Network security risk early warning analysis system across internal and external network security partitions

Abstract

The invention discloses a network security risk early warning analysis system crossing internal and external network security partitions, and belongs to the technical field of network security risk early warning, a power monitoring system and a power plant early warning system. The dispatching data network early warning comprises machine room temperature and humidity warning, machine room power supply warning, SDH channel warning, business data port offline warning on a switch, data over-line warning on software and four-remote warning on software. Safe and reliable interconnection and intercommunication of the intranet and the extranet are realized, so that network security data of the intranet can be transmitted to the extranet. The system has a logical operation function, analyzes network security data captured from an intranet, and can perform early warning on machine room temperature and humidity out-of-limit, machine room power supply alarm, SDH channel fault, business data port offline on a switch, data over-line on software, four-remote over-line on software and the like. And the network security risk early warning analysis module can be communicated with an operator interface to realize data transmission to a mobile terminal.

Description

Technical Field

[0001] The present invention relates to the technical field of network security risk early warning, and in particular to a network security risk early warning analysis system across internal and external network security partitions. Background Art

[0002] In the power system, operation and maintenance technology is a key link to ensure the continuity, reliability and safety of power supply. With the development of information technology, the monitoring and management of power systems are increasingly dependent on advanced network technologies, including the interconnection of internal and external networks. However, this dependence also brings network security risks, especially in the environment of cross-internal and external network security partitions.

[0003] Internal and external network security partitioning refers to the physical or logical isolation of the network inside the power system (intranet) from the external Internet (extranet) to protect the internal network from external threats. The intranet usually contains key control systems and data, while the extranet may face more security threats, such as viruses, hacker attacks, etc.

[0004] The network security risk early warning analysis system across internal and external network security partitions is designed to monitor and analyze data flows across internal and external networks in real time, so as to promptly detect potential security threats and take corresponding preventive measures. The system needs to be able to process large amounts of data, identify abnormal behavior, predict possible attacks, and issue alarms when necessary. Summary of the invention

[0005] In view of the above problems existing in the prior art, the present invention is proposed.

[0006] Therefore, the present invention provides a network security risk early warning analysis system across internal and external network security partitions, which can solve the problem that traditional computer room temperature and humidity alarms, computer room power alarms, SDH channel alarms, service data port offline alarms on switches, data out-of-line alarms on software, and "four remote" alarms on software, etc., these alarms cannot be monitored and viewed in time during holidays and at night when people are not around.

[0007] In order to solve the above technical problems, the present invention provides the following technical solutions: a network security risk early warning analysis system across internal and external network security partitions, including a power monitoring system and a power plant early warning system;

[0008] The power monitoring system includes a safety zone I and a safety zone II;

[0009] The power plant early warning system includes a network security early warning analysis module;

[0010] Dispatching data network warnings include room temperature and humidity alarms, room power alarms, SDH channel alarms, service data port offline alarms on switches, data off-line alarms on software, and "four remote" alarms on software;

[0011] The network security early warning analysis module realizes non-network-based secure data exchange between two security zones through a forward isolation device. The network security monitoring device realizes one-way sending of alarms through the socket protocol. After receiving the alarm data, the network security early warning analysis module returns a byte to confirm whether the data has been received.

[0012] As a preferred solution of the network security risk early warning analysis system across internal and external network security partitions described in the present invention, wherein: the security zone I includes an energy storage system, an NCS system, a network security system and a dispatching data network;

[0013] The safety zone II shown includes the energy storage information substation system, dispatching data network and network security system.

[0014] As a preferred solution of a network security risk early warning analysis system across internal and external network security partitions described in the present invention, the energy storage system includes an EMS workstation, an acquisition server, an EMS energy management system, an EMS server, a PCS inverter, a BMS battery management system, a communication server, a protocol conversion, a coordination controller and an Ethernet switch.

[0015] As a preferred solution of the network security risk early warning analysis system across internal and external network security partitions described in the present invention, wherein: the EMS workstation is an interface for operators to interact with the EMS energy management system;

[0016] The EMS energy management system is the core of the energy storage system and is responsible for data processing, analysis and decision-making.

