民航空管气象网络安全建设方案设计与实现

Design and Implementation of Civil Aviation Meteorological Network Security Construction Scheme

研究目的是对民航气象信息网络系统安全加固,提高内网保护等级,对外网的入侵实施有效隔离。改进的方法是针对外网航空公司等VPN用户,使用网闸进行物理隔离,防火墙进行逻辑隔离,并增加IPS入侵防御体系。根据气象网络服务的用户不同,将气象网络划分内网和外网,分段隔离。所有气象资料数据经网闸传输。网闸实现内外2个网络安全区之间的非网络方式的安全单向数据传输,并保证安全隔离装置内外两个系统无电气物理连通。外网经过防火墙和IPS双重过滤,保障内网终端不受侵入,有效地保护民航气象信息网络的安全。内网的民航气象资料从服务器经网闸以千兆带宽高效、实时传输,此次优化调整提高效能促进气象业务的可持续发展。IPS、防火墙和网闸的建设投入,使民航气象内网的设备安全得到加固,外网的病毒感染隐患得到彻底解决。

The purpose of this paper is to reinforce the aviation meteorological information network system security,im-prove the network protection level,implementation of effective isolation of network intrusion.Improved method for network airlines such as VPN users,use the gap of physical isolation,logic isolation firewall,intrusion prevention system and in-creased IPS. 〈br〉 According to the meteorological network service users,the internal and external meteorological network division,sec-tionalizing.All weather data transmission via gateway.The gap between internal and external security of unidirectional data transmission non-network mode between 2 network security area,and ensure the safety isolating device inside and outside two system without electrical physical connectivity. 〈br〉 The external network after double filtering firewall and IPS,security of Intranet terminal but not intrusive,effectively protecting the safety of civil aviation meteorological information network.Civil aviation meteorological data from the server through the network gateway to Gigabit bandwidth efficient,real-time transmission,the optimization and adjustment to im-prove efficiency and promote the sustainable development of meteorological service. 〈br〉 Investment in construction of IPS,firewalls and network security equipment,civil aviation meteorological network is strengthened,virus infection risks outside the network completely resolved.