Hierarchical protection method and system based on intelligent power plant network topology structure

Abstract

The invention relates to a hierarchical protection method and system based on an intelligent power plant network topology structure. The method comprises the steps that the constructed intelligent power plant network topology comprises an intelligent power generation platform, an intelligent management platform, a large production area network, a large management area network and an industrial wireless network. A log acquisition module is arranged in each network, two platforms deploy SIEM systems to process and classify logs, and security events are weighted and analyzed according to event emergency degree, affected resource importance and occurrence frequency. At the same time, a DPI module is deployed at a network boundary and key nodes (such as a core switch and a router) to identify attack traffic, and a result is fed back to the SIEM. And the SIEM integrates weighted analysis and DPI feedback to identify a cross-level attack mode. According to the structure, the security and management efficiency of the power plant network are improved by simplifying the security operation and maintenance hierarchy.

Description

Technical Field

[0001] The invention relates to a layered protection method and system based on a smart power plant network topology structure, belonging to the field of power system network security. Background Art

[0002] With the deepening of the global energy crisis and the advocacy of low-carbon economy, the construction of smart grids and smart power plants has become an important engine for economic development in various countries. As an important part of smart grids, smart power plants achieve optimized dispatching, efficient operation and reliable power supply of power systems by integrating information technology, communication technology and automation technology. Among them, the "two platforms and three networks" architecture is the key to the construction of smart power plants. It covers the intelligent power generation system ICS, the intelligent management system IMS and multiple communication networks, providing strong technical support for the production and management of power plants.

[0003] The network protection system of traditional smart power plants may lack systematicity and integrity. For example, some power plants may only focus on certain specific security threats and ignore other potential risks. This may lead to loopholes in the protection system, allowing attackers to exploit these loopholes to carry out network attacks. Access control is an important part of network security, which determines which users or devices can access network resources. However, some traditional smart power plants may have problems with lax access control. For example, some power plants may allow unauthorized users or devices to access critical systems, which may lead to the leakage of sensitive information or the destruction of systems.

[0004] Prior art, such as a Chinese patent with patent number "CN107547228B", discloses an implementation architecture of a security operation and maintenance management platform based on big data.

[0005] The problem with the above-mentioned prior art is that it involves three levels: edge management nodes, regional management nodes and global management nodes. This multi-level structure may cause information transmission delays, especially when dealing with emergency security incidents. Summary of the invention

[0006] In order to solve the above problems existing in the prior art, the present invention proposes a hierarchical protection method and system based on the network topology structure of a smart power plant.

[0007] The technical solution of the present invention is as follows:

[0008] In one aspect, the present invention provides a hierarchical protection method based on a smart power plant network topology structure, comprising the following steps:

[0009] Constructing a smart power plant network topology structure including two platforms and three networks, wherein the two platforms are a smart power generation platform and a smart management platform, and the three networks are a production area network, a management area network, and an industrial wireless network;

[0010] A log collection module is set up in the three-network structure to record information, and a SIEM system is deployed in the two-platform structure. The log information recorded by the log collection module is processed according to the preset classification rules to obtain the corresponding security events in the log information. The logs corresponding to the security events are weighted and analyzed according to the urgency of the security events, the importance of the affected resources, and the frequency of the events.

[0011] Deploy DPI modules at network boundaries and key nodes to identify attack traffic and feed back identification results to the SIEM system; the key nodes include core switches and routers, and the network boundaries are isolation boundaries of two platforms and three networks;

[0012] The SIEM system identifies cross-level attack patterns based on weighted analysis results and DPI module feedback results.

[0013] As a preferred implementation, the log collection module includes a local log collection module, a centralized security log server and a security event log server;

[0014] For the production area network, a local log collection module is installed on the industrial control equipment, and the local log collection module monitors the equipment operation status, instruction flow, and port access in real time. The industrial control equipment includes PLC and SCADA system;

[0015] Deploy a centralized security log server in the control center to collect log information of industrial control equipment;

[0016] For the management area network, deploy a security event log server in the management area network to record the login, logout, resource access and management command execution logs of administrator accounts;

[0017] For industrial wireless networks, configure wireless security logs on wireless switches to record the access status, MAC addresses, and signal strength of wireless devices.

[0018] As a preferred implementation, the log collection module of the three-network structure is transmitted to the SIEM system through an encrypted channel, and the encrypted channel includes Syslog and SNMP.

[0019] As a preferred implementation, after the SIEM system detects a cross-layer attack pattern, it modifies the firewall rules or isolates the attack traffic;

[0020] At the same time, the SIEM system sends instructions to the industrial wireless network to restrict the access rights of suspicious devices and asks them to re-authenticate. The SIEM system also sends instructions to the management area network to restrict the access rights of users who have not passed the two-factor authentication to highly sensitive areas.

[0021] The first factor of the two-factor authentication is the authentication of the user name and password, and the second factor is face recognition. The highly sensitive area includes the SCADA system and the DCS system.

[0022] As a preferred implementation, data transmission in the production area network, management area network and industrial wireless network is encrypted through a security gateway, and the TLS / SSL protocol is used to protect the data in transmission.

[0023] As a preferred implementation, devices in the production area network, management area network and industrial wireless network need to present digital certificates and pass PKI authentication before accessing the network. Only after passing the authentication can cross-layer data transmission be allowed.

[0024] On the other hand, the present invention also provides a hierarchical protection system based on the network topology structure of a smart power plant, characterized in that it includes:

[0025] Network topology hierarchical module: constructs a smart power plant network topology structure including two platforms and three networks. The two platforms are the smart power generation platform and the smart management platform, and the three networks are the production area network, the management area network and the industrial wireless network.

[0026] Log analysis module: A log collection module is set up in the three-network structure to record information, and a SIEM system is deployed in the two-platform structure. The log information recorded by the log collection module is processed according to the preset classification rules to obtain the corresponding security events in the log information. The logs corresponding to the security events are weightedly analyzed according to the urgency of the security events, the importance of the affected resources, and the frequency of the events.

[0027] Traffic identification module: Deploy DPI modules at network boundaries and key nodes to identify attack traffic and feed back identification results to the SIEM system; the key nodes include core switches and routers, and the network boundaries are the isolation boundaries of the two platforms and three networks;

[0028] Attack identification module: The SIEM system identifies cross-level attack patterns based on weighted analysis results and DPI module feedback results.

[0029] The present invention has the following beneficial effects:

[0030] The present invention combines the "two platforms, three networks" architecture of the power plant, uses different protection technologies and strategies, and realizes comprehensive protection of information security for network security needs at all levels within the power plant. By dividing the network according to function and sensitivity, the system can implement differentiated security protection for each level and realize a collaborative protection strategy for cross-level data security circulation and control. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 The present invention is a flowchart for implementing the method.

[0032] Figure 2 This is a topology diagram of the two-platform three-network layered and graded protection system of the present invention. DETAILED DESCRIPTION

[0033] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0034] It should be understood that the step numbers used in this document are only for convenience of description and are not intended to limit the order in which the steps are executed.

[0035] It should be understood that the terms used in the present specification are only for the purpose of describing specific embodiments and are not intended to limit the present invention. As used in the present specification and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include plural forms.

[0036] The terms “include” and “comprising” indicate the presence of described features, integers, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or combinations thereof.

[0037] The term "and / or" means and includes any and all possible combinations of one or more of the associated listed items.

[0038] Embodiment 1:

[0039] See also Figure 1 The present invention provides a hierarchical protection method based on a smart power plant network topology structure, comprising the following steps:

[0040] See also Figure 2 , construct a smart power plant network topology structure including two platforms and three networks, the two platforms are the smart power generation platform and the smart management platform, the three networks are the production area network, the management area network and the industrial wireless network;

[0041] A log collection module is set up in the three-network structure to record information, and a SIEM system is deployed in the two-platform structure. The full name of the SIEM system is Security Information and Event Management, which is a security software that integrates the functions of Security Information Management (SIM) and Security Event Management (SEM). The log information recorded by the log collection module is processed according to the preset classification rules to obtain the corresponding security events in the log information. The logs corresponding to the security events are weighted and analyzed according to the urgency of the security events, the importance of the affected resources, and the frequency of the events.

[0042] Deploy DPI modules at network boundaries and key nodes to identify attack traffic. DPI (Display Pixel Interface) is an interface for active matrix LCD displays of handheld devices, and feeds identification results back to the SIEM system. The key nodes include core switches and routers, and the network boundaries are isolation boundaries of two platforms and three networks.

[0043] The SIEM system identifies cross-level attack patterns based on weighted analysis results and DPI module feedback results.

[0044] As a preferred implementation, the log collection module includes a local log collection module, a centralized security log server and a security event log server;

[0045] For the production area network, a local log collection module is installed on the industrial control equipment. The local log collection module monitors the equipment operation status, instruction flow, and port access in real time. The industrial control equipment includes PLC and SCADA systems; PLC stands for Programmable Logic Controller, which is a digital computing and operating electronic system specially designed for application in industrial environments. SCADA (Supervisory Control And Data Acquisition) system, that is, data acquisition and monitoring control system, is a computer-based production process control and scheduling automation system.

[0046] Deploy a centralized security log server in the control center to collect log information of industrial control equipment;

[0047] For the management area network, deploy a security event log server in the management area network to record the login, logout, resource access and management command execution logs of administrator accounts;

[0048] For industrial wireless networks, configure wireless security logs on wireless switches to record the access status, MAC addresses, and signal strength of wireless devices.

[0049] As a preferred implementation, the log collection module of the three-network structure is transmitted to the SIEM system through an encrypted channel, and the encrypted channel includes Syslog and SNMP.

[0050] Syslog is a text-based log transmission protocol used to transmit log files in Internet Protocol (TCP / IP) networks. It allows network devices (such as routers, switches, firewalls) and servers to send their system events in the form of logs to a centralized log server, thereby achieving unified management of logs.

[0051] SNMP is an Internet standard protocol based on IP networks, mainly used to manage and monitor network devices such as routers, switches, servers, etc. It runs at the application layer, follows the client-server model, and collects device performance data through regular polling.

[0052] As a preferred implementation, after the SIEM system detects a cross-layer attack pattern, it modifies the firewall rules or isolates the attack traffic;

[0053] At the same time, the SIEM system sends instructions to the industrial wireless network to restrict the access rights of suspicious devices and asks them to re-authenticate. The SIEM system also sends instructions to the management area network to restrict the access rights of users who have not passed the two-factor authentication to highly sensitive areas.

[0054] The first factor of the two-factor authentication is the authentication of the user name and password, the second factor is face recognition, and the highly sensitive areas include the SCADA system and the DCS system. In order to strengthen access control, two-factor authentication requires users to provide two different types of verification factors when logging in or accessing certain key systems. The system is designed with two-factor authentication including the following two factors. The first factor is the user name and password. The second factor is face recognition. Highly sensitive areas refer to systems and areas that are critical to the operation of the power plant and may contain highly sensitive data. In the network structure of the smart power plant, highly sensitive areas include: SCADA system, DCS system. The system directly controls key processes such as power generation and transmission; core switches and routers: This device is responsible for connecting different network areas; power generation control platform: including consoles and dispatching systems related to actual power generation; important management systems: such as financial systems, personnel management systems, etc., containing sensitive management and operation data.

[0055] SCADA system is a data acquisition and monitoring control system, which is mainly used for remote monitoring and data acquisition. Through the communication network, the SCADA system can collect data from remote sites and transmit it to the central monitoring center for operators to monitor the status of equipment and control the field equipment. DCS system is a distributed control system, which is a comprehensive system for automatic control. It consists of multiple control units, each of which is responsible for the control task of a specific process or equipment. These control units are coordinated through the communication network to realize the automatic control of the entire system.

[0056] As a preferred implementation, data transmission in the production area network, management area network and industrial wireless network is encrypted through a security gateway, and the TLS / SSL protocol is used to protect the data in transmission.

[0057] SSL (Secure Sockets Layer): Secure Sockets Layer, originally developed by Netscape, is used to provide security and data integrity protection in Internet communications. It is located between the application layer and the transport layer, and can encrypt the transmitted data to prevent the data from being eavesdropped or tampered with. TLS (Transport Layer Security): Transport Layer Security Protocol, a successor to SSL, provides similar functions to SSL, but is more secure and efficient. TLS is also located between the application layer and the transport layer, and is used to provide confidentiality and data integrity between two communicating applications. The main function of the TLS / SSL protocol is to ensure privacy and data security between two communicating entities. For example, when shopping online, sensitive information (such as credit card numbers and personal identity information) exchanged between the browser and the server needs to be encrypted through TLS / SSL to protect user data from being accessed by unauthorized third parties.