[0017] As a preferred solution of the network security risk early warning analysis system across internal and external network security partitions described in the present invention, the NCS system includes PMU, PMU collector, remote control host, scheduling real-time planning substation, reporting substation, monitoring background, protocol converter, primary frequency modulation / AGC, AVC and Ethernet switch.

[0018] As a preferred solution of the network security risk early warning analysis system across internal and external network security partitions described in the present invention, the energy storage information substation system includes a fault recorder, power query, power collection terminal, energy storage information substation and energy storage information substation switch.

[0019] As a preferred solution of the network security risk early warning analysis system across internal and external network security partitions described in the present invention, wherein: the scheduling data network is divided into a first plane and a second plane;

[0020] The first plane and the second plane respectively include a router, a vertical encryption device, a real-time switch and a non-real-time switch.

[0021] As a preferred solution of the network security risk early warning analysis system across internal and external network security partitions described in the present invention, the network security system includes IDS intrusion detection, network security monitoring device, anti-malicious code system, security audit and firewall.

[0022] A computer device includes a memory and a processor, wherein the memory stores a computer program, and is characterized in that when the processor executes the computer program, the steps of any one of the methods in a network security risk early warning analysis system across internal and external network security partitions are implemented.

[0023] A computer-readable storage medium having a computer program stored thereon, characterized in that when the computer program is executed by a processor, the steps of any one of the methods in a network security risk early warning analysis system across internal and external network security partitions are implemented.

[0024] The beneficial effects of the present invention are as follows: safe and reliable interconnection of internal and external networks is achieved, so that the network security data of the internal network can be transmitted to the external network. It has a logical operation function, can analyze the network security data captured from the internal network, and can issue warnings for problems such as temperature and humidity exceeding the limit in the computer room, power supply alarm in the computer room, SDH channel failure, service data port offline on the switch, data crossing the line in the software, and "four remote" crossing the line in the software. The network security risk warning analysis module can be connected to the operator interface to realize data transmission to the mobile terminal. The operation and maintenance personnel can receive various alarms of the dispatching data network in a timely and effective manner, and can respond and deal with problems quickly after discovering them, ensuring the safety and reliability of the dispatching data network. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. Among them:

[0026] Figure 1 A structural diagram of a network security risk early warning analysis system across internal and external network security partitions provided for one embodiment of the present invention. DETAILED DESCRIPTION

[0027] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0028] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0029] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The term "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor is it a separate or selective embodiment that is mutually exclusive with other embodiments.

[0030] The present invention is described in detail with reference to schematic diagrams. When describing the embodiments of the present invention, for the sake of convenience, the cross-sectional diagrams showing the device structure will not be partially enlarged according to the general scale, and the schematic diagrams are only examples, which should not limit the scope of protection of the present invention. In addition, in actual production, the three-dimensional dimensions of length, width and depth should be included.

[0031] At the same time, in the description of the present invention, it should be noted that the directions or positional relationships indicated by the terms "upper, lower, inner and outer" are based on the directions or positional relationships shown in the drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific direction, be constructed and operated in a specific direction, and therefore cannot be understood as limiting the present invention. In addition, the terms "first, second or third" are only used for descriptive purposes and cannot be understood as indicating or implying relative importance.

[0032] In the present invention, unless otherwise clearly specified and limited, the terms "install, connect, connect" should be understood in a broad sense, for example: it can be a fixed connection, a detachable connection or an integral connection; it can also be a mechanical connection, an electrical connection or a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0033] Example 1, reference Figure 1 , which is the first embodiment of the present invention, and provides a network security risk early warning analysis system across internal and external network security partitions, including:

[0034] like Figure 1 As shown, the power monitoring system and power plant early warning system are integrated according to the importance of the business system and the degree of impact on the primary system.

[0035] The power monitoring system is divided into safety zone I and safety zone II.

[0036] The orange part is the safety zone I, including the energy storage system 112, the NCS system 113, the network security system 110 and the dispatching data network 100;

[0037] The purple part is the safety II zone, which includes the energy storage information substation system 114, the dispatching data network 101 and the network security system 111.

