Wired and wireless integrated network security system and networking method thereof

Abstract

The invention discloses a wired and wireless integrated network security system and a networking method of the wired and wireless integrated network security system. The certificate issuing and authentication server is used for carrying out certificate management and identity authentication on the first Ethernet security control end, the second Ethernet security control end, the third Ethernet security control end, the Ethernet security terminal, the WAPI wireless terminal and the wireless access point; the wireless access point controller is used for managing the wireless access points; the first Ethernet security control end is used as an authentication access controller and performs identity authentication with the second Ethernet security control end; the second Ethernet security control end is used as an authentication access controller and performs identity authentication with the third Ethernet security control end; and the third Ethernet security control end is used as an authentication access controller to authenticate the Ethernet security terminal. According to the method, illegal access to the network of the transformer substation is prevented, repudiation resistance is achieved, confidentiality and integrity of data are ensured, and fragile communication links in the transformer substation are reinforced.

Description

Technical Field

[0001] The present invention belongs to the technical field of substation network transmission security, and in particular relates to a wired and wireless integrated network security system and a network construction method thereof. Background Art

[0002] At present, power construction and planning are constantly developing towards intelligence and digitalization, and network security management and control have become particularly important. As an important part of the power system, the protection of sensitive information of substations is crucial. In this context, technical personnel in this field have conducted theoretical and pilot implementation explorations in the field of energy network security applications for power-related research in a step-by-step manner.

[0003] There are three main forms of network reinforcement for substations in the existing technology, including: wireless network security reinforcement based on WAPI (Wireless LAN Authentication and Privacy Infrastructure), security reinforcement based on forward and reverse isolation devices, and security reinforcement based on vertical encryption authentication devices. Among them, the wireless network security reinforcement method based on WAPI only protects the wireless network, but fails to protect the wired network. As for the security reinforcement method based on forward and reverse isolation devices and the security reinforcement method based on vertical encryption authentication devices, although the network is reinforced to a certain extent, the password method used is easy to crack, and the device does not have a unique identity and is not non-repudiation. Summary of the invention

[0004] In order to solve the above problems existing in the prior art, the present invention provides a wired and wireless integrated network security system and a network construction method thereof. The technical problem to be solved by the present invention is achieved through the following technical solutions:

[0005] In a first aspect, the present invention provides a wired and wireless integrated network security system, comprising: a management end and a station end, wherein the management end comprises a certificate issuance and authentication server, a wireless access point controller and a first Ethernet security control end, and the station end comprises a second Ethernet security control end, a third Ethernet security control end, an Ethernet security terminal, a wireless access point and a WAPI wireless terminal; wherein,

[0006] The certificate issuance and authentication server is used to perform certificate management and identity authentication on the first Ethernet security control terminal, the second Ethernet security control terminal, the third Ethernet security control terminal, the Ethernet security terminal, the WAPI wireless terminal and the wireless access point;

[0007] The wireless access point controller is used to manage the wireless access point;

[0008] The first Ethernet security control terminal is used to serve as an authentication access controller and perform identity authentication with the second Ethernet security control terminal;

[0009] The second Ethernet security control terminal is used to perform identity authentication with the first Ethernet security control terminal as a requester;

[0010] The third Ethernet security control terminal is used as an authentication access controller to authenticate the Ethernet security terminal.

[0011] In one embodiment of the present invention, the certificate issuance and authentication server is specifically used to issue digital certificates for the first Ethernet security control terminal and the second Ethernet security control terminal, so that the first Ethernet security control terminal and the second Ethernet security control terminal establish a secure channel based on their own digital certificates and conduct confidential communication.

[0012] In one embodiment of the present invention, the first Ethernet security control terminal and the second Ethernet security control terminal establish a security channel according to the following steps:

[0013] The first Ethernet security control terminal and the second Ethernet security control terminal perform security policy negotiation after discovering each other;

[0014] The first Ethernet security control terminal sends a first access request to the second Ethernet security control terminal, where the first access request includes a digital certificate of the first Ethernet security control terminal;

[0015] The second Ethernet security control terminal sends its own digital certificate and the digital certificate of the first Ethernet security control terminal to the certificate issuance and authentication server for authentication, and establishes a secure channel through unicast and multicast key negotiation.

