Substation security and protection system

Abstract

The invention discloses a substation security and protection system which comprises a network security monitoring device and a network security management platform. The network security monitoring device is deployed in a transformer substation and used for collecting and processing data of all monitoring objects in a local power monitoring system and sending a processing result to a network security management platform deployed by a scheduling structure, and the monitoring objects comprise host equipment, network equipment and security equipment. After configuration of the detection object is completed, a network security probe is additionally installed to access the master station; the network security management platform is deployed at a scheduling master station and is used for collecting report event information of all network security monitoring devices in a jurisdiction range, carrying out advanced analysis processing and calling services provided by the network security monitoring devices to realize remote control and management; the method has the advantages that the network security can be monitored in real time and effectively managed, and the network security is guaranteed.

Description

Technical Field

[0001] The present invention belongs to the technical field of power system security protection, and in particular relates to a substation security system for network security monitoring. Background Art

[0002] As an important public infrastructure related to the national economy and people's livelihood, electricity has been listed as the preferred target of cyber warfare by many countries. Therefore, with the development of network technology and information technology, the network security situation of the power system is becoming increasingly severe. At the same time, the "Notice of the National Center for Network Security on Conducting the Verification and Assessment of the Network Security Monitoring Capability of the Power Monitoring System" (Network Security

[2022] No. 7) clearly pointed out: Regarding the version verification of network security monitoring devices, device access, encryption and monitoring devices, and other security equipment redundant configuration requirements, reduce the network security risks of the master station automation itself, and eliminate possible vulnerabilities.

[0003] The current substation power monitoring system mainly focuses on automation security, but not enough attention is paid to network security. There is a problem that the security defense capability is low and has been attacked due to relying solely on security equipment. In order to solve the above problems, it is necessary to develop a substation security system for network security monitoring. Summary of the invention

[0004] The purpose of the present invention is to overcome the deficiencies of the prior art and to provide a substation security system that can monitor and effectively manage network security in real time and ensure network security.

[0005] The purpose of the present invention is achieved as follows: a substation security system, including a network security monitoring device and a network security management platform; wherein the network security monitoring device is deployed in the substation, adopts type II, and is multiple in number, and is used to realize data collection and processing of all monitoring objects in the local power monitoring system, and at the same time sends the processing results to the network security management platform deployed by the dispatching structure; wherein the monitoring objects include host equipment, network equipment and security equipment, the host equipment includes a security substation, a fault recorder, a monitoring background and a five-defense host, the network equipment includes a router and a switch, and the security equipment includes a firewall, a horizontal isolation device and a vertical encryption device; after the network security software is installed in each host device, it is connected to the station control layer switch through a network cable, and then through The switch is connected to the network security monitoring device and configured with relevant data to achieve information exchange with the main station; log services are configured on each network device, and exported to the main station system through the network security monitoring device; the data required for network security monitoring is configured on each security device, and then connected to the network security monitoring device via a network cable; after confirming that the above connections are completed, network security probes are installed on key nodes, and each network security monitoring device is connected to the main station; among them, the network security management platform is deployed at the dispatching main station to collect reported event information from all network security monitoring devices under its jurisdiction, perform advanced analysis and processing, and at the same time call the services provided by the network security monitoring device to achieve remote control and management, including platform management and control, collection and monitoring, security alarms, verification and evaluation, and response and disposal.

[0006] Preferably, safety zoning is implemented in the substation, a longitudinal encryption device is provided in each zone, and a transverse isolation device is provided between the zones.

[0007] Preferably, the vertical encryption device of each zone adopts the SM2 algorithm.

[0008] Preferably, the address and route of the second management center are added for scheduling, and dual management centers are set up for the vertical encryption devices and network security monitoring devices in each zone, so as to realize dual-plane and four-link connection of the vertical encryption devices and network security monitoring devices.

