State monitoring system and method of power system information security network isolation device

Abstract

The invention discloses a state monitoring system for an information security network isolation device of a power system. The state monitoring system comprises an extranet heartbeat generation module, an intranet heartbeat database, an intranet heartbeat probe module and an intranet isolation device management module, the extranet heartbeat generation module is deployed in an extranet and is used for transmitting heartbeat information to the intranet heartbeat database by penetrating through the power system information security network isolation device; the intranet heartbeat database is deployed in an intranet and receives heartbeat information; the intranet heartbeat probe module is deployed in an intranet and is used for monitoring the updating state of an intranet heartbeat database and uploading monitoring information to the intranet isolation device management module; and the intranet isolation device management module is deployed in an intranet and is used for performing corresponding processing according to the monitoring information so as to ensure the operation of the power system information security network isolation device. The invention further discloses a monitoring method adopted by the state monitoring system of the power system information security network isolation device. The system is high in reliability and good in safety.

Description

Technical Field

[0001] The present invention belongs to the field of electrical automation, and in particular relates to a state monitoring system and method for an information security network isolation device of a power system. Background Art

[0002] With the development of economy and technology and the improvement of people's living standards, electricity has become an indispensable secondary energy source in people's production and life, bringing endless convenience to people's production and life. Therefore, ensuring the stable and reliable supply of electricity has become one of the most important tasks of the power system.

[0003] In order to ensure the safe and stable operation of the power system, the internal network of the power system must be isolated from the external public Internet network, so as to ensure the security and reliability of the internal data of the power system. In order to achieve this function, the power system has deployed a set of information security network isolation device system. The device system divides the management information network of the power system into an information intranet and an information extranet, and implements effective security isolation; according to the security strategy of "dual network and dual machine, partition and domain, graded protection, and multi-layer protection", through the information security network isolation device system, the high-intensity logical isolation of the information intranet and the equipment is realized, and only the necessary business data between the internal and external networks is allowed to be exchanged in a controllable database communication mode. The data access process is controllable, the interactive data is authentic and reliable, and any access to the Internet by the information intranet host is prohibited. At this stage, the information security network isolation device system widely used in the power system can provide SQL proxy services and support the information extranet business system to access the information intranet database through a dedicated security driver.

[0004] As the scale of power system external network business continues to expand, the interaction between internal and external networks is becoming more frequent and complex. The information security network isolation device system currently used has encountered many problems and can no longer guarantee the stable data transmission of the internal and external network business systems of the power system. Among them, the proxy process "sqlproxy" of the information security network isolation device system is the most serious.

[0005] However, due to the strong logical isolation between the internal and external networks of the power system, the traditional method of checking the health of the equipment through ICMP or by detecting port opening is no longer applicable. Therefore, the internal network management end cannot detect the pseudo-death of the agent program of the isolation device. This situation will greatly affect the safe and stable operation of the information security network isolation device system, and then affect the safe and stable operation of the power system. Summary of the invention

[0006] One of the purposes of the present invention is to provide a state monitoring system for an electric power system information security network isolation device with high reliability and good safety.

[0007] A second object of the present invention is to provide a monitoring method adopted by the status monitoring system of the power system information security network isolation device.

[0008] The state monitoring system of the electric power system information security network isolation device provided by the present invention comprises an external network heartbeat generating module, an internal network heartbeat database, an internal network heartbeat probe module and an internal network isolation device management module; the external network heartbeat generating module, the internal network heartbeat database, the internal network heartbeat probe module and the internal network isolation device management module are connected in series in sequence; the external network heartbeat generating module is deployed in the external network, and is used to penetrate the electric power system information security network isolation device according to the set rules and send heartbeat information to the internal network heartbeat database; the internal network heartbeat database is deployed in the internal network, and is used to receive the heartbeat information sent by the external network heartbeat generating module; the internal network heartbeat probe module is deployed in the internal network, and is used to monitor the update state of the internal network heartbeat database according to the set rules, and upload the monitoring information to the internal network isolation device management module; the internal network isolation device management module is deployed in the internal network, and is used to perform corresponding processing according to the monitoring information uploaded by the internal network heartbeat probe module to ensure the operation of the electric power system information security network isolation device.

