CPPS distributed security state estimation method based on cross-domain authentication and asynchronous ADMM

Abstract

The invention provides a CPPS distributed security state estimation method based on cross-domain authentication and asynchronous ADMM, and relates to the technical field of network security and state estimation. The method comprises the following steps: dividing a power grid region into a plurality of sub-regions by using a K-means algorithm so as to reduce global communication and calculation loads; establishing a distributed security state estimation framework which covers a physical layer, a network layer and a service layer; performing authentication and state iteration of a sub-region state estimator, including registration, cross-domain authentication, K-L divergence calculation and state updating; an asynchronous alternating direction multiplier (ADMM) algorithm is applied, so that a sub-region state estimator can iterate without waiting for state update of all adjacent sub-regions. According to the method, active defense and passive detection are combined, data packet loss, denial of service (DoS) attacks and false data injection (FDI) attacks are effectively dealt with, and the delay influence of network transmission and cross-domain security authentication calculation is reduced. Examples prove that the method is relatively high in convergence speed and relatively high in attack resistance.

Description

Technical Field

[0001] The present invention relates to the technical field of network security and state estimation, and in particular to a CPPS distributed security state estimation method based on cross-domain authentication and asynchronous ADMM. Background Art

[0002] With the continuous development of power cyber-physical systems (CPPS), smart terminals face many security issues during data transmission. In the prior art, for smart terminal data transmission of CPPS, the commonly used technical solutions include the certificateless aggregate signcryption (CLASC) scheme, which attempts to ensure the security of data during transmission. However, since smart terminals operate in a resource-constrained environment, the security of their data transmission is still threatened. Although the certificateless aggregate signcryption scheme provides certain protection, there are still potential security risks.

[0003] In terms of cross-domain communication, smart terminals in CPPS need to share and interact data between different domains. Existing security authentication mechanisms often cannot meet the efficiency and security requirements in cross-domain environments. Although some solutions try to use blockchain technology for cross-domain security authentication, the existing technology still has room for improvement in authentication efficiency and security when dealing with heterogeneous data and resource-constrained environments.

[0004] In addition, in distributed state estimation, the state estimators of each sub-area collaborate through an information network. However, this mode of information exchange makes the system vulnerable to a variety of network attacks, such as denial of service attacks (DoS attacks) and forged data injection attacks (FDI attacks). Existing technical solutions have not yet fully addressed these security issues, especially when dealing with asynchronous computing, data packet loss, and delays in distributed state estimation. More effective defense measures are still needed. Therefore, improving the security and effectiveness of distributed state estimation systems has become the focus of current research. Summary of the invention

[0005] In order to solve the technical problems in the prior art of insufficient security of smart terminal data transmission, insufficient efficiency and security of cross-domain authentication, and susceptibility to network attacks in distributed state estimation, the present invention provides a CPPS distributed security state estimation method based on cross-domain authentication and asynchronous ADMM.

[0006] In the existing technology, although the certificateless aggregate signcryption (CLASC) scheme provides certain protection for data transmission, its security still has hidden dangers due to the limited resources of smart terminals. For cross-domain communication, the existing security authentication mechanism fails to meet the requirements of efficiency and security. Although some schemes use blockchain technology, they still need to be improved in the environment of data heterogeneity and resource constraints. In addition, the information exchange mode in distributed state estimation is vulnerable to denial of service (DoS) attacks and forged data injection (FDI) attacks. The existing schemes are still insufficient in dealing with asynchronous computing, data packet loss and delay.

