Safety protection method, device and computer equipment for power monitoring system

Abstract

The present application relates to a security protection method, device, computer equipment, storage medium and computer program product for an electric power monitoring system. The method includes: the SDP gateway of the master station obtains a first access request from an autonomous safety type station, and performs a continuous trust assessment on the risk level of the autonomous safety type station; when the assessment passes, the first access request is authorized or forwarded; the security access area of ​​the master station obtains an access request from a managed safety type station; according to a second access request, the managed safety type station is trusted for authentication; when the trusted authentication passes, the SDP gateway of the master station obtains a second access request from the managed safety type station; a continuous trust assessment is performed on the risk level of the managed safety type station; when the assessment passes, the second access request is authorized or forwarded. The method divides the stations into autonomous safety type stations and managed safety type stations, constructs system boundary security protection and regional boundary security protection, and improves the security protection capabilities of the electric power monitoring system.

Description

Technical Field

[0001] The present application relates to the field of power safety technology, and in particular to a safety protection method, device, computer equipment, storage medium and computer program product for a power monitoring system. Background Art

[0002] As the traditional power monitoring system develops into a new power system, the mode of private network access is broken, the network boundary is more open, and the traditional power monitoring system security architecture is difficult to meet the latest security needs. For example, in the current power monitoring system security protection architecture, the vertical encryption device five-tuple isolation mechanism is not strict, and the security risk of not evaluating the identity and trust status of the access device is magnified. It is easy for the site to launch vertical penetration of the main station. For example, attackers can use the vulnerability of the APN and VPN authentication mechanisms to impersonate the trusted terminal to access the network and launch attacks. For another example, security devices such as firewalls provide horizontal isolation and protection for the environment outside the security boundary, but the internal traffic is trusted by default, causing attackers to enter the data center network and then move horizontally (or east-west) to attack. For example, attackers use the power monitoring system business system loopholes on the public network to enter the main station network and then penetrate horizontally.

[0003] The participants and equipment of the new type of electricity are more complex. There are not only dispatching centers, power plants, etc., but also integrated energy service companies, microgrids, etc. that are gradually connected. In addition, there are massive multi-source heterogeneous Internet of Things terminals connected to the network. The security protection capabilities are uneven. Therefore, the power system has the problem of weak security protection capabilities. Summary of the invention

[0004] Based on this, it is necessary to provide a safety protection method, device, computer equipment, computer-readable storage medium and computer program product for an electric power monitoring system that can improve the safety protection capability in response to the above-mentioned technical problems.

[0005] In a first aspect, the present application provides a security protection method. The method comprises:

[0006] The SDP gateway of the master station obtains the first access request of the autonomous safety type site;

[0007] Performing a continuous trust assessment on the risk level of the autonomous safety-type station according to the first access request;

[0008] When the evaluation is passed, the first access request is authorized or forwarded;

[0009] The secure access area of ​​the master station obtains the access request of the managed secure site;

[0010] Performing trusted authentication on the managed security site according to the second access request;

[0011] When the trusted authentication is passed, the SDP gateway of the master station obtains the second access request of the managed security site;

[0012] Performing a continuous trust assessment on the risk level of the managed security site according to the second access request;

[0013] When the evaluation is passed, the second access request is authorized or forwarded.

[0014] In one embodiment, the continuously trust evaluating the risk level of the autonomous safety type station according to the first access request includes:

[0015] Based on the first access request, multiple identity authentications are performed on the autonomous safety site, and the multiple identity authentications include at least time, location, machine health status and configuration.

[0016] In one of the embodiments, when the evaluation fails, the first access request is intercepted.

[0017] In one embodiment, the method further comprises:

[0018] The servers, cloud hosts, microservices and site servers of the main site are micro-isolated through a micro-isolation gateway.

[0019] In one of the embodiments, a policy execution unit is deployed on the server, cloud host, microservice and site server of the main site;

[0020] The servers, cloud hosts, microservices and site servers of the main site are micro-isolated through a micro-isolation gateway, including:

[0021] The main station's servers, cloud hosts, microservices and site servers send business access requests. After receiving the business access requests, the policy control center authenticates the calling subject and conducts continuous trust assessment on the calling subject's risk level. After the assessment, the policy control instruction is sent to the server's policy execution unit, and the server's policy execution unit executes the corresponding security policy action. The policy control center and the policy execution unit are deployed separately.

[0022] In one of the embodiments, the policy execution unit of the server releases the service access request when the service authentication of the policy control center passes and has access rights, and blocks the service access request when the service authentication of the policy control center fails or the authentication rights are insufficient.

