CN106534110B - Trinity transformer substation secondary system safety protection system framework system - Google Patents
Trinity transformer substation secondary system safety protection system framework system Download PDFInfo
- Publication number
- CN106534110B CN106534110B CN201610981634.9A CN201610981634A CN106534110B CN 106534110 B CN106534110 B CN 106534110B CN 201610981634 A CN201610981634 A CN 201610981634A CN 106534110 B CN106534110 B CN 106534110B
- Authority
- CN
- China
- Prior art keywords
- safety
- network
- behavior
- subsystem
- secondary system
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
- H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Telephonic Communication Services (AREA)
- Remote Monitoring And Control Of Power-Distribution Networks (AREA)
Abstract
The invention discloses a three-in-one transformer substation secondary system safety protection system framework. The system architecture integrated structure safety subsystem is used as a first safety defense line, the body safety subsystem is used as a second safety defense line, and the behavior safety subsystem is used for monitoring and controlling the network behavior safety. The structure safety is that an encryption authentication device, a network isolation device and firewall equipment are arranged on the network boundary of a secondary system; the body safely carries out system reinforcement on the network node equipment; the behavior safety is in the whole process of the network communication of the secondary system, a network behavior safety monitoring device and a network host equipment checking agent program are arranged, the network communication is monitored in real time, the safety risk is evaluated, the early warning prompt is pushed, and the safety audit is carried out. According to the invention, a three-dimensional security system is constructed from three levels of system structure boundaries, network node equipment and network dynamic behaviors, so that the safety performance of a secondary system can be greatly improved.
Description
Technical Field
The invention belongs to the field of network security and electric power automation, and particularly relates to a framework design related to the security protection of a secondary system of a transformer substation.
Background
With the networking, digitalization and intellectualization of the secondary system of the transformer substation, the situation of the secondary information safety of the transformer substation becomes more and more severe, and the current obvious safety risks mainly include: structurally, there are security risks at the secondary system networking boundaries. The secondary system is used as a relatively independent application system, the networking structure security of the secondary system is relatively high, and if the secondary system is openly interconnected with other systems or even directly connected to a public communication network, the risk is relatively high. From the network device perspective, the network device itself in the secondary system presents a security risk. Whether the operating system of each network device has a bug or not, whether the application software has a logic bomb or not, whether a port is reasonably opened or not, whether a communication protocol is secret transmission or not, whether the network device is robust or not when being attacked or not and the like. From the aspect of network behaviors, the communication interaction of different services of the secondary system is complex, and risks are brought by operation and maintenance of external access. Therefore, whether the framework design of the secondary security system of the transformer substation is comprehensive and practical is very important.
The traditional transformer substation secondary security system emphasizes on the boundary safety of the system structure, and the body safety of network equipment, particularly the behavior safety monitoring of network communication, is insufficient. At present, the secondary system function of the intelligent substation is increasingly complex, the networking of communication is common, and the operation and maintenance means are increasingly diversified, so that the traditional safety protection system with a boundary emphasized in the substation is insufficient.
Therefore, a more comprehensive and applicable security protection system needs to be researched and designed, and a multi-level and three-dimensional security protection system architecture is established in the three aspects of the boundary structure security of the system, the body security of the network node equipment and the behavior security of communication interaction.
Disclosure of Invention
The invention aims to provide a three-in-one transformer substation secondary system safety protection system architecture, which is used for perfecting and optimizing the defects of the existing safety protection in three aspects of boundary structure safety of a system, body safety of network node equipment and behavior safety of communication interaction.
In order to achieve the above object, the solution of the present invention is specifically as follows:
1) the construction of a three-in-one transformer substation secondary system safety protection system framework comprises a structure safety subsystem, a body safety subsystem and a behavior safety subsystem, and is characterized in that:
a multilevel three-dimensional transformer substation secondary system safety protection system with integrated structure safety, body safety and behavior safety is constructed, a special longitudinal encryption authentication device for electric power, a forward and reverse network isolation device and a firewall are arranged on the boundary of a system network to serve as a first safety defense line, and the integral boundary safety of the secondary system is guarded; on the network node equipment, performing system reinforcement to set a second safety defense line, and guarding the basic function safety of each network equipment in the secondary system on service; in the whole process of network communication of a secondary system, a network behavior safety control system is established, and comprises a network behavior safety monitoring device and a network node equipment checking agent program, so that the network communication behavior is monitored in real time, safety risks are evaluated, early warning prompts are pushed in real time, and the network safety of the system is audited.
