DC power transmission and distribution system and communication method for DC power transmission and distribution system

Abstract

The invention relates to a direct current power transmission and distribution system, a communication method and device of the direct current power transmission and distribution system, computer equipment, a storage medium and a computer program product. The system comprises a communication key management device and a power electronic device supervision module which communicate with each other, and the communication key management device is used for obtaining a system configuration file, generating security credential data corresponding to the power electronic device supervision module according to the system configuration file and sending the security credential data to the power electronic device supervision module. And sending the security credential data to a corresponding power electronic device supervision module, wherein the power electronic device supervision module performs communication based on the received security credential data. The method comprises the following steps: acquiring a system configuration file, and generating and sending security credential data to a corresponding power electronic device supervision module according to the system configuration file, so that the power electronic device supervision module performs communication based on the received security credential data. By adopting the scheme, the communication security of the system can be improved.

Description

Technical Field

[0001] The present application relates to the technical field of power system energy storage, and in particular to a direct current power transmission and distribution system, a communication method, an apparatus, a computer device, a storage medium and a computer program product of the direct current power transmission and distribution system. Background Art

[0002] In recent years, in order to make key information infrastructure (including power grid) fully localized and autonomously controllable to ensure national information security, State Grid has been promoting an autonomous and controllable security strategy, for example, by building an autonomous and controllable information infrastructure and establishing a security protection system to ensure the safe and stable operation of the power grid and build a solid line of defense for national information security.

[0003] At present, in the field of DC transmission and distribution, such as flexible DC control and protection, the safety of the power system is mainly solved by isolation devices at the physical level. It can be seen that in the DC transmission and distribution system, there is a problem of low communication security performance.

[0004] It can be seen that there is a need to provide a solution that can improve the communication security performance of the DC transmission and distribution system. Summary of the invention

[0005] Based on this, it is necessary to provide a DC transmission and distribution system, a communication method, an apparatus, a computer device, a computer-readable storage medium and a computer program product for the DC transmission and distribution system, which can improve the communication security performance of the DC transmission and distribution system in response to the above-mentioned technical problems.

[0006] In a first aspect, the present application provides a direct current power transmission and distribution system. The system comprises: a communication key management device and a power electronic device supervision module that communicate with each other;

[0007] The communication key management device is used to obtain a system configuration file, generate security credential data corresponding to a power electronic device supervision module according to the system configuration file, send the security credential data to the corresponding power electronic device supervision module, and the power electronic device supervision module communicates based on the received security credential data.

[0008] In the technical solution of the embodiment of the present application, a communication key management device is introduced, and the communication key management device obtains the system configuration file, generates security credential data for identity authentication and authority management according to the system configuration file, and then sends the security credential data to the corresponding power electronic device supervision module, and the power electronic device supervision module communicates based on the received security credential data. The above scheme can improve the reliability and stability of the DC power transmission and distribution system by introducing a communication key management device. Each power electronic device supervision module communicates based on the security credential data, and can perform identity authentication and authority management during the communication process, thereby effectively reducing the risk of data being viewed, leaked or tampered with by unauthorized personnel during the transmission process, thereby improving the communication security of the system. In summary, the adoption of this scheme can improve the communication security performance of the DC power transmission and distribution system.

[0009] In some embodiments, a communication key management device is used to extract device identification data corresponding to each power electronic device supervision module in a system configuration file, generate a communication key corresponding to each power electronic device supervision module based on the device identification data, extract permission requirement data in the system configuration file, and generate permission configuration data corresponding to the power electronic device supervision module based on the permission requirement data; the security credential data includes the communication key and the permission configuration data.

[0010] In the technical solution of the embodiment of the present application, a communication key is generated based on device identification data that is unique and difficult to forge, which is both safe and simple. By generating permission configuration data, permission management of each power electronic device can be achieved, reducing the possibility of malicious attackers or improper operators accessing and modifying important data without authorization, thereby improving system security.

[0011] In some embodiments, the power electronic device supervision module includes: a restricted supervision module and an unrestricted supervision module that communicate with each other, and the security credential data includes a communication key and permission configuration data;

[0012] The communication key management device is also used to send the communication key to the corresponding unrestricted supervision module, and send the communication key and authority configuration data to the corresponding restricted supervision module.

[0013] In the technical solution of the embodiment of the present application, the security credential data is sent in a targeted manner according to whether it is subject to the constraints of permission management, which can reduce the risk of security credential data leakage.

[0014] In some embodiments, the unrestricted supervision module includes a power conversion equipment control and protection system, the restricted supervision module includes a power conversion equipment master control device, and the communication key includes symmetric key data;

[0015] A communication key management device, used to send symmetric key data to the power conversion equipment control and protection system and the power conversion equipment main control device;

[0016] The power conversion equipment control and security system is used to encrypt the first communication data to be transmitted by a preset encryption algorithm when the legitimacy and validity of the symmetric key data are successfully verified, and send a control instruction carrying the encrypted first communication data to the power conversion equipment main control device;

[0017] The main control device of the power conversion equipment is used to execute the control instruction if it receives the control instruction and obtains the first communication data by decrypting the symmetric key data, and to feed back the instruction execution result of the control instruction to the power conversion equipment control and protection system after successfully verifying the legitimacy and validity of the symmetric key data.

[0018] In the technical solution of the embodiment of the present application, when the real-time requirements of data communication are high, symmetric key data is used for communication, which can quickly realize encryption and decryption, effectively improve communication efficiency, and have high security.

[0019] In some embodiments, the restricted supervision module further includes a monitoring system, the monitoring system communicates with the power conversion equipment master control device, and the communication key includes asymmetric key data;

[0020] The communication key management device is further used to send first asymmetric key data and first authority configuration data corresponding to the monitoring system to the monitoring system, and send second asymmetric key data and second authority configuration data corresponding to the power conversion device master control device to the power conversion device master control device;

[0021] The monitoring system is used to obtain the public key data of the main control device of the power conversion device when the legality and validity of the first asymmetric key data and the first authority configuration data are successfully verified, encrypt the second communication data to be transmitted by using the public key data of the main control device of the power conversion device, and send the main control device operation instruction carrying the encrypted second communication data to the main control device of the power conversion device based on the first authority configuration data;

[0022] The main control device of the power conversion equipment is also used to verify the legality and validity of the second asymmetric key data and the second authority configuration data. If an operation instruction of the main control device is received, and the second communication data is decrypted according to the second asymmetric key data and the operation authority of the monitoring system is successfully verified according to the second authority configuration data, the operation instruction of the main control device is executed, and the instruction execution result of the operation instruction of the main control device is fed back to the monitoring system.

[0023] The technical solution of the embodiment of the present application adopts asymmetric keys for communication between the monitoring system and the main control device of the power conversion equipment, which further improves the communication security and reliability. It performs authority authentication management through authority configuration data, and can also effectively reduce the possibility of malicious attackers or improper operators accessing and modifying important data of the monitoring system and the main control device of the power conversion equipment without authorization, thereby improving the stability of the system.

[0024] In some embodiments, the restricted supervision module further includes a battery management control device, the battery management control device communicating with the monitoring system;

[0025] The communication key management device is further used to send third asymmetric key data and third authority configuration data corresponding to the battery management control device to the battery management control device;

[0026] The monitoring system is further used to obtain the public key data of the battery management control device while verifying the legitimacy and validity of the first communication key and the first authority configuration data, encrypt the third communication data to be transmitted according to the public key data of the battery management control device, and send the battery management operation instruction carrying the encrypted third communication data to the battery management control device based on the first authority configuration data;

[0027] A battery management control device is used to verify the legitimacy and validity of a third communication key and a third authority configuration data. If a battery management operation instruction is received, and the third communication data is decrypted according to the third communication key and the operation authority of the monitoring system is successfully verified according to the third authority configuration data, then the battery management operation instruction is executed and the instruction execution result corresponding to the battery management operation instruction is fed back to the monitoring system.