[0023] In a second aspect, the present application also provides a safety protection device for a power monitoring system. The device comprises:

[0024] A first access request module, used for the SDP gateway of the master station to obtain a first access request of an autonomous safety type station;

[0025] A first access request evaluation module, configured to perform a continuous trust evaluation on the risk level of the autonomous safety type station according to the first access request;

[0026] A first access request execution module, configured to authorize or forward the first access request after passing the evaluation;

[0027] Access request module, used for the secure access area of ​​the master station to obtain access requests from managed secure sites;

[0028] A trusted authentication module, used for performing trusted authentication on the managed security site according to the second access request;

[0029] A second access request module, used for the SDP gateway of the master station to obtain a second access request of the managed security site when the trusted authentication passes;

[0030] A second access request evaluation module, configured to perform a continuous trust evaluation on the risk level of the managed security site according to the second access request;

[0031] The second access request execution module is used to authorize or forward the second access request after passing the evaluation.

[0032] In a third aspect, the present application further provides a computer device. The computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the following steps when executing the computer program:

[0033] The SDP gateway of the master station obtains the first access request of the autonomous safety type site;

[0034] Performing a continuous trust assessment on the risk level of the autonomous safety-type station according to the first access request;

[0035] When the evaluation is passed, the first access request is authorized or forwarded;

[0036] The secure access area of ​​the master station obtains the access request of the managed secure site;

[0037] Performing trusted authentication on the managed security site according to the second access request;

[0038] When the trusted authentication is passed, the SDP gateway of the master station obtains the second access request of the managed security site;

[0039] Performing a continuous trust assessment on the risk level of the managed security site according to the second access request;

[0040] When the evaluation is passed, the second access request is authorized or forwarded.

[0041] In a fourth aspect, the present application further provides a computer-readable storage medium. The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0042] The SDP gateway of the master station obtains the first access request of the autonomous safety type site;

[0043] Performing a continuous trust assessment on the risk level of the autonomous safety-type station according to the first access request;

[0044] When the evaluation is passed, the first access request is authorized or forwarded;

[0045] The secure access area of ​​the master station obtains the access request of the managed secure site;

[0046] Performing trusted authentication on the managed security site according to the second access request;

[0047] When the trusted authentication is passed, the SDP gateway of the master station obtains the second access request of the managed security site;

[0048] Performing a continuous trust assessment on the risk level of the managed security site according to the second access request;

[0049] When the evaluation is passed, the second access request is authorized or forwarded.

[0050] In a fifth aspect, the present application further provides a computer program product. The computer program product includes a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0051] The SDP gateway of the master station obtains the first access request of the autonomous safety type site;

[0052] Performing a continuous trust assessment on the risk level of the autonomous safety-type station according to the first access request;

[0053] When the evaluation is passed, the first access request is authorized or forwarded;

[0054] The secure access area of ​​the master station obtains the access request of the managed secure site;

[0055] Performing trusted authentication on the managed security site according to the second access request;

[0056] When the trusted authentication is passed, the SDP gateway of the master station obtains the second access request of the managed security site;

[0057] Performing a continuous trust assessment on the risk level of the managed security site according to the second access request;

[0058] When the evaluation is passed, the second access request is authorized or forwarded.

[0059] The above-mentioned security protection method, device, computer equipment, storage medium and computer program product of the electric power monitoring system, the SDP gateway of the master station obtains the first access request of the autonomous security type station; according to the first access request, the risk level of the autonomous security type station is continuously trusted; when the evaluation is passed, the first access request is authorized or forwarded; the security access area of ​​the master station obtains the access request of the managed security type station; according to the second access request, the managed security type station is trusted authenticated; when the trusted authentication is passed, the SDP gateway of the master station obtains the second access request of the managed security type station; according to the second access request, the risk level of the managed security type station is continuously trusted; when the evaluation is passed, the second access request is authorized or forwarded. This method divides the stations into autonomous security type stations and managed security type stations, builds system boundary security protection for autonomous security type stations, and builds regional boundary security protection for managed security type stations to enhance boundary protection capabilities, improve the security protection capabilities of the electric power monitoring system, and improve the level of network security management. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 An application environment diagram of a safety protection method for a power monitoring system in an embodiment;

[0061] Figure 2 A schematic diagram of a flow chart of a safety protection method for a power monitoring system in one embodiment;

[0062] Figure 3 A schematic diagram of a micro-isolation process in an embodiment;

