Power monitoring dispatching master station system network security protection deployment structure

Abstract

The invention discloses a network security protection deployment structure of a power monitoring and dispatching master station system, and belongs to the field of network security. The system mainly comprises a control area, a non-control area, a management information large area and a network security management platform, other network security protection equipment is deployed and perfected on the basis of performing network boundary protection on the power monitoring and dispatching master station system, and a brand new network security protection deployment structure of the power monitoring and dispatching master station system is formed. And boundary protection is transited to whole-process protection.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to a network security protection deployment structure of a power monitoring and dispatching master station system. Background Art

[0002] With the popularization of power monitoring systems and the continuous expansion of their application scope, the security issues of the system have received more and more attention. In order to ensure the safe and reliable operation of the power monitoring system, we need to develop a complete set of security protection plans and security strategies. According to the overall protection requirements, first of all, we need to conduct a comprehensive risk assessment of the power monitoring system, determine the various security threats faced by the system, formulate corresponding security plans, and establish a complete security management mechanism and emergency response mechanism. Secondly, we need to strictly control access to the power monitoring system to ensure that only authorized personnel can access the system. A variety of identity authentication methods such as password authentication and fingerprint recognition can be used to ensure the security of the system. At the same time, it is necessary to conduct regular security audits and vulnerability scans on the system to promptly discover and patch security vulnerabilities in the system to ensure the continuous and stable operation of the system. Finally, it is necessary to strengthen the protection of system data, establish a data backup and recovery mechanism, and ensure that data can be quickly restored when attacked or accidentally lost. In short, the security protection of the power monitoring system is a comprehensive project that requires comprehensive consideration of the security, reliability and stability of the system, and takes a variety of measures for comprehensive protection. Only by establishing a complete security protection plan and security strategy can the safe and stable operation of the power monitoring system be guaranteed.

[0003] The physical boundaries and security deployment of traditional power monitoring and dispatching automation systems are as follows: Figure 1 As shown, the functions of data collection, monitoring, control and security analysis are realized for the real-time power system. However, the traditional power monitoring and dispatching automation system focuses on the network boundary protection of the main station system, lacks protection for other network security equipment, and does not involve the full process protection of the power monitoring system. Summary of the invention

[0004] The purpose of the present invention is to overcome the problems existing in the prior art and to provide a network security protection deployment structure for a power monitoring and dispatching master station system.

[0005] The objective of the present invention is achieved through the following technical solutions:

[0006] Provided is a network security protection deployment structure of a power monitoring and dispatching master station system, including a control area, a non-control area, a management information area and a network security management platform. The deployment structure of the control area includes:

[0007] In terms of network security protection equipment, configure the zone 1 operation and maintenance gateway, zone 1 intrusion detection, zone 1 security audit, zone 1 log audit, zone 1 type I network security monitoring device and zone 1 malicious code monitoring device in the network; in terms of business protection, configure the network extension firewall in the extended business, configure the forward and reverse security isolation device in the public network business, and configure the vertical encryption authentication device in the vertical business of the dispatching data network; in terms of the switch network, access the network security management platform and various network security protection devices; in terms of other server groups in the system, deploy probes to access the network security management platform, deploy trusted verification nodes at key nodes, and deploy malicious code client software at the same time;

[0008] The deployment structure of the non-controlled area includes:

[0009] In terms of network security protection equipment, the network is equipped with the Zone 2 operation and maintenance gateway, Zone 2 intrusion detection, Zone 2 security audit, Zone 2 log audit, production control zone situation awareness module, production control zone unified management platform, Zone 2 Type I network security monitoring device, production control zone trusted verification management module, Zone 2 malicious code monitoring device, trusted verification management center and malicious code management center, and the network security management platform is deployed in an independent network inside the secure non-control area; in terms of business protection, vertical encryption authentication devices are configured in the vertical business of the dispatching data network; in terms of the switch network, access to the network security management platform and open mirror ports to access various network security protection devices; in terms of other server groups in the system, probes are deployed to access the network security management platform, and trusted verification nodes are deployed at key nodes, and malicious code client software is deployed at the same time;

[0010] The deployment structure of the management information area includes:

[0011] In terms of network security protection equipment, three-zone operation and maintenance gateways, three-zone intrusion detection, three-zone security audit, three-zone log audit, management information zone situation awareness module, management information zone unified management platform, three-zone full-flow threat probes, three-zone type I network security monitoring devices, trusted verification modules and three-zone malicious code monitoring devices are configured in the network; in terms of business protection, access and firewalls are configured in the vertical business of the management network, and firewalls are configured in the publishing business; in terms of switch network, access to the network security management platform and open mirror ports to access various network security protection devices; in terms of other server groups in the system, probes are deployed to access the network security management platform, and trusted verification nodes are deployed at key nodes, and malicious code client software is deployed at the same time;

[0012] It also includes: deploying forward and reverse safety isolation devices at the lateral boundaries between the management information area and the control area and / or non-control area.

[0013] In some possible embodiments, the network security management platform is accessed through syslog logs.

[0014] In some possible embodiments, the three-zone full-flow threat probe is deployed at a bypass of a core switch in a management information zone.

[0015] In some possible embodiments, the production control area situation awareness module is deployed at a bypass of a core switch in a non-control area, and the management information area situation awareness module is deployed at a bypass of a core switch in a management information area.

[0016] In some possible embodiments, the firewall in the control area is deployed in series between the control area main switch and the network extension service switch.

[0017] In some possible embodiments, the log audit is deployed in a stand-alone manner, and the log information of the device objects is collected through a built-in log collector and normalized, analyzed, and centrally stored.

[0018] In some possible embodiments, the security audit bypasses the core switches of the control area, non-control area and management information area, and monitors the full flow data of the power monitoring system network through flow mirroring.

[0019] In some possible embodiments, the production control zone trusted verification management module independently manages the trusted verification nodes in different zones and connects the operating status and alarm information to the network security management platform.

[0020] In some possible embodiments, the malicious code monitoring device includes a client, a client management module, a network traffic monitoring and collection device, and a malicious code analysis module.

[0021] In some possible embodiments, the Type I network security monitoring device is deployed in the local area network of the power monitoring system to collect network security information of the monitored object, upload events to the network security management platform and provide service agent functions.

[0022] It should be further explained that the technical features corresponding to the above options can be combined or replaced with each other to form a new technical solution if there is no conflict.

[0023] Compared with the prior art, the present invention has the following beneficial effects:

[0024] On the basis of doing a good job in network boundary protection of the electric power monitoring and dispatching main station system, the present invention deploys and improves other network security protection equipment, forming a new network security protection deployment structure of the electric power monitoring and dispatching main station system, and transitioning from boundary protection to full-process protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1The physical boundary and security deployment structure of a traditional electric power monitoring and dispatching automation system shown in an embodiment of the present invention;

[0026] Figure 2 A network security protection deployment structure of a power monitoring and dispatching master station system is shown in an embodiment of the present invention. DETAILED DESCRIPTION

[0027] The technical solution of the present invention is clearly and completely described below in conjunction with the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all of the embodiments. The components of the embodiments of the present application described and shown in the accompanying drawings can be arranged and designed in various configurations. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0028] It should be noted that the defects existing in the solutions in the above-mentioned prior art are the results obtained by the inventor after practice and careful research. Therefore, the discovery process of the above-mentioned problems and the solutions proposed in the embodiments of the present application for the above-mentioned problems below should all be the contributions made by the inventor to the present application in the process of invention and creation, and should not be understood as technical contents known to technical personnel in this field.

[0029] In view of the technical problems pointed out in the background technology, the embodiments provided by the present invention are as follows:

[0030] Reference Figure 2 In an exemplary embodiment, a network security protection deployment structure of a power monitoring and dispatching master station system is provided, including a control area (security zone I), a non-control area (security zone II), a management information area, and a network security management platform. Among them, the control area and the non-control area are collectively referred to as the production control area, and the management information area includes the production management area (zone three in the figure, also called security zone III) and the management information area (zone four, the information intranet in the figure is the four-zone network).

[0031] The deployment structure of the control area includes:

[0032] In terms of network security protection equipment, configure the zone 1 operation and maintenance gateway, zone 1 intrusion detection, zone 1 security audit, zone 1 log audit, zone 1 type I network security monitoring device and zone 1 malicious code monitoring device (collection device and management module) in the network;

[0033] In terms of business protection, a network extension firewall is configured in the extended business, a forward and reverse security isolation device is configured in the public network business, and a vertical encryption authentication device is configured in the vertical business of the dispatching data network;

[0034] In terms of switch network, the first is to access the syslog log to the network security management platform, and the second is to open the mirror port to access various network security protection devices;

[0035] In terms of other server groups in the system, one is to deploy probes to access the network security management platform, two is to deploy trusted verification nodes at key nodes, and three is to deploy malicious code client software;

[0036] The deployment structure of the non-controlled area includes:

[0037] In terms of network security protection equipment, the network is equipped with Zone 2 operation and maintenance gateway, Zone 2 intrusion detection, Zone 2 security audit, Zone 2 log audit, production control zone situation awareness module (directly connected to Zone 2 network and connected to Zone 1 network through firewall), production control zone unified management platform (directly manage Zone 2 network security equipment and manage Zone 1 network security equipment through firewall), Zone 2 Type I network security monitoring device, production control zone trusted verification management module, Zone 2 malicious code monitoring device (collection device, management module and analysis module), trusted verification management center and malicious code management center, and the network security management platform is deployed in an independent network within the secure non-control area;

[0038] In terms of business protection, vertical encryption and authentication devices are configured in the vertical business of the dispatching data network;

[0039] In terms of switch network, the first is to access the syslog log to the network security management platform, and the second is to open the mirror port to access various network security protection devices;

[0040] In terms of other server groups in the system, one is to deploy probes to access the network security management platform, two is to deploy trusted verification nodes at key nodes, and three is to deploy malicious code client software;

[0041] The deployment structure of the management information area includes:

[0042] In terms of network security protection equipment, three-zone operation and maintenance gateway, three-zone intrusion detection, three-zone security audit, three-zone log audit, management information zone situation awareness module, management information zone unified management platform, three-zone full-flow threat probe, three-zone type I network security monitoring device, trusted verification module and three-zone malicious code monitoring device (collection device, management module and analysis module) are configured in the network;

[0043] In terms of business protection, access and firewalls are configured in the vertical business of the management network, and firewalls in zones 3 and 4 are configured in the services released in zones 3 and 4;

[0044] In terms of switch network, the first is to access the syslog log to the network security management platform, and the second is to open the mirror port to access various network security protection devices;

[0045] In terms of other server groups in the system, one is to deploy probes to access the network security management platform, two is to deploy trusted verification nodes at key nodes, and three is to deploy malicious code client software;

[0046] Furthermore, the structure also includes cross-zone interconnection, and forward and reverse safety isolation devices are deployed at the lateral boundaries between the management information area and the production control area (control area and non-control area), specifically between areas I and III and between areas II and III.

[0047] Furthermore, the following content describes the specific deployment methods of each network security protection device.

[0048] 1. Full-flow threat probe

[0049] The full-flow threat probe integrates IDS, WAF, threat intelligence and full-flow behavior logs, and can quickly and accurately detect threats. It can judge and analyze threats and use its own strategies to block attackers, greatly improving the response speed of major events.

[0050] Deployment method:

[0051] Deploy full-flow threat probes in bypass mode on the core switch of security zone III. Collect, monitor, and summarize full-flow data of zone III network through traffic mirroring and upload it to the situation awareness platform.

[0052] 2. Unified security management platform

[0053] The unified security management platform is an important tool for security equipment maintenance and security operation and maintenance management. It is suitable for various security operation and maintenance scenarios such as security equipment maintenance, threat management, and full life cycle management of virtual devices in a "cloud computing" environment.

[0054] Deployment Mode:

[0055] A unified security management platform is deployed in bypass of the core switches in security zones II and III to manage all network security protection devices in zones II and III. Log in to the management center to access the platform and distinguish different management responsibilities through system permission settings.

[0056] 3. Situational Awareness Module

[0057] Situational awareness collects data from various IT equipment in the system from the perspective of power monitoring system security, including business equipment log collection, security equipment event collection, network traffic data collection, security equipment configuration collection, etc. The platform uniformly analyzes and displays the collected results, discovers abnormal behaviors within the network, such as new assets, time anomalies, new relationships, load changes, abnormal access, etc., and realizes early warning and response to on-site security incidents.