[0007] The technical solution provided by the present invention is as follows:

[0008] The present invention provides a CPPS distributed security state estimation method based on cross-domain authentication and asynchronous ADMM, comprising:

[0009] S1. K-means-based power grid area division, which divides the entire power grid area into several sub-areas, thereby reducing the global communication cost and computing load;

[0010] S2. Establishing a distributed security state estimation framework through a state estimator in each of the sub-areas, the framework comprising a physical layer, a network layer and a service layer, and each of the sub-areas comprises a state estimator;

[0011] S3, authentication and state iteration of the sub-region state estimator:

[0012] S3a, the state estimator of the sub-area registers with the KGC;

[0013] S3b, the state estimator of the sub-area performs cross-domain authentication and exchanges boundary node state information;

[0014] S3c, the state estimator of the sub-area performs KL divergence calculation on the received state information of the boundary node to determine whether it is within the threshold range;

[0015] S3d, update the state according to the received information of some adjacent sub-region boundary nodes, and judge whether it converges. If not, enter the next iteration;

[0016] S4. Introducing the asynchronous alternating direction method of multipliers (ADMM) algorithm, so that the state estimator of each sub-region can perform the next iteration without waiting for the states of all adjacent sub-regions to be updated.

[0017] The beneficial effects brought about by the technical solution provided by the present invention include at least:

[0018] (1) In the present invention, active defense mechanism and passive detection technology are combined to address the security issues in distributed state estimation. A distributed security state estimation scheme based on cross-domain authentication and asynchronous alternating direction multiplier method (ADMM) is proposed. This scheme not only effectively resists the problem of data packet loss, but also effectively prevents two common network attacks, denial of service attack (DoS attack) and false data injection attack (FDI attack). By combining active defense mechanism with passive detection technology, the overall security protection level of the distributed system is significantly improved, thereby ensuring the stable operation of the system under various complex attack environments;

[0019] (2) In the present invention, by introducing the asynchronous ADMM algorithm and cross-domain authentication technology, the delay effect caused by the network transmission and cross-domain security authentication calculation cost is effectively reduced. The application of asynchronous ADMM allows asynchronous calculation of local state estimation without the need for all adjacent sub-region state estimators to complete the calculation, thereby significantly reducing the delay caused by the data transmission and authentication process. This mechanism optimizes the operating efficiency of the system, improves the real-time performance of data processing, and ensures the efficient operation of the system under high load and high complexity environments;

[0020] (3) In the present invention, a faster convergence speed and excellent anti-attack ability are shown in the distributed state estimation. The design of this scheme takes into account various complex situations in practical applications. It can quickly restore to normal state and maintain the stability of the system when facing network attacks and data transmission challenges. Its innovative algorithm design and efficient authentication mechanism not only enhance the system's defense capabilities against attacks, but also optimize the data processing process, thereby improving the reliability and response speed of the system in practical applications. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0022] Figure 1 A flow chart of a CPPS distributed security state estimation method based on cross-domain authentication and asynchronous ADMM provided by an embodiment of the present invention;

[0023] Figure 2 A schematic diagram of a distributed security state estimation framework structure of a CPPS distributed security state estimation method based on cross-domain authentication and asynchronous ADMM provided in an embodiment of the present invention;

[0024] Figure 3A schematic diagram of a distributed security state estimation framework flow chart of a CPPS distributed security state estimation method based on cross-domain authentication and asynchronous ADMM provided in an embodiment of the present invention;

[0025] Figure 4 A schematic diagram of a transmission line equivalent model of a CPPS distributed security state estimation method based on cross-domain authentication and asynchronous ADMM provided in an embodiment of the present invention;

[0026] Figure 5 A synchronous ADMM iteration schematic diagram of a CPPS distributed security state estimation method based on cross-domain authentication and asynchronous ADMM provided in an embodiment of the present invention;

[0027] Figure 6 A schematic diagram of asynchronous ADMM iteration of a CPPS distributed security state estimation method based on cross-domain authentication and asynchronous ADMM provided in an embodiment of the present invention;

[0028] Figure 7 A schematic diagram of sub-area division results of a CPPS distributed security state estimation method based on cross-domain authentication and asynchronous ADMM provided in an embodiment of the present invention;

[0029] Figure 8 A schematic diagram of a synchronous ADMM sub-area 1 state estimation error of a CPPS distributed security state estimation method based on cross-domain authentication and asynchronous ADMM provided in an embodiment of the present invention;