[0009] The external network heartbeat generation module specifically includes the following steps:

[0010] The external network heartbeat generation module is deployed on the external network;

[0011] The external network heartbeat generation module uses SQL commands and the set rules to penetrate the power system information security network isolation device and send timestamp information to the internal network heartbeat probe module;

[0012] An external network heartbeat generation module corresponds to an electric power system information security network isolation device.

[0013] The intranet heartbeat database specifically includes the following steps:

[0014] The intranet heartbeat database is deployed on the intranet;

[0015] Establish a real database instance as the intranet heartbeat database;

[0016] The intranet heartbeat database establishes several data tables, which are used to store the timestamp information sent by the extranet heartbeat generation module.

[0017] The intranet heartbeat probe module specifically includes the following steps:

[0018] The intranet heartbeat probe module is deployed in the intranet;

[0019] The intranet heartbeat probe module monitors the update status of the intranet heartbeat database according to the set rules: if the timestamp information of any data table in the intranet heartbeat database stops updating, it is determined that the process of the power system information security network isolation device corresponding to the data table has hung, and the information is recorded and uploaded to the intranet isolation device management module.

[0020] The intranet isolation device management module specifically includes the following steps:

[0021] The intranet isolation device management module is deployed in the intranet;

[0022] The intranet isolation device management module includes an isolation equipment pool, a dispatcher and an isolation device emergency processing submodule; the isolation equipment pool is used to input the list information of the monitored power system information security network isolation device; the dispatcher is used to receive the data information uploaded by the intranet heartbeat probe module, and obtain the list information of the corresponding power system information security network isolation device in the isolation equipment pool according to the received data information, and send the obtained list information to the isolation device emergency processing submodule; the isolation device emergency processing submodule is used to deal with the power system information security network isolation device with a process hang phenomenon according to the received list information, so as to ensure the service recovery of the corresponding power system information security network isolation device;

[0023] The list information includes IP address and login account name.

[0024] The present invention also provides a monitoring method adopted by the state monitoring system of the power system information security network isolation device, comprising the following steps:

[0025] S1. Establish an external network heartbeat module: The external network heartbeat module, according to the set rules, uses SQL commands to penetrate the power system information security network isolation device and send timestamp information to the internal network heartbeat probe module;

[0026] S2. Configure SQL proxy service on the power system information security network isolation device;

[0027] S3. Establish an intranet heartbeat database;

[0028] S4. Establish an intranet heartbeat probe module: ensure that the data information of the intranet heartbeat database can be read through SQL commands in the intranet;

[0029] S5. Establish an intranet isolation device management module: ensure that the intranet isolation device management module can communicate with the intranet heartbeat probe module, and can also log in to the monitored power system information security network isolation device through SSH;

[0030] S6. The external network heartbeat module sends heartbeat information to the internal network heartbeat database;

[0031] S7. The intranet heartbeat probe module detects the update information of the data table in the intranet heartbeat database;

[0032] S8. Based on the updated information obtained in step S7, the status monitoring of the power system information security network isolation device is implemented.

[0033] The step S1 specifically further comprises the following steps:

[0034] The process jdbc connection string of each external network heartbeat generating module is configured with the real interface external network IP of the corresponding power system information security network isolation device; each external network heartbeat generating module corresponds to a power system information security network isolation device.

[0035] The step S2 specifically includes the following steps:

[0036] Configure a real database to be used as the intranet heartbeat database, and configure the database data information at the same time; configure an extranet virtual database for the intranet heartbeat database, and configure the data information of the extranet virtual database at the same time; complete the connection test of the intranet heartbeat database.

[0037] The step S3 specifically includes the following steps:

[0038] A real database is established on the intranet database server; a data table is established in the database, the first column of the data table is used to record the serial number of the written timestamp information, and the second column of the data table is used to record the written timestamp information; the number of data tables established is the same as the number of monitored power system information security network isolation devices.

