CN109194505A - A kind of power network security defence warning system - Google Patents

Abstract

Translated fromChinese

一种电力网络安全防御告警系统，包括安全监管模块，监测电力网络中网络主机的安全状态信息；区域监管模块，采集可用通信节点网管配置信息，检测相应网络的实时通信状态；协同防御模块，对电网终端边缘接入提供安全防御；安全分析模块，对各网络进行网络安全分析；实时告警模块，进行实时告警和显示。本发明的电力网络安全防御告警系统，可以对电力网络实现全方位的个体监控、整区监控、协同防御、安全分析、实时告警，立体全面地保护整个电力网络的安全。

An electric power network security defense alarm system includes a safety supervision module, which monitors the security status information of network hosts in the electric power network; a regional supervision module, which collects network management configuration information of available communication nodes and detects the real-time communication status of the corresponding network; The power grid terminal edge access provides security defense; the security analysis module performs network security analysis on each network; the real-time alarm module provides real-time alarm and display. The power network security defense alarm system of the present invention can realize all-round individual monitoring, whole-area monitoring, collaborative defense, security analysis, and real-time alarm for the power network, and comprehensively protect the security of the entire power network.

Description

A kind of power network security defence warning system

Technical field

The invention belongs to power network security fields, and in particular to a kind of power network security defence warning system.

Background technique

Currently, international network security situation is increasingly serious, and cyberspace has become country after four territories of land, sea, air, outer spaceThe 5th territory later, network attack grouping of the world economy, the trend of Basic national topographic map are increasingly apparent.Due to the complicated multiplicity of NETWORK STRUCTURE PRESERVING POWER SYSTEM,Widely distributed, importance is high and integrated wide area interconnection, once paralysis influences huge, easily becomes the first choice of hostile force attackTarget.In recent years, with largely being introduced using cloud computing, Internet of Things, big data as " internet+" technology of representative, and it is a large amount ofThe access of intelligent terminal further increases electric network information security protection difficulty.First is that the access of a large amount of intelligent terminals,Using a large amount of communications such as WIFI, 3G/4G, electric power networks basic environment also changes therewith, network boundary increasingly mouldPaste, traditional security boundary protective range can not ensure electric intelligent terminal security.Second is that the acquisition side of electric power relevant informationNew variation also has occurred in method, storage form, transmission channel and processing mode, and application virtualization, data assets, terminal are mobileChange will all introduce new information network security risk, and the information security exposure of power grid is increasing sharply.It is held simultaneously with advancedContinuous property network attack (APT) is the novel attack means also continuous evolution of representative, gives information network security of power system protected workingBring severe challenge.

Power Information Network is rapidly developed in recent years, based on high-speed power communication network, forms each electricity of coveringNet the integrated State Grid's dispatching data network and information network of enterprise.It is micro- that power telecom network has evolved into optical fiber, numberThe trunk communication network of a variety of transmission means such as wave, wireless, satellite, substantially covers each ring such as power generation, transmission of electricity, distributionSection.In electric power wide area Internet network, anywhere user can touch network.In this manner, due to networkDevelopment trend be increasingly intended to ubiquitous network structure system, this requires we have to find out a kind of new the whole network integration,The security system of protection is cooperateed with, to solve the existing and new safety problem of this network.From this respect, it can be seen that electric powerSafety problem under wide area Internet network is worth us to go to study and inquire into.

Summary of the invention

To solve power network security missile defense, the present invention provides a kind of power network securities to defend warning system,The system, comprising:

Security control module, for monitoring the safety state information of network host in electric power networks, and the peace that will be monitoredZone supervisors module corresponding to the network host is sent on full state information is real-time；

Zone supervisors module, for the acquisition available communication node by the center switch of network where each network hostNetwork management configuration information detects the real-time communication conditions of corresponding network, and combines the safety state information sent in security control module,It is formed in network security real time information and is sent to safety analysis module；

Composite defense module, for the available communication node network management configuration information of receiving area administration module acquisition, to electricityNetwork termination edge access provides Prevention-Security；

Safety analysis module, the network security real time information sent on the administration module of receiving area carry out each networkNetwork Safety Analysis；

Real-time Alarm module carries out Real-time Alarm and display for that will analyze obtained security risk, and by Real-time AlarmIt is sent on information and network security analysis result information to the central server of affiliated area, and by Real-time Alarm information and networkThe report of safety analysis result is stored as historical data.