[0038] The data collected by the energy storage system 112 is mainly used to monitor and manage the storage and use of energy to optimize energy efficiency and reduce costs. By analyzing these data, the best charging and discharging strategy can be determined to improve the service life and performance of the battery. The emphasis is on the global management and optimization of the power system, including all aspects of power generation, transmission, distribution and power consumption. The data collected by the NCS system 113 is mainly used for the operation and control of the power grid to ensure the stability and reliability of the power system. By analyzing these data, the state of the power grid can be monitored in real time, and possible failures can be predicted and prevented, thereby ensuring the continuity and stability of power supply. The NCS system 113 focuses more on local automation control and monitoring, especially inside the substation. It collects and processes a large amount of real-time data to achieve precise control and fault diagnosis of substation equipment, improve the automation level and operation reliability of the substation. The energy storage information substation system 114 mainly serves as a bridge between the protection device and the dispatcher. When a complex accident occurs in the power grid, the information substation system can quickly transmit fault information, provide support for the dispatcher, and help formulate countermeasures to ensure the safe operation of the power grid.

[0039] The power plant early warning system 116 includes a network security early warning analysis module;

[0040] Dispatching data network warnings include room temperature and humidity alarms, room power alarms, SDH channel alarms, service data port offline alarms on switches, data off-line alarms on software, and "four remote" alarms on software;

[0041] The network security early warning analysis module realizes non-network-based secure data exchange between two security zones through the forward isolation device 115. The network security monitoring device realizes one-way sending of alarms through the socket protocol. After receiving the alarm data, the network security early warning analysis module returns a byte to confirm whether the data has been received.

[0042] Dispatching data network 100 and dispatching data network 101 mainly include room temperature and humidity alarms, room power alarms, SDH channel alarms, service data port offline alarms on switches, data crossing alarms on software, and "four remote" alarms on software. The network security early warning analysis module uses a forward isolation device to achieve non-network-based secure data exchange between two security zones to avoid security risks in the production control area. The network security monitoring device uses the socket protocol to achieve one-way transmission of alarms. After receiving the alarm data, the network security early warning analysis module returns a byte (0x00 or Oxff) to confirm whether the data has been received.

[0043] The energy storage system 112 includes an EMS workstation, a data collection server, an EMS energy management system, an EMS server, a PCS converter, a BMS battery management system, a communication server, a protocol conversion, a coordination controller and an Ethernet switch.

[0044] The EMS workstation is the interface for operators to interact with the energy management system. It allows users to monitor, control and manage the operating status of the entire energy storage system, including data display, alarm processing, system configuration, etc. Through the EMS workstation, operation and maintenance personnel can obtain system information in real time and make necessary operational adjustments.

[0045] The acquisition server is responsible for collecting data from various devices and sensors. These data include but are not limited to key parameters such as current, voltage, and temperature. The acquisition server organizes these data and sends them to the EMS energy management system for analysis and processing.

[0046] The EMS energy management system is the brain of the entire energy storage system, responsible for data processing, analysis and decision-making. It optimizes the charging and discharging strategies of energy storage equipment based on the collected data to ensure efficient and stable operation of the system. At the same time, EMS can also perform predictive analysis to respond to possible system anomalies or failures in advance.

[0047] The EMS server is mainly used to store and process large amounts of data. It supports highly concurrent data access and complex computing tasks, providing powerful computing and storage support for the EMS energy management system.

[0048] The PCS converter is a key device that connects the DC side battery and the AC power grid. It is responsible for converting the DC power of the battery into AC power and controlling the flow of electrical energy, that is, the charging or discharging process.

[0049] The BMS battery management system focuses on the management of battery packs, including monitoring battery voltage, current, temperature and other parameters, protecting the battery from overcharging, over-discharging, overheating and other problems, and extending the battery life.

[0050] The communication server is responsible for data communication between various devices in the system. It ensures accurate and fast data transmission between devices and supports multiple communication protocols and network topologies.

[0051] Protocol converters are used to convert between different communication protocols to ensure that devices from different manufacturers and different types can communicate seamlessly in the same system. This is crucial to achieving system interoperability.

[0052] The coordination controller is responsible for coordinating the work of each subsystem to ensure that they work together according to the predetermined strategy. For example, it can dynamically adjust the working mode of the PCS according to the grid demand and the status of the energy storage system.