[0028] The technical solution of the embodiment of the present application adopts asymmetric keys for communication between the monitoring system and the battery management control device, which can further improve the communication security and reliability. By performing authority authentication management through authority configuration data, it can also effectively reduce the possibility of malicious attackers or improper operators accessing and modifying important data without authorization, thereby improving the stability of the system.

[0029] In some embodiments, the communication key management device is further used to send the security credential data to the power electronic device supervision module in an offline or online manner.

[0030] In the technical solution of the embodiment of the present application, the communication key management device distributes security credential data offline, does not rely on the network, and can reduce the risk of data leakage caused by network transmission; by distributing security credential data online, it can quickly complete data distribution and support real-time updating and expansion of key data, which is more conducive to maintaining the security of the system.

[0031] In some embodiments, the communication key management device is also used to send the security credential data online to the power electronic device supervision module through a preset security port.

[0032] In the technical solution of the embodiment of the present application, sending security credential data through a secure port can reduce the possibility of data being stolen or tampered with during transmission, and can further ensure the integrity, reliability and correctness of data transmission.

[0033] In some embodiments, the communication protocol between the monitoring system and the main control device of the power conversion equipment includes a target security authentication protocol, and the target security authentication protocol includes a communication protocol oriented to the power system.

[0034] In the technical solution of the embodiment of the present application, by adding a security authentication protocol between the monitoring system and the main control device of the power conversion equipment, the power system communication can be made more secure and reliable, ensuring the stable operation of the monitoring system and the main control device of the power conversion equipment, and protecting electricity safety and information privacy.

[0035] In some embodiments, the communication protocol between the monitoring system and the battery management control device includes a target safety authentication protocol, and the target safety authentication protocol includes a communication protocol for the power system.

[0036] In the technical solution of the embodiment of the present application, by adding a security authentication protocol between the monitoring system and the battery management control device, the power system communication can be made safer and more reliable, ensuring the stable operation of the battery management control device.

[0037] In a second aspect, the present application further provides a communication method for a DC power transmission and distribution system, the system comprising the system as described in any of the above embodiments, the method comprising:

[0038] Get the system configuration file;

[0039] Generate security credential data corresponding to the power electronic device supervision module according to the system configuration file, and the security credential data is used to realize identity authentication and authority management;

[0040] The security credential data is sent to a corresponding power electronic device supervisory module, so that the power electronic device supervisory module communicates based on the received security credential data.

[0041] In the technical solution of the embodiment of the present application, the communication key management device obtains a system configuration file, generates security credential data for identity authentication and authority management based on the system configuration file, and then sends the security credential data to the corresponding power electronic device supervision module, so that the power electronic device supervision module communicates based on the received security credential data. The above scheme generates security credential data based on the system configuration file, and each power electronic device supervision module communicates based on the security credential data, which can perform identity authentication and authority management during the communication process, thereby effectively reducing the risk of data being viewed, leaked or tampered with by unauthorized personnel during the transmission process, and improving the communication security of the system. In summary, the adoption of this scheme can improve the communication security performance of the DC transmission and distribution system.

[0042] In some embodiments, generating security credential data corresponding to the power electronic device supervision module according to the system configuration file includes:

[0043] Extracting device identification data corresponding to each power electronic device supervision module in the system configuration file, and generating a communication key corresponding to each power electronic device supervision module based on the device identification data; and

[0044] Extracting authority requirement data from a system configuration file, and generating authority configuration data corresponding to a power electronic device supervision module according to the authority requirement data;

[0045] Security credential data includes communication keys and permission configuration data.

[0046] In the technical solution of the embodiment of the present application, a communication key is generated based on device identification data that is unique and difficult to forge, which is both safe and simple. By generating permission configuration data, permission management of each power electronic device can be achieved, reducing the possibility of malicious attackers or improper operators accessing and modifying important data without authorization, thereby improving system security.

[0047] In a third aspect, the present application further provides a communication device for a DC power transmission and distribution system, the system comprising the system as described in any of the above embodiments. The device comprises:

[0048] A data acquisition module, used to obtain system configuration files;

[0049] A data processing module is used to obtain a system configuration file, and generate security credential data corresponding to the power electronic device supervision module according to the system configuration file, wherein the security credential data is used to implement identity authentication and authority management;

[0050] The data sending module is used to send the security credential data to the corresponding power electronic device supervision module, and the power electronic device supervision module communicates based on the received security credential data.

[0051] In a fourth aspect, the present application further provides a computer device, wherein the computer device comprises a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps in the communication method of the DC power transmission and distribution system are implemented.

[0052] In a fifth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps in the communication method of the DC power transmission and distribution system are implemented.

[0053] In a sixth aspect, the present application further provides a computer program product, wherein the computer program product comprises a computer program, and when the computer program is executed by a processor, the steps in the communication method of the DC power transmission and distribution system are implemented.

[0054] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 This is a structural block diagram of a DC power transmission and distribution system in some embodiments of the present application;

[0056] Figure 2 A structural block diagram of a DC power transmission and distribution system in some other embodiments of the present application;

[0057] Figure 3 A structural block diagram of a DC power transmission and distribution system in some other embodiments of the present application;

[0058] Figure 4 This is a structural block diagram of a DC power transmission and distribution system in some further embodiments of the present application;

[0059] Figure 5 This is a structural block diagram of a direct-mounted energy storage system in some embodiments of the present application;

[0060] Figure 6 This is a structural block diagram of a direct-mounted energy storage system in some other embodiments of the present application;

[0061] Figure 7 A schematic flow chart of a communication method for a DC power transmission and distribution system in some embodiments of the present application;

[0062] Figure 8 A schematic flow chart of a communication method for a DC power transmission and distribution system in some other embodiments of the present application;

[0063] Fig. 9This is a structural block diagram of a communication device of a DC power transmission and distribution system in some embodiments of the present application;

[0064] Fig.10 This is a diagram of the internal structure of a computer device in some embodiments of the present application. DETAILED DESCRIPTION

[0065] The following embodiments of the technical solution of the present application are described in detail in conjunction with the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solution of the present application, and are therefore only used as examples, and cannot be used to limit the scope of protection of the present application.

[0066] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by technicians in the technical field to which this application belongs; the terms used herein are only for the purpose of describing specific embodiments and are not intended to limit this application; the terms "including" and "having" in the specification and claims of this application and the above-mentioned figure descriptions and any variations thereof are intended to cover non-exclusive inclusions.

[0067] In the description of the embodiments of the present application, the technical terms "first", "second", etc. are only used to distinguish different objects, and cannot be understood as indicating or implying relative importance or implicitly indicating the number, specific order or primary and secondary relationship of the indicated technical features. In the description of the embodiments of the present application, the meaning of "multiple" is more than two, unless otherwise clearly and specifically defined.

[0068] Reference to "embodiments" herein means that the specific features, structures, or characteristics described in conjunction with the embodiments may be included in at least some embodiments of the present application. The appearance of the phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0069] In the description of the embodiments of the present application, the term "and / or" is only a description of the association relationship of the associated objects, indicating that there may be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0070] In the description of the embodiments of the present application, the term "multiple" refers to more than two (including two). Similarly, "multiple groups" refers to more than two groups (including two groups), and "multiple pieces" refers to more than two pieces (including two pieces).

[0071] In recent years, in order to make key information infrastructure (including power grid) fully localized and autonomously controllable to ensure national information security, State Grid has been promoting an autonomous and controllable security strategy, for example, by building an autonomous and controllable information infrastructure and establishing a security protection system to ensure the safe and stable operation of the power grid and build a solid line of defense for national information security.

