Network security protection system of power monitoring system

Abstract

According to the network security protection system of the electric power monitoring system provided by the invention, USB security isolation devices are deployed in a security area I and a security area II, security isolation and virus detection are carried out on accessed USB equipment, it is ensured that only authenticated equipment is allowed to carry out data exchange, and virus and Trojan horse transmission through a USB interface is avoided; a malicious code monitoring system is deployed in the safety area II, the data traffic in the network is monitored in real time, whether malicious codes, Trojan horses or viruses invade or not is detected, early warning can be automatically given out, and malicious attacks are timely prevented; a special portable operation and maintenance gateway is configured, an approach for operation and maintenance personnel to remotely access the power monitoring system is provided, and an encryption authentication mechanism is adopted to ensure the safety of system operation. Besides, a firewall is deployed between the safety zone I and the safety zone II and is responsible for filtering cross-zone data streams, preventing illegal access and data transmission and preventing unauthorized access and invasion of malicious data packets.

Description

Technical Field

[0001] The present application relates to the technical field of electric power monitoring, and in particular to a network security protection system for an electric power monitoring system. Background Art

[0002] In recent years, the digital transformation process of key industries such as global energy and electricity, industrial enterprises, etc. has accelerated. New-generation information technologies represented by big data, cloud computing, artificial intelligence, etc. have fully penetrated into the fields of energy and electricity, and industrial enterprises. The degree of openness of the production process has gradually deepened, and the business has flourished.

[0003] With the acceleration of the digitalization and automation of modern power systems, power monitoring systems have been widely used in power production, substations, distribution networks and other links to achieve real-time monitoring and control of power equipment. However, the accompanying network architecture design and construction are becoming more and more complex, and the number of network assets to be managed is increasing. As a result, illegal access to peripherals, unauthorized access, mixed and misconnected connections are emerging in an endless stream, causing serious troubles to network access management and greatly increasing the potential risks of network security.

[0004] Therefore, how to effectively protect the power monitoring system from external malicious intrusion and internal security risks has become a technical problem that power companies urgently need to solve. Summary of the invention

[0005] In response to the above problems, the present application provides a network security protection system for an electric power monitoring system, which is used to protect the electric power monitoring system from network security threats such as malicious attacks, virus infections, and unauthorized access during operation.

[0006] To achieve the purpose of this application, this application provides the following technical solutions:

[0007] The present application provides a network security protection system for a power monitoring system, including a USB security isolation device, located in the security zone I and the security zone II, for securely isolating data of an external USB device to prevent the intrusion of viruses or malicious codes;

[0008] Malicious code monitoring system, located in Security Zone II, is used to detect malicious code in the network in real time and provide security warnings;

[0009] The firewall is located between security zone I and security zone II to ensure data security isolation between the two zones and prevent improper network communication or attacks.

[0010] The portable operation and maintenance gateway, located in Security Zone II, is used for secure remote operation and maintenance operations, ensuring that only authorized personnel can safely perform network operation and maintenance through encrypted authentication.

[0011] In one possible implementation, the USB security isolation device has virus scanning and data transmission filtering functions, performs virus detection and elimination on connected mobile media, and only allows data transmission that complies with security policies.

[0012] In one possible implementation, the malicious code monitoring system includes a real-time scanning module and an emergency response module, wherein the real-time scanning module is used to detect malicious codes in the network, and the emergency response module is used to provide alarm information when an abnormality is found.

[0013] In one possible implementation, the portable operation and maintenance gateway is connected to the power monitoring network through an encrypted channel, supports network configuration and data transmission through authorized operation and maintenance equipment, and ensures the security of operation and maintenance operations.

[0014] In one possible implementation, the firewall includes an access control module and a data filtering module, which are used to manage access rights between different security areas and filter illegal or malicious data flows.

[0015] In one possible implementation, the malicious code monitoring system further includes a traffic monitoring module for performing real-time analysis on network traffic, detecting potential malicious attack behaviors, and issuing alarms in a timely manner for disposal.