2) And constructing a structural safety subsystem as a first safety defense line of a three-in-one multi-level three-dimensional combined security system, and arranging an encryption authentication device, a network isolation device and firewall equipment on the boundary of the secondary system network independent networking. The structure safety realizes the safety protection of the interactive communication between the service outlet and the internal areas with different safety levels of the secondary system, prevents illegal access and external attack, and ensures the whole boundary safety of the secondary system.
3) The method comprises the steps of constructing a body security subsystem as a second security defense line of a three-in-one multi-level three-dimensional combined security system, performing system reinforcement on network node equipment of a secondary system, closing unsafe port services by adopting a safe hardware system and a safe operating system, enhancing complexity and strength of a user password, establishing role-based access control, establishing event record and audit, and establishing encryption authentication control for external communication. The second security defense line realizes the operation security of the network node equipment, prevents illegal access and malicious attack to the equipment and ensures the security of the secondary system equipment in function operation.
4) And constructing a behavior safety subsystem as a security control system of a three-in-one multi-level three-dimensional combination for network behavior, wherein the behavior safety subsystem comprises an independently arranged behavior safety monitoring device and an equipment checking agent program installed in network node equipment. The behavior safety monitoring device acquires all communication data of system network interaction through a mirror image network port on a system key switch, monitors network communication behaviors in real time, checks network behaviors of network node equipment, stores original messages and system logs, evaluates safety risks, pushes early warning prompts in real time, and audits network safety of the system. The network behavior safety control realizes real-time monitoring and analysis of the network behavior of the secondary system, evaluates and pre-warns safety risks, and guarantees the safety level of network interaction of the secondary system.
The invention has the beneficial effects that: the safety protection system of the multilevel three-dimensional transformer substation secondary system with integrated structure safety, body safety and behavior safety is constructed, the safety design that the transformer substation secondary system security protection system emphasizes boundary protection for a long time and lacks three-dimensional depth protection is changed, safety risks are comprehensively supervised on the boundary, node equipment and communication behavior of a system network, three-dimensional real-time monitoring and risk assessment of the whole system are carried out, and the safety performance of the secondary system can be greatly improved.
Drawings
FIG. 1 is a diagram of the overall architecture of the system of the present invention;
FIG. 2 is a diagram of the architectural security subsystems in the architecture of the present invention;
FIG. 3 is a diagram of an ontology security subsystem in the architecture of the present invention;
FIG. 4 is a diagram of a behavioral security subsystem in the architecture of the present invention;
Detailed Description
In order to make the technical scheme and the characteristics of the invention more clear, the invention is further explained below.
1) The overall architecture diagram of the system is shown in fig. 1, and a safety protection system architecture of a multi-level and three-dimensional transformer substation secondary system integrating a structure safety subsystem, a body safety subsystem and a behavior safety subsystem is constructed.
2) A special longitudinal encryption authentication device for electric power, a forward and reverse network isolation device and a firewall are arranged on the boundary of a system network to serve as a first safety defense line, and the whole boundary safety of a secondary system is guarded.
3) And (4) on the network node equipment, carrying out system reinforcement to set a second safety defense line, and guarding the basic function safety of each independent equipment in the secondary system on the service.
4) In the whole process of system network communication, a network behavior safety management and control system is established, network communication behaviors are monitored and audited in real time, and safety risks are evaluated.