[0072] At present, in the AC substation system, the State Grid has been vigorously promoting the autonomous control of information security. However, in the flexible DC transmission and distribution system, there is no information security requirement, and there is no ready-made system specification to fully or clearly define information security. For example, in the field of flexible DC transmission and distribution control and protection, since the structure of the flexible DC transmission and distribution control and protection system is more complex than the traditional power system, including multiple levels, multiple subsystems and a large number of equipment, these devices need to exchange and communicate frequently, and there is a high-speed real-time response requirement for data communication. As a result, in the field of flexible DC transmission and distribution control and protection, due to the various technical difficulties in deploying information security technology, unified standards and specifications have not yet been formed. The security of the power system is mainly solved by isolation devices at the physical level, and the security of communication between systems cannot be guaranteed. This has a certain impact on the normal operation and normal operation and maintenance of the power system. It can be seen that in the field of flexible DC transmission and distribution control and protection, there is a problem of low communication security of the power system.

[0073] Based on the above considerations, in order to solve the problem of low information security of power systems in the field of DC transmission and distribution control and protection, this application independently develops and defines unified standards and specifications applicable to the communication of each module in the DC transmission and distribution system, and adopts advanced security technology, introduces information security measures, adds a communication key management device, separates security policies and mechanisms from the system's application programs, and creates a more secure application operating environment. In the actual communication process, the communication key management device obtains the system configuration file, generates security credential data according to the system configuration file, and sends the security credential data to the connected power electronic device supervision module, so that the power electronic device supervision module communicates based on the communication key or security credential data, and the power electronic device supervision module communicates securely based on the security credential data. In this way, by introducing the communication key management device, the reliability and stability of the DC transmission and distribution system can be improved, and each power electronic device supervision module communicates based on the security credential data, and can perform identity authentication and authority management during the communication process, thereby effectively reducing the risk of data being viewed, leaked or tampered with by unauthorized personnel during transmission, and improving the communication security of the system. In summary, the adoption of this solution can improve the communication security performance of the DC transmission and distribution system.

[0074] The DC power transmission and distribution system disclosed in the embodiments of the present application may be, but is not limited to, a new direct-mounted energy storage system, a flexible DC power transmission and distribution system, and the like.

[0075] In some embodiments, Figure 1 As shown, a DC power transmission and distribution system 100 is provided. The system comprises: a communication key management device 120 and a power electronic device supervision module 200 (hereinafter referred to as a supervision module) communicating with each other;

[0076] The communication key management device 120 is used to obtain a system configuration file, generate security credential data corresponding to the power electronic device supervision module 200 according to the system configuration file, and send the security credential data to the corresponding power electronic device supervision module 200. The power electronic device supervision module 200 communicates based on the received security credential data.

[0077] The communication key management device 120 may also be referred to as a communication key management machine, which is used to generate, distribute, store and revoke keys used for encrypted communications. It is an important component for ensuring information security in DC transmission and distribution systems, and can ensure that encrypted communications between communicating parties maintain confidentiality, integrity and reliability. The power electronic device supervision module 200 refers to a module used to monitor and control the working status of a power electronic device. It may be a specific device, such as a power electronic device control device, or a system, such as an automated control system. The system configuration file includes access control lists, security protocols, key management policies, encryption algorithms, permission management configuration files, and configuration files for each module in the system. Security credential data is information used to verify identity and authorize access to specific resources. In this embodiment, the security credential data may include digital identity information, key data, and permission configuration data.

[0078] In specific implementation, the communication key management device 120 may read the system configuration file, extract the corresponding data in the system configuration file, such as the key management strategy, encryption algorithm parameters and configuration data of each power electronic device module in the system, and generate the security credential data corresponding to each power electronic supervision module 200 through the corresponding encryption algorithm, that is, each power electronic device supervision module 200 corresponds to a unique security credential data. Then, according to the mapping relationship between the security credential data and each power electronic device supervision module 200, each security credential data is sent to the corresponding power electronic device supervision module 200. After the power electronic device supervision module 200 receives the security credential data matching itself, it communicates with other modules based on the security credential data. In the actual communication process, the communication data sender can encrypt the communication data to be transmitted based on the security credential data, and then send the encrypted communication data to the communication data receiver. The communication data receiver can use the security credential data to verify the identity and operation authority of the communication data sender. After the verification is successful, the security credential data is further used to decrypt the encrypted communication data to be transmitted. After the decryption is successful, the corresponding operation is performed.

[0079] In the technical solution of the embodiment of the present application, a communication key management device 120 is introduced, and the communication key management device 120 obtains a system configuration file, generates security credential data for identity authentication and authority management according to the system configuration file, and then sends the security credential data to the corresponding power electronic device supervision module 200, and the power electronic device supervision module 200 communicates based on the received security credential data. The above scheme, by introducing the communication key management device 120, can improve the reliability and stability of the DC power transmission and distribution system, and each power electronic device supervision module 200 communicates based on the security credential data, and can perform identity authentication and authority management during the communication process, thereby effectively reducing the risk of data being viewed, leaked or tampered with by unauthorized personnel during the transmission process, and improving the communication security of the system. In summary, the adoption of this scheme can improve the communication security performance of the DC power transmission and distribution system.

[0080] In some embodiments, the communication key management device 120 is further configured to send the security credential data to the power electronic device supervision module 200 in an offline or online manner.

[0081] In this embodiment, the communication key management device 120 supports the transmission of security credential data in an offline or online manner. If the offline transmission method is adopted, the security credential data is sent to the power electronic device supervision module 200 in an offline manner, and the security credential data can be transmitted step by step between each power electronic device supervision module 200. If the online transmission method is adopted, the security credential data can be distributed online to the connected power electronic device supervision module 200 directly through a private communication protocol or through a network switch. Furthermore, in this embodiment, for the case of online distribution of security credential data, in order to ensure communication security, the communication key in the security credential data can be updated regularly. In the DC transmission and distribution system, the mechanism for updating the communication key can include the following methods: the first is based on an event-driven update mechanism, specifically, it can be a pre-defined event that triggers the update of the communication key, such as system restart, key expiration, user authority change, system failure or malicious attack, etc. After a predefined event is triggered, a new communication key will be automatically generated. At the same time, in order to ensure the reliability and security of the key, the newly generated communication key can also be encrypted and authenticated, and then the newly generated communication key that has passed the authentication can be distributed to each power electronic device module 200. During the distribution process, encryption, digital signature and authentication technologies can be used to ensure the security of communication key transmission. After receiving the newly generated communication key, each power electronic device module 200 performs a communication key synchronization operation to ensure that subsequent communications use the latest communication key. Within a certain period of time, if no new event is triggered, each power electronic device module 200 continues to use the current communication key for communication. When the next event is triggered, the system will generate and distribute a new key again, and repeat the above communication key update operation. The second is based on a time-driven update mechanism, that is, updating the communication key corresponding to each power electronic device supervision module 200 at a fixed time period, for example, using a method of updating the communication key every week, every day, or even every few hours. The third is a manual update mechanism, that is, the power system management personnel can manually trigger the key update according to actual needs, such as in an emergency scenario, to generate a new communication key, and then distribute the newly generated communication key to each power electronic device module 200 through encryption, digital signature and authentication technologies. After each power electronic device supervision module 200 receives the newly generated communication key, it performs the communication key synchronization operation.

[0082] In the technical solution of the embodiment of the present application, the communication key management device 120 distributes security credential data offline, does not rely on the network, and can reduce the risk of data leakage caused by network transmission; by distributing security credential data online, it can quickly complete data distribution and support real-time updating and expansion of key data, which is more conducive to maintaining the security of the system.

[0083] In some embodiments, the communication key management device 120 is also used to send the security credential data online to the power electronic device supervision module 200 through a preset security port.

[0084] The preset security port refers to a predefined security port, and the security port may be a port that supports encrypted transmission and complies with international standards. Continuing from the previous embodiment, in this embodiment, the security credential data may be sent online to the power electronic device supervision module 200 through a preset security port, such as a specific security port 9102 in the power system. It is understandable that in other embodiments, other security ports may be used to distribute the security credential data online, which is not limited here.

[0085] In the technical solution of the embodiment of the present application, sending security credential data through a secure port can reduce the possibility of data being stolen or tampered with during transmission, and can further ensure the integrity, reliability and correctness of data transmission.

[0086] In some embodiments, the communication key management device 120 is used to extract device identification data corresponding to each power electronic device supervision module 200 in the system configuration file, generate a communication key corresponding to each power electronic device supervision module 200 based on the device identification data, extract permission requirement data in the system configuration file, and generate permission configuration data corresponding to the power electronic device supervision module 200 according to the permission requirement data; the security credential data includes the communication key and the permission configuration data.

[0087] In this embodiment, the security credential data includes a communication key and permission configuration data. The device identification data refers to the unique identifier of the power electronic device supervision module 200, including but not limited to the device serial code, the device MAC (Media Access Control) address and the device model data. In this embodiment, the communication key management device 120 generates a communication key according to the system configuration file by extracting the device identification data of each power electronic supervision module in the system configuration file, and then, for each power electronic supervision module, the data is converted into a key according to a predefined algorithm and rules, and the converted key is used as the communication key of the power electronic supervision module. This process usually involves hashing and salting the device identification data to increase the complexity and security of the key. Specifically, the device serial code can be taken as an example, and a predefined hash encryption algorithm can be used to convert the device serial code into a communication key. In other embodiments, the HMAC encryption algorithm can be selected to encrypt the device serial code of each power electronic device supervision module 200 to obtain a communication key. Specifically, a suitable hash function such as SHA-256 and a key K may be determined first, and the device serial code of the power electronic device supervision module 200 may be input as a message M into the HMAC algorithm. Before inputting the message, the device serial code may be preprocessed (such as padding or truncation) to meet the requirements of the hash function. For the device serial code M to be encrypted, the key K is used to calculate the HMAC value, and the formula is: HMAC(K,M)=H((K⊕opad)||H((K⊕ipad)||M)), where "||" represents a concatenation operation, "H" represents a hash function, "opad" and "ipad" are predefined constants, and the obtained HMAC value is the communication key of the power electronic device supervision module 200. Subsequently, the communication key corresponding to each power electronic device supervision module 200 is saved, and a mapping relationship between the power electronic device supervision module and the communication key is established.

[0088] In other embodiments, a random number can be generated using a secure random number generator, and the generated random number is used as the key K of the HMAC algorithm. Then, the HMAC algorithm is used to calculate the HMAC value of the device serial code and the random number to obtain the communication key. For example, the device serial code of the power electronic device supervision module 200A is "ABC123", and a random number such as "D4CFE5A0" is generated using a secure random number generator, which is used as the key of the HMAC algorithm. Then, the HMAC algorithm is used to calculate the HMAC value of the device serial code and the random number. The HMAC value calculated by the SHA-256 hash algorithm is "F1A3C27BDA80506DABA9C2AEE3D5FA6B6234B924A8E21E275935CAC6FE99B84C". Then, part of the data of the HMAC value is intercepted as the communication key, for example, the first 16 bytes (128 bits) of the HMAC value can be used as the communication key. In this embodiment, based on the above HMAC value, the intercepted key is "F1A3C27BDA80506DABA9C2AEE3D5FA6B".

[0089] In this embodiment, the communication key management device 120 generates the permission configuration data according to the system configuration file by: querying the corresponding permission requirement data in the system configuration file according to the device identification data of each power electronic device supervision module 200, and then generating the permission configuration data corresponding to the power electronic device supervision module 200 according to the query permission requirement data of each power electronic device supervision module 200. It can be based on the permission requirement data of each power electronic device supervision module 200, combined with the different types and roles of different modules, to determine the permission configuration of each power electronic device supervision module 200, that is, to assign corresponding permissions to each power electronic device supervision module 200, such as data access permission and data modification permission, and finally, determine the permission configuration data of each power electronic device supervision module 200. Specifically, the generation of the permission configuration data can be automatically generated by a script, by executing a preset permission configuration script, reading the device information and permission requirement data of each power electronic device supervision module 200 in the system configuration file, and automatically generating the permission configuration data corresponding to each supervision module. It can also be calling a third-party permission management tool to read the device information and permission requirement data of each supervision module in the system configuration file, and automatically generating the permission configuration data corresponding to each supervision module.

[0090] In the technical solution of the embodiment of the present application, a communication key is generated based on device identification data that is unique and difficult to forge, which is both safe and simple. By generating permission configuration data, permission management of each power electronic device can be achieved, reducing the possibility of malicious attackers or improper operators accessing and modifying important data without authorization, thereby improving system security.

[0091] In some embodiments, the power electronic device supervision module 200 includes: a restricted supervision module and an unrestricted supervision module that communicate with each other, and the security credential data includes a communication key and permission configuration data;

[0092] The communication key management device 120 is further used to send the communication key to the corresponding unrestricted supervision module, and send the communication key and the authority configuration data to the corresponding restricted supervision module.

[0093] A restricted supervision module refers to a power electronic device supervision module 200 that is subject to the authority configuration data constraints, and an unrestricted supervision module refers to a power electronic device supervision module 200 that is not subject to the authority configuration data constraints. In this embodiment, the power electronic device supervision module 200 can be divided into a restricted supervision module and an unrestricted supervision module according to whether the authority management is received, wherein the restricted supervision module and the unrestricted supervision module can perform network communication. The communication key management device 120 can send the communication key to the corresponding unrestricted supervision module according to whether it is subject to the authority management, and send the communication key and the authority configuration data to the corresponding restricted supervision module.

[0094] In the technical solution of the embodiment of the present application, the security credential data is sent in a targeted manner according to whether it is subject to the constraints of permission management, which can reduce the risk of security credential data leakage.

[0095] like Figure 2 As shown, in some embodiments, the unrestricted supervision module includes a power conversion equipment control and protection system 222, the restricted supervision module includes a power conversion equipment master control device 242, and the communication key includes symmetric key data;

[0096] The communication key management device 120 is used to send symmetric key data to the power conversion equipment control and security system 222 and the power conversion equipment main control device 242.

[0097] The power conversion equipment control and security system 222 is used to encrypt the first communication data to be transmitted by a preset encryption algorithm when the legitimacy and validity of the symmetric key data are successfully verified, and send a control instruction carrying the encrypted first communication data to the power conversion equipment main control device 242.

[0098] The power conversion equipment main control device 242 is used to successfully verify the legitimacy and validity of the symmetric key data. If a control instruction is received and the first communication data is obtained by decrypting the symmetric key data, the control instruction will be executed and the instruction execution result of the control instruction will be fed back to the power conversion equipment control and protection system 222.

[0099] In this embodiment, the communication key can be divided into symmetric key data and asymmetric key data according to the real-time requirements of data communication. Among them, for the supervision module with high requirements for data communication real-time, the corresponding symmetric key data is generated, and for the supervision module with low requirements for data communication real-time, the corresponding asymmetric key data is generated. Specifically, the unrestricted supervision module includes a power conversion equipment control and protection system 222, and the restricted supervision module includes a power conversion equipment main control device 242. The power conversion equipment control and protection system 222 is a system for monitoring, controlling and protecting power conversion equipment. For example, the power conversion equipment takes the converter valve as an example, the power conversion equipment control and protection system 222 is the converter valve control and protection system, and the power conversion equipment main control device 242 is the converter valve main control device. Since the power conversion equipment control and protection system 222 belongs to the station control layer system, and the power conversion equipment master control device 242 belongs to the local control layer, that is, the power conversion equipment master control device 242 belongs to the subordinate management object of the power conversion equipment control and protection system 222, both have high requirements for the real-time performance of data communication. Therefore, symmetric key data can be used for communication between the power conversion equipment control and protection system 222 and the power conversion equipment master control device 242.

[0100] In a specific implementation, the communication key management device 120 may encrypt based on the device serial code corresponding to the power conversion device control and protection system 222 and the power conversion device main control device 242 to generate symmetric key data, and then send the symmetric key data to the power conversion device control and protection system 222 and the power conversion device main control device 242. After receiving the symmetric key data, the power conversion device control and protection system 222 and the power conversion device main control device 242 need to verify the legitimacy and validity of the symmetric key data. The legitimacy verification includes verifying whether the key format is correct and whether it is distributed by the communication key management device 120. The validity verification includes verifying whether the key is expired and whether it can be successfully decrypted. When the legitimacy and validity of the symmetric key data are successfully verified, the power conversion equipment control and protection system 222 can encrypt the communication data a to be transmitted by a preset encryption algorithm, and send the control instruction carrying the encrypted communication data a to the power conversion equipment main control device 242. Otherwise, the control instruction carrying the communication data a is directly sent to the power conversion equipment main control device 242, and then the power conversion equipment main control device 242 is waited for to reply information. If the command execution result fed back by the power conversion equipment main control device 242 is received, the command execution is confirmed to be successful. When the legitimacy and validity of the symmetric key data are successfully verified, the power conversion equipment main control device 242 receives the control instruction, and then decrypts the control instruction using the symmetric key data received by itself. If the communication data a is obtained by decryption, it indicates that the key verification is successful, and further responds to and executes the control instruction, and feeds back the corresponding execution result to the power conversion equipment control and protection system 222. If the communication data a cannot be decrypted according to the symmetric key data, it indicates that the key verification fails, that is, the control instruction is refused to be executed, and the communication process is terminated. Similarly, in a DC power transmission and distribution system, if the power electronic device supervision module 200 needs to send a control instruction to a lower-level management object, it is also necessary to first encrypt the communication data to be transmitted, and then send the encrypted control instruction to the lower-level management object. The lower-level management object will only execute the control command when it uses the key data to decrypt the control instruction to obtain the communication data, and feedback the corresponding command execution result to the upper-level supervision module.

[0101] In the technical solution of the embodiment of the present application, when the real-time requirements of data communication are high, symmetric key data is used for communication, which can quickly realize encryption and decryption, effectively improve communication efficiency, and have high security.

[0102] like Figure 3 As shown, in some embodiments, the restricted supervision module further includes a monitoring system 244, and the monitoring system 244 communicates with the power conversion equipment master control device 242, and the communication key includes asymmetric key data.

[0103] The communication key management device 120 is also used to send the first asymmetric key data and the first authority configuration data corresponding to the monitoring system 244 to the monitoring system 244, and to send the second asymmetric key data and the second authority configuration data corresponding to the power conversion device master control device 242 to the power conversion device master control device 242.

[0104] The monitoring system 244 is used to obtain the public key data of the power conversion equipment main control device 242 when the legality and validity of the first asymmetric key data and the first authority configuration data are successfully verified, encrypt the second communication data to be transmitted by the public key data of the power conversion equipment main control device 242, and send the main control device operation instructions carrying the encrypted second communication data to the power conversion equipment main control device 242 based on the first authority configuration data.

[0105] The main control device 242 of the power conversion equipment is also used to verify the legality and validity of the second asymmetric key data and the second authority configuration data. If an operation instruction of the main control device is received, and the second communication data is decrypted according to the second asymmetric key data and the operation authority of the monitoring system 244 is successfully verified according to the second authority configuration data, then the operation instruction of the main control device is executed and the instruction execution result of the operation instruction of the main control device is fed back to the monitoring system 244.

[0106] The monitoring system 244 refers to the local monitoring system of the local control layer. The monitoring system 244 has access rights to the power conversion equipment master control device 242 and can send control instructions to the power conversion equipment master control device 242. In this embodiment, according to the real-time requirements of data communication, asymmetric key data is used for communication between the monitoring system 244 and the power conversion equipment master control device 242. Specifically, the communication key management device 120 can send the first asymmetric key data and the first permission configuration data corresponding to the monitoring system 244 to the monitoring system 244, and send the second asymmetric key data and the second permission configuration data corresponding to the power conversion equipment master control device 242 to the power conversion equipment master control device 242. Similarly, after receiving the corresponding asymmetric key data and authority configuration data, the monitoring system 244 and the power conversion equipment main control device 242 need to verify the legality and validity of the asymmetric key data and the authority configuration data. If the verification is passed, if the monitoring system 244 needs to communicate with the power conversion equipment main control device 242, it can initiate a corresponding authority request through the authority configuration data, obtain the public key data of the power conversion equipment main control device 242, use the public key data to encrypt the communication data b to be transmitted, and then based on the first authority configuration data, send the main control device operation instruction carrying the encrypted signal data b to the power conversion equipment main control device 242. If the legality verification and validity verification fail, the operation instruction carrying the communication data b is directly sent to the power conversion equipment main control device 242, and wait for the feedback information of the power conversion equipment main control device 242.

[0107] When the power conversion equipment master control device 242 receives an operation instruction carrying the encrypted communication data b, it uses its own private key data to decrypt the operation instruction. If the communication data b is successfully decrypted, it indicates that the key verification is successful. It further verifies whether the monitoring system 244 has access rights and operation rights according to the second permission configuration data received by itself. Otherwise, it discards the operation instruction data and records the wrong access. If it is verified that the monitoring system 244 has the corresponding access rights, it indicates that the authority verification is successful, confirms and executes the corresponding operation, and feeds back the operation execution result to the monitoring system 244. If the monitoring system 244 receives the operation execution result, it confirms that the power conversion equipment master control device 242 operates successfully. If the power conversion equipment master control device 242 receives an operation instruction carrying the unencrypted communication data b, it directly responds to the instruction, executes the corresponding operation, and feeds back the corresponding operation result to the monitoring system 244. It can be understood that in the case where the real-time requirements of data communication are high, symmetric keys can also be used for communication between the monitoring system 244 and the power conversion equipment master control device 242.

[0108] The technical solution of the embodiment of the present application adopts asymmetric keys for communication for supervision modules with low requirements for real-time data communication, thereby further improving communication security and reliability. It performs authority authentication management through authority configuration data, and can also effectively reduce the possibility of malicious attackers or improper operators accessing and modifying important data without authorization, thereby improving the stability of the system.

[0109] like Figure 4 As shown, in some embodiments, the restricted supervision module further includes a battery management control device 246 , which communicates with the monitoring system 244 ;

[0110] The communication key management device 120 is further used to send the third asymmetric key data and the third authority configuration data corresponding to the battery management control device 246 to the battery management control device 246;

[0111] The monitoring system 244 is further used to obtain the public key data of the battery management control device 246 while verifying the legitimacy and validity of the first communication key and the first authority configuration data, encrypt the third communication data to be transmitted according to the public key data of the battery management control device 246, and send the battery management operation instruction carrying the encrypted third communication data to the battery management control device 246 based on the first authority configuration data;

[0112] The battery management control device 246 is used to execute the battery management operation instruction if it receives a battery management operation instruction, decrypts the third communication data according to the third communication key, and successfully verifies the operation authority of the monitoring system 244 according to the third authority configuration data, while verifying the legitimacy and validity of the third communication key and the third authority configuration data, and feeds back the instruction execution result corresponding to the battery management operation instruction to the monitoring system 244.

[0113] The battery management control device 246 can be regarded as a battery management control unit (Battery Management Controller, BMC). The monitoring system 244 can send corresponding operation instructions to the battery management control device 246. Considering that the real-time requirements for data communication between the two are not high, in this embodiment, asymmetric key data can also be used for communication. Specifically, the communication key management device 120 can send the third asymmetric key data and the third authority configuration data corresponding to the battery management control device 246 to the battery management control device 246. The battery management control device 246 verifies the legitimacy and validity of the third asymmetric key data and the third authority configuration data. If the monitoring system 244 successfully verifies the received asymmetric key data and permission configuration, and needs to communicate with the battery management control device 246, it can initiate a corresponding permission request through the permission configuration data, obtain the public key data of the battery management control device 246, use the public key data to encrypt the communication data c to be transmitted, and then based on the first permission configuration data, send the battery management operation instruction carrying the encrypted communication data c to the battery management control device 246. If the legality verification and validity verification fail, the battery management operation instruction carrying the communication data c is directly sent to the battery management control device 246, and wait for feedback information from the battery management control device 246.

