Data scheduling method and system based on power network

Abstract

The invention discloses a data scheduling method and system based on a power network. The invention aims to ensure the safety and stability of an electric power monitoring system through the rectification and optimization of a centralized system. The method comprises the following steps: adding a firewall device and an IDS intrusion detection device in a production control region, refining an access control strategy according to an actual network service condition, and detecting network intrusion. According to the method, the security of the power network can be effectively improved, network attacks and data leakage are prevented, and a powerful technical guarantee is provided for stable operation of a power system.

Description

Technical Field

[0001] The present invention relates to the technical field of electric power monitoring network, and in particular to a data dispatching method and system based on an electric power network. Background Art

[0002] With the rapid development of power systems, power monitoring systems play an increasingly important role in ensuring power supply and stable operation of power grids. However, due to its criticality and complexity, power monitoring systems face severe network security challenges. Traditional power monitoring systems usually lack effective network security protection measures, making the system vulnerable to external attacks and internal threats, thus affecting the safe and stable operation of the power system.

[0003] In the existing power monitoring system, key components such as UPS power supply system, network security isolation system, dispatching data network dual network system, log audit system, etc. often operate independently, lacking effective centralized management and dynamic configuration capabilities. This makes it difficult for the system to respond and adjust quickly in the face of complex and changing network threats, thus failing to meet the increasingly stringent network security requirements. Summary of the invention

[0004] Based on this, the embodiment of the present application provides a data dispatching method and system based on the power network, which can realize the centralized management and dynamic optimization of the power monitoring system by adding firewall devices and IDS intrusion detection devices in the production control area, combining the actual network business situation, and refining the key attributes such as access control strategies and service ports. This method can effectively improve the network security protection capability of the power monitoring system and ensure the safe and stable operation of the power system.

[0005] In a first aspect, a data scheduling method based on a power network is provided, the method comprising:

[0006] Analyze the current network architecture and business requirements of the power network system, and determine the number and location of additional firewall devices and IDS intrusion detection devices, including defining service ports, source addresses, and destination addresses;

[0007] Deploy firewall devices and IDS intrusion detection devices, set firewall rules to control data flow between different network areas, and configure IDS intrusion detection devices after deployment;

[0008] Conduct systematic testing to verify the security and stability of the power network system, including testing of firewalls and IDS intrusion detection devices.

[0009] Optionally, define the service port, source address, and destination address, including:

[0010] One or more port numbers are usually assigned to each network service or application to identify and distinguish different network traffic; among them, HTTP service port 80, HTTPS service port 443;

[0011] It is necessary to formulate a detailed access control list based on business needs to determine the accessible destination addresses and service ports.

[0012] Optionally, deploying a firewall device specifically includes:

[0013] Configure the IP address and subnet mask of the firewall, and configure access control rules to limit network access rights.

[0014] Optionally, setting firewall rules specifically includes:

[0015] Define the source address, destination address, and service port;

[0016] Set up security zones, divide different interfaces into different security zones, and define access policies between zones;

[0017] Configure the session table and server-map to record the connection status and handle traffic forwarding for special protocols.

[0018] Optionally, configure an IDS intrusion detection device, specifically including:

[0019] Set up monitoring interfaces, define detection strategies, configure alarm thresholds, and select alarm methods;

[0020] Configure the engine interface, enable the data audit function, and set the monitoring interface. At the same time, configure traffic alarm, policy configuration, filtering configuration, and content detection;

[0021] Configure the management interface, including the management IP address, gateway, and DNS server address to ensure that the IDS device can properly communicate with other devices on the network.

[0022] In a second aspect, a data dispatching system based on a power network is provided, the system comprising:

[0023] A determination module is used to analyze the current network architecture and business requirements of the power network system, and determine the number and location of new firewall devices and IDS intrusion detection devices, including defining service ports, source addresses, and destination addresses;

[0024] A configuration module, used to deploy firewall devices and IDS intrusion detection devices, set firewall rules to control data flow between different network areas after deployment, and configure the IDS intrusion detection device;

[0025] The test module is used to conduct system tests to verify the security and stability of the power network system, including tests on firewalls and IDS intrusion detection devices.