1) The structure safety subsystem in the system framework of the invention is shown in figure 2, is used as a structure safety subsystem of a first safety defense line, and sets safety measures on the boundary of a secondary system network of a transformer substation according to the principles of network special, safety zoning, transverse isolation and longitudinal authentication, and is characterized by also comprising the following steps:
step one, a network of a secondary system is built according to a physical independent principle, and a link directly connected with an external network is not provided;
dividing the network structure of the secondary system into a production control area and an information management area, wherein the two areas have different safety levels respectively;
step three, arranging a special longitudinal encryption authentication device for electric power at a telecontrol communication outlet from a production control area of the secondary system to the main station to realize authentication of communication establishment and encryption of information transmission;
setting a forward and reverse physical isolation device between a production control area and an information management area of the secondary system to realize unidirectional data transmission between areas incapable of safety levels;
step five, a firewall is arranged at a communication outlet from an information management area of the secondary system to the main station, so that the communication access and the safety filtration of data interaction are realized;
5) the body security subsystem in the system architecture of the present invention is shown in fig. 3, and is used as the body security subsystem of the second security defense line to perform system reinforcement on the network node device, and is further characterized by the following steps:
designing a hardware system of the network equipment by adopting a safe chip and a safe mainboard;
designing a software system environment of the network equipment by adopting a safe operating system;
step three, closing unsafe ports and services;
step four, the complexity and the strength of the user password are enhanced;
step five, establishing access control based on roles on equipment access;
step six, establishing event records and audits;
step seven, establishing encryption authentication control for external communication;
6) the behavior security subsystem in the architecture of the present invention is shown in fig. 4, and as a behavior security subsystem for network behavior security control, an independent behavior security monitoring device and a device checking agent installed in a network node device are provided in a system network channel, and the present invention is characterized by further comprising the following steps:
establishing a mirror interface on a key switch of a system network, and acquiring all interactive data passing through the switch;
monitoring the communication data of the switch, monitoring the network behavior, monitoring the network flow, and monitoring and analyzing the legality of the network equipment and the network connection;
step three, collecting an original message through a mirror image port of the switch, and storing the original message;
establishing a correlation evidence of the network abnormal behavior and the original field message;
step five, immediately pushing the network abnormity to an interface alarm prompt;
step six, the equipment checking agent program in the network node equipment scans the process in the equipment and the characteristic change of the access of the mobile storage equipment in real time, and sends a message to the behavior safety monitoring device for recording and alarming;
step seven, log recording and event auditing are carried out;
step eight, the behavior safety monitoring device evaluates the risk of network safety in real time and gives an analysis result;
it should be noted that the above-mentioned only represents the embodiments of the present invention, and the description thereof is more specific and detailed, but not construed as limiting the scope of the present invention. It should be noted that, for a person skilled in the art, several variations and modifications can be made without departing from the inventive concept, which falls within the scope of the present invention. Therefore, the protection scope of the present patent shall be subject to the appended claims.
Claims (2)
1. The utility model provides a transformer substation secondary system safety protection system framework system of trinity, includes structure safety subsystem, body safety subsystem, action safety subsystem, its characterized in that:
the structure safety subsystem establishes a first safety defense line by arranging an encryption authentication device, a network isolation device and firewall equipment on the network boundary of the secondary system;
the body safety subsystem carries out system reinforcement on the network node equipment to construct a second safety defense line;
the behavior safety subsystem is provided with a network behavior safety monitoring device and a network host equipment checking agent program in the whole process of network communication of a secondary system, monitors network communication behaviors in real time, evaluates safety risks, pushes early warning prompts in real time, audits the network safety of the system and constructs safety control on the network behaviors;
the first safety defense line guards the whole boundary safety of the secondary system, the second safety defense line guards the function safety of each network node device after the first safety defense line is out of guard, and the safety dynamic of the network communication behavior of the whole secondary system is monitored in real time and risk analyzed by the behavior safety subsystem;
the behavior safety subsystem is used for safety control of network behaviors in a safety protection system architecture system and comprises two parts, namely an independently arranged behavior safety monitoring device and an equipment checking agent program installed in network node equipment; the behavior safety monitoring device acquires all communication data of system network interaction through a mirror image network port on a system key switch, monitors network communication behaviors in real time, checks the network behaviors of network node equipment, stores original messages and system logs, evaluates safety risks, pushes early warning prompts in real time and audits the network safety of the system; the equipment checking agent program in the network node equipment scans the process in the equipment and the characteristic change of the access of the mobile storage equipment in real time, and sends a message to the behavior safety monitoring device for recording and alarming; the network behavior safety control realizes real-time monitoring and analysis of the network behavior of the secondary system, evaluates and pre-warns safety risks, and guarantees the safety level of network interaction of the secondary system.