[0039] The step S6 specifically includes the following steps:

[0040] The external network heartbeat generation module obtains the local time according to the set rules, penetrates the power system information security network isolation device through SQL commands, executes the Insert statement to the data table in the internal network heartbeat database, and writes the heartbeat timestamp information into the second column of the data table;

[0041] If the writing fails, the external network heartbeat generation module will continue to send the timestamp information and insert it according to the set rules after writing the log;

[0042] If there are N power system information security network isolation devices, N processes are used to perform N timestamp information sending and inserting operations.

[0043] The step S7 specifically includes the following steps:

[0044] The intranet heartbeat probe module obtains the timestamp information of the last data and the second-to-last data in the data table in the intranet heartbeat database according to the set rules;

[0045] Calculate the time difference of the acquired timestamp information and make a judgment:

[0046] If the time difference is greater than or equal to the first set value, and the corresponding power system information security network isolation device does not reset the process operation within the set time, it is determined that the power system information security network isolation device has a process hang phenomenon, and the data information of the power system information security network isolation device is recorded and sent to the intranet isolation device management module;

[0047] If the time difference is greater than or equal to the first set value and less than the second set value, and the corresponding power system information security network isolation device has a reset process operation within the set time, no operation is performed to retain the time of the process reset;

[0048] If the time difference is greater than or equal to the second set value, and the corresponding power system information security network isolation device has a reset process operation within the set time, it is determined that the reset process has failed and an alarm is issued;

[0049] Otherwise, no action is taken.

[0050] The step S8 specifically includes the following steps:

[0051] If the intranet isolation device management module receives data information of the power system information security network isolation device with a process hang phenomenon, it starts the SSH process, logs in to the corresponding power system information security network isolation device, and restarts the proxy process "sqlproxy" through the script;

[0052] After the restart operation is completed, the intranet isolation device management module links to the intranet heartbeat database and writes the set timestamp information at the end of the data table corresponding to the restarted power system information security network isolation device to indicate that a restart operation has occurred in the power system information security network isolation device.

[0053] The status monitoring system and method of the power system information security network isolation device provided by the present invention construct a corresponding status monitoring system of the power system information security network isolation device and propose a corresponding monitoring method; the present invention not only realizes the status monitoring of the power system information security network isolation device by sending heartbeat information from the external network to the internal network, but also has high reliability and good safety. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 Schematic diagram of the functional modules of the system of the present invention.

[0055] Figure 2 The figure is a schematic diagram of the method flow of the present invention. DETAILED DESCRIPTION

[0056] like Figure 1 The figure shows a schematic diagram of the functional modules of the system of the present invention: the status monitoring system of the power system information security network isolation device disclosed in the present invention comprises an external network heartbeat generating module, an internal network heartbeat database, an internal network heartbeat probe module and an internal network isolation device management module; the external network heartbeat generating module, the internal network heartbeat database, the internal network heartbeat probe module and the internal network isolation device management module are connected in series in sequence; the external network heartbeat generating module is deployed in the external network, and is used to penetrate the power system information security network isolation device according to the set rules and send heartbeat information to the internal network heartbeat database; the internal network heartbeat database is deployed in the internal network, and is used to receive the heartbeat information sent by the external network heartbeat generating module; the internal network heartbeat probe module is deployed in the internal network, and is used to monitor the update status of the internal network heartbeat database according to the set rules, and upload the monitoring information to the internal network isolation device management module; the internal network isolation device management module is deployed in the internal network, and is used to perform corresponding processing according to the monitoring information uploaded by the internal network heartbeat probe module to ensure the operation of the power system information security network isolation device.

[0057] When implementing:

[0058] External network heartbeat generation module:

[0059] The external network heartbeat generation module is deployed on the external network;

[0060] The external network heartbeat generation module uses SQL commands and the set rules to penetrate the power system information security network isolation device and send timestamp information to the internal network heartbeat probe module;

[0061] An external network heartbeat generation module corresponds to an electric power system information security network isolation device.

[0062] Intranet heartbeat database:

[0063] The intranet heartbeat database is deployed on the intranet;

[0064] Establish a real database instance as the intranet heartbeat database;

[0065] The intranet heartbeat database establishes several data tables, which are used to store the timestamp information sent by the extranet heartbeat generation module.