[0026] Optionally, define the service port, source address, and destination address, including:

[0027] One or more port numbers are usually assigned to each network service or application to identify and distinguish different network traffic; among them, HTTP service port 80, HTTPS service port 443;

[0028] It is necessary to formulate a detailed access control list based on business needs to determine the accessible destination addresses and service ports.

[0029] Optionally, deploying a firewall device specifically includes:

[0030] Configure the IP address and subnet mask of the firewall, and configure access control rules to limit network access rights.

[0031] Optionally, setting firewall rules specifically includes:

[0032] Define the source address, destination address, and service port;

[0033] Set up security zones, divide different interfaces into different security zones, and define access policies between zones;

[0034] Configure the session table and server-map to record the connection status and handle traffic forwarding for special protocols.

[0035] Optionally, configure an IDS intrusion detection device, specifically including:

[0036] Set up monitoring interfaces, define detection strategies, configure alarm thresholds, and select alarm methods;

[0037] Configure the engine interface, enable the data audit function, and set the monitoring interface. At the same time, configure traffic alarm, policy configuration, filtering configuration, and content detection;

[0038] Configure the management interface, including the management IP address, gateway, and DNS server address to ensure that the IDS device can properly communicate with other devices on the network.

[0039] The beneficial effects brought by the technical solution provided by the embodiment of the present application include at least:

[0040] (1) By deploying firewall devices and IDS intrusion detection devices, network traffic can be effectively monitored and controlled to prevent unauthorized access and various network attacks, thereby improving the security and stability of the power network. This multi-level security protection measure can provide a more reliable network environment for the power system and ensure the security of critical information infrastructure.

[0041] (2) By optimizing the network architecture and configuration, such as setting up a UPS power supply system to ensure the uninterrupted operation of key equipment, the risk of power system interruption caused by network failure can be reduced. At the same time, by refining the access control strategy and service port configuration, the reliability and stability of the network can be improved, ensuring the continuity and accuracy of the power monitoring system and data scheduling. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the implementation methods of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for the implementation methods or the description of the prior art. Obviously, the drawings in the following description are only exemplary, and for ordinary technicians in this field, other implementation drawings can be derived from the provided drawings without creative work.

[0043] Figure 1 A data scheduling flow chart based on a power network provided in an embodiment of the present application;

[0044] Figure 2 A block diagram of a data dispatching system based on a power network provided in an embodiment of the present application. DETAILED DESCRIPTION

[0045] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0046] In the description of the present invention, the terms "comprises", "has" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or apparatus comprising a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may also include other steps or units that are not explicitly listed but are inherent to these processes, methods, products or apparatuses, or steps or units added based on further optimization schemes conceived by the present invention.

[0047] With the rapid development of power systems, power monitoring systems play an increasingly important role in ensuring power supply and stable operation of power grids. However, due to its criticality and complexity, power monitoring systems face severe network security challenges. Traditional power monitoring systems usually lack effective network security protection measures, making the system vulnerable to external attacks and internal threats, thus affecting the safe and stable operation of the power system.

[0048] In the existing power monitoring system, key components such as UPS power supply system, network security isolation system, dispatching data network dual network system, log audit system, etc. often operate independently, lacking effective centralized management and dynamic configuration capabilities. This makes it difficult for the system to respond and adjust quickly in the face of complex and changing network threats, thus failing to meet the increasingly stringent network security requirements.

[0049] Please refer to Figure 1 , which shows a flow chart of a data scheduling method based on a power network provided by an embodiment of the present application, the method may include the following steps:

[0050] S1, analyze the current network architecture and business requirements of the power network system, and determine the number and location of new firewall devices and IDS intrusion detection devices that need to be added.

[0051] This includes defining service ports, source addresses, and destination addresses. This step requires an in-depth analysis of the existing power network system to understand the current network architecture and business needs. This step includes determining the number and location of new firewall devices and IDS intrusion detection devices, as well as defining key attributes such as service ports, source addresses, and destination addresses. This requires close cooperation with power grid operators to ensure that the system design meets actual business needs and security standards. Among them, defining service ports, source addresses, and destination addresses specifically includes: one or more port numbers are usually assigned to each network service or application to identify and distinguish different network traffic; among them, HTTP service port 80, HTTPS service port 443; it is necessary to formulate a detailed access control list based on business needs to determine the destination address and service port that can be accessed.