[0053] Ethernet switches are core devices in the network, responsible for data routing and forwarding. They ensure that data can be efficiently and accurately transmitted to the destination in the network. In energy storage systems, Ethernet switches provide stable and high-speed network connections for various devices.

[0054] Through the collaborative work of EMS workstations, EMS servers, acquisition servers and EMS energy management systems, the energy storage system can efficiently manage electric energy. These systems can monitor and adjust charging and discharging strategies in real time to ensure that energy storage equipment operates in the best condition, thereby improving energy utilization efficiency.

[0055] The PCS converter, BMS battery management system and coordination controller work together to achieve the conversion between DC and AC and manage the battery pack in a refined manner, which not only ensures the stable operation of the energy storage system but also extends the service life of the battery.

[0056] The communication server and protocol converter are responsible for data communication between various devices in the system, ensuring that information is transmitted accurately and quickly.

[0057] The NCS system 113 includes PMU, PMU collector, telecontrol host, dispatch real-time planning substation, message substation, monitoring background, protocol converter, primary frequency modulation / AGC, AVC and Ethernet switch.

[0058] PMU (Phasor Measurement Unit) is used to synchronously collect dynamic phasor information of power systems such as voltage and current, and provide data support for power system analysis and control.

[0059] The PMU collector is responsible for collecting PMU data and transmitting it to the system center or other monitoring equipment.

[0060] The telecontrol host realizes remote control functions, including remote control, remote signaling, remote measurement and remote adjustment, and is a key part in realizing automatic control.

[0061] The dispatch real-time planning substation processes and executes instructions from the dispatch center to ensure that power generation or transmission operations proceed as planned.

[0062] The reporting substation is responsible for reporting the system's operating status, alarm signals and other information to relevant personnel or systems in a timely manner.

[0063] The monitoring background provides a human-computer interaction interface, allowing operators to monitor and control the operating status of the system.

[0064] The protocol converter converts between different communication protocols to ensure effective communication between different devices.

[0065] Primary frequency regulation / AGC (automatic generation control) automatically adjusts the output power of the generator set according to changes in grid load to maintain a stable grid frequency.

[0066] AVC (Automatic Voltage Control) automatically adjusts the voltage level of the generator or substation to ensure stable grid voltage.

[0067] As the core of network communication, Ethernet switches are responsible for data routing and forwarding, ensuring efficient transmission of information flow.

[0068] The energy storage information substation system 114 includes a fault recorder, an electric quantity inquiry, an electric quantity collection terminal, an energy storage information substation and an energy storage information substation switch.

[0069] The fault recorder is used to record electrical quantities such as current and voltage when a fault occurs in the energy storage system, which facilitates the analysis of the cause and location of the fault.

[0070] The power query module is used to query the remaining power, charging status and other information of the energy storage system in real time.

[0071] The electric energy collection terminal is used to collect electric energy data of the energy storage system, such as voltage, current, power, etc.

[0072] The energy storage information substation is the core of the entire energy storage information substation system 114, responsible for collecting, processing and storing data from each module, and transmitting the data to the main station system.

[0073] The energy storage information substation switch is responsible for realizing data communication and network connection between various modules.

[0074] The modules exchange data and communicate with each other through the energy storage information substation switch, and work together to monitor and manage the energy storage system.

[0075] The dispatching data network is divided into a first plane and a second plane, which respectively include routers, vertical encryption devices, real-time switches and non-real-time switches.

[0076] The router is one of the core devices of the dispatching data network, responsible for forwarding data packets between different network nodes. Data is divided and transmitted through routers of different levels (such as local dispatching and provincial dispatching), and finally the data is gathered into two planes. In the power dispatching system, the router not only undertakes the task of data transmission, but also plays the role of data diversion and routing selection, ensuring that the data can reach the target location quickly and accurately.

[0077] The vertical encryption device is mainly used to ensure the security of data. The vertical encryption authentication device is deployed on the secure zone I / zone II link of the data network ground access network to realize the vertical two-way identity authentication, data encryption and access control of the zone I / zone II business system of the ground access network. This device ensures the security of data during data transmission and prevents unauthorized access and data leakage.

