Microgrid full-link safety protection system and method and computer program

Abstract

The invention provides a micro-grid full-link security protection system, which comprises a micro-grid master station server data receiving module used for encrypting service data through an encryption unit installed on a micro-grid slave station server and transmitting the encrypted service data to a security access isolation gateway, and an external network side host used for decrypting the encrypted service data and transmitting the decrypted service data to a security access isolation gateway; the reverse internal network side host sends the decrypted service data to a micro-grid master station server; the micro-grid master station server data sending module is used for filtering business data of the micro-grid master station server through the forward internal network side host and sending the business data to the micro-grid slave station server; the credibility verification module is used for carrying out integrity verification on the security access isolation gateway through a credibility verification unit; and the network security monitoring module is used for performing security monitoring on the micro-grid master station server and the security access isolation gateway through a network security monitoring device. According to the invention, the investment cost is reduced, and the data transmission security is improved.

Description

Technical Field

[0001] The present invention relates to the field of microgrid safety technology, and in particular to a microgrid full-link safety protection system, method and computer program. Background Art

[0002] The master-slave systems of microgrids are connected to the source-grid-load-storage systems of the ground dispatching master stations in large numbers, which makes the openness of the power monitoring system increasingly increasing and the network boundaries continue to extend to the end. Traditional network security protection methods are difficult to cope with the new challenges brought by microgrid applications.

[0003] During the application process, there are several problems with microgrid security protection: (1) According to the traditional construction model, the mainstream 1000M and 100M power-specific security devices require a large investment and are difficult to adapt to the access needs of the massive business terminals of the microgrid. (2) There are a large number of microgrid slave stations. According to the traditional plant-station model, the cost of deploying network security monitoring devices to monitor alarm information is huge, the installation is complex, and the subsequent maintenance is difficult. In addition, the alarm information cannot be sent via wireless transmission. (3) Data is transmitted between the microgrid master station and the slave station through the 5G network. The open communication environment makes wireless transmission more vulnerable to malicious attacks than wired communication. Summary of the invention

[0004] The purpose of the present invention is to provide a microgrid full-link safety protection system to address the defects of the prior art, including:

[0005] A trusted verification module, used to verify the integrity of the secure access isolation gateway through a trusted verification unit;

[0006] A data receiving module for a microgrid master server is used to encrypt business data through an encryption unit installed on a microgrid slave server after integrity verification, and the microgrid slave server transmits the encrypted business data to a secure access isolation gateway through an external network, and a host on the external network side of the secure access isolation gateway receives the encrypted business data and decrypts the encrypted business data, and a host on the reverse internal network side of the secure access isolation gateway receives the decrypted business data and sends the decrypted business data to the microgrid master server through a first isolation component;

[0007] The microgrid master station server data sending module is used to filter the business data of the microgrid master station server according to preset filtering rules through the forward intranet host of the secure access isolation gateway after integrity verification, and send the filtered business data to the microgrid slave station server through the second isolation component;

[0008] The network security monitoring module is used to perform security monitoring on the microgrid master station server and the security access isolation gateway respectively through the network security monitoring device during the data reception or data transmission process of the microgrid master station server.

[0009] Furthermore, the secure access isolation gateway is composed of an external network side host, a reverse internal network side host, a forward internal network side host, a first isolation component, a second isolation component and a trusted verification unit, and the network security monitoring device is respectively installed on the secure access isolation gateway and the microgrid master station server.

[0010] Furthermore, the first isolation component is a reverse safety isolation gateway, and the second isolation component is a forward safety isolation gateway.

[0011] Further, in the data receiving module of the microgrid master server, the business data is encrypted by the encryption unit installed in the microgrid slave server, and the microgrid slave server transmits the encrypted business data to the secure access isolation gateway of the microgrid master server through the external network. The external network side host of the secure access isolation gateway receives the encrypted business data and decrypts it. The specific method is:

[0012] The encryption unit of the microgrid slave server uses the public key to encrypt the business data. The microgrid slave server transmits the encrypted business data to the secure access isolation gateway of the microgrid master server through the external network. The external network host of the secure access isolation gateway uses the private key paired with the public key to decrypt the encrypted business data.

[0013] Furthermore, in the data receiving module of the microgrid master station server, the reverse intranet-side host of the secure access isolation gateway is also used to convert the format of the business data. The specific method is as follows:

[0014] The reverse intranet-side host converts the format of the decrypted business data into the electric e language format.