The beneficial effect comprise that the invention proposes a kind of power network securities to defend warning system, it can be rightElectric power networks realize comprehensive individual monitoring, main plot monitoring, composite defense, safety analysis, Real-time Alarm, and solid is comprehensively protectedProtect the safety of entire electric power networks.Especially, it can be achieved that communicating pair or in many ways by primary data exchange, set canRandom negotiation is concentrated to determine communication topology associated diagram and correlation time with network node, the opening up according to agreement in communication processFlutter associated diagram and establish dynamic communication link, listener is difficult to grasp communication topology interior joint network management configuration rule, thus be difficult toTrack communicates overall process.During network link auto-associating, legal entity maintains normal communication using correct node network management configuration,Unauthorized entity is due to that can not know that legal entity node network management configuration will be difficult to carry out effective attack.Meanwhile main station side and clientEnd can under specific circumstances, security update topological correlation figure, to guarantee what network link auto-associating was shown to greatest extentRandomness increases the time and space complexity that attack is implemented, to reach information security attack Initiative Defense target.

Detailed description of the invention

System framework figure Fig. 1 of the invention

The method schematic diagram that Fig. 2 present system uses.

Specific embodiment

For a better understanding of the present invention, with reference to the description of the embodiment of the accompanying drawings, system of the invention is carried outFurther instruction.

In order to fully understand the present invention, numerous details are referred in the following detailed description.But art technologyPersonnel are it should be understood that the present invention may not need these details and realize.In embodiment, it is not described in detail well known sideMethod, process, component, in order to avoid unnecessarily make embodiment cumbersome.

Referring to figure 1 and figure 2, the present invention provides a kind of power network securities to defend warning system, comprising:

Security control module, for monitoring the safety state information of network host in electric power networks, and the peace that will be monitoredZone supervisors module corresponding to the network host is sent on full state information is real-time；

Zone supervisors module, for the acquisition available communication node by the center switch of network where each network hostNetwork management configuration information detects the real-time communication conditions of corresponding network, and combines the safety state information sent in security control module,It is formed in network security real time information and is sent to safety analysis module；

Composite defense module, for the available communication node network management configuration information of receiving area administration module acquisition, to electricityNetwork termination edge access provides Prevention-Security；

Safety analysis module, the network security real time information sent on the administration module of receiving area carry out each networkNetwork Safety Analysis；

Real-time Alarm module carries out Real-time Alarm and display for that will analyze obtained security risk, and by Real-time AlarmIt is sent on information and network security analysis result information to the central server of affiliated area, and by Real-time Alarm information and networkThe report of safety analysis result is stored as historical data.

Preferably, security control module is with coded communication mode, by the safety state information monitored it is real-time on send to thisThe corresponding zone supervisors module of network host.

Preferably, the system also includes policy development modules, the net for being obtained according to central server based on analysisThe security postures information of network, connected applications need and security regulations, formulate corresponding power network security defence policies.

Preferably, wherein the composite defense module includes specifically including:

Resource pool module: for by network communication node structure all in received available communication node network management configuration informationAt network communication node resource pool, alternative resource pond is provided for the choice of dynamical and auto-associating of later period network link；

Link module: it for constructing network link auto-associating space, randomly selects available network communication node and constitutesAvailable link space；

Negotiation module: executing network communication link auto-associating for network communication both sides and negotiate process, negotiates to choose and work asPreceding communication link, and timing unoccupied place carries out the adjustment of communication link dynamic negotiation.

Preferably, the zone supervisors module, for the acquisition by the center switch of network where each network hostAvailable communication node network management configuration information, wherein the available communication node network management configuration information include network address information,Port information, protocol information.

Preferably, the network address is the address IPv4 or the address IPv6.

Preferably, the resource pool module: for by net all in received available communication node network management configuration informationNetwork communication node constitutes network communication node resource pool, provides alternative money for the choice of dynamical and auto-associating of later period network linkSource pond,

Wherein, all available address information form address pool I={ ip₁, ip₂, L, ip_m}；Port is the various agreements of application layerProcess carries out the address that interlayer interacts with transportation entities, and usable range is 0 to 65535, removes first 1024 known ports, remainsRemaining 64512 available ports, all available port information form port pool P={ port₁, port₂, L, port_n}；Agreement includesNetwork communication protocol, data encryption protocol, data compression algorithm etc., all allowed protocol information form protocol pool Ψ={ pro₁,pro₂, L, pro_s}。

