Optical transmission network security risk analysis system and defense method

Abstract

The invention discloses an optical transmission network security risk analysis system and defense method, and the system comprises a risk analysis system which comprises a defense model platform, a communication security defense platform, a physical risk analysis platform, a defense measure platform, and a step-by-step analysis platform. According to the invention, the defense measure platform is set to carry out risk defense on the optical transmission network in real time, the password strategy module adopts a strong password and periodically changes the password so as to prevent a hacker from illegal access by using a password cracking technology, and the security management module establishes a security management system and a security training mechanism, so that the network security awareness is improved, and the security management capability is enhanced; the defense model platform carries out situation awareness, multi-factor identity authentication, starting of access control lists of network management and equipment and integrity detection, a security version communication protocol is used between the equipment and the network management, the equipment is forbidden to have a command line, even if a single point is physically contacted, the single point cannot be controlled, and the risk prevention and control requirements of people are met.

Description

Technical Field

[0001] The present invention relates to the field of optical fiber communication technology, and in particular to an optical transmission network security risk analysis system and a defense method. Background Art

[0002] The power communication network is the nervous system of the power grid and the core infrastructure of the power system. Under the background of building a new power system and digital power grid, the power grid is becoming more and more complex. The production control, management and operation of the power grid are highly dependent on the power communication network to provide highly reliable, wide-coverage, large-bandwidth and flexible access communication channels; SDH and OTN (OSU) optical transmission network is the physical layer foundation of the power communication network, directly carrying the power grid production real-time control business dedicated line, and is also the basic bearing network for other power communication subsystems such as dispatching data network, integrated data network, video conferencing, telephone exchange, etc. If the optical transmission network is interrupted, the impact on the business is very large, directly threatening the safety of the power grid. Therefore, the optical transmission network is the basis for the safe and stable operation of the power grid, and security protection is extremely important. The optical transmission network has three advantages in ensuring the security of the business network: SDH and OTN (OSU) optical transmission network Using circuit time division multiplexing based on fixed time slots, the circuits are physically isolated, the services between different circuits will not be interconnected, and network attacks cannot use the optical transmission network to spread horizontally in the service system; if application system 1 is attacked, the network attack will not spread horizontally to application system 2 through the optical transmission network; the management plane and the transmission plane are physically isolated, and the breach of the service side will not lead to illegal control of the optical transmission network; the service port and the management port on the device are completely isolated, and the service data will not enter the management plane. The failure of the network management system or the management plane of the device will only cause the device to be out of management, and will not cause service interruption. If the application system is attacked, the network attack will not spread to the network management system through the optical transmission network; the data flow direction of the optical transmission network carrying the service is only determined by the cross-connection configuration of the device by the network management, and the tampering of the service data content will not change its flow direction. After the optical transmission dedicated line is established, as long as the network management does not modify the route, the service data will always be transmitted along the dedicated line; the two stations of the application system communicate point-to-point through the optical transmission dedicated line, and the data flow direction is fixed, and the data flow direction will not be changed in the optical transmission network, so that the information can be stolen or tampered.

[0003] The optical transmission network management is physically isolated from the Internet, and data from the Internet will not enter the network management. Some business systems carried by the optical transmission network are connected to the Internet, and data from the Internet will only be within the transmission plane. Because the management plane and the transmission plane are physically isolated, data from the Internet will not enter the network management through the business channel. The biggest network security threat faced by the optical transmission network is to control the entire transmission network management through a single point of physical access.

[0004] However, traditional optical transmission networks have the following disadvantages:

[0005] Traditional optical transmission networks lack situational awareness of network attack threats. Network management alarms are only for physical failures such as equipment failures and optical cable failures. There is no effective supervision of events that threaten network security, such as abnormal logins to devices and network management, file access and modification, and unauthorized process startup, which affects the normal use of optical transmission networks. Summary of the invention

[0006] The purpose of the present invention is to provide an optical transmission network security risk analysis system and defense method to solve the problem raised in the above background technology that the traditional optical transmission network lacks the situational awareness capability of network attack threats, and the network management alarm is only for physical failures such as equipment failure and optical cable failure. There is no effective supervision on events that threaten network security such as abnormal login to equipment and network management, file access and modification, and unauthorized process startup, which affects the normal use of the optical transmission network.

