摘  要：随着空管信息化建设的不断深入，运维人员维护的设备也随之增加，在以往的项目建设中，网络安全方面的设计仅针对于防护外部攻击，对内部网络安全并无涉及。国家网络安全相关部门发布的报告显示，超过70%的网络安全威胁源于内部。公安部在《信息系统安全等级保护基本要求》中明确要求，对于重要信息系统网络安全、主机安全、应用安全均要求具备安全审计功能。今年，民航系统对其下属单位的网络安全问题也尤为重视，就在前不久，由民航局空管局网信办、民航大学等多家部门就对我局核心信息系统进行了网络安全评估工作，在提出的整改意见中，其中一条就是对设备维护行为采取行之有效的安全审计。基于以上情况，本文探讨了运用堡垒主机提高空管系统网络安全的理念。

关键词：堡垒主机;空中交通管制;网络安全

中图分类号：TP309       文献标识码：A 文章编号：2096-4706（2019）08-0149-03

Abstract：With the deepening of the construction of air traffic control informatization，the equipment maintained by operation and maintenance personnel has also increased. In the past project construction，the design of network security only aims at protecting external attacks，but does not involve the internal network security. The report issued by the relevant departments of national network security shows that more than 70% of network security threats originate from inside. In the Basic Requirements of Information System Security Grade Protection，the Ministry of Public Security clearly requires that the security auditing function be provided for the network security，host security and application security of important information systems. This year，the Civil Aviation System attaches great importance to the network security of its subordinate units. Just recently，many departments，such as the Network Communications Office of the Air Administration of Civil Aviation Administration and the Civil Aviation University，have carried out network security assessment on the core information system of the Civil Aviation Bureau. Among the suggestions for improvement，one of them is to take effective safety audits on equipment maintenance behavior. Based on the above situation，this paper discusses the idea of using the bastion host to improve the network security of air traffic control system.

Keywords：bastion host;air traffic control;network security

0  引  言

随着国民经济的持续增长，民航市场的需求不断扩大，航班流量始终保持高速增长，管制业务自动化控制需求也在不断增加。为了保障管制业务的安全、高效运行，空管系统不断推进信息化建设工作，大量新建业务系统投入生产。这些系统的增加，不仅给技术保障部门带来维护压力，也使得信息网络安全问题越来越突出。

目前，在空管系统项目建设时，在网络安全方面安装了大量的网络防护设备，形成了一套较为完善的信息安全防护体系，但网络安全故障仍时有发生。……