[0058] Deployment Mode:

[0059] A situation awareness system is deployed in bypass mode on the core switches in security zones II and III. By linking intrusion detection, security auditing, log auditing, full-flow threat probes and other equipment in security zones I, II and III, configuration data is uploaded to the situation awareness platform. Users can log in to the platform's interactive interface through a browser and perform various management operations based on corresponding permissions.

[0060] 4. Firewall

[0061] The firewall is designed to meet the needs of network boundary isolation and security protection of power monitoring systems, and is designed to fully respond to traditional network attacks and power Internet threats for power monitoring system networks. It adopts a single-channel parallel processing architecture, and when the network data packets of the power monitoring system are disassembled at one time, it can not only realize the in-depth analysis of various application protocols (MQTT, Modbus, OPC, http, etc.), but also realize virus detection, intrusion protection, access control and other functions simultaneously.

[0062] Deployment Mode:

[0063] Deployed in series between safety zone I and safety zone II.

[0064] Deployed in series between safety zone III and safety zone IV.

[0065] Deployed in series between the main switch in Zone I and the network extension service switch.

[0066] 5. Log audit system

[0067] The log audit system is a comprehensive log management platform based on big data architecture. It realizes the full life cycle management of logs through innovative technologies such as massive log collection, normalization of heterogeneous device logs, and security event correlation analysis. It assists operation and maintenance personnel in monitoring network security events from multiple dimensions such as before (discovering security risks), during (analysis and tracing), and after (investigation and evidence collection), and helps the power monitoring system meet the requirements of the Cybersecurity Law and security compliance.

[0068] Deployment method:

[0069] Adopting the single-machine deployment mode, in the security zones I, II, and III, the log audit system is deployed in the bypass of the core switch. Its built-in log collector can collect the log information of the device objects and perform normalized processing, analysis, and centralized storage, etc. Users can log in to the interactive interface of the log audit system through a browser and perform various management operations according to the corresponding permissions.

[0070] 6. Security audit system

[0071] In-depth analysis of various protocols used in power monitoring systems and conduct security audits.

[0072] Deployment Mode:

[0073] It is deployed in security zones I, II, and III, and is bypassed to the core switches in each security zone. It monitors the full flow data of the power monitoring system network through traffic mirroring. It does not actively send packets, and has "no disturbance and zero risk" to the system without making any modifications to the network.

[0074] 7. Intrusion Detection System

[0075] The intrusion detection system can effectively detect possible attacks on the power monitoring system, and provide operation and maintenance personnel with a set of visual detection results suitable for the business characteristics of the power grid from three angles: pre-warning, in-process protection, and post-event evidence collection, thereby improving the safety of production operations.

[0076] Deployment method:

[0077] Deployed in security zones I, II, and III, it is bypassed to the core switches in each security zone, and controls the security of control system traffic through unidirectional mirroring to detect potential attacks and abnormal behaviors.

[0078] 8. Trusted Verification

[0079] The trusted verification architecture of the power monitoring system is mainly composed of a trusted verification module and a trusted verification management module. The trusted verification module is deployed on the trusted verification node and consists of a trusted root and a trusted software base. The trusted root should provide cryptographic support and policy protection functions; the trusted software base implements trusted verification of the operating system boot program, system program, application program, and important configuration parameters, and also has functions such as trusted auditing, version management, module self-protection, and local configuration management. The trusted verification management module implements centralized node management, policy management, and audit management of multiple trusted verification nodes.

[0080] Deployment method:

[0081] Trusted verification module nodes are deployed in security zones I, II, and III respectively, and are uniformly managed by the trusted verification management module. A set of trusted verification management modules is deployed in security zone II to achieve independent management of trusted verification nodes in different security areas and connect the operating status and alarm information to the network security management platform of the power monitoring system.

[0082] 9. Malicious code monitoring

[0083] The malicious code monitoring system consists of four parts: client, client management module, network traffic monitoring and collection device, and malicious code analysis module. The client has monitoring, disposal, and management functions; the client management module has policy issuance, multi-level management, and feature library update functions; the network traffic monitoring and collection device has the functions of collecting network traffic from the bypass and analyzing and identifying malicious code; the malicious code analysis module has the functions of feature library update, monitoring and analysis of known and unknown malicious codes, alarm, and audit.