[0016] In one embodiment of the present invention, the first Ethernet security control terminal and the second Ethernet security control terminal discover each other based on the neighbor node discovery protocol in GB / T 15629.3-2014.

[0017] In one embodiment of the present invention, the first Ethernet security control terminal and the second Ethernet security control terminal perform security policy negotiation using the security policy negotiation protocol in GB / T 15629.3-2014.

[0018] In one embodiment of the present invention, the certificate issuance and authentication server is also used to issue digital certificates for the third Ethernet security control terminal and Ethernet security terminal, so that the third Ethernet security control terminal and Ethernet security terminal establish a secure channel based on their own digital certificates and conduct confidential communication.

[0019] In one embodiment of the present invention, the third Ethernet security control terminal and the Ethernet security terminal establish a security channel according to the following steps:

[0020] The Ethernet security terminal and the third Ethernet security control terminal perform security policy negotiation after discovering each other;

[0021] The Ethernet security terminal sends a second access request to the third Ethernet security control terminal, where the second access request includes a digital certificate of the Ethernet security terminal;

[0022] The third Ethernet security control terminal sends its own digital certificate and the digital certificate of the Ethernet security terminal to the certificate issuance and authentication server for authentication, and establishes a secure channel through unicast and multicast key negotiation.

[0023] In one embodiment of the present invention, the certificate issuance and authentication server is further used to issue digital certificates for the WAPI wireless terminal and the wireless access point, so that the WAPI wireless terminal and the wireless access point establish a secure channel and perform confidential communication.

[0024] In one embodiment of the present invention, the WAPI wireless terminal and the wireless access point establish a secure channel according to the following steps:

[0025] The wireless access point controller remotely manages the wireless access point;

[0026] Placing the wireless access point at the physical location of the Ethernet security terminal, and performing security association between the WAPI wireless terminal and the wireless access point;

[0027] The WAPI wireless terminal sends a third access request to the wireless access point, where the third access request includes a digital certificate of the WAPI wireless terminal;

[0028] The wireless access point sends the digital certificate of the WAPI wireless terminal and its own digital certificate to the certificate issuance and authentication server for authentication, and establishes a secure channel through unicast and multicast key negotiation.

[0029] In a second aspect, the present invention further provides a method for establishing a wired and wireless integrated network security system, which is applied to the wired and wireless integrated network security system described in the first aspect;

[0030] The method includes:

[0031] The first Ethernet security control terminal and the second Ethernet security control terminal perform identity authentication;

[0032] The third Ethernet security control terminal is connected to the second Ethernet security control terminal through a network;

[0033] The Ethernet security terminal performs identity authentication with the third Ethernet security control terminal;

[0034] The wireless access point is connected to the Ethernet security terminal through a network;

[0035] The WAPI wireless terminal performs identity authentication through the wireless access point and accesses the network.

[0036] Compared with the prior art, the present invention has the following beneficial effects:

[0037] The present invention provides a wired and wireless integrated network security system and a network construction method thereof, which protects the wireless link through a WAPI wireless terminal and connects the wired and wireless links through an Ethernet security terminal, thereby ensuring the security of the connection point between the wireless network and the wired network; at the same time, the optical fiber link between the station end and the management end is reinforced using an Ethernet security control terminal, and a digital certificate mechanism is used for identity authentication, and confidential communication is achieved based on a national secret algorithm. Therefore, the network security system and network construction method provided by the present invention can prevent illegal access to the network of the substation, have anti-repudiation, and can ensure the confidentiality and integrity of the data, thereby reinforcing the fragile communication links in the substation, and facilitating unified management of operation and maintenance, effectively reducing the equipment investment cost and management cost.

[0038] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 It is a schematic diagram of a wired and wireless integrated network security system provided by an embodiment of the present invention;

[0040] Figure 2 is a schematic diagram of a wired optical cable between a station end and a management end provided by an embodiment of the present invention;

[0041] Figure 3 is a schematic diagram of an outdoor wired network outside a station provided by an embodiment of the present invention;

[0042] Figure 4 is a schematic diagram of a station-side wireless network provided by an embodiment of the present invention;

[0043] Figure 5 The invention discloses a method for establishing a wired and wireless integrated network security system. DETAILED DESCRIPTION

[0044] The present invention is further described in detail below with reference to specific embodiments, but the embodiments of the present invention are not limited thereto.