Node network management configuration e is made of address, port, agreement triple, individual node network management configuration e_i=(ip_i,port_i, pro_i), node network management configuration state space is as follows:

E=I × P × Ψ={ (ip_i, port_j, pro_k) | 1≤i≤m, 1≤j≤n, 1≤k≤s }

Preferably, for constructing network link auto-associating space, it is logical the link module: to randomly select available networkBelieve that node constitutes available link space, specifically include: is random from available communication node resource pond by way of pseudo random numberA plurality of alternative communication link is chosen, and pseudorandom selection and configuration are carried out to information such as communication port, agreements；

Network link auto-associating space EH is by node network management configuration state space E, pseudo-random sequence collection Φ, automated topologyIt is associated with the five-tuple group that node of graph network management configuration state set Ω, Correlation Criteria C, network link auto-associating transfer relationship δ are constitutedAt i.e. EH=(E, Φ, Ω, C, δ).

Φ₁, Φ₂, Φ₃For pseudo-random functionThe pseudo-random sequence of generation, define respectively address, port, agreement three classes node network management configuration association sequence, communicating pair pressesImplement association and communication according to the node network management configuration of sequence mapping.Pseudo-random sequence guarantees the random of network link auto-associatingProperty, the ability of attacker's match network topologies is reduced, attacker is made to be difficult to hold the related law of destination host, increases and attacksThe person of hitting detects difficulty.

It is the network management configuration state set for constituting all nodes of topological correlation figureIt closes, whereinFor the node network management configuration used in moment t system.

C is the condition for triggering network link auto-associating, such as receives a certain confirmation message, the time for reaching agreement, sendsA certain number of data packets etc., C=(c₁, c₂, L, c_p) the different trigger condition of characterization.

Indicate Correlation Criteria c_iUnder, node network management configuration that communicating pair uses is from Ω (t_i) stateMove to Ω (t_i+1) state process, meet

Preferably, the negotiation module: executing network communication link auto-associating for network communication both sides and negotiate process,Negotiate to choose current communications link, and timing unoccupied place carries out the adjustment of communication link dynamic negotiation, specifically includes: communicating pair executesNetwork link auto-associating negotiates process, and one or more communication link is chosen from alternative communication link as practical communication chainRoad, and the execution network link auto-associating negotiation of timing gap adjusts process again, realizes that the network based on homomorphism communication link is attackedHit composite defense.

Network link auto-associating can be communication one side's single-point association, be also possible to the association of communicating pair equity, evenIt is the collaboration association between multiple communication objects.Therefore the present invention provides correlating method for equity association.Method allows moreIndependent transmission node layer on a network link auto-associating channel, main station side and client require to state certainly to communication objectOneself topological correlation figure, topological correlation figure two-way exchange, then according to set topological correlation figure communication with high safety, wherein main websiteIt holds related procedure to be acted on behalf of by power grid main website topological correlation to execute.

The negotiation module: network communication link auto-associating is executed for network communication both sides and negotiates process, negotiates choosingCurrent communications link is taken, and timing unoccupied place carries out the adjustment of communication link dynamic negotiation, the negotiation module specifically includes:

Request message sending module: for preparing to lead to main station side when the client of a support network link auto-associatingWhen letter, conventional requests message is sent to main station side firstUse client private key K_rcTo client identityID_c, network link auto-associating support label mark and request message send when time stamp T₁Signature；

First signature verification module: message is received for main station side recordTime T₂, use clientHold public key K_ucSignature verification is carried out, the legitimacy of client identity is verified (if main station side does not support network link certainlyDynamic association, ignores the message)；

Auto-associating communication module: after authenticating successfully for client identity, main station side is immediately switched to network link certainlyDynamic association communication pattern, and response message is sent to clientUse main station side private key K_rsTo main station sideIdentity ID_s, main station side network link automated topology associated diagram HP_sT is stabbed with response message sending time₃It signs；

Second signature verification module: message is received for client recordTime T₄, use main station sidePublic key K_usSignature verification is carried out, the legitimacy of main station side identity is verified；

Response message sending module: after main station side authentication success, client sends response message to main station sideUse client private key K_rcTo client network link automated topology associated diagram HP_cWhen being sent with response messageBetween stab T₄It signs；

Time drift computing module: for main station side according to time stamp T₁, T₂, T₃, T₄The time drift θ of calculating both sides=(T₂-T₁+T₃-T₄)/2, and send it to client

Synchronous correction module: correction is synchronized to local zone time according to time drift θ for client, and switches to netNetwork link auto-associating communication pattern；

Secure communication module: for client and main station side according to given network link automated topology associated diagram HP_sAnd HP_cIt securely communicates；

Period update module: for working as topological correlation figure T life cycle_hWhen arrival, updates network link automated topology and closeConnection figure.