[0084] Deployment method:

[0085] Anti-malicious code client software is deployed on the hosts in security zones I, II, and III, and they are managed uniformly by the malicious code client management module. A set of malicious code client management modules is deployed in each of security zones I, II, and III to achieve independent management of malicious code clients in different security partitions. A set of network traffic malicious code monitoring and collection devices is deployed in each of security zones I, II, and III to collect mirrored traffic of the LAN and data network. A set of malicious code analysis modules is deployed in each of security zones II and III to collect events, alarms, logs, and other information generated by the anti-malicious code client management modules and network traffic malicious code monitoring and collection devices in the production control zone and zone III, and to send corresponding security events to the network security management platform, while being managed and controlled by the network security management platform.

[0086] 10. Operation and maintenance gateway

[0087] The operation and maintenance gateway realizes accurate pre-identification, fine in-process control and precise post-audit, and establishes a centralized and proactive operation and maintenance security management and control mode for users. The operation and maintenance management and control has functions such as account management, authentication management, authorization management, behavior control, authentication login information recording, file transfer function, authorization behavior and record report, etc.

[0088] Deployment method:

[0089] The operation and maintenance gateway is deployed in the dispatching master station security zone I, zone II, and zone III, and cuts off the direct access between the operation and maintenance workstation and the operation and maintenance object on the network through the protocol proxy. A data integration channel is established between the operation and maintenance gateway of each security zone and the type I network security monitoring device; the security alarm, operation and maintenance record and other information of the operation and maintenance gateway are sent to the network security management platform.

[0090] 11. Network security management platform and type I network security monitoring device

[0091] The network security management platform consists of functions such as security verification, security monitoring, security alarm, security audit, and security analysis. It can conduct real-time monitoring and online management of security risks and security incidents in the power monitoring system.

[0092] Type I network security monitoring device is deployed in the local area network of the power monitoring system to collect network security information of the monitored object, upload events to the network security management platform and provide service agent functions.

[0093] Deployment method:

[0094] The network security management platform adopts the deployment mode of independent networking inside the security zone II on the main station side. One type I network security monitoring device is deployed in each of the security zones I, II, and III on the main station side. One device in each security zone operates independently and is responsible for collecting the relevant operation information, operation information, alarm information, etc. of the host equipment, network equipment (switches), security equipment, and database in their respective intranet areas and forwarding them to the management platform. Among them, after receiving the data, the type I network security monitoring device deployed in the security zones I and II sends it to the management platform of the security zone II through the intranet address; the type I network security monitoring device deployed in the security zone III forms the received data into a file that complies with the reverse isolation transmission, and forwards the collected alarm information to the platform server of zone II through the reverse isolation device.

[0095] 12. Forward and reverse safety isolation device and longitudinal encryption authentication device

[0096] In accordance with the requirements of the "Overall Plan for the Security Protection of Electric Power Monitoring Systems" and its supporting "Security Protection Plan for Monitoring Systems of Local Dispatching Centers" for local-level dispatching, forward and reverse safety isolation devices and vertical encryption authentication devices are important network security protection equipment for border protection.

[0097] Deployment method:

[0098] Positive and negative safety isolation devices are deployed at the horizontal boundaries between the production control area and the management information area, specifically between areas I and III and between areas II and III. Vertical encryption authentication devices are deployed at the vertical boundaries between the control area and the non-control area, specifically for the vertical services of the real-time subnet and non-real-time subnet of the dispatching data network.

[0099] The above specific implementation methods are detailed descriptions of the present invention. It cannot be determined that the specific implementation methods of the present invention are limited to these descriptions. For ordinary technicians in the technical field to which the present invention belongs, several simple deductions and substitutions can be made without departing from the concept of the present invention, which should be regarded as belonging to the protection scope of the present invention.