[0015] Furthermore, in the data sending module of the microgrid master station server, the preset filtering rules are preset based on the data source address, destination address, port number, network protocol or application layer protocol type, and user identity.

[0016] Further, in the trusted verification module, the specific method of performing integrity verification on the secure access isolation gateway through the trusted verification unit is:

[0017] Before the operating system of the secure access isolation gateway is started, the trusted verification unit measures whether the general hardware and firmware, the master boot area, and the kernel have been tampered with;

[0018] When the operating system of the secure access isolation gateway is started, measure whether the Bootloader, master boot area, and kernel have been tampered with;

[0019] After the operating system of the secure access isolation gateway is started, the trusted verification unit measures whether its own trusted driver module has been tampered with;

[0020] Start the trusted software base in the operating system of the secure access isolation gateway to measure whether the trusted software base has been tampered with;

[0021] Measure whether the application has been tampered with in the operating system of the secure access isolation gateway;

[0022] The measurement is defined as comparing a preset whitelist with the object to be measured. If the object to be measured is inconsistent with the preset whitelist, it is determined that the object to be measured has been tampered with, otherwise the object to be measured has not been tampered with. The preset whitelist includes all objects to be measured and their complete files.

[0023] Furthermore, in the network security monitoring module, the specific method of performing security monitoring on the microgrid master station server and the secure access isolation gateway respectively through the network security monitoring device is:

[0024] The network security monitoring device performs security monitoring on the microgrid master station server through the Agent monitoring method based on the business data of the microgrid master station server;

[0025] The network security monitoring device performs security monitoring on the security access isolation gateway through a syslog monitoring method based on the business data of the security access isolation gateway.

[0026] A microgrid full-link safety protection method, comprising:

[0027] The integrity of the secure access isolation gateway is verified through a trusted verification unit;

[0028] After the integrity verification, the business data is encrypted by the encryption unit installed in the microgrid slave server, and the microgrid slave server transmits the encrypted business data to the secure access isolation gateway through the external network. The external network side host of the secure access isolation gateway receives the encrypted business data and decrypts the encrypted business data. The reverse internal network side host of the secure access isolation gateway receives the decrypted business data and sends the decrypted business data to the microgrid master server through the first isolation component;

[0029] After integrity verification, the service data of the microgrid master server is filtered according to preset filtering rules by the forward intranet host of the secure access isolation gateway, and the filtered service data is sent to the microgrid slave server through the second isolation component;

[0030] During the data receiving or data sending process of the microgrid master station server, the network security monitoring device is used to perform security monitoring on the microgrid master station server and the security access isolation gateway.

[0031] A computer program product includes a computer program / instruction, and when the computer program / instruction is executed by a processor, the above-mentioned microgrid full-link safety protection method is implemented.

[0032] The beneficial effects of the present invention are:

[0033] 1. By setting up a secure access isolation gateway between the microgrid master server and the microgrid slave server, the security of business data transmission between the microgrid master server and the microgrid slave server is guaranteed, and the installation of a trusted verification module ensures that the computing components in the secure access isolation gateway will not be maliciously tampered with. At the same time, the occurrence of suspicious network activities is monitored through the network security monitoring device.

[0034] 2. Through trusted verification, the basic computing and operating environment of the secure access isolation gateway device is ensured to be trustworthy, and the computing components in the secure access isolation gateway are protected from malicious tampering. A defense mechanism against malicious code attacks is established from the root, thereby improving the boundary protection capabilities of the microgrid master station.

[0035] 3. Through network security monitoring, the alarms of the microgrid master / slave station business servers, security equipment, and network equipment can be collected and forwarded to detect network attacks in a timely manner.

[0036] 4. Through network security monitoring devices, highly integrated security isolation gateways and other measures, the access of massive business terminals in the microgrid can reduce monitoring costs and investment costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 This is a system block diagram of the present invention. DETAILED DESCRIPTION

[0038] In order to make the technical problems, technical solutions and beneficial effects to be solved by the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0039] Example 1

[0040] refer to Figure 1 , a microgrid full-link safety protection system, comprising:

[0041] A trusted verification module, used to verify the integrity of the secure access isolation gateway through a trusted verification unit;