[0045] Figure 1FIG. 1 is a schematic diagram of a wired and wireless integrated network security system provided by an embodiment of the present invention. Figure 1 As shown, the embodiment of the present invention provides a wired and wireless integrated network security system, including: a management end and a station end, the management end includes a certificate issuance and authentication server 101, a wireless access point controller 102 and a first Ethernet security control end 103, and the station end includes a second Ethernet security control end 104, a third Ethernet security control end 105, an Ethernet security terminal 106, a wireless access point 107 and a WAPI wireless terminal 108; wherein,

[0046] The certificate issuance and authentication server 101 is used to perform certificate management and identity authentication for the first Ethernet security control terminal 103, the second Ethernet security control terminal 104, the third Ethernet security control terminal 105, the Ethernet security terminal 106, the WAPI wireless terminal 108 and the wireless access point 107;

[0047] A wireless access point controller 102, used to manage a wireless access point 107;

[0048] The first Ethernet security control terminal 103 is used as an authentication access controller to perform identity authentication with the second Ethernet security control terminal 104;

[0049] The second Ethernet security control terminal 104 is used as an authentication access controller to perform identity authentication with the third Ethernet security control terminal 105;

[0050] The third Ethernet security control terminal 105 is used as an authentication access controller to authenticate the Ethernet security terminal 106 .

[0051] It should be noted that in this embodiment, the certificate issuance and authentication server 101 can be a physical entity, or it can include a certificate issuance server and an authentication server. As a trusted third party, the certificate issuance and authentication server 101 is located at the management end and is responsible for the issuance, revocation and identity authentication of digital certificates of security devices in the above-mentioned wired and wireless integrated network security system.

[0052] The first Ethernet security control terminal 103, the second Ethernet security control terminal 104 and the third Ethernet security control terminal 105 are access security control devices for wired networks, and have identity authentication, key management and confidential communication functions, and also have common layer 2 switching functions, that is, in the process of identity authentication, their own roles can be requesters (REQ) or authentication access controllers (AAC). Exemplarily, when the Ethernet security control terminal authenticates the Ethernet control terminal, the role is usually determined by automatic negotiation according to relevant policies, and when the Ethernet security control terminal authenticates the Ethernet security terminal 106, it acts as an authentication access controller.

[0053] The Ethernet security terminal 106 is an access device for the wired network, which has identity authentication, key management and confidential communication functions, and also has the function of bridging wireless and wired networks, and acts as a requester in the identity authentication process. Figure 1 Only two Ethernet security terminals are taken as an example. In fact, there may be multiple Ethernet security terminals, and this application does not limit this.

[0054] Furthermore, the wireless access point controller 102 is used to control and manage the wireless access point 107 in the network, and is generally arranged at the management end. The wireless access point 107 (AP) is responsible for the access control of the wireless network, and has WAPI identity authentication, key management and confidential communication functions. The WAPI wireless terminal 108 is an access device for the wireless network, and has WAPI identity authentication, key management and confidential communication functions. Optionally, the WAPI wireless terminal 108 includes: a WAPI video acquisition device 1081, a WAPI inspection robot 1082, a WAPI handheld terminal 1083 and a WAPI portable computer 1084.

[0055] Figure 2 is a schematic diagram of a wired optical cable between a station end and a management end provided by an embodiment of the present invention, Figure 3 is a schematic diagram of an outdoor wired network outside a station provided by an embodiment of the present invention, Figure 4 Schematic diagram of a wireless network at a station end provided by an embodiment of the present invention. Figure 1-4 In the above-mentioned wired and wireless integrated network security system, the station end can be a power substation, and the management end is a management unit responsible for power management and dispatching. In the network between the substation and the management unit, there are three network segments that are most vulnerable and susceptible to threats such as data theft or attack, namely: (1) long-distance optical fiber transmission between the station end and the management end. Since the station end and the management end are generally far apart, the two are connected through an operator network (wired optical cable) to transmit large amounts of data; (2) the network line from the station end wireless access point 107 to the aggregation switch 109 in the power substation computer room; (3) the network line between the WAPI wireless terminal 108 and the wireless access point 107.