[0016] In one possible implementation, the portable operation and maintenance gateway also has log recording and auditing functions, which can record all behaviors during the operation and maintenance operation in real time to facilitate future security auditing and tracking.

[0017] In one possible implementation, the security zone I is used to store core monitoring equipment, and the internal network and external network are strictly isolated to restrict access by unauthorized devices; the security zone II is used for interaction with the external network, and strict traffic control and monitoring are implemented.

[0018] In one possible implementation, the network communication between the security zone I and the security zone II uses segment management and encryption technology to ensure that cross-region data exchange is carried out under strict security control.

[0019] In one possible implementation, the safety zone I includes an NCS operator station for performing system operation and status monitoring; an NCS engineer station for engineering maintenance, configuration and debugging; synchronous vector equipment for phasor synchronization monitoring of the power system; five-protection equipment for preventing misoperation and ensuring operation safety; protection and measurement and control equipment for monitoring and protecting power parameters and equipment; measurement and control devices and telecontrol devices for remote monitoring and control of data transmission; NCS servers and switches for providing data storage, processing and communication functions;

[0020] The safety zone II includes a protection substation for realizing the protection function of the power grid and equipment; a fault recording device for real-time recording and analysis of fault data; an electric quantity collection device for collecting power grid parameters such as voltage, current, and power; and a switch for network communication connection of equipment inside the safety zone II.

[0021] Beneficial effects of the embodiments of the present application:

[0022] The network security protection system of a power monitoring system provided by the present application deploys USB security isolation devices in the safety zone I and the safety zone II of the production control area respectively. The device performs virus scanning and data transmission filtering on the connected external USB devices, effectively preventing malicious codes such as viruses and Trojans from invading the system through external devices, and reducing the network security risks caused by external physical devices; deploys a malicious code monitoring system in the safety zone II to monitor the data flow in the network in real time, detect whether there is malicious code, Trojans or virus invasion, and can automatically issue early warnings to prevent malicious attacks in time; configures a dedicated portable operation and maintenance gateway to provide operation and maintenance personnel with a way to remotely access the power monitoring system. The operation and maintenance gateway adopts an encryption authentication mechanism, and only authorized operation and maintenance personnel can perform system maintenance through the gateway to ensure the safety of system operation. In addition, a firewall is deployed between the safety zone I and the safety zone II. The firewall is responsible for filtering cross-zone data flows, preventing illegal access and data transmission, and preventing unauthorized access and the invasion of malicious data packets. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0024] Figure 1 A schematic diagram of the structure of a network security protection system for an electric power monitoring system provided in an embodiment of the present application. DETAILED DESCRIPTION

[0025] In order to make the purpose, technical solutions and advantages of this application clearer, the technical solutions in this application will be clearly and completely described below in conjunction with the drawings in this application. Obviously, the described embodiments are part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0026] The terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features; in the description of this application, unless otherwise specified, "plurality" means two or more.

[0027] Embodiment 1:

[0028] The present application provides a network security protection system for a power monitoring system, including a USB security isolation device, located in the security zone I and the security zone II, for securely isolating data of an external USB device to prevent the intrusion of viruses or malicious codes;

[0029] Malicious code monitoring system, located in Security Zone II, is used to detect malicious code in the network in real time and provide security warnings;

[0030] The firewall is located between security zone I and security zone II to ensure data security isolation between the two zones and prevent improper network communication or attacks.

[0031] The portable operation and maintenance gateway, located in Security Zone II, is used for secure remote operation and maintenance operations, ensuring that only authorized personnel can safely perform network operation and maintenance through encrypted authentication.

[0032] Specifically, the two ends of the USB security isolation device in security zone I are connected between two NCS switches to limit unauthorized USB device access and record access behavior. The two ends of the USB security isolation device in security zone II are connected between two switches to limit the access of USB devices in security zone II and record behavior. The malicious code monitoring system and portable operation and maintenance gateway are connected between the two switches in security zone II.