[0114] When the battery management control device 246 receives a battery management operation instruction carrying the encrypted communication data c, it uses its own private key data to decrypt the battery management operation instruction. If the communication data c is successfully decrypted, it indicates that the key verification is successful. It further verifies whether the monitoring system 244 has the authority to access itself and command itself to perform the operation according to the third authority configuration data received by itself. Otherwise, the operation instruction data is discarded and the wrong access is recorded. If it is verified that the monitoring system 244 has the corresponding access authority, it indicates that the authority verification is successful, confirms and executes the corresponding operation, and feeds back the operation execution result to the monitoring system 244. If the monitoring system 244 receives the operation execution result, it confirms that the battery management control device 246 operates successfully. If the battery management control device 246 receives an operation instruction carrying unencrypted communication data c, it directly responds to the instruction, executes the corresponding operation, and feeds back the corresponding operation result to the monitoring system 244. It can be understood that in the case where the real-time requirements of data communication are high, symmetric keys can also be used for communication between the monitoring system 244 and the battery management control device 246.

[0115] The technical solution of the embodiment of the present application adopts asymmetric keys for communication between the monitoring system 244 and the battery management control device 246, which can further improve the security and reliability of communication, and perform authority authentication management through authority configuration data, which can also effectively reduce the possibility of malicious attackers or improper operators accessing and modifying important data without authorization, thereby improving the stability of the system.

[0116] In some embodiments, the communication protocol between the monitoring system 244 and the power conversion equipment master control device 242 includes a target security authentication protocol, and the target security authentication protocol includes a communication protocol oriented to the power system.

[0117] The target security authentication protocol refers to a security protocol used for power system communications. In this embodiment, the target security authentication protocol may be the 62351 protocol. In the 62351 protocol, encryption and identity authentication mechanisms are defined to protect the data transmitted in the communication from unauthorized access, tampering or eavesdropping to the greatest extent possible. In specific implementation, the communication between the monitoring system 244 and the power conversion equipment main control device 242 may be carried out in the manner of IEC61850 protocol + security authentication protocol 62351 protocol + authority management authentication. It is to be understood that in other embodiments, the target security authentication protocol may also include but is not limited to other protocols such as the Kerberos protocol.

[0118] In the technical solution of the embodiment of the present application, by adding a security authentication protocol between the monitoring system 244 and the power conversion equipment main control device 242, the power system communication can be made more secure and reliable, ensuring the stable operation of the monitoring system 244 and the power conversion equipment main control device 242, and protecting electricity safety and information privacy.

[0119] In some embodiments, the communication protocol between the monitoring system 244 and the battery management control device 246 includes a target safety authentication protocol, and the target safety authentication protocol includes a communication protocol for the power system.

[0120] As described in the previous embodiment, in this embodiment, the communication protocol between the monitoring system 244 and the battery management control device 246 can also add a security authentication protocol such as the 62351 protocol. In specific implementation, the communication between the monitoring system 244 and the battery management control device 246 can also be implemented in the manner of IEC61850 protocol + security authentication protocol 62351 protocol + authority management authentication.

[0121] In the technical solution of the embodiment of the present application, by adding a security authentication protocol between the monitoring system 244 and the battery management control device 246, the power system communication can be made safer and more reliable, ensuring the stable operation of the battery management control device 246.

[0122] In order to more clearly illustrate the communication method of each supervision module in the DC transmission and distribution system, the following takes the DC transmission and distribution system as a direct-mounted energy storage system, the communication key management device as a communication key management machine, the power conversion equipment control and protection system as a converter valve control and protection system, the power conversion equipment main control device as a valve control main control device, the lower-level management device of the valve control main control device includes a valve protection device and a valve control expansion device, the lower-level management device of the valve control expansion device includes a sub-power module, the monitoring system is an on-site monitoring system, the battery management control device is a battery management control unit, and the communication key management device 120 in the system distributes security credential data to each supervision module in an offline manner as an example, and combines the attached Figure 5 To explain:

[0123] like Figure 5 As shown, the direct-mounted energy storage system 500 includes a communication key management machine 510, a converter valve control and protection system 520, an on-site monitoring system 530, a valve control main control device 540, a valve protection device 550, a valve control expansion device 560, a battery management control unit 570 and a sub-power module 580. The communication architecture between the modules can be as follows:

[0124] (1) The converter valve control and protection system 520 communicates with the valve control main control device 540 using Gigabit Ethernet + private protocol + secure authentication HMAC encryption algorithm, wherein the private protocol is a protocol independently developed between the converter valve control and protection system 520 and the valve control main control device 540, and is used for internal communication and data exchange of the DC transmission and distribution system.

[0125] (2) The communication between the valve control main control device 540 and the local monitoring system 530 is implemented using the IEC61850 protocol + security certification IEC62351 + authority management mode.

[0126] (3) The valve control main control device 540 communicates with the valve control expansion device 560 using the FT3+AURORA protocol.

[0127] (4) The valve control main control device 540 communicates with the valve protection device 550 using the FT3+AURORA protocol.

[0128] (5) The sub-power module (SMC) 580 communicates with the valve control expansion device 560 using the FT3 proprietary protocol.

[0129] (6) The sub-power module (SMC) 580 communicates with the battery management control unit (BMC) 570 using the FT3+ proprietary protocol.

[0130] (7) The battery management control unit (BMC) 570 communicates with the local monitoring system 530 using the IEC61850 protocol + security certification 62351 + authority management mode.

[0131] Specifically, the local monitoring system 530 communicates with the battery management control unit 570 and the valve control main control device 540 using the 61850 protocol with the SM2 algorithm for data encryption, and the authority configuration information can be encrypted with the SM3 algorithm.

[0132] If the communication key management machine distributes security credential data to each supervision module in an online manner, the communication architecture diagram can be as follows: Figure 6 The communication key management machine 510 can directly communicate with the converter valve control and protection system 520, the valve control main control device 540, the local monitoring system 530 and the battery management control unit 570 in a two-way online manner through the network.

[0133] In some embodiments, the present application also provides a communication method for a DC power transmission and distribution system. The communication method for a DC power transmission and distribution system provided in the embodiments of the present application can be applied to Figure 1 In the application environment shown. Specifically, it can be applied to the communication key management device 120, the communication key management device 120 obtains the system configuration file, obtains the system configuration file, generates security credential data corresponding to the power electronic device supervision module for identity authentication and authority management according to the system configuration file, and then sends the security credential data to the corresponding power electronic device supervision module 200, and the power electronic device supervision module 200 communicates based on the received security credential data. Among them, the communication key management device 120 can be but not limited to various personal computers, laptops, smart phones, tablets, Internet of Things devices and portable wearable devices. The Internet of Things devices can be smart speakers, smart TVs, smart air conditioners, smart car-mounted devices, etc. Portable wearable devices can be smart watches, smart bracelets, head-mounted devices, etc. It can also be implemented with an independent server or a server cluster consisting of multiple servers.

[0134] In some embodiments, Figure 7 As shown, a communication method for a DC power transmission and distribution system is provided, and the method is applied to Figure 1 The communication key management device 120 in FIG. 1 is used as an example to illustrate, and the following steps are included:

[0135] Step S202, obtaining a system configuration file.