[0042] A data receiving module for a microgrid master server is used to encrypt business data through an encryption unit installed on a microgrid slave server after integrity verification, and the microgrid slave server transmits the encrypted business data to a secure access isolation gateway through an external network, and a host on the external network side of the secure access isolation gateway receives the encrypted business data and decrypts the encrypted business data, and a host on the reverse internal network side of the secure access isolation gateway receives the decrypted business data and sends the decrypted business data to the microgrid master server through a first isolation component;

[0043] The microgrid master station server data sending module is used to filter the business data of the microgrid master station server according to preset filtering rules through the forward intranet host of the secure access isolation gateway after integrity verification, and send the filtered business data to the microgrid slave station server through the second isolation component;

[0044] The network security monitoring module is used to perform security monitoring on the microgrid master station server and the security access isolation gateway respectively through the network security monitoring device during the data reception or data transmission process of the microgrid master station server.

[0045] (1) The secure access isolation gateway is composed of an external network host, a reverse internal network host, a forward internal network host, a first isolation component, a second isolation component and a trusted verification unit, and the network security monitoring device is installed on the secure access isolation gateway and the microgrid master station server respectively.

[0046] The secure access isolation gateway is established between the microgrid master server and the microgrid slave server. It integrates the functions of isolation components and encrypted transmission, provides a simplified networking solution, effectively reduces the networking cost and difficulty, and meets the construction requirements of the microgrid master station security access area. Only one device is required to complete the construction of the microgrid business master station security access area, which not only reduces the investment in the initial security protection construction of the microgrid, but also greatly reduces the workload of subsequent operation and maintenance.

[0047] The secure access isolation gateway establishes a barrier between the microgrid slave server and the microgrid master server, meeting the network security protection requirements of multi-level wireless transmission and cross-security zone data interaction in the microgrid scenario, significantly improving the overall security protection capabilities of the microgrid, and avoiding the problem of being vulnerable to attacks when transmitting data through the external network.

[0048] (2) The first isolation component is a reverse safety isolation gateway, and the second isolation component is a forward safety isolation gateway.

[0049] (3) In the data receiving module of the microgrid master server, the business data is encrypted by the encryption unit installed in the microgrid slave server, and the microgrid slave server transmits the encrypted business data to the secure access isolation gateway of the microgrid master server through the external network. The external network host of the secure access isolation gateway receives the encrypted business data and decrypts it. The specific method is:

[0050] The encryption unit of the microgrid slave server uses the public key to encrypt the business data. The microgrid slave server transmits the encrypted business data to the secure access isolation gateway of the microgrid master server through the external network. The external network host of the secure access isolation gateway uses the private key paired with the public key to decrypt the encrypted business data.

[0051] (4) In the data receiving module of the microgrid master station server, the reverse intranet host of the secure access isolation gateway is also used to convert the format of the business data. The specific method is as follows:

[0052] The reverse intranet-side host converts the format of the decrypted business data into the format of e-text.

[0053] (5) In the data sending module of the microgrid master station server, the preset filtering rules are preset based on the data source address, destination address, port number, network protocol or application layer protocol type, and user identity.

[0054] (6) In the trusted verification module, the specific method of performing integrity verification on the secure access isolation gateway through the trusted verification unit is:

[0055] Before the operating system of the secure access isolation gateway is started, the trusted verification unit measures whether the general hardware and firmware, the master boot area, and the kernel have been tampered with;

[0056] When the operating system of the secure access isolation gateway is started, measure whether the Bootloader, master boot area, and kernel have been tampered with;

[0057] After the operating system of the secure access isolation gateway is started, the trusted verification unit measures whether its own trusted driver module has been tampered with;

[0058] Start the trusted software base in the operating system of the secure access isolation gateway to measure whether the trusted software base has been tampered with;

[0059] Measure whether the application has been tampered with in the operating system of the secure access isolation gateway;

[0060] The measurement is defined as comparing a preset whitelist with the object to be measured. If the object to be measured is inconsistent with the preset whitelist, it is determined that the object to be measured has been tampered with, otherwise the object to be measured has not been tampered with. The preset whitelist includes all objects to be measured and their complete files.

[0061] Through trusted verification, the basic computing and operating environment of the secure access isolation gateway device is ensured to be trustworthy, and the computing components in the secure access isolation gateway are protected from malicious tampering. A defense mechanism against malicious code attacks is established from the root, improving the boundary protection capabilities of the microgrid master station.