[0058] As a preferred implementation, devices in the production area network, management area network and industrial wireless network need to present digital certificates and pass PKI authentication before accessing the network. Only after passing the authentication can cross-layer data transmission be allowed.

[0059] Administrators can view the security status of each network layer in real time through the global monitoring interface of the SIEM system, including network traffic, device health status, log events, etc.

[0060] Security events at each layer are recorded in detail in the system, and administrators can respond quickly based on the alarm level and scope of impact.

[0061] The present invention also includes an equipment layer: the equipment layer includes hardware facilities such as power generation equipment, sensors, actuators, etc., which are responsible for the actual power generation process and the collection of environmental data. This layer is connected to the intelligent power generation platform and the production area network through a dedicated network, and uses an end-to-end encrypted communication module to ensure the security of data and control instructions.

[0062] Embodiment 2:

[0063] The present invention also provides a hierarchical protection system based on the network topology structure of an intelligent power plant, which is characterized by comprising:

[0064] Network topology hierarchical module: constructs a smart power plant network topology structure including two platforms and three networks. The two platforms are the smart power generation platform and the smart management platform, and the three networks are the production area network, the management area network and the industrial wireless network.

[0065] Log analysis module: A log collection module is set up in the three-network structure to record information, and a SIEM system is deployed in the two-platform structure. The log information recorded by the log collection module is processed according to the preset classification rules to obtain the corresponding security events in the log information. The logs corresponding to the security events are weightedly analyzed according to the urgency of the security events, the importance of the affected resources, and the frequency of the events.

[0066] Traffic identification module: Deploy DPI modules at network boundaries and key nodes to identify attack traffic and feed back identification results to the SIEM system; the key nodes include core switches and routers, and the network boundaries are the isolation boundaries of the two platforms and three networks;

[0067] Attack identification module: The SIEM system identifies cross-level attack patterns based on weighted analysis results and DPI module feedback results.

[0068] In the embodiments of the present application, "at least one" refers to one or more, and "more than one" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent the existence of A alone, the existence of A and B at the same time, and the existence of B alone. Among them, A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following" and similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b and c can be represented by: a, b, c, a and b, a and c, b and c, or a and b and c, where a, b, c can be single or multiple.

[0069] Those of ordinary skill in the art will appreciate that the various units and algorithm steps described in the embodiments disclosed herein can be implemented in a combination of electronic hardware, computer software, and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0070] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0071] In several embodiments provided in the present application, if any function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory; hereinafter referred to as: ROM), random access memory (Random Access Memory; hereinafter referred to as: RAM), disk or optical disk, and other media that can store program codes.

[0072] The above descriptions are merely embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A hierarchical protection method based on the network topology structure of a smart power plant, characterized in that: The following steps are involved: Constructing a smart power plant network topology structure including two platforms and three networks, wherein the two platforms are a smart power generation platform and a smart management platform, and the three networks are a production area network, a management area network, and an industrial wireless network; A log collection module is set up in the three-network structure to record information, and a SIEM system is deployed in the two-platform structure. The log information recorded by the log collection module is processed according to the preset classification rules to obtain the corresponding security events in the log information. The logs corresponding to the security events are weighted and analyzed according to the urgency of the security events, the importance of the affected resources, and the frequency of the events. Deploy DPI modules at network boundaries and key nodes to identify attack traffic and feed the identification results back to the SIEM system; The key nodes include core switches and routers, and the network boundary is the isolation boundary of two platforms and three networks; The SIEM system identifies cross-level attack patterns based on weighted analysis results and DPI module feedback results.

2. The hierarchical protection method based on the network topology structure of the smart power plant according to claim 1 is characterized in that: The log collection module includes a local log collection module, a centralized security log server and a security event log server; For the production area network, a local log collection module is installed on the industrial control equipment, and the local log collection module monitors the equipment operation status, instruction flow, and port access in real time. The industrial control equipment includes PLC and SCADA system; Deploy a centralized security log server in the control center to collect log information of industrial control equipment; For the management area network, deploy a security event log server in the management area network to record the login, logout, resource access and management command execution logs of administrator accounts; For industrial wireless networks, configure wireless security logs on wireless switches to record the access status, MAC addresses, and signal strength of wireless devices.