[0033] In one possible implementation, the USB security isolation device has virus scanning and data transmission filtering functions, performs virus detection and elimination on connected mobile media, and only allows data transmission that complies with security policies.

[0034] It is understandable that real-time virus detection is performed on connected USB mobile devices (such as USB flash drives, mobile hard disks, etc.) to prevent malicious programs from spreading to industrial control systems through mobile media.

[0035] Specifically, when a USB device is connected, the security isolation device automatically enables the built-in antivirus engine to perform a comprehensive scan of the files in the USB device. Using the latest virus database and malicious program feature database (which needs to be updated regularly), it can effectively identify known viruses, Trojans, malicious scripts and other threats. During the scanning process, any detected threat files will be isolated or deleted to ensure that malicious programs cannot enter the industrial control system.

[0036] It is understandable that the data transmitted by the connected USB device is filtered to allow only data that complies with the preset security policy to pass, thereby preventing unnecessary data from being transmitted to the system.

[0037] Specifically, for file type filtering, by setting the file types allowed to be transmitted (such as only allowing PDF, TXT, DOCX, etc.), unknown file types or file types that are not in the whitelist are rejected; file content detection, in-depth inspection of file content, identification of hidden malicious code or scripts; permission control, according to the user permissions set by the system, only authorized users are allowed to complete file transfer operations, and the details of each transfer operation (such as time, user, file name, etc.) are recorded in real time; two-way filtering, external device upload: only files that comply with security policies are allowed to enter the industrial control network, internal device download: data transmitted from the industrial control network to the USB device is screened to avoid leakage of sensitive information.

[0038] It can be further understood that every time a USB device is connected, scanned, and all data transfer operations are recorded in the log to facilitate subsequent security audits and tracking.

[0039] In the above implementation, through virus scanning, viruses, Trojans and other malicious programs in USB devices can be effectively intercepted to ensure the safe operation of the production control system; through the data transmission filtering function, unnecessary or potential risk data can be prevented from entering the system, preventing system failures caused by misoperation or malicious behavior; all access behaviors are recorded to facilitate the operation and maintenance team to manage the access and use of USB devices.

[0040] In one possible implementation, the malicious code monitoring system includes a real-time scanning module and an emergency response module, wherein the real-time scanning module is used to detect malicious codes in the network, and the emergency response module is used to provide alarm information when an abnormality is found.

[0041] It is understandable that the real-time scanning module detects potential malicious code or abnormal behavior in a timely manner by continuously scanning communication data, file transfers and system processes within the network.

[0042] Specifically, traffic monitoring: analyze the data flow within the network, identify abnormal communication patterns (such as frequent unknown IP access or abnormal port requests) and potential malicious code; file detection: check the files transmitted in the network, deeply analyze the content of the files, and identify malicious code (such as viruses, Trojans, ransomware, etc.) through virus signature libraries or AI algorithms; process monitoring: monitor system processes in real time on key hosts, identify unknown processes or malicious code injections, and detect whether process behavior complies with security policies (such as whether it attempts to access sensitive areas); dynamic update: regularly update the virus signature library through a network connection or offline to ensure the ability to identify the latest threats.

[0043] It is understandable that when the real-time scanning module detects an anomaly, the emergency response module takes prompt action to reduce the impact of the security incident on the system through alarms or automated processing.

[0044] Specifically, alarm information generation: when malicious code or abnormal behavior is detected, an alarm is triggered immediately. The alarm methods include: visual alarm (such as the host displays a warning window), sound alarm, SMS or email notification to the system administrator; automatic isolation: after discovering an infected host, it can automatically disconnect the host from the network to prevent the spread of malicious code and block specific abnormal communication behaviors (such as closing the connection of abnormal IP or restricting specific ports); logging and auditing: all scanning behaviors, abnormal discoveries and response behaviors are recorded in detail to facilitate subsequent analysis and security audits; plan execution: according to preset security policies (such as isolating the network, stopping related services, etc.), the emergency plan is automatically executed, and manual intervention is supported so that the administrator can adjust the handling measures according to the actual situation.