[0136] The system configuration file includes access control lists, security protocols, key management policies, encryption algorithms, rights management configuration files, and configuration files of various modules in the system. In specific implementation, the system configuration file may be obtained when a key data generation message is received. Specifically, the system configuration file may be obtained through a command line tool, where a command line tool refers to a tool for operating a computer system through a command line interface. Common command line tools include Bash in Linux and PowerShell in Windows.

[0137] Step S204: generating security credential data corresponding to the power electronic device supervision module according to the system configuration file, wherein the security credential data is used to implement identity authentication and authority management.

[0138] The power electronic device supervision module refers to a module used to monitor and control the working state of the power electronic device, which can be a specific device, such as a power electronic device control device, or a system, such as an automatic control system, etc. Security credential data is information used to verify identity and authorize access to specific resources. In this embodiment, the security credential data may include digital identity information, key data, and permission configuration data, etc.

[0139] In specific implementation, the communication key management device can read the system configuration file, extract the corresponding data in the system configuration file, such as the key management strategy, encryption algorithm parameters and configuration data of each power electronic device module in the system, and generate security credential data corresponding to each power electronic supervision module through the corresponding encryption algorithm.

[0140] Step S206 , sending the security credential data to the corresponding power electronic device supervision module, so that the power electronic device supervision module communicates based on the received security credential data.

[0141] For each power electronic supervision module, after the corresponding security credential data is generated, each security credential data can be sent to the corresponding power electronic device supervision module according to the mapping relationship between the security credential data and each power electronic device supervision module. After the power electronic device supervision module receives the security credential data that matches itself, it can communicate with other supervision modules based on the security credential data. In the actual communication process, the communication data sender can encrypt the communication data to be transmitted based on the security credential data, and then send the encrypted communication data to the communication data receiver. The communication data receiver can use the security credential data to verify the identity and operation authority of the communication data sender. After the verification is successful, the security credential data is further used to decrypt the encrypted communication data to be transmitted. After the decryption is successful, the corresponding operation is performed.

[0142] In the technical solution of the embodiment of the present application, the communication key management device obtains a system configuration file, generates security credential data for identity authentication and authority management based on the system configuration file, and then sends the security credential data to the corresponding power electronic device supervision module, so that the power electronic device supervision module communicates based on the received security credential data. The above scheme generates security credential data based on the system configuration file, and each power electronic device supervision module communicates based on the security credential data, which can perform identity authentication and authority management during the communication process, thereby effectively reducing the risk of data being viewed, leaked or tampered with by unauthorized personnel during the transmission process, and improving the communication security of the system. In summary, the adoption of this scheme can improve the communication security performance of the DC transmission and distribution system.

[0143] like Figure 8 As shown, in some embodiments, step S204 includes:

[0144] Step S224, extract the device identification data corresponding to each power electronic device supervision module in the system configuration file, generate a communication key corresponding to each power electronic device supervision module based on the device identification data, extract the permission requirement data in the system configuration file, and generate the permission configuration data corresponding to the power electronic device supervision module according to the permission requirement data.

[0145] Step S206 includes: Step S226, sending the communication key and the authority configuration data to the corresponding power electronic device supervision module, so that the power electronic device supervision module communicates based on the received security credential data.

[0146] In this embodiment, the security credential data includes a communication key and permission configuration data. The device identification data refers to the unique identifier of the power electronic device supervision module, including but not limited to the device serial code, the MAC address of the device, and the device model data. The communication key management device generates the communication key according to the system configuration file by extracting the device identification data of each power electronic supervision module in the system configuration file, and then, for each power electronic supervision module, according to the predefined algorithm and rules, converting the corresponding device identification data into a key, and using the converted key as the communication key of the power electronic supervision module. This process usually involves hashing, salting and other operations on the device identification data to increase the complexity and security of the key. Specifically, the device serial code can be taken as an example, and a predefined hash encryption algorithm can be used to convert the device serial code into a communication key. In other embodiments, the HMAC encryption algorithm can be selected to encrypt the device serial code of each power electronic device supervision module to obtain the communication key, and the obtained HMAC value is the communication key of the power electronic device supervision module. The specific process of obtaining the communication key using the HMAC encryption algorithm can refer to the description of the relevant content in the above embodiment, which will not be repeated here. After obtaining the communication key corresponding to the power electronic device supervision module, the communication key corresponding to each power electronic device supervision module can be saved to establish a mapping relationship between the power electronic device supervision module and the communication key.

[0147] In other embodiments, a random number may be generated using a secure random number generator, and the generated random number may be used as the key K of the HMAC algorithm. Then, the HMAC algorithm is used to calculate the HMAC value of the device sequence code and the random number to obtain the communication key. The specific process can be found in the description of the relevant content in the above embodiment, which will not be repeated here.

[0148] In this embodiment, the communication key management device generates the permission configuration data according to the system configuration file, which can be: according to the device identification data of each power electronic device supervision module, the corresponding permission requirement data is queried in the system configuration file, and then, according to the permission requirement data of each power electronic device supervision module, the permission configuration data corresponding to the power electronic device supervision module is generated. It can be based on the permission requirement data of each power electronic device supervision module, combined with the different types and roles of different modules, to determine the permission configuration of each power electronic device supervision module, that is, to assign corresponding permissions to each power electronic device supervision module, such as data access permission and data modification permission, and finally, determine the permission configuration data of each power electronic device supervision module. Specifically, the generation of the permission configuration data can be automatically generated by a script, by executing a preset permission configuration script, reading the device information and permission requirement data of each power electronic device supervision module in the system configuration file, and automatically generating the permission configuration data corresponding to each supervision module. It can also be calling a third-party permission management tool to read the device information and permission requirement data of each supervision module in the system configuration file, and automatically generating the permission configuration data corresponding to each supervision module.

[0149] In specific implementation, each power electronic device supervision module includes a restricted supervision module and an unrestricted supervision module, and the communication key and authority configuration data may be sent to the corresponding restricted supervision module, and the communication key may be sent to the corresponding unrestricted supervision module.

[0150] In the technical solution of the embodiment of the present application, a communication key is generated based on device identification data that is unique and difficult to forge, which is both safe and simple. By generating permission configuration data, permission management of each power electronic device can be achieved, reducing the possibility of malicious attackers or improper operators accessing and modifying important data without authorization, thereby improving system security.

[0151] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0152] Based on the same inventive concept, the embodiment of the present application also provides a communication device for a DC power transmission and distribution system for implementing the communication method for the DC power transmission and distribution system involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in the embodiments of the communication device for one or more DC power transmission and distribution systems provided below can refer to the limitations on the communication method for the DC power transmission and distribution system above, and will not be repeated here.

[0153] In some embodiments, Fig. 9 As shown, a communication device of a DC power transmission and distribution system is provided, the system includes the system as described in any of the above embodiments, the device includes: a data acquisition module 910, a data processing module 920 and a data sending module 930, wherein:

[0154] The data acquisition module 910 is used to acquire the system configuration file.

[0155] The data processing module 920 is used to generate security credential data corresponding to the power electronic device supervision module according to the system configuration file, and the security credential data is used to implement identity authentication and authority management.

[0156] The data sending module 930 is used to send the security credential data to the corresponding power electronic device supervision module, and the power electronic device supervision module communicates based on the received security credential data.

[0157] In the technical solution of the embodiment of the present application, security credential data for identity authentication and authority management is generated based on the system configuration file, and then the security credential data is sent to the corresponding power electronic device supervision module, so that the power electronic device supervision module communicates based on the received security credential data. The above scheme generates security credential data based on the system configuration file, and each power electronic device supervision module communicates based on the security credential data, which can perform identity authentication and authority management during the communication process, thereby effectively reducing the risk of data being viewed, leaked or tampered with by unauthorized personnel during the transmission process, and improving the communication security of the system. In summary, the adoption of this scheme can improve the communication security performance of the DC transmission and distribution system.