[0007] To achieve the above-mentioned purpose, the present invention provides the following technical solutions: an optical transmission network security risk analysis system, comprising a risk analysis system, wherein the risk analysis system comprises a defense model platform, a communication security defense platform, a physical risk analysis platform, a defense measures platform and a step-by-step analysis platform.

[0008] As a preferred technical solution of the present invention, the defense model platform includes a defense-in-depth model module, an information assurance model module, a layered protection model module and an information flow model module;

[0009] The basic idea of ​​the in-depth defense model module is to organically combine information network security protection measures, deploy appropriate security measures for the protection objects, form multiple protection lines, and each security protection measure supports and remediates each other to block the threat of attackers. At present, the security community believes that the four security protection lines that need to be established in the network are the first line of defense of the network, which prevents intrusion and harm to the network; security monitoring is the second line of defense of the network, which promptly detects intrusion and damage; real-time response is the third line of defense of the network, which maintains the network when an attack occurs; recovery is the fourth line of defense of the network, which enables the network to "resurrect" at the fastest speed after being attacked, and minimizes the losses caused by security incidents. The layered protection model module targets individual protection nodes and uses the OSI7-layer model as a reference to perform layered protection on the protection objects. The typical protection layers are physical layer, network layer, system layer, application layer, user layer, and management layer. Then, for the security threats at each layer, appropriate security measures are deployed for layered protection. The information flow model module is a deformation of the access control model, referred to as FM, which is used to analyze the covert channels of the system to prevent sensitive information from leaking through covert channels.

[0010] As a preferred technical solution of the present invention, the information assurance model module includes a PDRR model submodule, a P2DR model submodule and a WPDRRC model submodule;

[0011] The PDRR model sub-modules include protection, detection, recovery, and response. The P2DR model sub-modules include policy, protection, detection, and response. The WPDRRC model sub-modules include policy, protection, detection, and response. The WPDRRC model sub-modules include warning, protection, detection, response, recovery, and counterattack.

[0012] As a preferred technical solution of the present invention, the communication security defense platform includes an information collection module, a defense line identification module, a reliability evaluation module, a fault monitoring module and a fault analysis library;

[0013] The information collection module collects information on the wide-area optical transmission network. The defense line identification module identifies the prevention line, emergency response line, correction control line and recovery line of the optical transmission network. The reliability evaluation module evaluates the reliability of the optical transmission network communication network. The fault monitoring module monitors whether the optical transmission network is in a fault state. The fault analysis library inputs the monitored fault data and connects to the fault analysis expert and searches for fault parameters in the analysis library for comparison.

[0014] As a preferred technical solution of the present invention, the physical risk analysis platform includes a display module, a processing module, a storage module, an I / O interface and an information identification device, wherein the information identification device is connected to the I / O interface, and the I / O interface, the storage module and the display module are all connected to the processing module;

[0015] The display module visually displays the risk analysis results, the processing module processes the status and information of the connection between the information identification device and the IO interface, the storage module stores the risk analysis data, the I / O interface facilitates the connection of the information identification device, and the information identification device is installed on one side of the optical transmission network to identify the information security of the optical transmission network.

[0016] As a preferred technical solution of the present invention, the defense measures platform includes a password policy module, a data encryption module, an access control module and a security management module;

[0017] The password policy module uses strong passwords and changes them regularly to prevent hackers from using password cracking technology to gain illegal access. The data encryption module encrypts sensitive data to prevent data leakage in the event that data is intercepted on the network. The access control module sets access rights and permission levels for devices and users in the network, prohibiting unauthorized users from accessing the network. The security management module establishes a security management system and security training mechanism to improve network security awareness and enhance security management capabilities.

[0018] As a preferred technical solution of the present invention, the step-by-step analysis platform includes a connection judgment module, an interface shielding module, an interface release module and a result evaluation module;

[0019] The connection judgment module judges the network connection status between network devices. The interface shielding module shields the physical interface of the network device if the network devices maintain network connection with each other. The interface release module releases the shielded physical interface of the network device if the network devices disconnect with each other. The result evaluation module intuitively evaluates and displays the judged information.

[0020] The present invention provides a method for defending against security risks of an optical transmission network, comprising the following steps:

[0021] Step 1: Connection status analysis: The level-by-level analysis platform analyzes whether the equipment required by the optical transmission network is connected level by level;

[0022] Step 2: Information status analysis: The physical risk analysis platform analyzes the information status transmitted in the optical transmission network equipment;

[0023] Step 3: Communication status analysis: The communication security defense platform analyzes the communication status within the optical transmission network equipment;

[0024] Step 4: Real-time defense: The defense model platform and defense measures platform perform risk defense on the optical transmission network in real time.