2. The architecture system of claim 1, wherein the body security subsystem employs a secure hardware system and a secure operating system, closes an unsecure port service, increases complexity and strength of a user password, establishes role-based access control, establishes event recording and auditing, establishes encryption authentication control for external communication, and implements security of network node devices by a second security line, thereby preventing illegal access and malicious attack to the devices themselves and ensuring security of secondary system devices in functional operation.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610981634.9A CN106534110B (en) | 2016-11-08 | 2016-11-08 | Trinity transformer substation secondary system safety protection system framework system |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610981634.9A CN106534110B (en) | 2016-11-08 | 2016-11-08 | Trinity transformer substation secondary system safety protection system framework system |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN106534110A CN106534110A (en) | 2017-03-22 |
| CN106534110B true CN106534110B (en) | 2020-07-28 |
Family
ID=58350005
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201610981634.9A Active CN106534110B (en) | 2016-11-08 | 2016-11-08 | Trinity transformer substation secondary system safety protection system framework system |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN106534110B (en) |
Families Citing this family (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107426171A (en) * | 2017-06-02 | 2017-12-01 | 国家电网公司 | The safety protecting method and device of power information Intranet |
| CN109586409B (en) * | 2018-11-28 | 2020-11-10 | 广东电网有限责任公司 | Automatic scheduling system and automatic scheduling method |
| CN109639681B (en) * | 2018-12-14 | 2022-04-05 | 三门核电有限公司 | Online reactor core power distribution monitoring system |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103269332A (en) * | 2013-04-22 | 2013-08-28 | 中国南方电网有限责任公司 | Safeguard system for power secondary system |
| CN103532776A (en) * | 2013-09-30 | 2014-01-22 | 广东电网公司电力调度控制中心 | Service flow detection method and system |
| CN103546488A (en) * | 2013-11-05 | 2014-01-29 | 上海电机学院 | Active security defense system and method of power secondary system |
Family Cites Families (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US7327221B1 (en) * | 2003-09-30 | 2008-02-05 | Rockwell Automation Technologies, Inc. | Power supply communication system and method |
| CN103473626A (en) * | 2013-08-20 | 2013-12-25 | 国家电网公司 | Security protection method based on integrated dispatching data network operation and maintenance system |
| CN105847021B (en) * | 2015-01-13 | 2019-06-14 | 国家电网公司 | A kind of smart grid Dispatching Control System concentration O&M safety auditing system |
-
2016
- 2016-11-08 CN CN201610981634.9A patent/CN106534110B/en active Active
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103269332A (en) * | 2013-04-22 | 2013-08-28 | 中国南方电网有限责任公司 | Safeguard system for power secondary system |
| CN103532776A (en) * | 2013-09-30 | 2014-01-22 | 广东电网公司电力调度控制中心 | Service flow detection method and system |
| CN103546488A (en) * | 2013-11-05 | 2014-01-29 | 上海电机学院 | Active security defense system and method of power secondary system |
Non-Patent Citations (1)
| Title |
|---|
| "电力二次系统网络信息安全防护的设计与实现";潘路;《中国优秀硕士学位论文全文数据库工程科技Ⅱ辑2015年第01期》;20150115;第2-4章，图2-4至图2-6，图4-1 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN106534110A (en) | 2017-03-22 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| Asghar et al. | Cybersecurity in industrial control systems: Issues, technologies, and challenges | |
| CN107493265B (en) | A kind of network security monitoring method towards industrial control system | |
| Yang et al. | Impact of cyber-security issues on smart grid | |
| Goel et al. | Security challenges in smart grid implementation | |
| CN103036886B (en) | Industrial control network security protection method | |
| CN109976239A (en) | Industrial control system terminal security guard system | |
| CN109995796A (en) | Industrial control system terminal safety protection method | |
| CN106534110B (en) | Trinity transformer substation secondary system safety protection system framework system | |
| CN108259478A (en) | Safety protecting method based on industry control terminal device interface HOOK | |
| CN108833425A (en) | A kind of network safety system and method based on big data | |
| CN115314286A (en) | Safety guarantee system | |
| Suo et al. | Research on the application of honeypot technology in intrusion detection system | |
| Mahboob et al. | Intrusion avoidance for SCADA security in industrial plants | |
| Tefek et al. | A Smart Grid Ontology: Vulnerabilities, Attacks, and Security Policies | |
| Zou et al. | Research and implementation of intelligent substation information security risk assessment tool | |
| CN105471857A (en) | Power grid terminal invalid external connection monitoring blocking method | |
| Qassim et al. | An anomaly detection technique for deception attacks in industrial control systems | |
| Chen et al. | Research on the active defense security system based on cloud computing of wisdom campus network | |
| Sarralde et al. | Cyber security applied to P&C IEDs | |
| CN212084141U (en) | Safety reinforcement management device for industrial control terminal | |
| McKay | Lessons to learn for US electric grid critical infrastructure protection: Organizational challenges for utilities in identification of critical assets and adequate security measures | |
| Shrestha et al. | Security Classification for Smart Grid Infra structures (long version) | |
| Zhou et al. | Behavior based anomaly detection model in SCADA system | |
| CN102970188A (en) | 110kV digital transformer substation security network | |
| Risley et al. | Low-or no-cost cybersecurity solutions for defending the electric power system against electronic intrusions |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |