服務(wù)熱線
13313705507
智能電網(wǎng)作為未來電網(wǎng)的發(fā)展方向，滲透到發(fā)電、輸電、變電、配電、用電、調(diào)度、通信信息各個(gè)環(huán)節(jié)。在上述這些環(huán)節(jié)中，智能變電站無疑核心的一環(huán)。智能變電站采用先進(jìn)、可靠、集成、低碳、環(huán)保的智能設(shè)備，以全站信息數(shù)字化、通信平臺網(wǎng)絡(luò)化、信息共享標(biāo)準(zhǔn)化為基本要求，自動(dòng)完成信息采集、測量、控制、保護(hù)、計(jì)量和監(jiān)測等基本功能，并可根據(jù)需要支持電網(wǎng)實(shí)時(shí)自動(dòng)控制、智能調(diào)節(jié)、在線分析決策、協(xié)同互動(dòng)等功能，實(shí)現(xiàn)與相鄰變電站、電網(wǎng)調(diào)度等互動(dòng)。
信息化技術(shù)的發(fā)展給電網(wǎng)的智能化提供了保障，然而更多的研究和實(shí)踐側(cè)重于信息化引入新功能的實(shí)現(xiàn)與挖掘，對信息化背景下智能電網(wǎng)的安全性缺乏足夠的考慮，給信息采集、傳輸、智能控制等環(huán)節(jié)帶來不同程度的安全風(fēng)險(xiǎn)。隨著智能變電站建設(shè)的推進(jìn)，與傳統(tǒng)變電站相比，智能變電站具有更廣闊的開放性和復(fù)雜性，大量的采用IT技術(shù)和TCP/IP以太網(wǎng)等開放的體系架構(gòu)，把傳統(tǒng)信息安全領(lǐng)域的安全威脅引入到電網(wǎng)系統(tǒng)。所以，一旦受到惡性攻擊、病毒感染，就會導(dǎo)致局部、甚至大面積停電，造成嚴(yán)重經(jīng)濟(jì)損失等后果。
2 智能變電站監(jiān)控系統(tǒng)的安全問題
智能變電站監(jiān)控系統(tǒng)面臨各種安全風(fēng)險(xiǎn)，僅僅采用被動(dòng)防御和修補(bǔ)是不可靠的，需要的是整體解決方案，針對智能變電站監(jiān)控系統(tǒng)的特點(diǎn)，需要從以下幾個(gè)方面來解決安全問題：
1）威脅管理：部署威脅管理平臺，對智能變電站監(jiān)控系統(tǒng)進(jìn)行風(fēng)險(xiǎn)評估，漏洞分析，安全性分析以便正確、及時(shí)的了解目前系統(tǒng)的安全現(xiàn)狀,方便根據(jù)實(shí)際情況有計(jì)劃有步驟的完成風(fēng)險(xiǎn)評估以及后續(xù)安全數(shù)據(jù)收集分析工作。
2）安全審計(jì)設(shè)計(jì)：在間隔層和站控層之間部署監(jiān)測審計(jì)平臺，監(jiān)視端口掃描、強(qiáng)力攻擊、木馬后門攻擊、拒絕服務(wù)攻擊、緩沖區(qū)溢出攻擊等，當(dāng)檢測到嚴(yán)重入侵事件時(shí)提供報(bào)警；并對網(wǎng)絡(luò)系統(tǒng)中的網(wǎng)絡(luò)設(shè)備運(yùn)行狀況、網(wǎng)絡(luò)流量、用戶行為等進(jìn)行日志記錄；
3）惡意代碼防范設(shè)計(jì)： 在間隔層部署IAD智能保護(hù)產(chǎn)品，啟用惡意代碼檢測及阻斷功能。
4）綜合管理。部署安全監(jiān)管平臺，統(tǒng)一在線對監(jiān)測審計(jì)終端、智能防護(hù)終端等進(jìn)行統(tǒng)一管理、可視化展示和預(yù)警。
As the development direction of future power grids, smart grids penetrate into various links such as power generation, transmission, transformation, distribution, consumption, scheduling, and communication information. Among these links, the intelligent substation is undoubtedly the most crucial one. The intelligent substation adopts advanced, reliable, integrated, low-carbon, and environmentally friendly intelligent equipment, with the basic requirements of digitalization of the entire station information, networking of communication platforms, and standardization of information sharing. It automatically completes basic functions such as information collection, measurement, control, protection, measurement, and monitoring, and can support advanced functions such as real-time automatic control, intelligent regulation, online analysis and decision-making, and collaborative interaction with adjacent substations and power grid dispatch as needed.
The development of information technology provides a guarantee for the intelligence of the power grid, but more research and practice focus on the implementation and mining of new functions introduced by information technology, lacking sufficient consideration for the security of smart grids under the background of information technology, which brings varying degrees of security risks to information collection, transmission, intelligent control and other links. With the advancement of smart substation construction, compared with traditional substations, smart substations have broader openness and complexity, and a large number of open system architectures such as IT technology and TCP/IP Ethernet are used to introduce security threats from traditional information security fields into the power grid system. So, once subjected to malicious attacks or virus infections, it can lead to local or even large-scale power outages, causing serious economic losses and other consequences.
Security issues of intelligent substation monitoring system
The intelligent substation monitoring system faces various security risks, and relying solely on passive defense and repair is unreliable. What is needed is a comprehensive solution. Based on the characteristics of the intelligent substation monitoring system, the following aspects need to be addressed to address security issues:
1) Threat Management: Deploy a threat management platform to conduct risk assessment, vulnerability analysis, and security analysis on the intelligent substation monitoring system, in order to accurately and timely understand the current security status of the system, facilitate the planned and step-by-step completion of risk assessment and subsequent security data collection and analysis work based on the actual situation.
2) Security audit design: Deploy a monitoring audit platform between the partition layer and the station control layer to monitor port scanning, brute force attacks, Trojan backdoor attacks, denial of service attacks, buffer overflow attacks, etc., and provide alarms when serious intrusion events are detected; And record the operation status of network devices, network traffic, user behavior, etc. in the network system in logs;
3) Malicious code prevention design: Deploy IAD intelligent protection products at the partition layer, enabling malicious code detection and blocking functions.
4) Comprehensive management. Deploy a security supervision platform to unify online management, visual display, and early warning of monitoring and auditing terminals, intelligent protection terminals, etc.