[0063] Figure 4 A structural block diagram of a safety protection device of a power monitoring system in one embodiment;

[0064] Figure 5 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0065] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0066] The safety protection method of the power monitoring system provided in the embodiment of the present application can be applied to Figure 1 In the power monitoring system shown in the figure. Figure 1 As shown in the figure, the security protection architecture of the power monitoring system consists of participants, a master station, a zero-trust gateway, and a secure access cloud. The participants are divided into two categories: autonomous security stations and managed security stations. The master station is the power information system, which is horizontally divided into a production control area and a management information area, among which the production control area is divided into a control area (also known as security area I) and a non-control area (also known as security area II). In the power monitoring system, the SDP gateway of the master station obtains the first access request of the autonomous security station; performs a continuous trust assessment on the risk level of the autonomous security station according to the first access request; when the assessment passes, the first access request is authorized or forwarded; the security access area of ​​the master station obtains the access request of the managed security station; performs a trusted authentication on the managed security station according to the second access request; when the trusted authentication passes, the SDP gateway of the master station obtains the second access request of the managed security station; performs a continuous trust assessment on the risk level of the managed security station according to the second access request; when the assessment passes, the second access request is authorized or forwarded. Among them, autonomous security stations mainly include dispatch centers, substations, and power plants, and managed security stations mainly include small stations such as microgrids and plant networks. Zero-trust gateway refers to the Software Defined Perimeter (SDP) gateway, which dynamically and finely controls the station's access to the main station system. The secure access cloud builds a flexible secure access boundary for managed security stations.

[0067] In one embodiment, Figure 2 As shown, a safety protection method for an electric power monitoring system is provided, which is applied to Figure 1 The power monitoring system in the embodiment includes the following steps:

[0068] Step 202: The SDP gateway of the master station obtains a first access request of an autonomous security site.

[0069] Among them, SDP gateway (Software Defined Perimeter) refers to a concept of user network security protection, which aims to distrust any device, person, identity, system, etc. in network security protection. Each step must be verified and based on a basis, so that all security protection becomes credible and safe. Autonomous security stations mainly include dispatch centers, substations, power plants, etc.

[0070] Specifically, a zero-trust software-defined perimeter (SDP) gateway is deployed at the edge of the master station's wide area network. After the autonomous security site sends a first access request to the master station, the master station's SDP gateway obtains the first access request of the autonomous security site.

[0071] Step 204: Perform a continuous trust assessment on the risk level of the autonomous safety-type site according to the first access request.

[0072] Among them, continuous trust assessment requires the access subject to come up with multiple identity authentication variables to confirm the identity of the access subject or verify whether the access subject can be trusted.

[0073] Based on the scheduling digital certificate SDP gateway, the identities of RTU, DTU, FTU and other devices connected to the main station are authenticated, the security baseline, security vulnerability and security threat status of the equipment are evaluated, and the device's access to the main station system is dynamically and finely controlled.

[0074] Specifically, after the SDP gateway of the master station obtains the first access request of the autonomous security site, the security control center conducts a continuous trust assessment on the risk level of the access subject, requiring the access subject to provide multiple authentication variables, such as time, location, machine health status and configuration, to verify the identity of the access subject. When the access subject's behavior or environment changes, the context is continuously monitored, and the access subject's identity is verified based on location, time, security status and some custom attributes to implement access control.

[0075] Step 206: When the evaluation is passed, the first access request is authorized or forwarded.

[0076] Specifically, when the continuous trust evaluation of the autonomous security site passes, that is, the autonomous security site is determined to be trusted based on the continuous trust evaluation, the security control center makes an authorization decision, and the trusted access agent authorizes or forwards the first access request. That is, the vertical boundary is built through the SDP gateway to achieve a fine-grained, full-stack isolation control mechanism for people, devices and applications.

[0077] Step 208: The secure access zone of the master station obtains an access request from the managed secure site.

[0078] Among them, managed security sites mainly include small sites such as microgrids and factory networks. The secure access area uses software-defined boundary technology in zero trust to perform trusted authentication on devices connected to the site.

[0079] Specifically, after the managed security site sends an access request to the master site, the security access zone of the master site obtains the access request of the managed security site.

[0080] Step 210: Perform trusted authentication on the managed security site according to the second access request.