[0009] Preferably, the platform management and control includes two aspects: asset model information 3C management and network security platform basic support. The asset model information 3C management is used to complete the synchronization function of the network security platform and the basic model of the control cloud platform, establish ledger entry, 3C verification and unified release workflow, and perform source-end maintenance and centralized and unified release of business system model data across the entire network. The network security platform basic support is used to timely monitor platform defects and conduct closed-loop disposal, so that the overall availability of the platform is higher than 99.95%, ensuring that the network security platform server, gateway machine and network security monitoring device are in normal synchronization, and ensuring redundant dual-link access between upper and lower platforms and between platforms and plants.

[0010] Preferably, the collection and monitoring includes two aspects: the depth of security risk perception and the coordinated linkage of the network security platform. The depth of security risk perception is used to implement the requirements for all network security monitoring objects of the master station and the plant station to be connected, ensure that the access situation is consistent with the control cloud ledger and the security protection plan, and ensure that the substation access assets fully cover the station control layer host, network equipment and security equipment; the coordinated linkage of the network security platform is used to timely exchange information between upper and lower platforms, between the platform and the plant station, and complete the real-time synchronization function of information changes to ensure that the superior's review and response is timely and accurate.

[0011] Preferably, the security alarm includes three aspects: network security alarm uploading, security alarm intelligent analysis and network security alarm quality. The network security alarm uploading is used to improve the self-perception ability of the monitored object. The monitored objects include host equipment, network equipment, security equipment and database, to ensure that each behavior alarm is accurately uploaded to the network security management platform. The behavior alarm includes user login, peripheral access, network access and suspicious operation; the security alarm intelligent analysis is used to ensure that the network security platform can intelligently generate high-level alarms based on the original alarms, to ensure that the three major applications meet the practical requirements, the three major applications include trusted verification, malicious code monitoring and operation and maintenance audit, and to ensure that the alarm information is timely accessed to the network security management platform; the network security alarm quality is used to ensure that the alarm uploading time of the monitoring device meets the delay requirements, the agent correctly configures the port whitelist function, invalid alarms are promptly managed, the alarm methods are complete, the alarm methods include voice and text messages of the network security platform, and the alarm retention time is greater than 6 months.

[0012] Preferably, the verification and evaluation includes three aspects: equipment security configuration compliance, normalized security risk management and control, and feature library maintenance. Equipment security configuration compliance is used to rely on the security verification function of the network security platform to conduct monthly configuration policy compliance checks to ensure that the configuration policies of host devices, network devices and vertical encryption devices comply with whitelist and minimization requirements; normalized security risk management is used to rely on the risk assessment function of the network security platform to conduct monthly security risk assessments and vulnerability scans to implement closed-loop rectification; feature library maintenance is used to regularly update the feature library to ensure that the security verification items and risk assessment vulnerability library are the latest versions.

[0013] Preferably, the response and disposal include two aspects: a linkage response mechanism and a disposal specification. The linkage response mechanism is used to promptly detect potential network attacks through routine inspection of platform logs and network transmission content, to issue early warnings and to link to various network security monitoring devices and the main station platform in real time; the disposal specification is used to ensure that customs clearance personnel are in place in time to carry out security alarms and early warning disposal, and to ensure that the platform follows up according to the disposal specification of one alarm, one call, and one core.

[0014] Due to the adoption of the above technical scheme, the beneficial effects of the present invention are as follows: the present invention adopts Type II network security monitoring device and network security management platform, which are respectively deployed in the substation and the dispatching master station. The Type II network security monitoring device with more powerful performance is connected to all monitoring equipment in the substation, and the collected data is sent to the remote master station system to complete network security monitoring. At the same time, the master station system returns control instructions to complete the monitoring and management of all monitoring equipment in the substation. Through two-way communication between the two, the monitoring object itself can be perceived, the network security monitoring device can collect data in a distributed manner, and the network security management platform can uniformly control and manage, thus forming a network security monitoring and management system for the power monitoring system, and realizing real-time monitoring and effective management of cyberspace security; the present invention adopts the installation of network security probes at key nodes of the network topology structure, and cooperates with horizontal isolation devices and vertical encryption devices to further strengthen the network security protection of the power monitoring system and jointly ensure the network security of the substation; in general, the present invention has the advantages of real-time monitoring and effective management of network security and guaranteed network security. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 It is a schematic diagram of the system composition of the present invention.