[0030] Fig. 9 A schematic diagram of a synchronous ADMM sub-area 2 state estimation error of a CPPS distributed security state estimation method based on cross-domain authentication and asynchronous ADMM provided in an embodiment of the present invention;

[0031] Fig.10 A schematic diagram of state estimation error of synchronous ADMM sub-area 3 of a CPPS distributed security state estimation method based on cross-domain authentication and asynchronous ADMM provided in an embodiment of the present invention;

[0032] Fig.11 A schematic diagram of state estimation error of synchronous ADMM sub-area 4 of a CPPS distributed security state estimation method based on cross-domain authentication and asynchronous ADMM provided in an embodiment of the present invention;

[0033] Fig.12 A schematic diagram of state estimation error of synchronous ADMM sub-area 5 of a CPPS distributed security state estimation method based on cross-domain authentication and asynchronous ADMM provided by an embodiment of the present invention;

[0034] Fig.13A schematic diagram of state estimation errors of each sub-region of a synchronous ADMM of a CPPS distributed security state estimation method based on cross-domain authentication and asynchronous ADMM provided by an embodiment of the present invention;

[0035] Fig.14 A schematic diagram of the state estimation error of asynchronous ADMM sub-area 1 of a CPPS distributed security state estimation method based on cross-domain authentication and asynchronous ADMM provided by an embodiment of the present invention;

[0036] Fig.15 A schematic diagram of the state estimation error of asynchronous ADMM sub-area 2 of a CPPS distributed security state estimation method based on cross-domain authentication and asynchronous ADMM provided in an embodiment of the present invention;

[0037] Fig.16 A schematic diagram of the state estimation error of asynchronous ADMM sub-area 3 of a CPPS distributed security state estimation method based on cross-domain authentication and asynchronous ADMM provided by an embodiment of the present invention;

[0038] Fig.17 A schematic diagram of the state estimation error of asynchronous ADMM sub-area 4 of a CPPS distributed security state estimation method based on cross-domain authentication and asynchronous ADMM provided in an embodiment of the present invention;

[0039] Fig.18 A schematic diagram of the state estimation error of asynchronous ADMM sub-area 5 of a CPPS distributed security state estimation method based on cross-domain authentication and asynchronous ADMM provided by an embodiment of the present invention;

[0040] Fig.19 A schematic diagram of the state estimation error of each sub-area of ​​the asynchronous ADMM of a CPPS distributed security state estimation method based on cross-domain authentication and asynchronous ADMM provided by an embodiment of the present invention;

[0041] Fig. 20 A schematic diagram of state estimation error of sub-area 1 under FDI attack of a CPPS distributed security state estimation method based on cross-domain authentication and asynchronous ADMM provided by an embodiment of the present invention;

[0042] Fig.21 A schematic diagram of state estimation error of sub-area 2 under FDI attack of a CPPS distributed security state estimation method based on cross-domain authentication and asynchronous ADMM provided by an embodiment of the present invention;

[0043] Fig. 22 A schematic diagram of state estimation error of sub-area 3 under FDI attack of a CPPS distributed security state estimation method based on cross-domain authentication and asynchronous ADMM provided by an embodiment of the present invention;

[0044] Fig.23 A schematic diagram of state estimation error of sub-area 4 under FDI attack of a CPPS distributed security state estimation method based on cross-domain authentication and asynchronous ADMM provided by an embodiment of the present invention;

[0045] Fig.24 A schematic diagram of state estimation error of sub-area 5 under FDI attack of a CPPS distributed security state estimation method based on cross-domain authentication and asynchronous ADMM provided by an embodiment of the present invention;

[0046] Fig.25 A schematic diagram of state estimation errors of each sub-region under FDI attack in a CPPS distributed security state estimation method based on cross-domain authentication and asynchronous ADMM provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0047] The technical solution of the present invention is described below in conjunction with the accompanying drawings.

[0048] In the embodiments of the present invention, words such as "exemplarily" and "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "example" in the present invention should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of the word "example" is intended to present the concept in a specific way. In addition, in the embodiments of the present invention, the meaning expressed by "and / or" can be both, or it can be either of the two.