[0056] In the first aspect, in order to protect the network line between the station end and the management end, in this embodiment, the certificate issuance and authentication server 101 is specifically used to issue digital certificates to the first Ethernet security control end 103 and the second Ethernet security control end 104, so that the first Ethernet security control end 103 and the second Ethernet security control end 104 establish a secure channel based on their own digital certificates and communicate confidentially. Optionally, the first Ethernet security control end 103 and the second Ethernet security control end 104 establish a secure channel according to the following steps:

[0057] The first Ethernet security control terminal 103 and the second Ethernet security control terminal 104 perform security policy negotiation after discovering each other;

[0058] The first Ethernet security control terminal 103 sends a first access request to the second Ethernet security control terminal 104, where the first access request includes a digital certificate of the first Ethernet security control terminal 103;

[0059] The second Ethernet security control terminal 104 sends its own digital certificate and the digital certificate of the first Ethernet security control terminal 103 to the certificate issuance and authentication server 101 for authentication, and establishes a secure channel through unicast and multicast key negotiation.

[0060] Specifically, the certificate issuance and authentication server 101 issues digital certificates to the first Ethernet security control terminal 103 and the second Ethernet security control terminal 104 respectively, and distributes them. The digital certificates include user certificates and authentication server (AS) certificates, wherein the user certificate is a unique identity credential, and the authentication server (AS) certificate is used to verify the legitimacy of the access result. Optionally, the first Ethernet security control terminal 103 and the second Ethernet security control terminal 104 use the neighbor node discovery protocol in GB / T 15629.3-2014 to achieve mutual discovery, and determine their own roles as requesters or authentication access controllers through role adaptation. In this embodiment, the roles of the first Ethernet security control terminal 103 and the second Ethernet security control terminal 104 are authentication access controllers and requesters, respectively. Then, the first Ethernet security control terminal 103 and the second Ethernet security control terminal 104 use the security policy negotiation protocol in GB / T 15629.3-2014 to negotiate security policies, such as cryptographic algorithms and other policies. Furthermore, the first Ethernet security control terminal 103 sends an access activation frame to the second Ethernet security control terminal 104, and the access activation frame contains the digital certificate of the first Ethernet security control terminal 103; the second Ethernet security control terminal 104 sends a first access request containing its own digital certificate and the digital certificate of the first Ethernet security control terminal 103 to the certificate issuance and authentication server 101 for identity authentication; finally, unicast and multicast key negotiation is performed, and after the negotiation is passed, a secure channel is established, so that the first Ethernet security control terminal 103 and the second Ethernet security control terminal 104 use the secure channel to communicate confidentially.

[0061] Secondly, for the network line from the wireless access point 107 to the aggregation switch in the power substation room, this embodiment uses the Ethernet security terminal 106 and the third Ethernet security control terminal to perform link protection.

[0062] In the wired and wireless integrated network security system, the certificate issuance and authentication server 101 is also used to issue digital certificates for the third Ethernet security control terminal 105 and the Ethernet security terminal 106, so that the third Ethernet security control terminal 105 and the Ethernet security terminal 106 can establish a secure channel based on their own digital certificates and conduct confidential communication.

[0063] Exemplarily, the third Ethernet security control terminal 105 and the Ethernet security terminal 106 establish a security channel according to the following steps:

[0064] The Ethernet security terminal 106 and the third Ethernet security control terminal 105 discover each other and then negotiate security policies;

[0065] The Ethernet security terminal 106 sends a second access request to the third Ethernet security control terminal 105, where the second access request includes a digital certificate of the Ethernet security terminal 106;

[0066] The third Ethernet security control terminal 105 sends its own digital certificate and the digital certificate of the Ethernet security terminal 106 to the certificate issuance and authentication server 101 for authentication, and establishes a secure channel through unicast and multicast key negotiation.