[0066] Intranet heartbeat probe module:

[0067] The intranet heartbeat probe module is deployed in the intranet;

[0068] The intranet heartbeat probe module monitors the update status of the intranet heartbeat database according to the set rules: if the timestamp information of any data table in the intranet heartbeat database stops updating, it is determined that the process of the power system information security network isolation device corresponding to the data table has hung, and the information is recorded and uploaded to the intranet isolation device management module.

[0069] Intranet isolation device management module:

[0070] The intranet isolation device management module is deployed in the intranet;

[0071] The intranet isolation device management module includes an isolation equipment pool, a dispatcher and an isolation device emergency processing submodule; the isolation equipment pool is used to enter the inventory information of the monitored power system information security network isolation device; the dispatcher is used to receive the data information uploaded by the intranet heartbeat probe module, and according to the received data information, obtain the inventory information of the corresponding power system information security network isolation device in the isolation equipment pool, and send the obtained inventory information to the isolation device emergency processing submodule; the isolation device emergency processing submodule is used to deal with the power system information security network isolation device with a process hang phenomenon according to the received inventory information, so as to ensure the service recovery of the corresponding power system information security network isolation device; the inventory information includes IP address and login account name, etc.

[0072] like Figure 2 The method flow diagram of the method of the present invention is shown as follows: the monitoring method adopted by the state monitoring system of the power system information security network isolation device disclosed in the present invention comprises the following steps:

[0073] S1. Establish an external network heartbeat generation module: The external network heartbeat generation module, according to the set rules, uses SQL commands to penetrate the power system information security network isolation device and send timestamp information to the internal network heartbeat probe module; specifically, it also includes the following steps:

[0074] The jdbc connection string of the process of each external network heartbeat generation module is configured with the real interface external network IP of the corresponding power system information security network isolation device; each external network heartbeat generation module corresponds to a power system information security network isolation device;

[0075] S2. Configure the SQL proxy service on the power system information security network isolation device; specifically include the following steps:

[0076] Configure a real database as the intranet heartbeat database, and configure the database data information; configure an extranet virtual database for the intranet heartbeat database, and configure the extranet virtual database data information; complete the connection test of the intranet heartbeat database;

[0077] S3. Establish an intranet heartbeat database; specifically includes the following steps:

[0078] Establish a real database on the intranet database server; establish a data table in the database, the first column of the data table is used to record the serial number of the written timestamp information, and the second column of the data table is used to record the written timestamp information; the number of established data tables is the same as the number of monitored power system information security network isolation devices;

[0079] S4. Establish an intranet heartbeat probe module: ensure that the data information of the intranet heartbeat database can be read through SQL commands in the intranet;

[0080] S5. Establish an intranet isolation device management module: ensure that the intranet isolation device management module can communicate with the intranet heartbeat probe module, and can also log in to the monitored power system information security network isolation device through SSH;

[0081] S6. The external network heartbeat module sends heartbeat information to the internal network heartbeat database; specifically includes the following steps:

[0082] The external network heartbeat generation module obtains the local time according to the set rules, penetrates the power system information security network isolation device through SQL commands, executes the Insert statement to the data table in the internal network heartbeat database, and writes the heartbeat timestamp information into the second column of the data table; the data type of the second column is set to the timestamp type;

[0083] If the writing fails, the external network heartbeat generation module will continue to send the timestamp information and insert it according to the set rules after writing the log;

[0084] If there are N power system information security network isolation devices, N processes are used to perform N timestamp information sending and inserting operations;

[0085] S7. The intranet heartbeat probe module detects the update information of the data table in the intranet heartbeat database; specifically comprises the following steps:

[0086] The intranet heartbeat probe module obtains the timestamp information of the last data and the second-to-last data in the data table in the intranet heartbeat database according to the set rules;

[0087] Calculate the time difference of the acquired timestamp information and make a judgment:

[0088] If the time difference is greater than or equal to a first set value (preferably 30 seconds), and the corresponding power system information security network isolation device does not reset the process operation within the set time, it is determined that the power system information security network isolation device has a process hang phenomenon, and the data information of the power system information security network isolation device is recorded and sent to the intranet isolation device management module;

[0089] If the time difference is greater than or equal to the first set value and less than the second set value (preferably 120 seconds), and the corresponding power system information security network isolation device has a reset process operation within the set time, no operation is performed to retain the process reset time;