[0078] Real-time switches are used to handle services with high real-time requirements, such as EMS dispatching automation system, telecontrol, power collection, etc. These services require millisecond or second data transmission speeds to ensure the stable operation of the power system.

[0079] Non-real-time switches are used to process non-real-time services, such as electricity metering and billing information, fault recording, and management data related to protection and safety automatic devices. The data transmission frequency of these services is usually minute or hour.

[0080] The network security system 100 and the network security system 101 include IDS intrusion detection, network security monitoring devices, anti-malicious code systems, security audits and firewalls.

[0081] Intrusion Detection System (IDS) is an important part of network security system, which is used to monitor network transmission in real time and issue alarms or take proactive response measures when suspicious behavior is found. It collects and analyzes network data to identify potential security threats, such as unauthorized access and malicious code injection. The main functions of IDS include anomaly detection and misuse detection, which can detect and respond to various network attack attempts in a timely manner.

[0082] Network security monitoring devices are responsible for continuously monitoring the network environment and detecting abnormal traffic and activities. These devices can analyze network data packets in real time to identify potential security threats and vulnerabilities.

[0083] Anti-malware appliances focus on detecting and preventing the spread and execution of malware. These appliances use methods such as virus scanning, heuristic analysis, and sandboxing to identify and isolate malicious code.

[0084] Security auditing is responsible for recording and analyzing security events in the network to ensure that all operations comply with security policies and regulatory requirements. It provides a means of post-event tracing and responsibility identification.

[0085] A firewall is the first line of defense in a network security system, responsible for controlling the flow of data in and out of the network to prevent unauthorized access and attacks. It allows or denies the transmission of data packets based on predefined security rules.

[0086] Firewalls work together with IDS, network security monitoring devices, anti-malicious code devices, and security audit systems to build a comprehensive network security protection system. Firewalls can block external attacks, while IDS provides deeper monitoring and response behind them. Network security monitoring devices can analyze traffic passing through the firewall in real time and identify potential internal threats. Anti-malicious code devices ensure that files and applications entering the network do not contain malicious code. Finally, the security audit system records all operations that pass through the firewall to provide data support for subsequent security analysis and improvements.

[0087] Example 2

[0088] The second embodiment of the present invention provides a network security risk early warning analysis system across internal and external network security partitions. In order to verify the beneficial effects of the present invention, scientific demonstration is carried out through experiments.

[0089] The purpose of this patent is to collect the data information required by operation and maintenance personnel and judge the alarm through the collection, and transmit it from the intranet to the external network, so that the operation and maintenance personnel can view it on their mobile phones in a timely manner.

[0090] The production control area has deployed a network security monitoring device for collecting and dispatching data network warnings. The network security warning analysis module realizes non-network-based secure data exchange between the two security areas through the forward isolation device 115 to avoid security risks in the production control area. The network security monitoring device realizes one-way transmission of alarms through the socket protocol. After receiving the alarm data, the network security warning analysis module returns a byte (0x00 or Oxff) to confirm whether the data has been received.

[0091] Step 1: Now transfer the intranet data to the external network server and use the socket protocol to achieve secure and reliable transmission.

[0092] Step 2: Develop a network security risk data analysis module, which can analyze the network security data captured from the intranet, and use its own logic and policy judgment to warn of network security risks. It can warn of temperature and humidity exceeding the limit in the computer room, power alarm in the computer room, SDH channel failure, service data port offline on the switch, data crossing the line in the software, and "four remote" crossing the line in the software.

[0093] Example 1: Temperature and humidity alarm:

[0094] Set thresholds: The normal range of temperature and humidity needs to be set according to the operating requirements of the equipment in the computer room, including the maximum and minimum limits of temperature and humidity.

[0095] Data analysis: The network security early warning analysis module will analyze the data sent by the network security detection device in real time and compare it with the preset threshold.

[0096] Alarm judgment:

[0097] Level 1 alarm: When the temperature and humidity are close to the set upper and lower limits, the system will issue an early warning to alert the management staff.

[0098] Level 2 alarm: When the temperature and humidity exceed the set safety range, the system will trigger a level 2 alarm, accompanied by sound and light prompts, and notify the management personnel via text message.