[0016] Figure 2 It is a schematic diagram of the network security process of the substation monitoring object accessing the main station system of the present invention. DETAILED DESCRIPTION

[0017] The technical solution of the present invention is further specifically described below through embodiments and in conjunction with the accompanying drawings.

[0018] like Figure 1 and Figure 2As shown, the present invention provides a substation security system, including a network security monitoring device and a network security management platform; wherein the network security monitoring device is deployed in the substation, adopts type II, and is multiple in number, and is used to realize data collection and processing of all monitoring objects in the local power monitoring system, and at the same time sends the processing results to the network security management platform deployed by the dispatching structure; wherein the monitoring objects include host equipment, network equipment and security equipment, the host equipment includes a security substation, a fault recorder, a monitoring background and a five-defense host, the network equipment includes a router and a switch, and the security equipment includes a firewall, a horizontal isolation device and a vertical encryption device; after the network security software is installed in each host device, it is connected to the station control layer switch through a network cable, and then through the switch The machine is connected to the network security monitoring device and related data is configured to achieve information exchange with the main station; log services are configured on each network device, and the logs are exported to the main station system through the network security monitoring device; the data required for network security monitoring is configured on each security device, and then connected to the network security monitoring device via a network cable; after the above connection is completed, network security probes are installed on key nodes, and each network security monitoring device is connected to the main station; the network security management platform is deployed at the dispatching main station to collect reported event information from all network security monitoring devices under its jurisdiction, conduct advanced analysis and processing, and call the services provided by the network security monitoring device to achieve remote control and management, including platform management and control, collection and monitoring, security alarms, verification and evaluation, and response and disposal.

[0019] During the specific implementation, security zoning is implemented in the substation, vertical encryption devices are installed in each zone, and horizontal isolation devices are installed between zones. The vertical encryption devices in each zone adopt the SM2 algorithm. At the same time, the address and route of the second dispatching management center are added, and dual management centers are set up for the vertical encryption devices and network security monitoring devices in each zone to achieve dual-plane and four-link connection of the vertical encryption devices and network security monitoring devices. This ensures that the network security monitoring devices on the station side operate stably, the alarms of various access objects are displayed in a timely and accurate manner, the configurations of various equipment are fully checked, and the network security emergency response is rapid, which further improves the network security operation monitoring level of the superior dispatching organization, and effectively improves the network security operation reliability rate indicators.

[0020] During the specific implementation, it is necessary to conduct device version verification and digital certificate on-site verification of each network security monitoring device, verify whether the on-site device version is consistent with the device version displayed on the network security management platform, and verify whether the device digital certificate is authorized by the control center to ensure information uniformity, which is conducive to the normal operation of the subsequent network security management platform.

[0021] Among them, platform management and control include two aspects: asset model information 3C management and network security platform basic support. The asset model information 3C management is used to complete the synchronization function of the network security platform and the basic model of the control cloud platform, establish ledger entry, 3C verification and unified release workflow, and perform source-end maintenance and centralized and unified release of business system model data across the entire network; the network security platform basic support is used to timely monitor platform defects and closed-loop disposal, so that the overall availability of the platform is higher than 99.95%, ensuring that the network security platform server, gateway machine and network security monitoring device are in normal synchronization, and ensuring redundant dual-link access between upper and lower platforms and between platforms and plants.

[0022] Among them, collection and monitoring include two aspects: the depth of security risk perception and the coordinated linkage of the network security platform. The depth of security risk perception is used to implement the requirements for the full connection of the network security monitoring objects of the main station and the plant station, ensure that the access situation is consistent with the control cloud ledger and the security protection plan, and ensure that the substation access assets fully cover the station control layer host, network equipment and security equipment; Among them, the coordinated linkage of the network security platform is used to timely exchange information between the upper and lower platforms, between the platform and the plant station, and complete the real-time synchronization function of information changes to ensure that the superior's review and response is timely and accurate.