[0052] S2, deploying the firewall device and the IDS intrusion detection device, setting firewall rules to control the data flow between different network areas, and configuring the IDS intrusion detection device after the deployment is completed.

[0053] After completing the network architecture and business needs analysis, the next step is to deploy firewall devices and IDS intrusion detection devices. This includes the optimization of the UPS power supply system, the installation of firewall devices, and the deployment of IDS intrusion detection devices. After the deployment is complete, it is necessary to set firewall rules to control the flow of data between different network areas, and configure IDS intrusion detection devices to monitor and respond to potential network attacks. This step requires precise technical operations and configuration to ensure that the equipment can perform its functions correctly.

[0054] In the embodiment of the present application, the deployment of the firewall device and the IDS intrusion detection device is implemented, and after the deployment is completed, the firewall rules are set to control the data flow between different network areas, and the specific process of configuring the IDS intrusion detection device is as follows:

[0055] Deployment of firewall devices:

[0056] First, determine the type of firewall based on network needs and security requirements, which can be a hardware firewall or a software firewall.

[0057] Plan the network topology, understand the network layout and device locations, and determine the best deployment plan for the firewall.

[0058] Install the hardware firewall, ensure the compatibility of the firewall device with other network devices, and connect the firewall device to the network according to the manuals and guidelines provided by the vendor.

[0059] Configure basic firewall settings, including IP address, subnet mask, etc., and configure access control rules to limit network access rights.

[0060] Firewall rule settings:

[0061] Determine the number of new firewall devices based on actual network business conditions, and refine key attributes such as access control policies and service ports.

[0062] Configure firewall rules, including defining source addresses, destination addresses, service ports, etc. to meet specific network security protection requirements. This may involve creating inbound and outbound rules, specifying protocol types, port numbers, and defining the scope, action (allow or block connections), and profiles of the rules.

[0063] Set security zones, divide different interfaces into different security zones, such as Trust, Untrust, and DMZ zones, and define access policies between these zones.

[0064] Configure the session table and server-map to record the connection status and handle traffic forwarding for special protocols.

[0065] Configuration of IDS intrusion detection device:

[0066] Determine the number of new IDS intrusion detection devices based on actual network business conditions, and clarify key attributes such as source address, destination address, and business service port.

[0067] Configure IDS intrusion detection devices, including setting monitoring interfaces, defining detection strategies, configuring alarm thresholds, and selecting alarm methods (such as email, Syslog, SNMP Trap, etc.).

[0068] Configure the engine interface, enable the data audit function, and set the monitoring interface. At the same time, configure traffic alarm, policy configuration, filter configuration, content detection, etc. to achieve real-time monitoring and analysis of network traffic.

[0069] Configure the management interface, including the management IP address, gateway, and DNS server address to ensure that the IDS device can properly communicate with other devices on the network.

[0070] Device linkage configuration: If necessary, configure the linkage between IDS and firewall so that it can automatically respond when a threat is detected, such as cutting off the connection or loading a new access control policy.

[0071] S3, conduct systematic testing to verify the safety and stability of the power network system.

[0072] This includes testing of firewalls and IDS intrusion detection devices.

[0073] After the equipment is deployed and configured, the last step is to conduct system testing to verify the security and stability of the power network system. This includes testing firewalls and IDS intrusion detection devices to ensure that they can correctly identify and block illegal traffic and attacks. During the testing process, some areas that need to be optimized may be found, such as the adjustment of firewall rules or the optimization of IDS configuration. This step is iterative and requires continuous testing and optimization until the system achieves the expected security performance.

[0074] like Figure 2 , the embodiment of the present application also provides a data dispatching system based on a power network. The system includes:

[0075] A determination module is used to analyze the current network architecture and business requirements of the power network system, and determine the number and location of new firewall devices and IDS intrusion detection devices, including defining service ports, source addresses, and destination addresses;

[0076] A configuration module, used to deploy firewall devices and IDS intrusion detection devices, set firewall rules to control data flow between different network areas after deployment, and configure the IDS intrusion detection device;

[0077] The test module is used to conduct system tests to verify the security and stability of the power network system, including tests on firewalls and IDS intrusion detection devices.