Compared with prior art, the present invention its remarkable advantage are as follows: the invention proposes a kind of defence of power network security to accuseAlert system can realize comprehensive individual monitoring to electric power networks, main plot monitoring, composite defense, safety analysis, accuse in real timeAlert, solid comprehensively protects the safety of entire electric power networks.Especially, it can be achieved that communicating pair or passing through primary data in many waysExchange is concentrated random negotiation to determine communication topology associated diagram and correlation time, was being communicated in set available network nodesTopological correlation figure in journey according to agreement establishes dynamic communication link, and listener is difficult to grasp communication topology interior joint network management configurationRule, to be difficult to track communication overall process.During network link auto-associating, legal entity is matched using correct node network managementMaintenance normal communication is set, unauthorized entity is due to that can not know that legal entity node network management configuration will be difficult to carry out effective attack.TogetherWhen, main station side and client can under specific circumstances, security update topological correlation figure, to guarantee network link certainly to greatest extentIt is dynamic to be associated with the randomness shown, the time and space complexity that attack is implemented is increased, to reach information security attack activelyDefensive Target.

Here the preferred embodiment of the present invention is only illustrated, but its meaning is not intended to limit the scope of the invention, applicability and is matchedIt sets.On the contrary, detailed explanation of the embodiments can be implemented by those skilled in the art.It will be understood that without departing from appended powerIn the case of the spirit and scope of the invention that sharp claim determines, changes and modifications may be made to details.

Claims (13)

1. a kind of power network security defends warning system characterized by comprising

Security control module, for monitoring the safety state information of network host in electric power networks, and the safe shape that will be monitoredZone supervisors module corresponding to the network host is sent on state information is real-time；

Zone supervisors module, for the acquisition available communication node network management by the center switch of network where each network hostConfiguration information detects the real-time communication conditions of corresponding network, and combines the safety state information sent in security control module, is formedIt is sent in network security real time information to safety analysis module；

Composite defense module, for the available communication node network management configuration information of receiving area administration module acquisition, to power grid endEnd margin access provides Prevention-Security；

Safety analysis module, the network security real time information sent on the administration module of receiving area carry out network to each networkSafety analysis；

Real-time Alarm module carries out Real-time Alarm and display for that will analyze obtained security risk, and by Real-time Alarm informationIt send in the report of Network Safety Analysis result to the central server of affiliated area, and by Real-time Alarm information and network securityAnalysis result information is stored as historical data.

2. power network security according to claim 1 defends warning system, which is characterized in that security control module is to addClose communication mode, by the safety state information monitored it is real-time on send zone supervisors module corresponding to the network host.

3. power network security according to claim 1 defends warning system, which is characterized in that the system also includes plansSlightly formulate module, the security postures information of network for being obtained according to central server based on analysis, connected applications need andSecurity regulations formulate corresponding power network security defence policies.

4. a kind of power network security according to claim 1 defends warning system, which is characterized in that the composite defenseModule includes specifically including:

1 resource pool module: for constituting network communication node all in received available communication node network management configuration informationNetwork communication node resource pool provides alternative resource pond for the choice of dynamical and auto-associating of later period network link；

2 link modules: for constructing network link auto-associating space, it is available to randomly select available network communication node compositionLink space；

3 negotiation modules: executing network communication link auto-associating for network communication both sides and negotiate process, negotiates to choose current logicalBelieve link, and timing unoccupied place carries out the adjustment of communication link dynamic negotiation.