[0062] (7) In the network security monitoring module, the specific method of performing security monitoring on the microgrid master station server and the security access isolation gateway respectively through the network security monitoring device is:

[0063] The network security monitoring device performs security monitoring on the microgrid master station server through the Agent monitoring method based on the business data of the microgrid master station server;

[0064] The network security monitoring device performs security monitoring on the security access isolation gateway through a syslog monitoring method based on the business data of the security access isolation gateway.

[0065] The so-called Agent monitoring method is to install a small Agent software on the host where the monitored application is located, through which the data collection and management are realized. The Agent monitoring agent software on the market can generally realize the monitoring of the host and the application on the host on one host.

[0066] Syslog is a standard for sending and receiving notification messages in a specific format from various network devices. These messages include timestamp, event message, severity, host IP address, diagnostics, etc. In terms of its built-in severity levels, it can convey levels 0, emergency, 5, warning, system instability, severe, and a range between levels 6 and 7 (information and debugging). Moreover, Syslog is open-ended. Syslog is designed to monitor network devices and systems to send out notification messages in case of any functional issues - it also sends out alerts for pre-notified events and monitors suspicious activities through the change logs / event logs of participating network devices.

[0067] Agent is a probe deployed on the main station server. Syslog is an industrial standard protocol that can be used to record device logs. It is more convenient to use Agent and syslog to collect and monitor.

[0068] Through network security monitoring, the collection and summary forwarding of alarms from the microgrid master / slave station business servers, security equipment, and network equipment are realized, achieving all-round monitoring of the microgrid secondary system.

[0069] The application of network security monitoring devices effectively reduces the overall cost investment of microgrid security monitoring. It is also suitable for scenarios such as distributed power sources, virtual power plants, and load aggregators that require alarm information collection and aggregation and low cost.

[0070] Example 2

[0071] A microgrid full-link safety protection method, comprising:

[0072] The integrity of the secure access isolation gateway is verified through a trusted verification unit;

[0073] After the integrity verification, the business data is encrypted by the encryption unit installed in the microgrid slave server, and the microgrid slave server transmits the encrypted business data to the secure access isolation gateway through the external network. The external network side host of the secure access isolation gateway receives the encrypted business data and decrypts the encrypted business data. The reverse internal network side host of the secure access isolation gateway receives the decrypted business data and sends the decrypted business data to the microgrid master server through the first isolation component;

[0074] After integrity verification, the service data of the microgrid master server is filtered according to preset filtering rules by the forward intranet host of the secure access isolation gateway, and the filtered service data is sent to the microgrid slave server through the second isolation component;

[0075] During the data receiving or data sending process of the microgrid master station server, the microgrid master station server and the security access isolation gateway are respectively monitored for security through the network security monitoring device.

[0076] (1) The secure access isolation gateway is composed of an external network host, a reverse internal network host, a forward internal network host, a first isolation component, a second isolation component and a trusted verification unit, and the network security monitoring device is installed on the secure access isolation gateway and the microgrid master station server respectively.

[0077] The secure access isolation gateway integrates the functions of isolation components and encrypted transmission, provides a simplified networking solution, effectively reduces the networking cost and difficulty, and meets the construction requirements of the microgrid master station security access area. Only one device is required to complete the construction of the microgrid business master station security access area, which not only reduces the investment in the initial security protection construction of the microgrid, but also greatly reduces the workload of subsequent operation and maintenance.

[0078] It meets the network security protection requirements of multi-level wireless transmission and cross-security zone data interaction in microgrid scenarios, significantly improves the overall security protection capabilities of microgrids, and avoids the problem of being vulnerable to attacks when transmitting data through external networks.

[0079] (2) The first isolation component is a reverse safety isolation gateway, and the second isolation component is a forward safety isolation gateway.

[0080] (3) The specific method of encrypting the business data by the encryption unit installed on the microgrid slave server, transmitting the encrypted business data to the secure access isolation gateway of the microgrid master server through the external network, and receiving and decrypting the encrypted business data by the external network host of the secure access isolation gateway is as follows:

[0081] The encryption unit of the microgrid slave server uses the public key to encrypt the business data. The microgrid slave server transmits the encrypted business data to the secure access isolation gateway of the microgrid master server through the external network. The external network host of the secure access isolation gateway uses the private key paired with the public key to decrypt the encrypted business data.

[0082] (4) The reverse intranet host of the secure access isolation gateway is also used to convert the format of business data. The specific method is as follows:

[0083] The reverse intranet-side host converts the format of the decrypted business data into the format of e-text.

[0084] (5) The preset filtering rules are preset based on the data source address, destination address, port number, network protocol or application layer protocol type, and user identity.