[0081] In the OSI / TCP / IP protocol, the transport layer can provide host-to-host communication services for applications, and the session layer is a mechanism for opening, closing, and managing sessions between terminal application processes. In vertical encryption authentication, for external requests, the wide area network and the production control area are first connected, and then authentication, encryption, and access control are performed. This is done after the session layer is connected, so it will bring many risks, such as TLS vulnerabilities and TCP / IP SYN-ACK attacks when establishing sessions. SDP can be deployed in the network layer before the OSI / TCP / IP transport layer protocol, which is transparent to the underlying IP infrastructure and can fully prevent the risks brought by the transport layer and session layer connections.

[0082] Among them, the terminal devices of the managed security site include RTU, DTU, FTU, etc. Trusted authentication includes authenticating the device identity based on the dispatch digital certificate, evaluating the device security baseline, security vulnerability, and security threat status, and fine-grained control of the device's access to the master station system. The secure access cloud builds a flexible secure access boundary for the managed security site.

[0083] The software-defined boundary can perform trusted authentication on RTU, DTU, FTU and other devices connected to the site, and monitor the interaction between users and the power grid in real time. When user behavior changes, SDP will monitor the context, continuously assess the security threat status of users based on location, time, security status, etc., perform access control management, and perform fine-grained control over the device's access to the main site system.

[0084] Specifically, after the security access area of ​​the master station obtains the access request of the hosted security site, it authenticates the hosted security site according to the second access request, evaluates the security baseline, security vulnerability, and security threat status, and performs fine-grained control over the device's access rights to the master station system based on the evaluation results.

[0085] Step 212: When the trusted authentication is passed, the SDP gateway of the master station obtains a second access request of the managed security site.

[0086] Specifically, when the trusted authentication of the managed security site passes, that is, it is determined based on the trusted authentication that the managed security site can be trusted, the SDP gateway of the master site obtains a second access request of the managed security site.

[0087] Step 214: Perform a continuous trust assessment on the risk level of the managed security site according to the second access request.

[0088] Specifically, the security control center conducts a continuous trust assessment on the risk level of the managed security site based on the second access request, requiring the access subject to provide multiple authentication variables, such as time, location, machine health status and configuration, to confirm the identity of the access subject, or verify whether the access subject can be trusted.

[0089] Step 216: When the evaluation is passed, the second access request is authorized or forwarded.

[0090] Specifically, when the continuous trust evaluation of the managed security site passes, that is, it is determined based on the trusted authentication that the managed security site can be trusted, the security control center makes an authorization decision, and the trusted access agent authorizes or forwards the second access request. That is, based on the software-defined boundary technology, combined with the cloud-based security service capabilities, a boundary security protection mechanism is built for the access of external participants and the data interaction of peripheral business systems, and a flexible security access boundary is built for managed security sites to prevent external attackers from invading the power monitoring system, in order to cope with the current situation of uneven security protection capabilities and achieve the unification of security protection capabilities.

[0091] The above-mentioned security protection method for the electric power monitoring system, in response to the access request of the site, the SDP gateway of the master station obtains the first access request of the autonomous security site, and performs continuous trust assessment on the risk level of the autonomous security site according to the first access request, and when the assessment passes, the first access request is authorized or forwarded; the security access area of ​​the master station obtains the access request of the managed security site, and performs trusted authentication on the managed security site according to the second access request, and when the trusted authentication passes, the SDP gateway of the master station obtains the second access request of the managed security site, and performs continuous trust assessment on the risk level of the managed security site according to the second access request, and when the assessment passes, the second access request is authorized or forwarded. This method divides the sites into autonomous security sites and managed security sites, builds system boundary security protection for autonomous security sites, and builds regional boundary security protection for managed security sites to enhance boundary protection capabilities, improve the security protection capabilities of the electric power monitoring system, and improve the level of network security management.

[0092] In one embodiment, a continuous trust assessment is performed on the risk level of the autonomous security site based on a first access request, including: based on the first access request, performing multiple identity authentications on the autonomous security site, the multiple identity authentications including at least time, location, machine health status, and configuration.

[0093] Specifically, multiple authentications are performed on autonomous safety stations, including time, location, machine health status, and configuration. By monitoring the location of the logged-in device, some logins can be determined to be abnormal, and by verifying the machine health status and configuration, it can be determined whether the currently logged-in device itself is in an abnormal state.

[0094] In this embodiment, multiple identity authentications are performed on the autonomous security type site to ensure that the autonomous security type site that sends the first access request is safe and normal.

[0095] In one embodiment, when the evaluation fails, the first access request is intercepted.