[0067] Specifically, after the certificate issuance and authentication server 101 issues digital certificates to the Ethernet security terminal 106 and the third Ethernet security control terminal 105, the two discover each other, and the Ethernet security terminal 106 sends a start frame to the third Ethernet security control terminal 105; then, the Ethernet security terminal 106 negotiates security policies with the third Ethernet security control terminal 105, and the third Ethernet security control terminal 105 sends an access activation frame to the Ethernet security terminal 106, and the access activation frame contains the digital certificate of the third Ethernet security control terminal 105; then, the Ethernet security terminal 106 sends a second access request containing its own digital certificate and the digital certificate of the third Ethernet security control terminal 105 to the certificate issuance and authentication server 101 for identity authentication; then, unicast and multicast key negotiation is performed, and after the negotiation is successful, a secure channel is established.

[0068] In a third aspect, the present invention protects the network line between the wireless terminal and the wireless access point 107 in the following manner:

[0069] In the wired and wireless integrated network security system provided in the embodiment of the present invention, the certificate issuance and authentication server 101 is also used to issue digital certificates for the WAPI wireless terminal 108 and the wireless access point 107, so that the WAPI wireless terminal 108 and the wireless access point 107 can establish a secure channel and communicate confidentially.

[0070] Furthermore, the WAPI wireless terminal 108 and the wireless access point 107 establish a secure channel according to the following steps:

[0071] The wireless access point controller 102 remotely manages the wireless access point 107;

[0072] The wireless access point 107 is placed at the physical location of the Ethernet security terminal 106, and the WAPI wireless terminal 108 and the wireless access point 107 are securely associated;

[0073] The WAPI wireless terminal 108 sends a third access request to the wireless access point 107, where the third access request includes a digital certificate of the WAPI wireless terminal 108;

[0074] The wireless access point 107 sends the digital certificate of the WAPI wireless terminal 108 and its own digital certificate to the certificate issuance and authentication server 101 for authentication, and establishes a secure channel through unicast and multicast key negotiation.

[0075] Specifically, in this embodiment, the certificate issuance and authentication server 101 issues digital certificates for the WAPI wireless terminal 108 and the wireless access point 107, and distributes them accordingly. The digital certificates include a user certificate and an authentication server certificate, wherein the user certificate is a unique identity certificate, and the authentication server certificate is used to verify the legitimacy of the access result. The wireless access point controller 102 can remotely manage and control the wireless access point 107, such as installing digital certificates, updating key configuration, etc. The wireless access point 107 is physically placed together with the Ethernet security terminal 106. Next, the WAPI wireless terminal 108 and the wireless access point 107 are securely associated based on the national standard GB / T 15629.11-2003 / XG1-2006, and then the WAPI wireless terminal 108 initiates a third access request to the wireless access point 107. The wireless access point 107 sends its own digital certificate and the digital certificate of the WAPI wireless terminal 108 in the third access request to the certificate issuance and authentication server 101 for authentication, and then performs unicast and multicast key negotiation. After the negotiation is passed, a secure channel is established.

[0076] In order to facilitate understanding of the technical solution, the wireless and wired integration process of the wired and wireless integrated network security system provided by the present invention is further described below:

[0077] First, the certificate issuance and authentication server 101 issues digital certificates to the first Ethernet security control terminal 103, the second Ethernet security control terminal 104, the third Ethernet security control terminal 105, the Ethernet security terminal 106, the wireless access point 107 and the WAPI wireless terminal 108, and each of the above devices installs digital certificates respectively.

[0078] Then, the first Ethernet security control terminal 103 and the second Ethernet security control terminal 104 perform identity authentication with the assistance of the certificate issuance and authentication server 101. After the authentication is passed, confidential communication is performed between the first Ethernet security control terminal 103 and the second Ethernet security control terminal 104. Similarly, the third Ethernet security control terminal 105 and the Ethernet security terminal 106 perform identity authentication with the assistance of the certificate issuance and authentication server 101. After the authentication is passed, confidential communication is performed between the third Ethernet security control terminal 105 and the Ethernet security terminal 106; the wireless access point 107 and the WAPI wireless terminal 108 perform identity authentication with the assistance of the certificate issuance and authentication server 101. After the authentication is passed, confidential communication is performed between the wireless access point 107 and the WAPI wireless terminal 108.