[0049] In the embodiments of the present invention, "image" and "picture" can sometimes be used interchangeably. It should be noted that when the difference between them is not emphasized, the meanings they intend to express are the same. "of", "corresponding, relevant" and "corresponding" can sometimes be used interchangeably. It should be noted that when the difference between them is not emphasized, the meanings they intend to express are the same.

[0050] In the embodiments of the present invention, sometimes the subscripts such as W 1 It may be mistakenly written as a non-subscript form such as W1. When the difference is not emphasized, the meanings they express are the same.

[0051] In order to make the technical problems, technical solutions and advantages to be solved by the present invention more clear, a detailed description will be given below with reference to the accompanying drawings and specific embodiments.

[0052] Reference Manual Attached Figure 1 , shows a flow chart of a CPPS distributed security state estimation method based on cross-domain authentication and asynchronous ADMM provided by an embodiment of the present invention.

[0053] The embodiment of the present invention provides a CPPS distributed security state estimation method based on cross-domain authentication and asynchronous ADMM. The processing flow may include the following steps:

[0054] In distributed state estimation, the entire system can be divided into several sub-areas, and the nodes in each sub-area exchange and calculate state information, thereby reducing the global communication cost and computing load and improving the robustness of the system. For large-scale power grid partitions, in order to balance the computational cost of each sub-area state estimator and reduce the communication cost between each sub-area state estimator. Each subsystem should have a similar scale (i.e., the number of nodes) as possible, and each subsystem should have fewer connecting lines. Therefore, the embodiment of the present invention uses K-means to perform regional division of large-scale power grids, and the steps are as follows:

[0055] First, the system structure is abstracted into a weighted undirected graph based on graph theory. The power nodes and generators are regarded as points, and the branches (i.e., the connection between the transmission lines and power equipment such as transformers in the power system) are regarded as edges. Assume that there are N nodes and L edges in this undirected graph, and the connection matrix C is used. L Represents the connection relationship between nodes, that is:

[0056]

[0057] If the connection weight w ij represents the cost of destroying the connection between node i and node j, then the connection matrix C can be defined L The weight matrix W L ,Right now:

[0058]

[0059] According to the principle of K-means clustering algorithm, the distortion function is defined as:

[0060]

[0061] Among them, k means there are k cluster centers, C j represents the jth center, index is a vector representing the index of each node to the corresponding cluster center (ranging from 1 to k), w i· Represents the i-th row of the weight matrix.

[0062] In order to obtain the optimal solution of the distortion function, the partition cost function is defined as:

[0063]

[0064] Among them, Pi represents the matrix mapped by the index vector index.

[0065] To sum up, the partitioning process based on the K-means method is as follows:

[0066] 1) Numerical preparation: Collect node data of the power grid (including node location information, load data, power generation information, etc.) and determine relevant weights based on parameters such as the distance between nodes, the magnitude of the current, and the importance of the load;

[0067] 2) Selection of cluster centers: Select k cluster centers;

[0068] 3) Cluster assignment: For each node, calculate its distance to each cluster center and assign it to the cluster with the closest cluster center, and obtain the index of the cluster center corresponding to each node;

[0069] 4) Cost calculation: Calculate the cost C of disconnection based on the index index obtained in step 3 cost ;

[0070] 5) Repeated iteration: Repeat cluster allocation and cost calculation until the termination condition is met (k clusters do not change or the cost function C cost less than the threshold).

[0071] In order to protect the sharing of boundary node state information between sub-region state estimators, the embodiment of the present invention designs a framework of distributed security state estimation based on cross-domain security authentication, and the specific contents are as follows:

[0072] The distributed security state estimation framework can be modeled into three layers, namely the physical layer, the network layer and the business layer, such as Figure 2 As shown:

[0073] 1) Physical layer: The physical layer represents the actual large-scale power grid, which is divided into different sub-areas according to the power grid partitioning results. Each sub-area includes internal nodes and boundary nodes. Each sub-area includes a state estimator and exchanges the state information of the boundary nodes with the state estimator of the adjacent sub-area to achieve collaborative cooperation.