[0096] Specifically, the security control center makes authorization decisions based on the continuous trust evaluation results, and sends the authorization decisions to the trusted access agent for execution. Among them, the trusted access agent is a policy execution point, which is divided into application agent and API agent. The trusted access agent executes the judgment results received from the security control center, including authorization, forwarding, interception, etc. of the access request. When the continuous trust evaluation fails, the first access request is intercepted.

[0097] In this embodiment, when the autonomous security site that sends an access request to the main site fails to pass the continuous trust evaluation, the autonomous security site intercepts the first access request it sends, ensuring that the site devices that can access the main site are allowed to access by the main site, thereby enhancing the boundary protection capability so that only authorized devices can access the main site, effectively preventing the site from infiltrating the main site vertically, and ensuring the security of the main site.

[0098] In one embodiment, the method further includes: micro-isolating the servers, cloud hosts, micro-services and site servers of the main site through a micro-isolating gateway.

[0099] Specifically, micro-isolation gateways are added to the main site and site stations to micro-isolate the main site server, cloud host, microservices, and site station servers, and uniformly deploy and manage servers and microservices running on the servers. When server applications access each other, two-way identity authentication is performed based on scheduling digital certificates, and the security baselines, security vulnerabilities, security threats, and other status of both parties are evaluated, and fine-grained control is performed on mutual access permissions.

[0100] In this embodiment, by micro-isolating the main site server, cloud host, microservices, and site server, strong verification and fine control are achieved to prevent attackers from moving laterally after entering the data center network, thereby protecting the security of the internal domain boundary.

[0101] In one embodiment, Figure 3 As shown, the policy execution units are deployed on the main site's servers, cloud hosts, microservices, and field servers: the main site's servers, cloud hosts, microservices, and field servers are micro-isolated through micro-isolation gateways, including:

[0102] Business access requests are sent between the main site's servers, cloud hosts, microservices, and site servers. After receiving the business access requests, the policy control center authenticates the calling subject and conducts continuous trust assessment on the risk level of the calling subject. After the assessment, the policy control instructions are sent to the server's policy execution unit, and the server's policy execution unit executes the corresponding security policy actions. The policy control center and the policy execution unit are deployed separately.

[0103] Micro-isolation generally consists of two modules: the policy control center and the policy execution unit. Different from the isolation on the single-point boundary of the traditional firewall, that is, the control platform and the isolation policy execution unit are coupled in one device or system, the policy control center and the policy execution unit of micro-isolation are deployed separately, with distributed and adaptive characteristics. Among them, the policy control center can perform asset management, policy management, authorization management, etc. The policy execution unit executes security policy actions according to the policy control instructions issued by the control center. Security policy actions include business release, blocking actions, etc.

[0104] Specifically, business access requests are sent between the main site's servers, cloud hosts, microservices and site servers. After receiving the business access requests between the main site's servers, cloud hosts, microservices and site servers, the policy control center performs identity authentication on the calling subject and conducts continuous trust assessment on the risk level of the calling subject. The policy control center obtains the assessment result of the calling subject and sends policy control instructions to the server's policy execution unit based on the assessment result. The policy execution unit executes corresponding security policy actions based on the received policy control instructions.

[0105] In this embodiment, a policy execution unit is deployed on each server of the main site and the site to monitor the microservices on the current server. When there is a call request between microservices, a decision is made through a centralized policy control center and the policy execution unit is responsible for execution. In this way, the call behavior between microservices is controlled, and micro-isolation of the main site server, cloud host, microservice, and site server is achieved to protect the security of the internal domain boundary.

[0106] In one embodiment, the policy execution unit of the server releases the service access request when the service authentication of the policy control center passes and the server has access rights, and blocks the service access request when the service authentication of the policy control center fails or the authentication rights are insufficient.

[0107] Specifically, when the policy control center passes the service authentication and has access rights, the server's policy execution unit releases the service access request, such as traffic release; when the policy control center fails the service authentication or the authentication rights are insufficient, the server's policy execution unit blocks the service access request.

[0108] In this embodiment, the policy execution unit releases or blocks the service access request according to the decision result of the policy control center, thereby controlling the calling behavior between microservices and preventing the attacker from moving laterally after entering the data center network.