[0079] Taking the case where the WAPI wireless terminal 108 is a WAPI video acquisition device 1081 as an example, when the WAPI video acquisition device 1081 transmits the collected substation video data back to the business main station of the local bureau, the video data is encrypted in the WAPI video acquisition device 1081, and is decrypted after reaching the wireless access point 107. The wireless access point 107 transmits the data in plain text to the Ethernet security terminal 106. The Ethernet security terminal 106 encrypts the data and transmits it to the third Ethernet security control terminal 105. The third Ethernet security control terminal 105 decrypts the data and passes it to the second Ethernet security control terminal 104 through the aggregation switch 109 of the station-side intranet. The second Ethernet security control terminal 104 encrypts the data and passes the data to the first Ethernet security control terminal 103 using a secure channel with the first Ethernet security control terminal 103. After the first Ethernet security control terminal 103 decrypts the data, it passes the video data to the business main station through the local bureau's internal network.

[0080] When the network management system needs to issue control commands to the WAPI video acquisition device 1081 of the substation for management, its management and control process is the reverse process of the data feedback of the above-mentioned WAPI video acquisition device 1081, so it will not be repeated here.

[0081] Figure 5 This is a flow chart of a method for establishing a wired and wireless integrated network security system provided by an embodiment of the present invention. Figure 1 , 5 , the embodiment of the present invention also provides a method for establishing a wired and wireless integrated network security system, which is applied to the above-mentioned wired and wireless integrated network security system;

[0082] The method includes:

[0083] S1, the first Ethernet security control terminal and the second Ethernet security control terminal perform identity authentication;

[0084] S2, the third Ethernet security control terminal is connected to the second Ethernet security control terminal through a network;

[0085] S3, the Ethernet security terminal performs identity authentication with the third Ethernet security control terminal;

[0086] S4, the wireless access point is connected to the Ethernet security terminal;

[0087] S5. The WAPI wireless terminal performs identity authentication through the wireless access point and accesses the network.

[0088] Compared with the prior art, the present invention has the following beneficial effects:

[0089] The present invention provides a wired and wireless integrated network security system and a network construction method thereof, which protects the wireless link through a WAPI wireless terminal and connects the wired and wireless links through an Ethernet security terminal, thereby ensuring the security of the connection point between the wireless network and the wired network; at the same time, the optical fiber link between the station end and the management end is reinforced using an Ethernet security control terminal, and a digital certificate mechanism is used for identity authentication, and confidential communication is achieved based on a national secret algorithm. Therefore, the network security system and network construction method provided by the present invention can prevent illegal access to the network of the substation, have anti-repudiation, and can ensure the confidentiality and integrity of the data, thereby reinforcing the fragile communication links in the substation, and facilitating unified management of operation and maintenance, effectively reducing the equipment investment cost and management cost.

[0090] In the description of the present invention, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of the present invention, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0091] The description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine different embodiments or examples described in this specification.

[0092] Although the present application is described herein in conjunction with various embodiments, in the process of implementing the present application for which protection is sought, a person skilled in the art may understand and implement other variations of the disclosed embodiments by reviewing the drawings, the disclosure, and the appended claims.

[0093] The above contents are further detailed descriptions of the present invention in combination with specific preferred embodiments, and it cannot be determined that the specific implementation of the present invention is limited to these descriptions. For ordinary technicians in the technical field to which the present invention belongs, several simple deductions or substitutions can be made without departing from the concept of the present invention, which should be regarded as falling within the protection scope of the present invention.

Claims

1. A wired and wireless integrated network security system, characterized in that: include: A management end and a station end, wherein the management end includes a certificate issuance and authentication server, a wireless access point controller and a first Ethernet security control end, and the station end includes a second Ethernet security control end, a third Ethernet security control end, an Ethernet security terminal, a wireless access point and a WAPI wireless terminal; wherein, The certificate issuance and authentication server is used to perform certificate management and identity authentication on the first Ethernet security control terminal, the second Ethernet security control terminal, the third Ethernet security control terminal, the Ethernet security terminal, the WAPI wireless terminal and the wireless access point; The wireless access point controller is used to manage the wireless access point; The first Ethernet security control terminal is used to serve as an authentication access controller and perform identity authentication with the second Ethernet security control terminal; The second Ethernet security control terminal is used to perform identity authentication with the first Ethernet security control terminal as a requester; The third Ethernet security control terminal is used as an authentication access controller to authenticate the Ethernet security terminal.