[0090] If the time difference is greater than or equal to the second set value, and the corresponding power system information security network isolation device has a reset process operation within the set time, it is determined that the reset process has failed and an alarm is issued; in specific implementation, a text message alarm, a telephone alarm, etc. can be used; such a reset process failure indicates that the corresponding power system information security network isolation device has completely failed and cannot be restarted in an automated manner, so manual intervention is required;

[0091] Otherwise, no operation is performed;

[0092] S8. According to the update information obtained in step S7, the status monitoring of the power system information security network isolation device is realized; specifically comprising the following steps:

[0093] If the intranet isolation device management module receives data information of the power system information security network isolation device with a process hang phenomenon, it starts the SSH process, logs in to the corresponding power system information security network isolation device, and restarts the proxy process "sqlproxy" through the script;

[0094] After the restart operation is completed, the intranet isolation device management module links to the intranet heartbeat database and writes the set timestamp information at the end of the data table corresponding to the restarted power system information security network isolation device to indicate that a restart operation has occurred in the power system information security network isolation device.

[0095] The scheme of the present invention is designed and developed based on the actual situation of strong logical isolation between the internal and external networks of the power system network, and realizes health checks, automatic processing of process hangs and alarms for information security network isolation devices. It eliminates the reliability risks of existing isolation devices that cannot be detected and processed after process hangs, and greatly improves the availability and fault tolerance of internal and external network interactions.

Claims

1. A status monitoring system for an information security network isolation device of an electric power system, comprising an external network heartbeat generation module, an internal network heartbeat database, an internal network heartbeat probe module and an internal network isolation device management module ； The external network heartbeat generation module, the internal network heartbeat database, the internal network heartbeat probe module and the internal network isolation device management module are connected in series in sequence; The external network heartbeat generation module is deployed in the external network and is used to penetrate the power system information security network isolation device according to the set rules and send heartbeat information to the internal network heartbeat database; The intranet heartbeat database is deployed in the intranet and is used to receive the heartbeat information sent by the external network heartbeat generation module; The intranet heartbeat probe module is deployed in the intranet and is used to monitor the update status of the intranet heartbeat database according to the set rules, and upload the monitoring information to the intranet isolation device management module; The intranet isolation device management module is deployed in the intranet and is used to perform corresponding processing based on the monitoring information uploaded by the intranet heartbeat probe module to ensure the operation of the power system information security network isolation device.

2. The state monitoring system of the power system information security network isolation device according to claim 1, Features The external network heartbeat generation module specifically includes the following steps: The external network heartbeat generation module is deployed on the external network; The external network heartbeat generation module uses SQL commands and the set rules to penetrate the power system information security network isolation device and send timestamp information to the internal network heartbeat probe module; An external network heartbeat generation module corresponds to an electric power system information security network isolation device.

3. The state monitoring system of the power system information security network isolation device according to claim 2, Features The intranet heartbeat database specifically includes the following steps: The intranet heartbeat database is deployed on the intranet; Establish a real database instance as the intranet heartbeat database; The intranet heartbeat database establishes several data tables, which are used to store the timestamp information sent by the extranet heartbeat generation module.

4. The state monitoring system of the power system information security network isolation device according to claim 3, Features The intranet heartbeat probe module specifically includes the following steps: The intranet heartbeat probe module is deployed in the intranet; The intranet heartbeat probe module monitors the update status of the intranet heartbeat database according to the set rules: if the timestamp information of any data table in the intranet heartbeat database stops updating, it is determined that the process of the power system information security network isolation device corresponding to the data table has hung, and the information is recorded and uploaded to the intranet isolation device management module.

5. The state monitoring system of the power system information security network isolation device according to claim 4, Features The intranet isolation device management module specifically includes the following steps: The intranet isolation device management module is deployed in the intranet; The intranet isolation device management module includes an isolation equipment pool, a scheduler, and an isolation device emergency processing submodule; The isolation equipment pool is used to input the inventory information of the monitored power system information security network isolation devices; The scheduler is used to receive the data information uploaded by the intranet heartbeat probe module, and obtain the list information of the corresponding power system information security network isolation device in the isolation equipment pool according to the received data information, and send the obtained list information to the isolation device emergency processing submodule; The isolation device emergency processing submodule is used to handle the power system information security network isolation device with a process hang phenomenon according to the received list information, so as to ensure the service recovery of the corresponding power system information security network isolation device; The list information includes IP address and login account name.