[0158] In some embodiments, the data processing module 920 is also used to extract device identification data corresponding to each power electronic device supervision module in the system configuration file, and generate a communication key corresponding to each power electronic device supervision module based on the device identification data; and to extract permission requirement data in the system configuration file, and generate permission configuration data corresponding to the power electronic device supervision module according to the permission requirement data; the data sending module 930 is also used to send the communication key and permission configuration data to the corresponding power electronic device supervision module, so that the power electronic device supervision module communicates based on the received security credential data.

[0159] Each module in the communication device of the above-mentioned DC power transmission and distribution system can be implemented in whole or in part by software, hardware and their combination. Each of the above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to each of the above modules.

[0160] In some embodiments, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Fig.10 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data such as system configuration files, communication keys and permission configuration data of each supervision module. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a communication method for a DC transmission and distribution system is implemented.

[0161] Those skilled in the art will understand that Fig.10 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0162] In some embodiments, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the communication method of the direct current transmission and distribution system when executing the computer program.

[0163] In some embodiments, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the communication method of the direct current transmission and distribution system are implemented.

[0164] In some embodiments, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the steps in the communication method of a direct current transmission and distribution system.

[0165] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions.

[0166] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0167] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them; although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein by equivalents; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present application, and they should all be included in the scope of the claims and specification of the present application. In particular, as long as there is no structural conflict, the various technical features mentioned in the various embodiments can be combined in any way. The present application is not limited to the specific embodiments disclosed herein, but includes all technical solutions that fall within the scope of the claims.

Claims

1. A DC power transmission and distribution system, characterized in that: The system comprises: a communication key management device and a power electronic device supervision module that communicate with each other; The communication key management device is used to obtain a system configuration file, generate security credential data corresponding to the power electronic device supervision module based on the system configuration file, and send the security credential data to the corresponding power electronic device supervision module. The power electronic device supervision module communicates based on the received security credential data, and the security credential data is used to implement identity authentication and authority management.

2. The DC power transmission and distribution system according to claim 1, characterized in that: The communication key management device is used to extract device identification data corresponding to each power electronic device supervision module in the system configuration file, generate a communication key corresponding to each power electronic device supervision module based on the device identification data, extract authority requirement data in the system configuration file, and generate authority configuration data corresponding to the power electronic device supervision module according to the authority requirement data; The security credential data includes a communication key and authority configuration data.

3. The DC power transmission and distribution system according to claim 2, characterized in that: The power electronic device supervision module includes: a restricted supervision module and an unrestricted supervision module that communicate with each other, and the security credential data includes a communication key and permission configuration data; The communication key management device is further used to send the communication key to the corresponding unrestricted supervision module, and send the communication key and the authority configuration data to the corresponding restricted supervision module.

4. The DC power transmission and distribution system according to claim 3, characterized in that: The unrestricted supervision module includes a power conversion equipment control and protection system, the restricted supervision module includes a power conversion equipment master control device, and the communication key includes symmetric key data; The communication key management device is used to send the symmetric key data to the power conversion equipment control and protection system and the power conversion equipment main control device; The power conversion equipment control and security system is used to encrypt the first communication data to be transmitted by a preset encryption algorithm when the legitimacy and validity of the symmetric key data are successfully verified, and send the control instruction carrying the encrypted first communication data to the power conversion equipment main control device; The main control device of the power conversion equipment is used to successfully verify the legitimacy and validity of the symmetric key data, if the control instruction is received and the first communication data is obtained by decrypting the symmetric key data, then execute the control instruction and feed back the instruction execution result of the control instruction to the power conversion equipment control and protection system.

5. The DC power transmission and distribution system according to claim 4, characterized in that: The restricted supervision module further includes a monitoring system, the monitoring system communicates with the power conversion equipment master control device, and the communication key includes asymmetric key data; The communication key management device is further used to send first asymmetric key data and first authority configuration data corresponding to the monitoring system to the monitoring system, and send second asymmetric key data and second authority configuration data corresponding to the power conversion device master control device to the power conversion device master control device; The monitoring system is used to obtain the public key data of the power conversion device master control device when successfully verifying the legitimacy and validity of the first asymmetric key data and the first authority configuration data, encrypt the second communication data to be transmitted by using the public key data of the power conversion device master control device, and send the master control device operation instruction carrying the encrypted second communication data to the power conversion device master control device based on the first authority configuration data; The main control device of the power conversion equipment is also used to verify the legality and validity of the second asymmetric key data and the second authority configuration data. If an operation instruction of the main control device is received, and the second communication data is decrypted according to the second asymmetric key data and the operation authority of the monitoring system is successfully verified according to the second authority configuration data, then the operation instruction of the main control device is executed, and the instruction execution result of the operation instruction of the main control device is fed back to the monitoring system.

6. The DC power transmission and distribution system according to claim 5, characterized in that: The restricted supervision module also includes a battery management control device, which communicates with the monitoring system; The communication key management device is further used to send third asymmetric key data and third authority configuration data corresponding to the battery management control device to the battery management control device; The monitoring system is further used to obtain the public key data of the battery management control device under the condition of verifying the legitimacy and validity of the first communication key and the first authority configuration data, encrypt the third communication data to be transmitted according to the public key data of the battery management control device, and send the battery management operation instruction carrying the encrypted third communication data to the battery management control device based on the first authority configuration data; The battery management control device is used to verify the legitimacy and validity of the third communication key and the third authority configuration data. If the battery management operation instruction is received, and the third communication data is decrypted according to the third communication key and the operation authority of the monitoring system is successfully verified according to the third authority configuration data, then the battery management operation instruction is executed and the instruction execution result corresponding to the battery management operation instruction is fed back to the monitoring system.

7. The DC power transmission and distribution system according to any one of claims 1 to 6, characterized in that: The communication key management device is also used to send the security credential data to the power electronic device supervision module in an offline or online manner.

8. The DC power transmission and distribution system according to any one of claims 1 to 6, characterized in that: The communication key management device is also used to send the security credential data online to the power electronic device supervision module through a preset security port.

9. The DC power transmission and distribution system according to claim 5, characterized in that: The communication protocol between the monitoring system and the main control device of the power conversion equipment includes a target security authentication protocol, and the target security authentication protocol includes a communication protocol oriented to the power system.

10. The DC power transmission and distribution system according to claim 6, characterized in that: The communication protocol between the monitoring system and the battery management control device includes a target safety authentication protocol, and the target safety authentication protocol includes a communication protocol oriented to the power system.

11. A communication method for a DC power transmission and distribution system, characterized in that: The system comprises the system according to any one of claims 1 to 10, the method is applied to the communication key management device, and the method comprises: Get the system configuration file; Generating security credential data corresponding to the power electronic device supervision module according to the system configuration file, wherein the security credential data is used to implement identity authentication and authority management; The security credential data is sent to a corresponding power electronic device supervision module, so that the power electronic device supervision module communicates based on the received security credential data.

12. The method according to claim 11, characterized in that The generating, according to the system configuration file, security credential data corresponding to the power electronic device supervision module comprises: Extracting device identification data corresponding to each power electronic device supervision module in the system configuration file, and generating a communication key corresponding to each power electronic device supervision module based on the device identification data; and The authority requirement data in the system configuration file is extracted, and the authority configuration data corresponding to the power electronic device supervision module is generated according to the authority requirement data, wherein the security credential data includes a communication key and the authority configuration data.

13. A communication device for a DC power transmission and distribution system, characterized in that: The system comprises the system according to any one of claims 1 to 10, and the device comprises: A data acquisition module, used to obtain system configuration files; A data processing module, used to generate security credential data corresponding to the power electronic device supervision module according to the system configuration file, wherein the security credential data is used to implement identity authentication and authority management; The data sending module is used to send the security credential data to the corresponding power electronic device supervision module, and the power electronic device supervision module communicates based on the received security credential data.

14. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to claims 11-12 are implemented.

15. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to claims 11-12 are implemented.

16. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method described in claims 11-12 are implemented.

Images