工业控制网络的信息安全及纵深防御体系结构研究  

Research of Security and Defense-in-depth Architecture of Industrial Control Network

作　　者：蒋宁[1,2,3] 林浒 尹震宇[2] 黄艳 

机构地区：[1]中国科学院大学,北京100049 [2]中国科学院沈阳计算技术研究所,沈阳110168 [3]沈阳师范大学教育技术学院,沈阳110034 [4]沈阳高精数控智能技术股份有限公司,沈阳110168

出　　处：《小型微型计算机系统》2017年第4期830-833,共4页Journal of Chinese Computer Systems

基　　金：国家科技重大专项项目(2014ZX04009-031)资助

摘　　要：工业以太网技术的引入和通用标准协议的使用导致工业控制系统面临着严峻的信息安全问题.为了从本质上分析工业控制系统的安全需求,对比了工业控制系统和信息系统的区别.从系统特征分析,工业控制系统属于信息物理融合系统.重点分析了工业控制系统的工业控制网络存在的脆弱性.将工业控制网络划分为不同的层级,不同的层级对应不同的安全域.根据纵深防御的基本原则,给出工业控制网络的多层纵深防御体系结构,针对不同的层级进行相应保护.分析了工业控制网络纵深防御体系结构中边界防御的关键技术,防火墙技术和入侵检测技术.这些技术的研究和发展,为工业控制网络的边界安全提供了保障.The introduction of industrial Ethemet technology and the use of general standard protocols lead to the serious problem of in- formation security in industrial control systems. In order to analyze the security requirements of the industrial control system in es- sence, the difference between the industrial control system and the information system is compared. From the system characteristic a- nalysis, the industrial control system belongs to cyber-physical system. The vulnerability of industrial control network of industrial con- trol system is analyzed. The industrial control system is divided into different levels, which correspond to different security zone. Ac- cording to the basic principle of defense in depth, the multi-layer defense-in-depth architecture of industrial control network is given, and the corresponding protection is carded out at different levels. The key technologies of perimeter defense, firewall technology and intrusion detection technology are analyzed. The research and development of these technologies provide a guarantee for the perimeter security of the industrial control network.

关 键 词：工业控制系统 工业控制网络 信息安全 纵深防御 

分 类 号：TP391[自动化与计算机技术—计算机应用技术]