[0045] In one possible implementation, the portable operation and maintenance gateway is connected to the power monitoring network through an encrypted channel, supports network configuration and data transmission through authorized operation and maintenance equipment, and ensures the security of operation and maintenance operations.

[0046] It is understandable that a communication channel is established through encryption protocols (such as TLS / SSL, IPSe, etc.) to ensure confidentiality and integrity during data transmission.

[0047] Specifically, data encryption: bidirectional encryption of data flows between operation and maintenance equipment and the power monitoring network to prevent sensitive data from being intercepted or tampered with; identity authentication: adopting a bidirectional authentication mechanism (such as digital certificates or dynamic passwords) to ensure that only authorized operation and maintenance personnel and equipment can access the power monitoring network, and prevent illegal equipment from impersonating legitimate operation and maintenance equipment; key management: key generation, storage and management are performed through the built-in security module, supporting regular key updates to reduce the risk of key leakage.

[0048] It is understandable that the portable operation and maintenance gateway is able to identify and verify the authorization status of the operation and maintenance equipment, and only allows operations through authorized devices.

[0049] Specifically, through the pre-configured whitelist, the identification of authorized operation and maintenance equipment (such as device serial number or MAC address) is registered, and only devices in the whitelist can access the gateway; it supports dynamic adjustment of authorization status according to operation and maintenance needs, and the authorization will automatically expire after expiration, and temporary authorization or extended authorization of the device can be achieved through administrator review.

[0050] In one possible implementation, the firewall includes an access control module and a data filtering module, which are used to manage access rights between different security areas and filter illegal or malicious data flows.

[0051] It can be understood that the access control module is used to define and enforce data access rights between different security zones, ensuring that only data flows that comply with security policies can pass through the firewall, thereby achieving strict zone isolation.

[0052] Specifically, clear access boundaries are set between different security zones I and II, and strict isolation is achieved through access control lists (ACLs); rule-based access control: set access control policies, accurately match and filter data streams based on source address, destination address, protocol type, port number and other information, support "whitelist" and "blacklist" mechanisms, and flexibly control access rights. User-based access control: integrates user authentication functions, verifies user identities through usernames, passwords or multi-factor authentication, and assigns different access rights based on user roles, such as administrators, operation and maintenance personnel, and ordinary users.

[0053] It is understandable that the data filtering module is used to detect and filter the data flow through the firewall, identify and prevent illegal or malicious data from flowing into or out of the security area, and protect the system from potential threats.

[0054] Specifically, the data packets in the network are parsed, the specific content in the data packets (such as files, scripts, application layer data, etc.) is detected, and malicious code, viruses or unauthorized content hidden in legal protocols are identified; the known malicious traffic feature library is used to match the characteristics of the transmitted data to block viruses, Trojans or other malicious traffic; only specific types of files are allowed to pass (such as document files PDF, TXT), and dangerous file types (such as .exe, .bat, .js) are blocked.

[0055] Specifically, a working process of the above embodiment is as follows: access request, when a data stream requests to access security zone II (or vice versa) from security zone I, the firewall first checks the request through the access control module to see whether it complies with the rules such as IP address, protocol, port number, user identity, etc. If it does, it is allowed to pass, otherwise it is rejected; data stream filtering: for legal data streams that pass access control, the data filtering module further checks its content to check whether the data packet contains malicious code, virus or abnormal behavior. If a threat is detected, the data stream is blocked and a log is recorded; log recording and alarm: all passing and blocked data streams are recorded in detail, including time, source address, destination address, protocol and other information, alarms are triggered for high-risk data streams, and administrators are notified in time to handle them.

[0056] In one possible implementation, the malicious code monitoring system further includes a traffic monitoring module for performing real-time analysis on network traffic, detecting potential malicious attack behaviors, and issuing alarms in a timely manner for disposal.