[0025] Compared with the prior art, the present invention has the following beneficial effects:

[0026] 1. The risk defense of the optical transmission network is carried out in real time by setting up a defense measure platform. The password policy module adopts strong passwords and changes them regularly to prevent hackers from using password cracking technology to conduct illegal access. The data encryption module encrypts sensitive data to prevent data leakage in the case of data interception on the network. The access control module sets access rights and permission levels for devices and users in the network, prohibiting unauthorized users from accessing the network. The security management module establishes a security management system and security training mechanism to improve network security awareness and enhance security management capabilities;

[0027] 2. The defense model platform performs situational awareness, multi-factor identity authentication, enables access control lists for network management and devices, and integrity detection. A secure version of the communication protocol is used between the device and the network management. Command lines are prohibited on the device. Even if a single point is physically contacted, it cannot be controlled, thus meeting people's risk prevention and control needs. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 is a schematic diagram of the architecture of the risk analysis system of the present invention;

[0029] Figure 2 It is a schematic diagram of the architecture of the defense model platform of the present invention;

[0030] Figure 3 This is a schematic diagram of the architecture of the communication security defense platform of the present invention;

[0031] Figure 4 It is a schematic diagram of the architecture of the physical risk analysis platform of the present invention;

[0032] Figure 5 It is a schematic diagram of the architecture of the defense measure platform of the present invention;

[0033] Figure 6 It is a schematic diagram of the architecture of the step-by-step analysis platform of the present invention;

[0034] Figure 7 It is a flow chart of the present invention.

[0035] In the figure: 1. Risk analysis system; 2. Defense model platform; 21. In-depth defense model module; 22. Information assurance model module; 221. PDRR model submodule; 222. P2DR model submodule; 223. WPDRRC model submodule; 23. Layered protection model module; 24. Information flow model module; 3. Communication security defense platform; 31. Information acquisition module; 32. Defense line identification module; 33. Reliability evaluation module; 34. Fault monitoring module; 35. Fault analysis library; 4. Physical risk analysis platform; 41. Display module; 42. Processing module; 43. Storage module; 44. I / O interface; 45. Information identification device; 5. Defense measures platform; 51. Password policy module; 52. Data encryption module; 53. Access control module; 54. Security management module; 6. Level-by-level analysis platform; 61. Connection judgment module; 62. Interface shielding module; 63. Interface release module; 64. Result evaluation module. DETAILED DESCRIPTION

[0036] The following will be combined with the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0037] See also Figure 1-7 The present invention provides an optical transmission network security risk analysis system, including a risk analysis system 1, the risk analysis system 1 includes a defense model platform 2, a communication security defense platform 3, a physical risk analysis platform 4, a defense measure platform 5 and a step-by-step analysis platform 6.

[0038] The defense model platform 2 includes a defense-in-depth model module 21, an information assurance model module 22, a layered protection model module 23, and an information flow model module 24;

[0039] The basic idea of ​​the in-depth defense model module 21 is to organically combine the information network security protection measures, deploy appropriate security measures for the protection objects, form multiple protection lines, and each security protection measure supports and remediates each other to block the threat of attackers. At present, the security community believes that the four security protection lines that need to be established in the network are the first line of defense of the network, which prevents intrusion and harm to the network; security monitoring is the second line of defense of the network, which promptly detects intrusion and damage; real-time response is the third line of defense of the network, which maintains the network when an attack occurs; recovery is the fourth line of defense of the network, which enables the network to "resurrect" as quickly as possible after being attacked, and minimizes the losses caused by security incidents. The layered protection model module 23 targets individual protection nodes and uses the OSI 7-layer model as a reference to perform layered protection on the protection objects. The typical protection layers are physical layer, network layer, system layer, application layer, user layer, and management layer. Then, for the security threats at each layer, appropriate security measures are deployed to perform layered protection. The information flow model module 24 is a variant of the access control model, referred to as FM, which is used to analyze the covert channels of the system to prevent sensitive information from leaking through covert channels.

