基于网络隔离与安全数据交换的发电集团双网体系研究与设计

doi:10.11959/j.issn.1000-0801.2017043

Abstract

Abstract:

It is a common concern for power enterprises of how to ensure the safety and stability of power production management and information network for group-oriented power generation enterprises.The dual-network architecture of group-type power generation enterprise was designed based on network isolation and the safe data exchange technology.Based on the protection of network security isolation,the private protocol interaction technology was introduced to meet the growing business development needs of power enterprises.The overall technical route of logical strong isolation was proposed,the design scheme of construction of information internal and external network,the application and deployment,and information exchange in typical application scenarios was put forward.In addition,in order to realize the centralized monitoring and unified protection after isolation,the design scheme of deploying unified monitoring,unified anti-virus,unified terminal management and unified authentication system was put forward.

Key words: electric group enterprise, network and information security, network isolation, secure data exchange

CLC Number:

TP393.08

Jing WANG,Kunlun GAO,Bo ZHANG. Research and design in dual network scheme of power corporation based on network isolation and secure data exchange[J]. Telecommunications Science, 2017, 33(2): 163-176.

Figures/Tables 9

References 10

[1]	李正忠 . 电力企业信息安全网络建设原则与实践[J]. 中国新通信， 2015(19): 25-27.
	LI Z Z . Principles and practice of information security network construction in electric power enterprise[J]. China New Telecommunications, 2015(19): 25-27.
[2]	李宇峰，王晓航 . 田湾河集控中心数据交换平台的应用[J]. 水电自动化与大坝监测， 2013,37(5): 25-28.
	LI Y F , WANG X H . The application of data exchange platform of Tian-Wan-He cascade dispatching center[J]. Hydropower Automation and Dam Monitoring, 2013,37(5): 25-28.
[3]	胡炎，辛耀中，韩英铎 . 二次系统安全体系结构化设计方案[J]. 电力系统自动化， 2013,27(21): 63-68.
	HU Y , XIN Y Z , HAN Y D . A method for the structured security architecture design of secondary systems[J]. Automation of Electric Power Systems, 2013,27(21): 63-68.
[4]	张庶 . 供电企业双网隔离工程在南阳供电公司的实施[J]. 电力信息化， 2010,8(6): 39-42.
	ZHANG S . The implementation of the power supply enterprise network isolation project in Nanyang power supply company[J]. Electric Power Information Technology, 2010,8(6): 39-42.
[5]	温兆聪，王永盛，白焰辉 . 应用虚拟化技术在电力行业应用研究[J]. 信息技术与信息化， 2015(9): 222-223.
	WEN Z C , WANG Y S , BAI Y H . Research on application of virtualization technology in electric power industry[J]. Information Technology and Informatization, 2015(9): 222-223.
[6]	刘铮，王静 . 移动办公在发电企业中的研究和应用[J]. 电信科学， 2013,29(11): 115-121.
	LIU Z , WANG J . Research and application of mobile OA technology in power generation enterprise[J]. Telecommunications Science, 2013,29(11): 115-121.
[7]	季君，杜钧，师宁，等. 基于安全隔离的边界防护体系的设计与实现[J]. 网络安全技术与应用， 2014,8(1): 16-18.
	JI J , DUN J , SHI N , et al. Design and implementation of border protection system based on secure isolation[J]. Network Security Technology ＆ Application, 2014,8(1): 16-18.
[8]	王福新，罗朝宇，李宗涛 . 内蒙古电力网络防病毒系统设计及应用[J]. 内蒙古电力技术， 2013,31(5): 72-79.
	WANG F X , LUO Z Y , LI Z T . Design and application of antivirus system in inner Mongolia power network[J]. Inner Mongolia Electric Power, 2013,31(5): 72-79.
[9]	陈新和 . 探讨入侵检测技术在电力信息网络安全中的应用[J]. 通讯世界， 2014,1(1): 67-68.
	CHEN X H . Application of intrusion detection technology in power information network security[J]. Telecom World, 2014,1(1): 67-68.
[10]	李洪涛 . 基于大数据的信息安全预警工作[J]. 城市建设理论研究， 2015,5(36): 35-35.
	LI H T . Early warning of information security based on big data[J]. Urban Construction Theory Research, 2015,5(36): 35-35.

Metrics

Recommended 0

No Suggested Reading articles found!

安全特征	隔离前	隔离后
数据传输加密	不支持	支持3DES、MD5或AES等加密算法和国家密码局许可使用的 SM1或者 SM2算法对传输数据进行加密
数据传输过程格式检查	不支持	支持对所交换的文件格式进行检查，能够防止在数据交换过程中传输可执行程序，从而造成病毒、木马夹杂在交换数据中进行传播
数据传输过程病毒查杀	不支持	支持对所交换的文件、数据库大字段、SOA中 XML格式数据等内容进行病毒查杀，阻断含有病毒或木马的数据交换
数据传输过程SQL过滤	不支持	支持SQL过滤，能够自动识别所交换内容中的SQL语句，如果出现SQL语句则自动阻断交换过程以保护内部数据库的安全
数据传输过程嵌入标记	不支持	支持对所有交换的数据对象（data object,DO）嵌入安全标记，按照标记实现对主、客体的安全访问控制
安全审计	支持粒度较粗	支持对整个数据交换行为的完整审计，包括数据源、发生时间、交换目标、交换内容、是否得到了授权、是否遵守交换规则、交换行为是否成功、不成功进行了几次尝试、交换结束时间等

Research and design in dual network scheme of power corporation based on network isolation and secure data exchange

RichHTML

PDF下载

Knowledge

Abstract

Cite this article

share this article

Figures/Tables 9

References 10

Related Articles 2

Metrics

Recommended 0

[1]	Xiaoyin XI,Xiaoyun YUAN. Practice analysis of domestic and foreign industry benchmarking enterprises in the field of network and information security [J]. Telecommunications Science, 2020, 36(11): 134-140.
[2]	Dongjie MA,Chengqiang JIN,·uan CHEN,Tieming CHEN. GreyFan:a network attack framework using Wi-Fi covert channel [J]. Telecommunications Science, 2019, 35(9): 85-97.