[0109] The power monitoring system security protection method of the present application focuses on system boundary security protection and regional boundary security protection, and can be applied to a security protection architecture composed of participating entities, master stations, zero-trust gateways, and secure access clouds. For system boundary security protection, a secure access cloud is constructed, and SASE technology is deployed to provide SDP access services, identity management, authorization management and other services for managed security sites, to build a unified security access zone for the entire network, and to converge the Internet access points of the security access zone to cope with the current situation of uneven security protection capabilities. For regional boundary security protection, a zero-trust software-defined boundary (SDP) gateway is deployed at the WAN boundary of the master station to effectively prevent the vertical penetration of the site to the master station, thereby protecting the vertical boundary security; micro-isolation gateways are added to the master station and the site, and the master station server, cloud host, microservice, and site server are micro-isolated to prevent attackers from entering the data center network and then moving horizontally, thereby protecting the internal domain boundary security. In summary, this application improves the security protection capabilities of the power monitoring system, improves the security of the network, and improves network security management capabilities from three aspects: system boundary security protection, regional boundary security protection, and internal domain boundary security protection.

[0110] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0111] Based on the same inventive concept, the embodiment of the present application also provides a safety protection device for an electric power monitoring system for implementing the safety protection method for an electric power monitoring system involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in the embodiments of the safety protection device for one or more electric power monitoring systems provided below can refer to the limitations of the safety protection method for an electric power monitoring system above, and will not be repeated here.

[0112] In one embodiment, Figure 4 As shown, a safety protection device 400 for a power monitoring system is provided, comprising: a first access request module 402, a first access request evaluation module 404, a first access request execution module 406, an access request module 408, a trusted authentication module 410, a second access request module 412, a second access request evaluation module 414, and a second access request execution module 416, wherein:

[0113] The first access request module 402 is used by the SDP gateway of the master station to obtain the first access request of the autonomous security site.

[0114] The first access request evaluation module 404 is used to perform continuous trust evaluation on the risk level of the autonomous security site according to the first access request.

[0115] The first access request execution module 406 is used to authorize or forward the first access request when the evaluation is passed.

[0116] The access request module 408 is used for the secure access area of ​​the master station to obtain the access request of the managed secure site.

[0117] The trusted authentication module 410 is used to perform trusted authentication on the managed security site according to the second access request.

[0118] The second access request module 412 is used for the SDP gateway of the master station to obtain the second access request of the managed security site when the trusted authentication passes.

[0119] The second access request evaluation module 414 is used to perform continuous trust evaluation on the risk level of the managed security site according to the second access request.

[0120] The second access request execution module 416 is used to authorize or forward the second access request when the evaluation is passed.

[0121] In one embodiment, the first access request evaluation module is used to perform multiple identity authentications on the autonomous security site according to the first access request, and the multiple identity authentications include at least time, location, machine health status and configuration.

[0122] In one embodiment, the first access request execution module is further configured to intercept the first access request when the evaluation fails.

[0123] In one embodiment, the device also includes: a micro-isolation module, which is used to perform micro-isolation between the main site's servers, cloud hosts, micro-services and site servers through a micro-isolation gateway.

[0124] In one embodiment, the micro-isolation module is used to send business access requests between the servers, cloud hosts, microservices and site servers of the main site. After receiving the business access request, the policy control center authenticates the calling subject and continuously trusts the risk level of the calling subject. After the evaluation, the policy control instruction is sent to the policy execution unit of the server, and the policy execution unit of the server executes the corresponding security policy action; wherein the policy control center and the policy execution unit are deployed separately. The policy execution unit is deployed on the servers, cloud hosts, microservices and site servers of the main site.

[0125] In one embodiment, the micro-isolation module is also used by the server's policy execution unit to release business access requests when the business authentication of the policy control center passes and has access rights, and to block business access requests when the business authentication of the policy control center fails or the authentication authority is insufficient.

[0126] Each module in the safety protection device of the above-mentioned power monitoring system can be implemented in whole or in part by software, hardware and their combination. Each of the above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the corresponding operations of each of the above modules.

[0127] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 5 As shown. The computer device includes a processor, a memory and a network interface connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store site data. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a safety protection method for an electric power monitoring system is implemented.

[0128] Those skilled in the art will understand that Figure 5 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0129] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the following steps are implemented:

[0130] The SDP gateway of the master station obtains the first access request of the autonomous safety type site;

[0131] Conduct continuous trust assessment of the risk level of the autonomous safety site based on the first access request;

[0132] When the evaluation is passed, the first access request is authorized or forwarded;

[0133] The secure access area of ​​the master station obtains the access request of the managed secure site;

[0134] Performing trusted authentication on the managed security site according to the second access request;

[0135] When the trusted authentication is passed, the SDP gateway of the master station obtains the second access request of the managed security site;

[0136] Conduct continuous trust assessment of risk level of managed secure sites based on second access requests;

[0137] When the evaluation passes, the second access request is authorized or forwarded.