[0078] The data dispatching system based on the electric power network provided in the embodiment of the present application is used to implement the above-mentioned data dispatching method based on the electric power network. For the specific definition of the data dispatching system based on the electric power network, please refer to the definition of the data dispatching method based on the electric power network in the above text, which will not be repeated here. The various parts of the above-mentioned data dispatching system based on the electric power network can be implemented in whole or in part by software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the device in the form of hardware, or can be stored in the memory in the device in the form of software, so that the processor can call and execute the operations corresponding to the above-mentioned modules.

[0079] The technical features of the above-described embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0080] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be construed as limiting the scope of the patent application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent application shall be subject to the attached claims.

Claims

1. A data scheduling method based on a power network, characterized in that: The method comprises: Analyze the current network architecture and business requirements of the power network system, and determine the number and location of additional firewall devices and IDS intrusion detection devices, including defining service ports, source addresses, and destination addresses; Deploy firewall devices and IDS intrusion detection devices, set firewall rules to control data flow between different network areas, and configure IDS intrusion detection devices after deployment; Conduct systematic testing to verify the security and stability of the power network system, including testing of firewalls and IDS intrusion detection devices.

2. The data scheduling method according to claim 1, characterized in that: Define the service port, source address, and destination address, including: One or more port numbers are usually assigned to each network service or application to identify and distinguish different network traffic; among them, HTTP service port 80, HTTPS service port 443; It is necessary to formulate a detailed access control list based on business needs to determine the accessible destination addresses and service ports.

3. The data scheduling method according to claim 1, characterized in that: Deploy the firewall device, including: Configure the IP address and subnet mask of the firewall, and configure access control rules to limit network access rights.

4. The data scheduling method according to claim 1, characterized in that: Setting firewall rules specifically includes: Define the source address, destination address, and service port; Set up security zones, divide different interfaces into different security zones, and define access policies between zones; Configure the session table and server-map to record the connection status and handle traffic forwarding for special protocols.

5. The data scheduling method according to claim 1, characterized in that: Configure the IDS intrusion detection device, including: Set up monitoring interfaces, define detection strategies, configure alarm thresholds, and select alarm methods; Configure the engine interface, enable the data audit function, and set the monitoring interface. At the same time, configure traffic alarm, policy configuration, filtering configuration, and content detection; Configure the management interface, including the management IP address, gateway, and DNS server address to ensure that the IDS device can properly communicate with other devices on the network.

6. A data dispatching system based on a power network, characterized in that: The system comprises: A determination module is used to analyze the current network architecture and business requirements of the power network system, and determine the number and location of new firewall devices and IDS intrusion detection devices, including defining service ports, source addresses, and destination addresses; A configuration module, used to deploy firewall devices and IDS intrusion detection devices, set firewall rules to control data flow between different network areas after deployment, and configure the IDS intrusion detection device; The test module is used to conduct system tests to verify the security and stability of the power network system, including tests on firewalls and IDS intrusion detection devices.

7. The data scheduling system according to claim 6, characterized in that: Define the service port, source address, and destination address, including: One or more port numbers are usually assigned to each network service or application to identify and distinguish different network traffic; among them, HTTP service port 80, HTTPS service port 443; A detailed access control list needs to be developed based on business needs to determine the accessible destination addresses and service ports.

8. The data scheduling system according to claim 6, characterized in that: Deploy the firewall device, including: Configure the IP address and subnet mask of the firewall, and configure access control rules to limit network access rights.

9. The data scheduling system according to claim 6, characterized in that: Setting firewall rules specifically includes: Define the source address, destination address, and service port; Set up security zones, divide different interfaces into different security zones, and define access policies between zones; Configure the session table and server-map to record the connection status and handle traffic forwarding for special protocols.

10. The data scheduling system according to claim 6, characterized in that: Configure the IDS intrusion detection device, including: Set up monitoring interfaces, define detection strategies, configure alarm thresholds, and select alarm methods; Configure the engine interface, enable the data audit function, and set the monitoring interface. At the same time, configure traffic alarm, policy configuration, filtering configuration, and content detection; Configure the management interface, including the management IP address, gateway, and DNS server address to ensure that the IDS device can properly communicate with other devices on the network.

Images