[0057] Specifically, the traffic monitoring module can continuously analyze all traffic entering and leaving the network to check for anomalies or features that match known attack patterns, such as detecting excessive request frequencies, abnormal packet sizes, or protocol abuse; the traffic monitoring module can also quickly identify potential malicious code or attack sources, such as DDoS attacks, SQL injections, cross-site scripting (XSS), etc., by comparing with a known malicious traffic database; the traffic monitoring module can also learn normal traffic patterns, and the module can identify traffic that deviates from normal behavior. For example, a device suddenly initiates a large number of external requests, or unauthorized remote access occurs.

[0058] In one possible implementation, the portable operation and maintenance gateway also has log recording and auditing functions, which can record all behaviors during the operation and maintenance operation in real time to facilitate future security auditing and tracking.

[0059] Specifically, during the operation and maintenance process, the system will automatically record detailed logs of all operations, including but not limited to: user identity and operation permissions, access time and date, operation type (such as login, configuration modification, start / stop service, network settings, etc.), operation object (such as specific equipment, system or file), operation result (success, failure or abnormal).

[0060] In one possible implementation, the security zone I is used to store core monitoring equipment, and the internal network and external network are strictly isolated to restrict access by unauthorized devices; the security zone II is used for interaction with the external network, and strict traffic control and monitoring are implemented.

[0061] In one possible implementation, the network communication between the security zone I and the security zone II uses segment management and encryption technology to ensure that cross-region data exchange is carried out under strict security control.

[0062] Specifically, a dedicated and secure communication channel is established between the two security zones, usually through VPN, IPSec tunnel or dedicated line connection, and access control lists (ACLs), firewall rules, port filtering and other means are used to ensure that only legitimate devices and users can access different network areas, and each cross-zone data transmission will be approved and authorized.

[0063] In one possible implementation, the safety zone I includes an NCS operator station for performing system operation and status monitoring; an NCS engineer station for engineering maintenance, configuration and debugging; synchronous vector equipment for phasor synchronization monitoring of the power system; five-protection equipment for preventing misoperation and ensuring operation safety; protection and measurement and control equipment for monitoring and protecting power parameters and equipment; measurement and control devices and telecontrol devices for remote monitoring and control of data transmission; NCS servers and switches for providing data storage, processing and communication functions;

[0064] The safety zone II includes a protection substation for realizing the protection function of the power grid and equipment; a fault recording device for real-time recording and analysis of fault data; an electric quantity collection device for collecting power grid parameters such as voltage, current, and power; and a switch for network communication connection of equipment inside the safety zone II.

[0065] It can be understood that the NCS operator station, engineer station, synchronous vector, five-defense, protection measurement and control, NCS server, etc. related to the core functions of the industrial control system are located in Security Zone I and interconnected through the NCS switch; the security substation, fault recording, power collection, etc. used for data collection, analysis and system status monitoring are located in Security Zone II, and the network interconnection of the internal equipment in this zone is achieved through the switch; the network protection and security policy isolation between Security Zone I and Security Zone II are achieved through firewalls.

[0066] Beneficial effects of the embodiments of the present application:

[0067] The network security protection system of a power monitoring system provided by the present application deploys USB security isolation devices in the safety zone I and the safety zone II of the production control area respectively. The device performs security isolation and virus detection on the connected USB devices to ensure that only authenticated devices are allowed to exchange data and avoid the spread of viruses and Trojans through the USB interface; a malicious code monitoring system is deployed in the safety zone II to monitor the data flow in the network in real time, detect whether there is malicious code, Trojan or virus invasion, and can automatically issue early warnings to prevent malicious attacks in time; a dedicated portable operation and maintenance gateway is configured to provide a way for operation and maintenance personnel to remotely access the power monitoring system. The operation and maintenance gateway adopts an encrypted authentication mechanism, and only authorized operation and maintenance personnel can perform system maintenance through the gateway to ensure the safety of system operation. In addition, a firewall is deployed between the safety zone I and the safety zone II. The firewall is responsible for filtering cross-zone data flows, blocking illegal access and data transmission, and preventing unauthorized access and the invasion of malicious data packets.