3. The hierarchical protection method based on the network topology structure of the smart power plant according to claim 1 is characterized in that: The log collection module of the three-network structure is transmitted to the SIEM system through an encrypted channel, and the encrypted channel includes Syslog and SNMP.

4. The hierarchical protection method based on the network topology structure of the smart power plant according to claim 1 is characterized in that: After the SIEM system detects a cross-layer attack pattern, it modifies the firewall rules or isolates the attack traffic. At the same time, the SIEM system sends instructions to the industrial wireless network to limit the access rights of suspicious devices and require them to re-authenticate their identities. The SIEM system will also send instructions to the management area network to restrict the access rights of users who have not passed the two-factor authentication to highly sensitive areas. The first factor of the two-factor authentication is the authentication of the user name and password, and the second factor is face recognition. The highly sensitive areas include SCADA systems and DCS systems.

5. The hierarchical protection method based on the network topology structure of the smart power plant according to claim 1 is characterized in that: The data transmission of the production area network, management area network and industrial wireless network is encrypted through a secure gateway, and the TLS / SSL protocol is used to protect the data in transmission.

6. The hierarchical protection method based on the network topology structure of the smart power plant according to claim 1 is characterized in that: Devices in the production area network, management area network, and industrial wireless network need to present digital certificates and pass PKI authentication before accessing the network. Only after passing the authentication can cross-layer data transmission be allowed.

7. A hierarchical protection system based on the network topology of an intelligent power plant, characterized in that: include: Network topology hierarchical module: constructs a smart power plant network topology structure including two platforms and three networks. The two platforms are the smart power generation platform and the smart management platform, and the three networks are the production area network, the management area network and the industrial wireless network. Log analysis module: A log collection module is set up in the three-network structure to record information, and a SIEM system is deployed in the two-platform structure. The log information recorded by the log collection module is processed according to the preset classification rules to obtain the corresponding security events in the log information. The logs corresponding to the security events are weightedly analyzed according to the urgency of the security events, the importance of the affected resources, and the frequency of the events. Traffic identification module: Deploy DPI modules at network boundaries and key nodes to identify attack traffic and feed back identification results to the SIEM system; the key nodes include core switches and routers, and the network boundaries are the isolation boundaries of the two platforms and three networks; Attack identification module: The SIEM system identifies cross-level attack patterns based on weighted analysis results and DPI module feedback results.

8. The hierarchical protection system based on the network topology structure of the smart power plant according to claim 7 is characterized in that: The log analysis module and the log collection module include a local log collection module, a centralized security log server and a security event log server; For the production area network, a local log collection module is installed on the industrial control equipment, and the local log collection module monitors the equipment operation status, instruction flow, and port access in real time. The industrial control equipment includes PLC and SCADA system; Deploy a centralized security log server in the control center to collect log information of industrial control equipment; For the management area network, deploy a security event log server in the management area network to record the login, logout, resource access and management command execution logs of administrator accounts; For industrial wireless networks, configure wireless security logs on wireless switches to record the access status, MAC addresses, and signal strength of wireless devices.

9. The hierarchical protection system based on the network topology structure of the smart power plant according to claim 7 is characterized in that: The log collection module of the three-network structure is transmitted to the SIEM system through an encrypted channel, and the encrypted channel includes Syslog and SNMP.

10. The hierarchical protection system based on the network topology structure of the smart power plant according to claim 7, characterized in that: It also includes a defense module. After the SIEM system detects a cross-layer attack pattern, it modifies the firewall rules or isolates the attack traffic. At the same time, the SIEM system sends instructions to the industrial wireless network to limit the access rights of suspicious devices and require them to re-authenticate their identities. The SIEM system will also send instructions to the management area network to restrict the access rights of users who have not passed the two-factor authentication to highly sensitive areas. The first factor of the two-factor authentication is the authentication of the user name and password, and the second factor is face recognition. The highly sensitive areas include SCADA systems and DCS systems.

Images