example, the computer-readable storage medium can be the above-mentioned memory including the computer program, and the above-mentioned computer program can be executed by the processor of the terminal device to complete the power Internet of Things communication security protection system as described in any of the above embodiments, and achieve the technical effect consistent with the above-mentioned method.

[0068] The above is a preferred embodiment of the present invention. It should be pointed out that a person skilled in the art can make several improvements and modifications without departing from the principle of the present invention. These improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A power Internet of Things communication security protection system, characterized in that: include: Sub-center servers, key management servers and traffic buffer pools; The sub-center server is used to transmit the key pair to the key management server through a one-way transmission device; The traffic buffer pool is used to mirror the traffic between the sub-center server and the switch connected to the sub-center server, call the public and private keys of the key management server to decrypt the traffic, and output the decrypted traffic to the switch; The key management server includes: an access control management module, a public key management module and a private key management module; The access control management module is used to receive a call request through a key query interface, and call a public key or a private key from the public key management module or the private key management module according to the call request.

2. The power Internet of Things communication security protection system according to claim 1 is characterized in that: The flow buffer pool includes: A key query and decryption module, used to call the public and private keys of the key management server to decrypt traffic; The traffic analysis framework is used to dynamically distribute the decrypted traffic to the interface of the traffic mirror exchange response for the engine to perform traffic analysis.

3. The power Internet of Things communication security protection system according to claim 2 is characterized in that: The flow buffer pool further includes: The alarm management system is used to manage the engine, including configuring policies for the engine and collecting alarm logs from the engine, and providing emergency response and management work logs based on the alarm logs.

4. The power Internet of Things communication security protection system according to claim 1 is characterized in that: The unidirectional transmission device includes a unidirectional network switch.

5. A method for protecting the security of power Internet of Things communications, characterized in that: include: caching the encrypted traffic, which is input to the sub-center server; Applying for a key from a key management server, and decrypting the encrypted traffic according to the key; wherein applying for a key from a key management server includes: applying for a key from a key management server of a superior sub-center or a local key management server; The decrypted traffic is input to the switch so that the switch sends the decrypted traffic to the engine for traffic analysis according to the traffic analysis framework.

6. The power Internet of Things communication security protection method according to claim 5 is characterized in that: After inputting the decrypted traffic into the switch so that the switch sends the decrypted traffic to the engine for traffic analysis according to the traffic analysis framework, the method further includes: Determine whether there is an alarm event in the analysis result; when there is an alarm event in the analysis result, report it to the traffic buffer pool.

7. The power Internet of Things communication security protection method according to claim 5 is characterized in that: If the key application to the key management server of the superior sub-center is unsuccessful, it will be reported to the traffic buffer pool to set automatic or manual access control.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by the processor, the power Internet of Things communication security protection method as described in any one of claims 5 to 7 is implemented.

Images