[0023] Among them, security alarms include three aspects: network security alarm transmission, security alarm intelligent analysis and network security alarm quality. Among them, network security alarm transmission is used to improve the self-perception ability of the monitored objects. The monitored objects include host equipment, network equipment, security equipment and database, to ensure that each behavior alarm is accurately sent to the network security management platform. Behavior alarms include user login, peripheral access, network access and suspicious operations; Among them, security alarm intelligent analysis is used to ensure that the network security platform can intelligently generate high-level alarms based on original alarms, and ensure that the three major applications meet the practical requirements. The three major applications include trusted verification, malicious code monitoring and operation and maintenance auditing, and at the same time ensure that the alarm information is timely connected to the network security management platform; Among them, the quality of network security alarms is used to ensure that the alarm transmission time of the monitoring device meets the delay requirements, the agent correctly configures the port whitelist function, invalid alarms are promptly managed, and the alarm methods are complete. The alarm methods include voice and text messages on the network security platform, and the alarm retention time is greater than 6 months.

[0024] Among them, the verification and evaluation include three aspects: equipment security configuration compliance, normalized security risk management and control, and feature library maintenance. Among them, equipment security configuration compliance is used to rely on the security verification function of the network security platform to conduct monthly configuration policy compliance checks to ensure that the configuration strategies of host devices, network devices and vertical encryption devices comply with the whitelist and minimization requirements; among them, normalized security risk management is used to rely on the risk assessment function of the network security platform to conduct monthly security risk assessments and vulnerability scans to implement closed-loop rectification; among them, feature library maintenance is used to regularly update the feature library to ensure that the security verification items and risk assessment vulnerability library are the latest versions.

[0025] Among them, the response and disposal include two aspects: linkage response mechanism and disposal specifications. The linkage response mechanism is used to timely discover potential network attacks through routine inspection of platform logs and network transmission content, provide early warning and real-time linkage to various network security monitoring devices and main station platforms; the disposal specifications are used to ensure that customs clearance personnel are in place in time for security alarms and early warning disposal, and ensure that the platform follows up according to the disposal specifications of one alarm, one electricity and one nuclear.

[0026] In summary, in actual use, the present invention improves the safety level of the equipment itself by carrying out functional program upgrades of the substation encryption device and the network security monitoring device and configuring a dual management center, realizes redundant four-link data transmission and control functions, ensures the reliable online rate of the equipment, ensures the reliable upload of network security alarms, and meets the assessment requirements of the superior management department, thereby comprehensively and effectively improving the economic benefits, social benefits and safety benefits of the power company.

[0027] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that the specific implementation modes of the present invention can still be modified or replaced by equivalents, and any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be included in the scope of the claims of the present invention.

Claims

1. A substation security system, Features: It includes a network security monitoring device and a network security management platform; the network security monitoring device is deployed in the substation, adopts type II, and is multiple in number, which is used to realize data collection and processing of all monitoring objects in the local power monitoring system, and at the same time sends the processing results to the network security management platform deployed by the dispatching structure; the monitoring objects include host equipment, network equipment and security equipment, the host equipment includes the security substation, fault recorder, monitoring background and five-defense host, the network equipment includes routers and switches, and the security equipment includes firewalls, horizontal isolation devices and vertical encryption devices; after installing the network security software in each host device, it is connected to the station control layer switch through the network cable, and then connected to the network security monitoring through the switch Device, and configure relevant data to achieve information exchange with the main station; configure log service on each network device, and export it to the main station system through the network security monitoring device; configure the data required for network security monitoring on each security device, and then connect it to the network security monitoring device through a network cable; after confirming that the above connection is completed, install network security probes on key nodes, and connect each network security monitoring device to the main station; among them, the network security management platform is deployed at the dispatching main station to collect reported event information from all network security monitoring devices under its jurisdiction, perform advanced analysis and processing, and call the services provided by the network security monitoring device to achieve remote control and management, including platform management and control, collection and monitoring, security alarms, verification and evaluation, and response and disposal.

