Rail Transit

At present, most subway signal systems use CBTC technology to realize the two-way communication between trains and ground equipment and use communication technology to achieve "train-to-control communication" and transmit "train positioning" information in real-time.The speed of the training is controlled through the information exchange between the railway communications systems on the command center, train station and train.However, the development of computer and network technologies has to lead to the deep integration of information and signal systems. The CBTC system, PIS network, voice broadcasting is increasing using standard protocols, general hardware software that interconnected via Ethernet with integrated monitoring. This development in turns leads to threats such as viruses and Trojans spreading to the CBTC system. 

Learn more
Solution Introduction

(1)Perimeter Protection

Industrial grade firewall is deployed to implement access control and segregate the network between the interconnected boundaries (A, B network) of signal systems and other systems (e.g. PIS systems and integrated monitoring systems).

The access control policies are set up by the perimeter firewall to enable access control of communication between signal systems and other systems, allowing only specific data transmissions and prohibiting non-essential network traffic.

The access control can be implemented based on traditional source IP address, destination IP address, protocol number, source port, destination port, assets, time, and other parameters.

The Modbus protocol communications between the signal system and other business systems are filtered at the commands level.


(2)Intrusion Detection

An intrusion detection system is used to monitor traffic on the backbone ring switch and analyze the application layer protocol in-depth and comparing it with the rule and policy to detect & alert possible intrusions and alert to achieve intrusion detection and business operation anomaly analysis.

(3)Business Audit

The security audit of the signal system is performed by deploying a database auditing system, an operation and maintenance auditing system, and a log auditing system (included in the security management platform).

The database auditing system performs network auditing on the central database. The auditing contents include the login of the database user and the addition, deletion, modification, and checking of the database.

The operation and maintenance audit system audits the maintenance operations of the maintenance workstation. The audit content includes the remote operation of the maintenance workstation to the network equipment, the ATS server, and the ATC maintenance machine, and can be operated and played back.


(4)Terminal Security Management

Each workstation of the signal system is protected by installing host security software.

The protection includes security baseline management, network ACL control, peripheral control, thumb drives control, illegal outbound blocking, virus killing, and so on.

Unified management of all workstations to have an overview of security posture and centralized configuration to enforce security policies.


(5)Centralized Security Management

The security management platform can monitor the status, resource monitoring, automatically generate asset lists, realize asset management, dynamically creates network topology, realize network-wide device performance monitoring, log management, etc. for all workstations, hosts, server hosts, network equipment, security equipment, etc.


Solution Benefits

The signal system needs to ensure the lowest possible latency and protection systems designed with passive monitoring is preferred. For example, establish a system consisting of IDS & FW for various control appliances to ensure the high security of the entire operations and network.

Establish security maintenance management to perform threat detection, security early warning, security reinforcement, security audit, emergency response, etc., during and after security incidents to ensure the continuous security of the signal system, and continue to defend according to demand.