[0099] Emergency alarm: When the temperature and humidity values ​​exceed the standard seriously and may cause irreversible damage to the equipment, the system will trigger an emergency alarm and notify the management personnel via SMS.

[0100] Example 2: Power supply alarm:

[0101] Set thresholds: Set the normal range of voltage, current, frequency and other parameters according to the operating requirements of the equipment in the computer room.

[0102] Data analysis: The network security early warning analysis module will analyze the data sent by the network security detection device in real time and compare it with the preset threshold.

[0103] Alarm judgment criteria:

[0104] Overvoltage alarm: When the power supply voltage exceeds the preset maximum voltage threshold.

[0105] Undervoltage warning: When the power supply voltage is lower than the preset minimum voltage threshold.

[0106] Overcurrent alarm: When the current exceeds the preset maximum current threshold, it may indicate that the device is overloaded or has a short circuit.

[0107] Leakage alarm: When the leakage current exceeds the safety value.

[0108] Frequency deviation alarm: When the power frequency deviates from the normal operating frequency and exceeds the preset allowable range.

[0109] Power failure alarm: When the power is completely cut off, the system will immediately issue an alarm, prompting the backup power supply or battery pack to start working.

[0110] Alarm triggering: Once any of the above abnormal conditions are detected, the monitoring system will immediately trigger an alarm.

[0111] Notify relevant personnel: notify the computer room management personnel through sound and light alarms and text messages.

[0112] Step 3: The network security risk warning analysis module can be connected to the operator interface to realize data transmission to the mobile terminal.

[0113] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

[0114] Example 3

[0115] The third embodiment of the present invention is different from the first two embodiments in that:

[0116] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc., which can store program codes.

[0117] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0118] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0119] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

Claims

1. A network security risk early warning analysis system across internal and external network security zones, characterized by: Including, power monitoring system and power plant early warning system; The power monitoring system includes a safety zone I and a safety zone II; The power plant early warning system includes a network security early warning analysis module; Dispatching data network warnings include room temperature and humidity alarms, room power alarms, SDH channel alarms, service data port offline alarms on switches, data off-line alarms on software, and "four remote" alarms on software; The network security early warning analysis module realizes non-network-based secure data exchange between two security zones through a forward isolation device. The network security monitoring device realizes one-way sending of alarms through the socket protocol. After receiving the alarm data, the network security early warning analysis module returns a byte to confirm whether the data has been received.

2. A network security risk early warning analysis system across internal and external network security zones as claimed in claim 1, characterized in that: The safety zone I includes the energy storage system, NCS system, network security system and dispatching data network; The safety zone II shown includes the energy storage information substation system, dispatching data network and network security system.

3. A network security risk early warning analysis system across internal and external network security zones as claimed in claim 2, characterized in that: The energy storage system includes an EMS workstation, a collection server, an EMS energy management system, an EMS server, a PCS converter, a BMS battery management system, a communication server, a protocol conversion, a coordination controller and an Ethernet switch.

4. A network security risk early warning analysis system across internal and external network security zones as claimed in claim 3, characterized in that: The EMS workstation is an interface for operators to interact with the EMS energy management system; The EMS energy management system is the core of the energy storage system and is responsible for data processing, analysis and decision-making.

5. A network security risk early warning analysis system across internal and external network security zones as claimed in claim 4, characterized in that: The NCS system includes PMU, PMU collector, telecontrol host, dispatch real-time planning substation, message substation, monitoring background, protocol converter, primary frequency modulation / AGC, AVC and Ethernet switch.

6. A network security risk early warning analysis system across internal and external network security zones as claimed in claim 5, characterized in that: The energy storage information substation system includes a fault recorder, an electric quantity inquiry, an electric energy collection terminal, an energy storage information substation and an energy storage information substation switch.

7. A network security risk early warning analysis system across internal and external network security zones as claimed in claim 6, characterized in that: The scheduling data network is divided into a first plane and a second plane; The first plane and the second plane respectively include a router, a vertical encryption device, a real-time switch and a non-real-time switch.

8. A network security risk early warning analysis system across internal and external network security zones as claimed in claim 7, characterized in that: The network security system includes IDS intrusion detection, network security monitoring device, anti-malicious code system, security audit and firewall.

Images