[0040] The information assurance model module 22 includes a PDRR model submodule 221, a P2DR model submodule 222, and a WPDRRC model submodule 223;

[0041] The PDRR model submodule 221 includes protection, detection, recovery, and response. The P2DR model submodule 222 includes policy, protection, detection, and response. The 2+ adaptive security model ASA predicts protection, detection, and response. The WPDRRC model submodule 223 performs early warning, protection, detection, response, recovery, and counterattack.

[0042] The communication security defense platform 3 includes an information collection module 31, a defense line identification module 32, a reliability evaluation module 33, a fault monitoring module 34 and a fault analysis library 35;

[0043] The information collection module 31 collects information on the wide area optical transmission network, the defense line identification module 32 identifies the prevention line, emergency response line, correction control line and recovery line of the optical transmission network, the reliability evaluation module 33 evaluates the reliability of the optical transmission network communication network, the fault monitoring module 34 monitors whether the optical transmission network is in a fault state, and the fault analysis library 35 inputs the monitored fault data and connects to the fault analysis expert and searches for fault parameters in the analysis library for comparison.

[0044] The physical risk analysis platform 4 includes a display module 41, a processing module 42, a storage module 43, an I / O interface 44 and an information identification device 45, wherein the information identification device 45 is connected to the I / O interface 44, and the I / O interface 44, the storage module 43 and the display module 41 are all connected to the processing module 42;

[0045] The display module 41 visually displays the risk analysis results, the processing module 42 processes the status and information of the connection between the information identification device and the IO interface, the storage module 43 stores the risk analysis data, and the I / O interface 44 facilitates the connection of the information identification device 45. The information identification device 45 is installed on one side of the optical transmission network to identify the information security of the optical transmission network.

[0046] The defense measures platform 5 includes a password policy module 51, a data encryption module 52, an access control module 53 and a security management module 54;

[0047] The password policy module 51 uses strong passwords and changes them regularly to prevent hackers from using password cracking technology to gain illegal access. The data encryption module 52 encrypts sensitive data to prevent data leakage when data is intercepted on the network. The access control module 53 sets access rights and permission levels for devices and users in the network to prohibit unauthorized users from accessing the network. The security management module 54 establishes a security management system and security training mechanism to improve network security awareness and enhance security management capabilities.

[0048] The step-by-step analysis platform 6 includes a connection judgment module 61, an interface shielding module 62, an interface release module 63 and a result evaluation module 64;

[0049] The connection judgment module 61 judges the network connection status between network devices. The interface shielding module 62 shields the physical interface of the network device if the network devices maintain network connection with each other. The interface releasing module 63 releases the shielded physical interface of the network device if the network devices disconnect with each other. The result evaluation module 64 intuitively evaluates and displays the judgment information.

[0050] The present invention provides a method for defending against security risks of an optical transmission network, comprising the following steps:

[0051] Step 1: Connection status analysis: The level-by-level analysis platform 6 analyzes whether the equipment required by the optical transmission network is connected level by level;

[0052] Step 2: Information status analysis: The physical risk analysis platform 4 analyzes the information status transmitted in the optical transmission network equipment;

[0053] Step 3: Communication status analysis: The communication security defense platform 3 analyzes the communication status in the optical transmission network equipment;

[0054] Step 4: Real-time defense: The defense model platform 2 and the defense measure platform 5 perform risk defense on the optical transmission network in real time.

