基于PF_RING的电力安全网关设计与实现  

Design and Implementation of Power Security Gateway Based on PF_RING

作　　者：吴克河[1] 郑碧煌 张玉俊 程瑞 雷煜卿 WU Kehe;ZHENG Bihuang;ZHANG Yujun;CHENG Rui;LEI Yuqing(School of Control and Computer Engineering,North China Electric Power University,Beijing 102206,China;China Electric Power Research Institute Co.,Ltd.,Beijing 100192,China)

机构地区：[1]华北电力大学控制与计算机工程学院,北京102206 [2]中国电力科学研究院有限公司,北京100192

出　　处：《电力信息与通信技术》2022年第9期9-15,共7页Electric Power Information and Communication Technology

基　　金：国家重点研发计划资助项目(2020YFB0905900)。

摘　　要：近年来,电力网络安全事件频发,电力系统所面临的安全威胁日益增加。IPSec技术作为虚拟专用网实现的重要技术,被广泛应用到电力系统的安全接入中。主流的IPSec框架Openswan和strongSwan采用传统的基于Linux协议栈的数据包捕获方式,需要进行多次数据复制,效率较低。文章提出一种基于PF_RING的电力安全网关的实现方法,通过PF_RING框架进行底层数据包捕获和转发,实现了数据快速处理。经过测试表明,该系统实现了对数据包的加密传输,性能优于开源框架Openswan和strongSwan,能有效保障通信安全。In recent years,with the frequent occurrence of power grid security incidents,power system is facing increasing security threats.As an important technology of virtual private network,IPSec technology is widely used in the security access of power system.Openswan and strongSwan,the mainstream open-source frameworks of IPSec,adopt the traditional packet capture method based on Linux,which requires multiple data replication and is inefficient.In this paper,a power security gateway implementation method based on PF_ RING is proposed,through the PF_ RING framework captures and forwards the underlying data packets to achieve data capture.The test results show that the system realizes the encrypted transmission of data packets,and its performance is better than open source frameworks Openswan and strongSwan,which can effectively guarantee the communication security.

关 键 词：安全网关 PFRING IPSEC 电力信息安全 国密算法 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术] TM73[自动化与计算机技术—计算机科学与技术]