基于零信任的电网安全防护架构研究.docxVIP

网络安全电力信息与通信技术2021 年第 网络安全 电力信息与通信技术 2021 年第 19 卷第 7 期 ................................................................ELECTRIC POWER ICT 中图分类号：TP393 文献标志码：A 文章编号：2095-641X(2021)07-025-08 DOI：10.16543/j.2095-641x.electric.power.ict.2021.07.004 著录格式：刘涛，马越，姜和芳，等．基于零信任的电网安全防护架构研究 [J]．电力信息与通信技术，2021，19(7)：25-32 . 基于零信任的电网安全防护 架构研究 刘涛 1，马越 1，姜和芳 1，伍少成 1，左金鑫 2，彭童 2 （1. 深圳供电局有限公司，广东 深圳 518001；2. 北京邮电大学 网络空间安全学院，北京 100876） Research on Power Grid Security Protection Architecture Based on Zero Trust LIU Tao1, MA Yue1, JIANG Hefang1, WU Shaocheng1, ZUO Jinxin2, PENG Tong2 (1. Shenzhen Power Supply Bureau Co.,Ltd., Shenzhen 518001, China; 2. School of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing 100876, China) 摘要：针对电力信息系统安全边界逐渐模糊、外部攻击和内部威胁日益严重的问题，文章参考国内外 摘要：针对电力信息系统安全边界逐渐模糊、外部攻击和内部威胁日益严重的问题，文章参考国内外 零信任架构理论和实践，构建了基于零信任的智能电网安全防护架构。该架构主要包括终端可信感 知 Agent、多源数据汇总平台、智能信任评估平台、动态访问控制平台及可信访问代理等。最后，以终 端设备数据传输和业务办公场景 2 个典型应用场景为例，阐述基于零信任的电网安全防护架构在电 网应用中的部署方案，为后续电力信息系统完善安全架构提供了建议。 关键词：智能电网；零信任；安全防护架构；信任评估 Abstract: In order to solve the problems that the security boundary of power information system is gradually blurred, and external attacks and internal threats are increasingly serious, a smart grid security protection architecture based on zero trust is constructed with the theory and practice of zero trust architecture at home and abroad. The architecture mainly includes terminal trusted sensing agent, multi- source data collection platform, intelligent trust evaluation platform, dynamic access control platform and trusted access agent. Finally, taking two typical application scenarios of terminal equipment data transmission and business o★ce scenario as examples, the deployment scheme of power grid security protection architecture based on zero trust in power grid application is elaborated, which provides suggestions for the subsequent power information system to improve the security architecture. Key words: smart grid; zero trust; security prot