[0138] In one embodiment, when the processor executes the computer program, the following steps are also implemented: performing continuous trust assessment on the risk level of the autonomous security site based on the first access request, including: performing multiple identity authentications on the autonomous security site based on the first access request, the multiple identity authentications including at least time, location, machine health status and configuration.

[0139] In one embodiment, when the processor executes the computer program, the following steps are further implemented: when the evaluation fails, intercepting the first access request.

[0140] In one embodiment, when the processor executes the computer program, the following steps are also implemented: the method also includes: micro-isolation is performed between the server, cloud host, microservice and site server of the main site through a micro-isolation gateway.

[0141] In one embodiment, the processor also implements the following steps when executing the computer program: a policy execution unit is deployed on the server, cloud host, microservice and site server of the main site; the server, cloud host, microservice and site server of the main site are micro-isolated through a micro-isolation gateway, including: a business access request is issued between the server, cloud host, microservice and site server of the main site, and after the policy control center receives the business access request, it authenticates the calling subject and conducts continuous trust assessment on the risk level of the calling subject. After the assessment, it sends a policy control instruction to the policy execution unit of the server, and the policy execution unit of the server executes the corresponding security policy action; the policy control center and the policy execution unit are deployed separately.

[0142] In one embodiment, when the processor executes the computer program, the following steps are also implemented: the policy execution unit of the server releases the business access request when the business authentication of the policy control center passes and has access rights; when the business authentication of the policy control center fails or the authentication authority is insufficient, the business access request is blocked.

[0143] In one embodiment, a computer readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0144] The SDP gateway of the master station obtains the first access request of the autonomous safety type site;

[0145] Conduct continuous trust assessment of the risk level of the autonomous safety site based on the first access request;

[0146] When the evaluation is passed, the first access request is authorized or forwarded;

[0147] The secure access area of ​​the master station obtains the access request of the managed secure site;

[0148] Performing trusted authentication on the managed security site according to the second access request;

[0149] When the trusted authentication is passed, the SDP gateway of the master station obtains the second access request of the managed security site;

[0150] Conduct continuous trust assessment of risk level of managed secure sites based on second access requests;

[0151] When the evaluation passes, the second access request is authorized or forwarded.

[0152] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: performing continuous trust assessment on the risk level of the autonomous security site based on the first access request, including: performing multiple identity authentications on the autonomous security site based on the first access request, the multiple identity authentications including at least time, location, machine health status and configuration.

[0153] In one embodiment, when the computer program is executed by the processor, the following steps are further implemented: when the evaluation fails, intercepting the first access request.

[0154] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: the method also includes: micro-isolation is performed between the server, cloud host, microservice and site server of the main site through a micro-isolation gateway.

[0155] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: policy execution units are deployed on the main site's servers, cloud hosts, microservices and site servers; micro-isolation is performed between the main site's servers, cloud hosts, microservices and site servers through a micro-isolation gateway, including: business access requests are issued between the main site's servers, cloud hosts, microservices and site servers, and after the policy control center receives the business access request, it authenticates the calling subject and conducts continuous trust assessment on the risk level of the calling subject. After the assessment, it sends policy control instructions to the server's policy execution unit, and the server's policy execution unit executes the corresponding security policy action; the policy control center and the policy execution unit are deployed separately.

[0156] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: the policy execution unit of the server releases the business access request when the business authentication of the policy control center passes and has access rights; when the business authentication of the policy control center fails or the authentication authority is insufficient, the business access request is blocked.

[0157] In one embodiment, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the following steps:

[0158] The SDP gateway of the master station obtains the first access request of the autonomous safety type site;

[0159] Conduct continuous trust assessment of the risk level of the autonomous safety site based on the first access request;

[0160] When the evaluation is passed, the first access request is authorized or forwarded;

[0161] The secure access area of ​​the master station obtains the access request of the managed secure site;

[0162] Performing trusted authentication on the managed security site according to the second access request;

[0163] When the trusted authentication is passed, the SDP gateway of the master station obtains the second access request of the managed security site;

[0164] Conduct continuous trust assessment of risk level of managed secure sites based on second access requests;

[0165] When the evaluation passes, the second access request is authorized or forwarded.

[0166] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: performing continuous trust assessment on the risk level of the autonomous security site based on the first access request, including: performing multiple identity authentications on the autonomous security site based on the first access request, the multiple identity authentications including at least time, location, machine health status and configuration.

[0167] In one embodiment, when the computer program is executed by the processor, the following steps are further implemented: when the evaluation fails, intercepting the first access request.