[0085] (6) The specific method of performing integrity verification on the secure access isolation gateway by the trusted verification unit is:

[0086] Before the operating system of the secure access isolation gateway is started, the trusted verification unit measures whether the general hardware and firmware, the master boot area, and the kernel have been tampered with;

[0087] When the operating system of the secure access isolation gateway is started, measure whether the Bootloader, master boot area, and kernel have been tampered with;

[0088] After the operating system of the secure access isolation gateway is started, the trusted verification unit measures whether its own trusted driver module has been tampered with;

[0089] Start the trusted software base in the operating system of the secure access isolation gateway to measure whether the trusted software base has been tampered with;

[0090] Measure whether the application has been tampered with in the operating system of the secure access isolation gateway;

[0091] The measurement is defined as comparing a preset whitelist with the object to be measured. If the object to be measured is inconsistent with the preset whitelist, it is determined that the object to be measured has been tampered with, otherwise the object to be measured has not been tampered with. The preset whitelist includes all objects to be measured and their complete files.

[0092] Through trusted verification, the basic computing and operating environment of the secure access isolation gateway device is ensured to be trustworthy, and the computing components in the secure access isolation gateway are protected from malicious tampering. A defense mechanism against malicious code attacks is established from the root, improving the boundary protection capabilities of the microgrid master station.

[0093] (7) The specific method of performing security monitoring on the microgrid master station server and the security access isolation gateway respectively through the network security monitoring device is:

[0094] The network security monitoring device performs security monitoring on the microgrid master station server through the Agent monitoring method based on the business data of the microgrid master station server;

[0095] The network security monitoring device performs security monitoring on the security access isolation gateway through a syslog monitoring method based on the business data of the security access isolation gateway.

[0096] The so-called Agent monitoring method is to install a small Agent software on the host where the monitored application is located, through which the data collection and management are realized. The Agent monitoring agent software on the market can generally realize the monitoring of the host and the application on the host on one host.

[0097] Syslog is a standard for sending and receiving notification messages in a specific format from various network devices. These messages include timestamp, event message, severity, host IP address, diagnostics, etc. In terms of its built-in severity levels, it can convey levels 0, emergency, 5, warning, system instability, severe, and a range between levels 6 and 7 (information and debugging). Moreover, Syslog is open-ended. Syslog is designed to monitor network devices and systems to send out notification messages in case of any functional issues - it also sends out alerts for pre-notified events and monitors suspicious activities through the change logs / event logs of participating network devices.

[0098] Agent is a probe deployed on the main station server. Syslog is an industrial standard protocol that can be used to record device logs. It is more convenient to use Agent and syslog to collect and monitor.

[0099] Through network security monitoring, the collection and summary forwarding of alarms from the microgrid master / slave station business servers, security equipment, and network equipment are realized, achieving all-round monitoring of the microgrid secondary system.

[0100] The application of network security monitoring devices effectively reduces the overall cost investment of microgrid security monitoring. It is also suitable for scenarios such as distributed power sources, virtual power plants, and load aggregators that require alarm information collection and aggregation and low cost.

[0101] Example 3

[0102] A computer program product includes a computer program / instruction, which, when executed by a processor, implements the microgrid full-link safety protection method in Example 2.

[0103] The contents not described in detail in this specification belong to the prior art known to those skilled in the art. It should be understood by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0104] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0105] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0106] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0107] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit its protection scope. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the field should understand that after reading the present invention, those skilled in the art can still make various changes, modifications or equivalent substitutions to the specific implementation methods of the invention, but these changes, modifications or equivalent substitutions are all within the protection scope of the pending claims of the invention.

Claims

1. A microgrid full-link safety protection system, characterized in that: include: A trusted verification module, used to verify the integrity of the secure access isolation gateway through a trusted verification unit; A data receiving module for a microgrid master server is used to encrypt business data through an encryption unit installed on a microgrid slave server after integrity verification, and the microgrid slave server transmits the encrypted business data to a secure access isolation gateway through an external network, and a host on the external network side of the secure access isolation gateway receives the encrypted business data and decrypts the encrypted business data, and a host on the reverse internal network side of the secure access isolation gateway receives the decrypted business data and sends the decrypted business data to the microgrid master server through a first isolation component; The microgrid master station server data sending module is used to filter the business data of the microgrid master station server according to preset filtering rules through the forward intranet host of the secure access isolation gateway after integrity verification, and send the filtered business data to the microgrid slave station server through the second isolation component; The network security monitoring module is used to perform security monitoring on the microgrid master station server and the security access isolation gateway respectively through the network security monitoring device during the data reception or data transmission process of the microgrid master station server.