2. The substation security system according to claim 1, Features: Implement safety zoning within the substation, install longitudinal encryption devices in each zone, and install transverse isolation devices between zones.

3. The substation security system according to claim 2, Features: The vertical encryption device in each zone adopts the SM2 algorithm.

4. The substation security system according to claim 2, Features: Add the address and route of the second dispatching management center, set up dual management centers for the vertical encryption devices and network security monitoring devices in each area, and realize dual-plane and four-link connection of the vertical encryption devices and network security monitoring devices.

5. The substation security system according to claim 1, Features: The platform management and control includes two aspects: asset model information 3C management and network security platform basic support. The asset model information 3C management is used to complete the synchronization function of the network security platform and the basic model of the control cloud platform, establish ledger entry, 3C verification and unified release workflow, and perform source-end maintenance and centralized and unified release of business system model data across the entire network; the network security platform basic support is used to timely monitor platform defects and closed-loop disposal, so that the overall availability of the platform is higher than 99.95%, ensuring that the network security platform server, gateway machine and network security monitoring device are in normal synchronization, and ensuring redundant dual-link access between upper and lower platforms and between platforms and plants.

6. The substation security system according to claim 1, Features: The collection and monitoring includes two aspects: the depth of security risk perception and the coordinated linkage of the network security platform. The depth of security risk perception is used to implement the requirements for all network security monitoring objects of the master station and the plant station to be connected, ensure that the access situation is consistent with the control cloud ledger and the security protection plan, and ensure that the substation access assets fully cover the station control layer host, network equipment and security equipment; the coordinated linkage of the network security platform is used to timely exchange information between upper and lower platforms, between platforms and plants and stations, and complete the real-time synchronization function of information changes to ensure that the superior's review and response is timely and accurate.

7. The substation security system according to claim 1, Features: The security alarm includes three aspects: network security alarm uploading, security alarm intelligent analysis and network security alarm quality. Network security alarm uploading is used to improve the self-perception ability of the monitored objects. The monitored objects include host devices, network devices, security devices and databases, ensuring that each behavior alarm is accurately sent to the network security management platform. Behavior alarms include user login, peripheral access, network access and suspicious operations. Intelligent analysis of security alerts is used to ensure that the network security platform can intelligently generate high-level alerts based on original alerts, ensure that the three major applications meet practical requirements, including trusted verification, malicious code monitoring and operation and maintenance auditing, and ensure that the alert information is timely connected to the network security management platform; The quality of network security alarms is used to ensure that the alarm transmission time of the monitoring device meets the delay requirements, the agent correctly configures the port whitelist function, invalid alarms are promptly managed, the alarm methods are complete, including voice and text messages on the network security platform, and the alarm retention time is greater than 6 months.

8. The substation security system according to claim 1, Features: The verification and evaluation include three aspects: equipment security configuration compliance, regular security risk management and control, and feature library maintenance. Among them, equipment security configuration compliance is used to rely on the security verification function of the network security platform to conduct monthly configuration policy compliance checks to ensure that the configuration policies of host devices, network devices and vertical encryption devices comply with whitelist and minimization requirements; among them, regular security risk management is used to rely on the risk assessment function of the network security platform to conduct monthly security risk assessments and vulnerability scans to implement closed-loop rectification; among them, feature library maintenance is used to regularly update the feature library to ensure that the security verification items and risk assessment vulnerability library are the latest versions.

9. The substation security system according to claim 1, Features: The response and disposal include two aspects: linkage response mechanism and disposal specifications. The linkage response mechanism is used to timely discover potential network attacks through routine inspection of platform logs and network transmission content, provide early warning and link to various network security monitoring devices and main station platforms in real time; the disposal specifications are used to ensure that customs clearance personnel are in place in time to carry out security alarms and early warning disposal, and ensure that the platform follows up according to the disposal specifications of one alarm, one electricity and one nuclear.

Images