[0168] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: the method also includes: micro-isolation is performed between the server, cloud host, microservice and site server of the main site through a micro-isolation gateway.

[0169] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: policy execution units are deployed on the main site's servers, cloud hosts, microservices and site servers; micro-isolation is performed between the main site's servers, cloud hosts, microservices and site servers through a micro-isolation gateway, including: business access requests are issued between the main site's servers, cloud hosts, microservices and site servers, and after the policy control center receives the business access request, it authenticates the calling subject and conducts continuous trust assessment on the risk level of the calling subject. After the assessment, it sends policy control instructions to the server's policy execution unit, and the server's policy execution unit executes the corresponding security policy action; the policy control center and the policy execution unit are deployed separately.

[0170] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: the policy execution unit of the server releases the business access request when the business authentication of the policy control center passes and has access rights; when the business authentication of the policy control center fails or the authentication authority is insufficient, the business access request is blocked.

[0171] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0172] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0173] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be construed as limiting the scope of the present application. It should be noted that, for a person of ordinary skill in the art, several modifications and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A safety protection method for an electric power monitoring system, characterized in that: The method comprises: The SDP gateway of the master station obtains the first access request of the autonomous safety type site; According to the first access request, multiple identity authentications are performed on the autonomous safety type site to continuously trust the risk level of the autonomous safety type site; the multiple identity authentications include at least time, location, machine health status and configuration; the autonomous safety type site includes a dispatching center, a substation and a power plant; When the evaluation is passed, the first access request is authorized or forwarded; The secure access area of ​​the master station obtains the access request of the managed secure site; According to the second access request, identity authentication is performed on the managed security site, and security baseline, security vulnerability, and security threat status are evaluated to perform trustworthy authentication on the managed security site; the managed security site includes a microgrid and a plant network; When the trusted authentication is passed, the SDP gateway of the master station obtains the second access request of the managed security site; Performing a continuous trust assessment on the risk level of the managed security site according to the second access request; When the evaluation is passed, the second access request is authorized or forwarded.

2. The method according to claim 1, characterized in that When the continuous trust assessment of the risk level of the autonomous safety-type site fails, the first access request is intercepted.

3. The method according to claim 1, characterized in that The method further comprises: The servers, cloud hosts, microservices and site servers of the main site are micro-isolated through a micro-isolation gateway.

4. The method according to claim 3, characterized in that The server, cloud host, microservice and site server of the master station are deployed with a policy execution unit; The servers, cloud hosts, microservices and site servers of the main site are micro-isolated through a micro-isolation gateway, including: The main station's servers, cloud hosts, microservices and site servers send business access requests. After receiving the business access requests, the policy control center authenticates the calling subject and conducts continuous trust assessment on the calling subject's risk level. After the assessment, the policy control instruction is sent to the server's policy execution unit, and the server's policy execution unit executes the corresponding security policy action. The policy control center and the policy execution unit are deployed separately.

5. The method according to claim 4, characterized in that The policy execution unit of the server releases the service access request when the service authentication of the policy control center passes and the server has access rights, and blocks the service access request when the service authentication of the policy control center fails or the authentication rights are insufficient.

6. A safety protection device for an electric power monitoring system, characterized in that: The device comprises: A first access request module, used for the SDP gateway of the master station to obtain a first access request of an autonomous safety type station; A first access request evaluation module is used to perform multiple identity authentications on the autonomous safety type site according to the first access request, so as to continuously trust the risk level of the autonomous safety type site; the multiple identity authentications include at least time, location, machine health status and configuration; the autonomous safety type site includes a dispatching center, a substation and a power plant; A first access request execution module, configured to authorize or forward the first access request after passing the evaluation; Access request module, used for the secure access area of ​​the master station to obtain access requests from managed secure sites; A trusted authentication module, used for performing trusted authentication on the managed security site according to the second access request; A second access request module, used for the SDP gateway of the master station to obtain a second access request of the managed security site when the trusted authentication passes; A second access request evaluation module is used to authenticate the identity of the managed security type site, evaluate the security baseline, security vulnerability, and security threat status according to the second access request, so as to perform continuous trust evaluation on the risk level of the managed security type site; the managed security type site includes a microgrid and a plant network; The second access request execution module is used to authorize or forward the second access request after passing the evaluation.

7. The device according to claim 6, characterized in that The device also includes: The micro-isolation module is used to perform micro-isolation between the server, cloud host, microservices and site server of the main site through a micro-isolation gateway.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 5 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

Images