2. The wired and wireless integrated network security system according to claim 1, characterized in that: The certificate issuance and authentication server is specifically used to issue digital certificates to the first Ethernet security control terminal and the second Ethernet security control terminal, so that the first Ethernet security control terminal and the second Ethernet security control terminal establish a secure channel based on their own digital certificates and perform confidential communication.

3. The wired and wireless integrated network security system according to claim 2, characterized in that: The first Ethernet security control terminal and the second Ethernet security control terminal establish a security channel according to the following steps: The first Ethernet security control terminal and the second Ethernet security control terminal perform security policy negotiation after discovering each other; The first Ethernet security control terminal sends a first access request to the second Ethernet security control terminal, where the first access request includes a digital certificate of the first Ethernet security control terminal; The second Ethernet security control terminal sends its own digital certificate and the digital certificate of the first Ethernet security control terminal to the certificate issuance and authentication server for authentication, and establishes a secure channel through unicast and multicast key negotiation.

4. The wired and wireless integrated network security system according to claim 3, characterized in that: The first Ethernet security control terminal and the second Ethernet security control terminal discover each other based on the neighbor node discovery protocol in GB / T 15629.3-2014.

5. The wired and wireless integrated network security system according to claim 4, characterized in that: The first Ethernet security control terminal and the second Ethernet security control terminal perform security policy negotiation using the security policy negotiation protocol in GB / T 15629.3-2014.

6. The wired and wireless integrated network security system according to claim 2, characterized in that: The certificate issuance and authentication server is also used to issue digital certificates to the third Ethernet security control terminal and the Ethernet security terminal, so that the third Ethernet security control terminal and the Ethernet security terminal establish a secure channel based on their own digital certificates and perform confidential communication.

7. The wired and wireless integrated network security system according to claim 6, characterized in that: The third Ethernet security control terminal and the Ethernet security terminal establish a security channel according to the following steps: The Ethernet security terminal and the third Ethernet security control terminal perform security policy negotiation after discovering each other; The Ethernet security terminal sends a second access request to the third Ethernet security control terminal, where the second access request includes a digital certificate of the Ethernet security terminal; The third Ethernet security control terminal sends its own digital certificate and the digital certificate of the Ethernet security terminal to the certificate issuance and authentication server for authentication, and establishes a secure channel through unicast and multicast key negotiation.

8. The wired and wireless integrated network security system according to claim 6, characterized in that: The certificate issuance and authentication server is also used to issue digital certificates to the WAPI wireless terminal and the wireless access point, so that the WAPI wireless terminal and the wireless access point can establish a secure channel and perform confidential communication.

9. The wired and wireless integrated network security system according to claim 8, characterized in that: The WAPI wireless terminal and the wireless access point establish a secure channel according to the following steps: The wireless access point controller remotely manages the wireless access point; Placing the wireless access point at the physical location of the Ethernet security terminal, and performing security association between the WAPI wireless terminal and the wireless access point; The WAPI wireless terminal sends a third access request to the wireless access point, where the third access request includes a digital certificate of the WAPI wireless terminal; The wireless access point sends the digital certificate of the WAPI wireless terminal and its own digital certificate to the certificate issuance and authentication server for authentication, and establishes a secure channel through unicast and multicast key negotiation.

10. A method for establishing a wired and wireless integrated network security system, characterized in that: The wired and wireless integrated network security system applied to any one of claims 1 to 9; The method includes: The first Ethernet security control terminal and the second Ethernet security control terminal perform identity authentication; The third Ethernet security control terminal is connected to the second Ethernet security control terminal through a network; The Ethernet security terminal performs identity authentication with the third Ethernet security control terminal; The wireless access point is connected to the Ethernet security terminal through a network; The WAPI wireless terminal performs identity authentication through the wireless access point and accesses the network.

Images