5. a kind of power network security according to claim 4 defends warning system, which is characterized in that the resource pool mouldBlock: for network communication node all in received available communication node network management configuration information to be constituted network communication node moneySource pond provides alternative resource pond for the choice of dynamical and auto-associating of later period network link,

Wherein, the available communication node network management configuration information includes the address information of network, port information, protocol information；

Wherein, all available address information form address pool I={ ip₁, ip₂, L, ip_m, m is available address quantity；

All available port information form port pool P={ port₁, port₂, L, port_n, the port is the various associations of application layerView process carries out the address that interlayer interacts with transportation entities, and n is available port quantity；

All allowed protocol information form protocol pool Ψ={ pro₁, pro₂, L, pro_s, the agreement includes at least network communicationAgreement, data encryption protocol or data compression algorithm, s are allowed protocol quantity；

Wherein, the node network management configuration information e is made of address information, port information, protocol information triple, individual nodeNetwork management configuration information e_i=(ip_i, port_i, pro_i), node network management configuration state space is as follows:

E=I × P × Ψ={ (ip_i, port_j, pro_k) | 1≤i≤m, 1≤j≤n, 1≤k≤s }.

6. a kind of power network security according to claim 5 defends warning system, which is characterized in that the wherein addressIt is the address IPv4 or the address IPv6.

7. a kind of power network security according to claim 2 defends warning system, which is characterized in that the link mouldBlock: it for constructing network link auto-associating space, randomly selects available network communication node and constitutes available link space, toolBody includes:

A plurality of alternative communication link is randomly selected from available communication node resource pond by way of pseudo random number, and to communicationPort, protocol information carry out pseudorandom selection and configuration；Network link auto-associating space EH is by node network management configuration shapeState space E, pseudo-random sequence collection Φ, automated topology are associated with node of graph network management configuration state set Ω, Correlation Criteria C, network linkThe five-tuple composition that auto-associating transfer relationship δ is constituted, i.e. EH=(E, Φ, Ω, C, δ).

8. a kind of power network security according to claim 7 defends warning system, which is characterized in that pseudo-random sequence collectionΦ=(Φ₁, Φ₂, Φ₃)^T, i.e.,

Φ={ (Φ₁, Φ₂, Φ₃)^T|Φ₁=(r₁¹, r₁², L, r₁^m),

Φ₂=(r₂¹, r₂², L, r₂ⁿ), Φ₃=(r₃¹, r₃², L, r₃^s),

Wherein, Φ₁, Φ₂, Φ₃For the pseudo-random sequence that pseudo-random function generates, address, port, agreement three classes section are defined respectivelyThe association sequence of point network management configuration, communicating pair implement association and communication according to the node network management configuration that the sequence maps.

9. a kind of power network security according to claim 7 defends warning system, which is characterized in that automated topology associationNode of graph network management configuration state setIt is the net for constituting all nodes of topological correlation figurePipe configuration status set, whereinFor the node network management configuration used in moment t system.

10. a kind of power network security according to claim 7 defends warning system, which is characterized in that Correlation Criteria C isTrigger the condition of network link auto-associating, C=(c₁, c₂, L, c_p) the different trigger condition of characterization, wherein p is trigger condition numberAmount.

11. a kind of power network security according to claim 7 defends warning system, which is characterized in that network link is certainlyDynamic association transfer relationshipIndicate Correlation Criteria c_iUnder, node network management configuration that communicating pair uses is from Ω(t_i) state transition is to Ω (t_i+1) state process, meet

12. a kind of power network security according to claim 2 defends warning system, which is characterized in that the negotiation mouldBlock: executing network communication link auto-associating for network communication both sides and negotiate process, negotiates to choose current communications link, and fixedWhen unoccupied place carry out the adjustment of communication link dynamic negotiation, specifically include: network communication both sides execute network communication link auto-associatingNegotiate process, one or more communication link is chosen from alternative communication link as practical communication link, and timing unoccupied place is heldThe negotiation of row network link auto-associating adjusts process again, realizes the network attack composite defense based on homomorphism communication link；Wherein,Network communication link auto-associating is between the association of one side's single-point of communication, the association of communicating pair equity or multiple communication objectsCollaboration association.

13. defending warning system according to a kind of any power network security of claim 2-12, which is characterized in that describedNegotiation module: executing network communication link auto-associating for network communication both sides and negotiate process, negotiates to choose present communications chainRoad, and timing unoccupied place carries out the adjustment of communication link dynamic negotiation, specifically includes:

Wherein, the network communication link auto-associating is associated with using communicating pair equity, and multiple network links is allowed to close automaticallyJoining independent transmission node layer on channel, main station side and client require to state the topological correlation figure of oneself to communication object,Topological correlation figure two-way exchange, then according to set topological correlation figure communication with high safety, wherein main station side related procedure is by electricityHost station topological correlation agency executes.