张世斌, 贾立东, 魏义昕, 史威, 王健. 输气管道SCADA系统网络安全策略探索与实现——以中俄东线天然气管道工程为例[J]. 油气储运, 2020, 39(6): 685-691. DOI: 10.6047/j.issn.1000-8241.2020.06.013
引用本文: 张世斌, 贾立东, 魏义昕, 史威, 王健. 输气管道SCADA系统网络安全策略探索与实现——以中俄东线天然气管道工程为例[J]. 油气储运, 2020, 39(6): 685-691. DOI: 10.6047/j.issn.1000-8241.2020.06.013
ZHANG Shibin, JIA Lidong, WEI Yixin, SHI Wei, WANG Jian. Exploration and implementation of network security strategy for gas pipeline SCADA system: taking the China-Russia Eastern Gas Pipeline Project as an example[J]. Oil & Gas Storage and Transportation, 2020, 39(6): 685-691. DOI: 10.6047/j.issn.1000-8241.2020.06.013
Citation: ZHANG Shibin, JIA Lidong, WEI Yixin, SHI Wei, WANG Jian. Exploration and implementation of network security strategy for gas pipeline SCADA system: taking the China-Russia Eastern Gas Pipeline Project as an example[J]. Oil & Gas Storage and Transportation, 2020, 39(6): 685-691. DOI: 10.6047/j.issn.1000-8241.2020.06.013

输气管道SCADA系统网络安全策略探索与实现——以中俄东线天然气管道工程为例

Exploration and implementation of network security strategy for gas pipeline SCADA system: taking the China-Russia Eastern Gas Pipeline Project as an example

  • 摘要: 为了保证输气管道站场SCADA系统网络的本质安全及可靠运行,落实《中华人民共和国网络安全法》等法律法规要求,在输气管道SCADA控制系统建设过程中,设计并实施了网络安全防护方案,从边界隔离、站场网络审计、防火墙阻断、网闸控制、态势感知平台综合分析等方面进行安全管控。利用相关设备的网络流量审计、隔离、分析功能,结合失陷分析、威胁情报分析、异常行为分析、未知威胁分析、网络异常分析、域名异常分析、攻击威胁特征分析、隐蔽通道分析以及丰富的整体安全分析报告功能,可有效检测外部攻击、外连威胁、内部非法连接、网络会话模式异常等安全威胁,是对传统安全防御系统的完善与提升。该策略为从站场到控制中心一体化的网络安全监控方案,系统采用独立网络传输,满足了不同系统之间数据通信的防护和监测要求,实现了跨国控制系统之间的访问控制,同时满足国家等保测评、网络安全法及行业安全规范的管理规定。

     

    Abstract: For the intrinsic safety and reliable operation of the SCADA system network of gas pipeline stations and the implementation of laws and regulations such as the People's Republic of China cyber security law, the network security protection scheme was designed and implemented during the construction of the SCADA control system of gas pipeline to ensure the safety control from boundary isolation, station network audit, firewall blocking, gatekeeper control, comprehensive analysis of situation awareness platform, etc. By virtue of the network audit, isolation and analysis functions of relevant equipment, combined with fall analysis, threat intelligence analysis, abnormal behavior analysis, unknown threat analysis, network anomaly analysis, domain name anomaly analysis, attack threat feature analysis, covert channel analysis and the rich overall security analysis and reporting functions, security threats such as external attacks, external threats, internal illegal connections, abnormal network session modes, etc. can be effectively detected. It is a perfection and improvement of the traditional security defense system and an integrated network security monitoring scheme from the station to the control center. The system adopts independent network transmission, which meets the protection and monitoring requirements of data communication between different systems, allows the access control between transnational control systems, and conforms to the management regulations of the national classified security protection evaluation, network security laws and industry security standards.

     

/

返回文章
返回