[0074] 2) Network layer: According to the content of Chapter 3, each sub-area state estimator (regarded as an intelligent terminal in the area) should be registered with the KGC in the area by the gateway to which it belongs, mutually authenticate with the state estimator of the adjacent sub-area, and exchange and negotiate data with the state estimator of the adjacent sub-area.

[0075] 3) Business layer: including the registration information of the sub-zone state estimator published on the chain by KGC, and the registration information of other STs in CPPS.

[0076] The specific process is as follows Figure 3As shown in the figure, first, the sub-area state estimator registers with the KGC to which it belongs; then, cross-domain authentication is performed with the adjacent sub-area state estimator and boundary node state information is exchanged, and the KL divergence of the received boundary node state information is calculated to determine whether it is within the threshold range; finally, the state is updated according to the received partial adjacent sub-area boundary node information to determine whether it converges. If not, it enters the next iteration.

[0077] The DC model with faster calculation speed obtained by simplifying the AC model can be used for rapid preliminary analysis of large-scale power grids. The embodiment of the present invention mainly considers the distributed security state estimation under the DC model. The following conditions are introduced to convert the nonlinear relationship of the AC model into the linear relationship of the DC model:

[0078] 1) Assume that the voltage phase difference between the two nodes is very small, that is, sinθ ij ≈θ ij ,cosθ ij ≈1;

[0079] 2) The voltage amplitude of the node is close to the unit quantity 1p.u.;

[0080] 3) For the transmission branch, the branch conductance is much smaller than the branch susceptance, i.e. g ij <<b ij .

[0081] Convert the charging power to the load power and get Figure 4 The equivalent model of the transmission line. Then the current, complex power and active power of the branch from node i to node j in the AC model are:

[0082]

[0083] Substituting the simplified conditions, we can obtain the active power and reactive power of the DC model branch:

[0084]

[0085] Q ij =0

[0086] Therefore, the active power injected into node i is:

[0087]

[0088] in, is an N-dimensional vector, then the DC model of the power grid can be obtained according to the above formula:

[0089]

[0090] Where z includes the measurement of node injection power and branch power, H is the measurement matrix, and v is the measurement error (with a mean of 0 and a variance of R v Gaussian distribution). Therefore, the relationship between the measured value and the state value of each sub-area is as follows:

[0091] z i =H i θ i +v i

[0092]

[0093] Among them, z i is the measurement value of sub-region i, H i is the measurement matrix of sub-region i, θ i is the state variable of the extended area, including the state variables of the nodes inside the sub-area θ i,int and the state variables θ of the boundary nodes adjacent to subregion i i [j](j∈N i , N i is the set of sub-regions adjacent to sub-region i), v i is the measurement noise of sub-region i, subject to v i ~N(0,R i ) is a Gaussian distribution.

[0094] Construct an objective function with boundary constraints based on the principle of minimum sum of squared errors:

[0095]

[0096] Among them, J(θ i ) is the objective function of state estimation in sub-region i, W i is the corresponding weight matrix, And introduce the intermediate variable θ ij and the boundary connectivity matrix D ij , so that θ i [j] = θ j [i] = θ ij =D ij θ i ,roll out:

[0097]

[0098] According to the alternating vector multiplier method for solving minimization problems with equality constraints, first, the objective function is substituted into the augmented Lagrangian matrix and the Lagrangian multipliers are scaled to obtain:

[0099]

[0100] Among them, ρ is the penalty parameter, u i,j is the telescopic Lagrange multiplier. Then the corresponding iterative steps are:

[0101]

[0102] Will Substitute into It can be deduced that:

[0103]

[0104] Substituting formula (2) into formula (1), we can deduce:

[0105]

[0106] From the above formula, it can be seen that the state variables of each sub-region are solved completely independently, and distributed parallel computing can be performed. It only needs to exchange the state information of the boundary with the adjacent sub-region to reduce the communication cost. However, during iterative calculation, it is still necessary to receive the information of all adjacent sub-region nodes before the next iteration.

