一种适用于地基测控网通信的安全网关设计

Design of a Security Gateway Applicable to Ground-Based TT&C Network Communications

摘要:

在当前商业测控系统中,部分系统部署在国外,因此需要设计符合要求的安全通信方案,以确保国外站点和国内中心系统之间的通信及数据安全。本文通过分析某商业测控中心系统与测控站点之间的网络拓扑结构和数据通信特点,并调研国内安全通信设备现状,设计了一种适用于测控网通信的安全网关方案。通过在外站和中心成对添加安全网关,实现业务数据加密、签名认证和完整性验证等技术,确保通信的安全性。采用国密标准的对称/非对称加解密算法对业务数据进行加密,防止数据在网络中的暴露。密钥协商过程基于非对称密码学算法,通过密钥协商建立安全关联,实现对称密钥的生成和共享,确保第三方无法解密或伪造数据包,从而有效保护通信安全。

Abstract:

In the current commercial monitoring and control systems, some systems are deployed overseas, necessitating the design of a security communication scheme to ensure the safety of data and communication between foreign sites and the domestic central system. This paper analyzes the network topology and data communication characteristics between a commercial monitoring and control center system and its sites, and surveys the current status of domestic security communication equipment. Based on this analysis, a security gateway solution suitable for communication in the monitoring and control network is designed.By adding security gateways in pairs at foreign stations and the central system, the solution implements techniques such as data encryption, signature authentication, and data integrity verification to ensure communication security. Using symmetric/asymmetric encryption and decryption algorithms based on national cryptographic standards to encrypt business data, thereby preventing data exposure on the network. The key agreement process is based on asymmetric cryptographic algorithms, establishing secure associations through key negotiation to generate and share symmetric keys, ensuring that third parties cannot decrypt or forge data packets, thus effectively protecting communication security.