[0055] In the present invention, the step-by-step analysis platform 6 analyzes whether the equipment required by the optical transmission network is connected step by step; the connection judgment module 61 judges the network connection status between the network equipment and the network equipment, the interface shielding module 62 shields the physical interface of the network equipment if the network equipment and the network equipment maintain network connection, and the interface release module 63 disconnects the network connection between the network equipment and the network equipment, and releases the shielded physical interface of the network equipment. The result evaluation module 64 visually evaluates and displays the judged information, and the physical risk analysis platform 4 analyzes the information status transmitted in the optical transmission network equipment; the display module 41 visually displays the risk analysis results, and the processing module 42 processes the status and information of the connection between the information identification device and the IO interface, and stores Module 43 stores risk analysis data, I / O interface 44 facilitates connection of information identification device 45, information identification device 45 is installed on one side of the optical transmission network to identify the information security of the optical transmission network, communication security defense platform 3 analyzes the communication status in the optical transmission network equipment; information collection module 31 collects information of the wide area optical transmission network, defense line identification module 32 identifies the prevention line, emergency response line, correction control line and recovery line of the optical transmission network, reliability evaluation module 33 evaluates the reliability of the optical transmission network communication network, fault monitoring module 34 monitors whether the optical transmission network is in a fault state, fault analysis library 35 inputs the monitored fault data and connects to the fault analysis expert and Find fault parameters in the analysis library for comparison. The defense model platform 2 and the defense measures platform 5 perform risk defense on the optical transmission network in real time. The password policy module 51 uses strong passwords and changes them regularly to prevent hackers from using password cracking technology for illegal access. The data encryption module 52 encrypts sensitive data to prevent data leakage when data is intercepted on the network. The access control module 53 sets access rights and authority levels for devices and users in the network, prohibiting unauthorized users from accessing the network. The security management module 54 establishes a security management system and security training mechanism to improve network security awareness and enhance security management capabilities. The defense model platform 2 is aware of the situation, and an intrusion detection system is installed to perform real-time security monitoring of ports, processes, and files. All-round supervision, especially the formation of alarms for network management and device login events; multi-factor identity authentication, using network management UKEY + biometric information identification, unauthorized personnel cannot log in to the network management; digital certificate verification of new network devices, tampered devices cannot pass the verification and cannot access the optical transmission network, enable access control lists for network management and devices, and two-person permission for high-risk operations (bank vault mode); four integrity detection, hardware built-in trusted root, hardware trusted root and software integrity verification are performed step by step during startup, and software version package integrity detection is performed to avoid the implantation of viruses and Trojans; encryption, identity authentication sensitive data is encrypted and stored, and a secure version of the communication protocol is used between the device and the network management, and communication data is encrypted to prevent key information from being obtained through databases and communication packet capture;Reduce the exposure surface. The network management on the device is closed by default and the three-layer forwarding is prohibited. The device closes the remote login and prohibits the existence of command lines on the device. Even if you physically contact a single point, you cannot control the single point. ;

[0056] Although the present invention has been described in detail with reference to the aforementioned embodiments, it is still possible for those skilled in the art to modify the technical solutions described in the aforementioned embodiments, or to make equivalent substitutions for some of the technical features therein. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. An optical transmission network security risk analysis system, comprising a risk analysis system (1), characterized in that: The risk analysis system (1) comprises a defense model platform (2), a communication security defense platform (3), a physical risk analysis platform (4), a defense measures platform (5) and a step-by-step analysis platform (6).

2. The optical transmission network security risk analysis system according to claim 1, characterized in that: The defense model platform (2) comprises a defense-in-depth model module (21), an information assurance model module (22), a layered protection model module (23) and an information flow model module (24).

3. The optical transmission network security risk analysis system according to claim 2, characterized in that: The information assurance model module (22) includes a PDRR model submodule (221), a P2DR model submodule (222) and a WPDRRC model submodule (223).

4. The optical transmission network security risk analysis system according to claim 1, characterized in that: The communication security defense platform (3) comprises an information collection module (31), a defense line identification module (32), a reliability evaluation module (33), a fault monitoring module (34) and a fault analysis library (35).

5. The optical transmission network security risk analysis system according to claim 1, characterized in that: The physical risk analysis platform (4) comprises a display module (41), a processing module (42), a storage module (43), an I / O interface (44) and an information identification device (45), wherein the information identification device (45) is connected to the I / O interface (44), and the I / O interface (44), the storage module (43) and the display module (41) are all connected to the processing module (42).

6. The optical transmission network security risk analysis system according to claim 1, characterized in that: The defense measure platform (5) comprises a password policy module (51), a data encryption module (52), an access control module (53) and a security management module (54).

7. The optical transmission network security risk analysis system according to claim 1, characterized in that: The step-by-step analysis platform (6) comprises a connection judgment module (61), an interface shielding module (62), an interface releasing module (63) and a result evaluation module (64).

8. A method for defending against security risks of an optical transmission network, characterized in that: The following steps are involved: Step 1: Connection status analysis: The level-by-level analysis platform (6) analyzes whether the equipment required by the optical transmission network is connected level by level; Step 2: Information status analysis: The physical risk analysis platform (4) analyzes the information status transmitted in the optical transmission network equipment; Step 3: Communication status analysis: The communication security defense platform (3) analyzes the communication status within the optical transmission network equipment; Step 4: Real-time defense: The defense model platform (2) and the defense measure platform (5) perform risk defense on the optical transmission network in real time.

Images