[0068] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0069] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0070] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0071] The above embodiments are only used to illustrate the technical solution of the present application, but not to limit it. The present application is not limited to the exact structure described above and illustrated in the accompanying drawings, and it cannot be determined that the specific implementation of the present application is limited to these descriptions. For ordinary technicians in the technical field to which the present application belongs, various changes and modifications made without departing from the concept of the present application should be deemed to belong to the protection scope of the present application.

Claims

1. A network security protection system for an electric power monitoring system, characterized in that: The network of the power monitoring system is divided into safety zone I and safety zone II, including: A USB security isolation device, located in the security zone I and the security zone II, is used to securely isolate data of external USB devices to prevent the intrusion of viruses or malicious codes; Malicious code monitoring system, located in Security Zone II, is used to detect malicious code in the network in real time and provide security warnings; The firewall is located between security zone I and security zone II to ensure data security isolation between the two zones and prevent improper network communication or attacks. The portable operation and maintenance gateway, located in Security Zone II, is used for secure remote operation and maintenance operations, ensuring that only authorized personnel can safely perform network operation and maintenance through encrypted authentication.

2. The network security protection system of the power monitoring system according to claim 1 is characterized in that: The USB security isolation device has virus scanning and data transmission filtering functions, performs virus detection and elimination on connected mobile media, and only allows data transmission that complies with security policies.

3. The network security protection system of the power monitoring system according to claim 1 is characterized in that: The malicious code monitoring system includes a real-time scanning module and an emergency response module. The real-time scanning module is used to detect malicious codes in the network, and the emergency response module is used to provide alarm information when an abnormality is found.

4. The network security protection system of the power monitoring system according to claim 1 is characterized in that: The portable operation and maintenance gateway is connected to the power monitoring network through an encrypted channel, supports network configuration and data transmission through authorized operation and maintenance equipment, and ensures the security of operation and maintenance operations.

5. The network security protection system of the power monitoring system according to claim 1 is characterized in that: The firewall includes an access control module and a data filtering module, which are used to manage access rights between different security areas and filter illegal or malicious data flows.

6. The network security protection system of the power monitoring system according to claim 3 is characterized in that: The malicious code monitoring system further includes a traffic monitoring module for real-time analysis of network traffic, detection of potential malicious attack behaviors, and timely issuance of alarms for disposal.

7. The network security protection system of the power monitoring system according to claim 4 is characterized in that: The portable operation and maintenance gateway also has log recording and auditing functions, which can record all behaviors during the operation and maintenance operation in real time, facilitating future security auditing and tracking.

8. The network security protection system of the power monitoring system according to claim 1 is characterized in that: The security zone I is used to store core monitoring equipment, and the internal network is strictly isolated from the external network to restrict the access of unauthorized devices; the security zone II is used for interaction with the external network, and strict traffic control and monitoring are implemented.

9. The network security protection system of the power monitoring system according to claim 1, characterized in that: include: The network communication between the security zone I and the security zone II adopts segment management and encryption technology to ensure that cross-region data exchange is carried out under strict security control.

10. The network security protection system of the power monitoring system according to claim 1, characterized in that: include: The safety zone I includes the NCS operator station, which is used to perform system operations and status monitoring; NCS engineer station, used for engineering maintenance, configuration and debugging; Synchronous vector equipment, used for phasor synchronization monitoring of power systems; five-protection equipment, used to prevent misoperation and ensure safe operation; Protection and measurement and control equipment, used to monitor and protect power parameters and equipment; measurement and control devices and telecontrol devices, used to remotely monitor and control data transmission; NCS servers and switches, used to provide data storage, processing and communication functions; The safety zone II includes a protection substation for realizing the protection function of the power grid and equipment; a fault recording device for real-time recording and analysis of fault data; an electric quantity collection device for collecting power grid parameters such as voltage, current, and power; and a switch for network communication connection of equipment inside the safety zone II.

Images