Claims

1. A network security protection deployment structure of a power monitoring and dispatching master station system, including a control area, a non-control area, a management information area and a network security management platform, characterized in that: The deployment structure of the control area includes: In terms of network security protection equipment, configure the zone 1 operation and maintenance gateway, zone 1 intrusion detection, zone 1 security audit, zone 1 log audit, zone 1 type I network security monitoring device and zone 1 malicious code monitoring device in the network; in terms of business protection, configure the network extension firewall in the extended business, configure the forward and reverse security isolation device in the public network business, and configure the vertical encryption authentication device in the vertical business of the dispatching data network; in terms of the switch network, access the network security management platform and various network security protection devices; in terms of other server groups in the system, deploy probes to access the network security management platform, deploy trusted verification nodes at key nodes, and deploy malicious code client software at the same time; The deployment structure of the non-controlled area includes: In terms of network security protection equipment, the network is equipped with the Zone 2 operation and maintenance gateway, Zone 2 intrusion detection, Zone 2 security audit, Zone 2 log audit, production control zone situation awareness module, production control zone unified management platform, Zone 2 Type I network security monitoring device, production control zone trusted verification management module, Zone 2 malicious code monitoring device, trusted verification management center and malicious code management center, and the network security management platform is deployed in an independent network inside the secure non-control area; in terms of business protection, vertical encryption authentication devices are configured in the vertical business of the dispatching data network; in terms of the switch network, access to the network security management platform and open mirror ports to access various network security protection devices; in terms of other server groups in the system, probes are deployed to access the network security management platform, and trusted verification nodes are deployed at key nodes, and malicious code client software is deployed at the same time; The deployment structure of the management information area includes: In terms of network security protection equipment, three-zone operation and maintenance gateways, three-zone intrusion detection, three-zone security audit, three-zone log audit, management information zone situation awareness module, management information zone unified management platform, three-zone full-flow threat probes, three-zone type I network security monitoring devices, trusted verification modules and three-zone malicious code monitoring devices are configured in the network; in terms of business protection, access and firewalls are configured in the vertical business of the management network, and firewalls are configured in the publishing business; in terms of switch network, access to the network security management platform and open mirror ports to access various network security protection devices; in terms of other server groups in the system, probes are deployed to access the network security management platform, and trusted verification nodes are deployed at key nodes, and malicious code client software is deployed at the same time; It also includes: deploying forward and reverse safety isolation devices at the lateral boundaries between the management information area and the control area and / or non-control area.

2. According to claim 1, the network security protection deployment structure of the power monitoring and dispatching master station system is characterized in that: Access the network security management platform through syslog logs.

3. The network security protection deployment structure of the power monitoring and dispatching master station system according to claim 1 is characterized in that: The three-zone full-flow threat probe is deployed at the bypass of the core switch in the management information zone.

4. The network security protection deployment structure of the power monitoring and dispatching master station system according to claim 1 is characterized in that: The production control area situation awareness module is deployed at the bypass of the core switch of the non-control area, and the management information area situation awareness module is deployed at the bypass of the core switch of the management information area.

5. The network security protection deployment structure of the power monitoring and dispatching master station system according to claim 1 is characterized in that: The firewall in the control area is deployed in series between the control area main switch and the network extension service switch.

6. The network security protection deployment structure of the power monitoring and dispatching master station system according to claim 1 is characterized in that: The log audit adopts a single-machine deployment mode, collects the log information of the device objects through the built-in log collector, and performs normalized processing, analysis and centralized storage.

7. The network security protection deployment structure of the power monitoring and dispatching master station system according to claim 1 is characterized in that: The security audit is bypassed to the core switches of the control area, non-control area and management information area, and monitors the full flow data of the power monitoring system network through flow mirroring.

8. The network security protection deployment structure of the power monitoring and dispatching master station system according to claim 1 is characterized in that: The production control zone trusted verification management module independently manages the trusted verification nodes in different zones and connects the operating status and alarm information to the network security management platform.

9. The network security protection deployment structure of the power monitoring and dispatching master station system according to claim 1 is characterized in that: The malicious code monitoring device includes a client, a client management module, a network traffic monitoring and collection device, and a malicious code analysis module.

10. The network security protection deployment structure of the power monitoring and dispatching master station system according to claim 1 is characterized in that: The Type I network security monitoring device is deployed in the local area network of the power monitoring system to collect network security information of the monitored object, upload events to the network security management platform and provide service agent functions.

Images