2. The microgrid full-link safety protection system according to claim 1 is characterized in that: The secure access isolation gateway is composed of an external network side host, a reverse internal network side host, a forward internal network side host, a first isolation component, a second isolation component and a trusted verification unit, and the network security monitoring device is respectively installed on the secure access isolation gateway and the microgrid master station server.

3. The microgrid full-link safety protection system according to claim 1 is characterized in that: The first isolation component is a reverse safety isolation network gate, and the second isolation component is a forward safety isolation network gate.

4. The microgrid full-link safety protection system according to claim 1 is characterized in that: In the data receiving module of the microgrid master server, the business data is encrypted by the encryption unit installed in the microgrid slave server, and the microgrid slave server transmits the encrypted business data to the secure access isolation gateway of the microgrid master server through the external network. The external network side host of the secure access isolation gateway receives the encrypted business data and decrypts it. The specific method is: The encryption unit of the microgrid slave server uses the public key to encrypt the business data. The microgrid slave server transmits the encrypted business data to the secure access isolation gateway of the microgrid master server through the external network. The external network host of the secure access isolation gateway uses the private key paired with the public key to decrypt the encrypted business data.

5. The microgrid full-link safety protection system according to claim 1 is characterized in that: In the data receiving module of the microgrid master server, the reverse intranet host of the secure access isolation gateway is also used to convert the format of the business data. The specific method is as follows: The reverse intranet-side host converts the format of the decrypted business data into the electric e language format.

6. The microgrid full-link safety protection system according to claim 1 is characterized in that: In the data sending module of the microgrid master station server, the preset filtering rules are preset based on the data source address, destination address, port number, network protocol or application layer protocol type, and user identity.

7. The microgrid full-link safety protection system according to claim 1 is characterized in that: In the trusted verification module, the specific method of performing integrity verification on the secure access isolation gateway through the trusted verification unit is: Before the operating system of the secure access isolation gateway is started, the trusted verification unit measures whether the general hardware and firmware, the master boot area, and the kernel have been tampered with; When the operating system of the secure access isolation gateway is started, measure whether the Bootloader, master boot area, and kernel have been tampered with; After the operating system of the secure access isolation gateway is started, the trusted verification unit measures whether its own trusted driver module has been tampered with; Start the trusted software base in the operating system of the secure access isolation gateway to measure whether the trusted software base has been tampered with; Measure whether the application has been tampered with in the operating system of the secure access isolation gateway; The measurement is defined as comparing a preset whitelist with the object to be measured. If the object to be measured is inconsistent with the preset whitelist, it is determined that the object to be measured has been tampered with, otherwise the object to be measured has not been tampered with. The preset whitelist includes all objects to be measured and their complete files.

8. The microgrid full-link safety protection system according to claim 1 is characterized by: In the network security monitoring module, the specific method of performing security monitoring on the microgrid master station server and the secure access isolation gateway respectively through the network security monitoring device is: The network security monitoring device performs security monitoring on the microgrid master station server through the Agent monitoring method based on the business data of the microgrid master station server; The network security monitoring device performs security monitoring on the security access isolation gateway through a syslog monitoring method based on the business data of the security access isolation gateway.

9. A microgrid full-link safety protection method, characterized in that: include: The integrity of the secure access isolation gateway is verified through a trusted verification unit; After the integrity verification, the business data is encrypted by the encryption unit installed in the microgrid slave server, and the microgrid slave server transmits the encrypted business data to the secure access isolation gateway through the external network. The external network side host of the secure access isolation gateway receives the encrypted business data and decrypts the encrypted business data. The reverse internal network side host of the secure access isolation gateway receives the decrypted business data and sends the decrypted business data to the microgrid master server through the first isolation component; After integrity verification, the service data of the microgrid master server is filtered according to preset filtering rules by the forward intranet host of the secure access isolation gateway, and the filtered service data is sent to the microgrid slave server through the second isolation component; During the data receiving or data sending process of the microgrid master station server, the microgrid master station server and the security access isolation gateway are respectively monitored for security through the network security monitoring device.

10. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by the processor, the microgrid full-link safety protection method described in claim 9 is implemented.

Images