6. A monitoring method adopted by the status monitoring system of the power system information security network isolation device according to any one of claims 1 to 5, comprising the following steps: S1. Establish an external network heartbeat module: The external network heartbeat module, according to the set rules, uses SQL commands to penetrate the power system information security network isolation device and send timestamp information to the internal network heartbeat probe module; S2. Configure SQL proxy service on the power system information security network isolation device; S3. Establish an intranet heartbeat database; S4. Establish an intranet heartbeat probe module: ensure that the data information of the intranet heartbeat database can be read through SQL commands in the intranet; S5. Establish an intranet isolation device management module: ensure that the intranet isolation device management module can communicate with the intranet heartbeat probe module, and can also log in to the monitored power system information security network isolation device through SSH; S6. The external network heartbeat module sends heartbeat information to the internal network heartbeat database; S7. The intranet heartbeat probe module detects the update information of the data table in the intranet heartbeat database; S8. Based on the updated information obtained in step S7, the status monitoring of the power system information security network isolation device is implemented.

7. The monitoring method according to claim 6, Features The step S1 specifically further comprises the following steps: The process jdbc connection string of each external network heartbeat generation module is configured with the real interface external network IP of the corresponding power system information security network isolation device; each external network heartbeat generation module corresponds to a power system information security network isolation device; The step S2 specifically includes the following steps: Configure a real database as the intranet heartbeat database, and configure the database data information; configure an extranet virtual database for the intranet heartbeat database, and configure the extranet virtual database data information; complete the connection test of the intranet heartbeat database; The step S3 specifically includes the following steps: A real database is established on the intranet database server; a data table is established in the database, the first column of the data table is used to record the serial number of the written timestamp information, and the second column of the data table is used to record the written timestamp information; the number of data tables established is the same as the number of monitored power system information security network isolation devices.

8. The monitoring method according to claim 7, Features The step S6 specifically includes the following steps: The external network heartbeat generation module obtains the local time according to the set rules, penetrates the power system information security network isolation device through SQL commands, executes the Insert statement to the data table in the internal network heartbeat database, and writes the heartbeat timestamp information into the second column of the data table; If the writing fails, the external network heartbeat generation module will continue to send the timestamp information and insert it according to the set rules after writing the log; If there are N power system information security network isolation devices, N processes are used to perform N timestamp information sending and inserting operations.

9. The monitoring method according to claim 8, Features The step S7 specifically includes the following steps: The intranet heartbeat probe module obtains the timestamp information of the last data and the second-to-last data in the data table in the intranet heartbeat database according to the set rules; Calculate the time difference of the acquired timestamp information and make a judgment: If the time difference is greater than or equal to the first set value, and the corresponding power system information security network isolation device does not reset the process operation within the set time, it is determined that the power system information security network isolation device has a process hang phenomenon, and the data information of the power system information security network isolation device is recorded and sent to the intranet isolation device management module; If the time difference is greater than or equal to the first set value and less than the second set value, and the corresponding power system information security network isolation device has a reset process operation within the set time, no operation is performed to retain the time of the process reset; If the time difference is greater than or equal to the second set value, and the corresponding power system information security network isolation device has a reset process operation within the set time, it is determined that the reset process has failed and an alarm is issued; Otherwise, no action is taken.

10. The monitoring method according to claim 9, Features The step S8 specifically includes the following steps: If the intranet isolation device management module receives data information of the power system information security network isolation device with a process hang phenomenon, it starts the SSH process, logs in to the corresponding power system information security network isolation device, and restarts the proxy process "sqlproxy" through the script; After the restart operation is completed, the intranet isolation device management module links to the intranet heartbeat database and writes the set timestamp information at the end of the data table corresponding to the restarted power system information security network isolation device to indicate that a restart operation has occurred in the power system information security network isolation device.

Images