[0107] In actual scenarios, the state estimators of each sub-area in a large-scale power grid have different computational amounts and speeds due to issues such as the number of nodes, synchronization cycles, and computing resources of the equipment, and the computational time to complete local state estimation is also different; and as the scale of the CPPS information network continues to expand, the network environment is becoming increasingly complex. Due to insufficient network resources, attacks, or the use of data protection schemes, the possibility of data packet loss and transmission delays in the collaboration of each sub-area state estimator is greatly increased. If the classic ADMM algorithm is used, it will not be able to deal with the problems of data packet loss and transmission delay well, and the iterative calculation time is long. In response to the above problems, the ADMM algorithm is modified below to achieve asynchronous computing:

[0108] Assume that there are N adjacent to sub-region i. i | sub-regions, received p i The boundary node information of adjacent sub-areas is required to receive at least p[|N i |](1≤p[|N i |]≤N i ) adjacent sub-regions’ boundary node information can be updated next time, that is, i ≥p[|N i |]. Let N k represents the set of sub-regions that meet the update conditions at the kth iteration, then formula (2) can be rewritten as:

[0109]

[0110] The following uses five sub-regions as an example to illustrate the difference between asynchronous ADMM and traditional (synchronous) ADMM. Assuming that each sub-region is adjacent to each other, when p[|N i |] = 2, and considering the communication delay, the computational cost of cross-domain authentication and the time consumption of KL divergence detection, the schematic diagram of synchronous ADMM and asynchronous ADMM iteration is as follows Figure 5-6 As shown, from Figure 5-6 It can be seen that the asynchronous ADMM algorithm does not need to wait for all adjacent sub-regions in the region to complete KL divergence detection, cross-domain authentication, sub-region calculation and mutual communication. Compared with the synchronous ADMM iterative update, the asynchronous ADMM algorithm can use the boundary node state variables in the previous iteration step of the adjacent sub-region state estimator, with faster iteration speed and higher computational efficiency, without waiting for areas with slow iteration speed. At the same time, when packet loss occurs, the information of other adjacent sub-regions can be used for update. Therefore, the asynchronous ADMM has an advantage in computational efficiency over the synchronous ADMM.

[0111] The active defense mechanism of cross-domain security authentication can protect the sub-region state estimator from FDI attacks launched by tampering, spoofing, replay and middleman during communication. However, attackers can still carry out FDI attacks through backdoor attacks. Therefore, it is necessary to introduce a passive defense detection method to improve the defense mechanism.

[0112] KL divergence is a method used to measure the difference between two probability distributions and has been widely used in many fields. The mathematical definition of KL divergence is as follows:

[0113]

[0114] Among them, D KL (p(y)||q(y 0 ))≥0, if and only if y=y 0 Time KL (p(y)||q(y 0 ))=0.

[0115] When the sub-region state estimator is collaborating, the state variables it sends to the boundary nodes of the neighboring sub-regions are It should change slowly. Define the change of the state variable of the boundary node as The changes in most state variables are small and close to 0.

[0116] Therefore, KL divergence can be used to determine whether the boundary node state variables received by the sub-region state estimator are attacked:

[0117]

[0118] Among them, τmax , τ min is the alarm threshold for bad data attack detection. In the absence of FDI attack, D KL (p(y)||q(y 0 )) should be within the threshold range. If D KL (p(y)||q(y 0 )) is considered to be under attack. In the case of no attack, the KL divergence 99% confidence level range is 4.9334 to 5.9915, so τ max =5.9915, τ min =4.9334. Where y is the increment of the state variable of the adjacent sub-area boundary node that may currently contain bad data p(y) is the probability distribution of the increment of the boundary node state variable; y 0 is the increment of the state variable of the historical normal boundary node; q(y 0 ) is the probability distribution of the historical normal boundary node state variable increment.

[0119] Since the KL divergence detection threshold uses a 99% confidence range and the threshold may be exceeded when an attack occurs, it is necessary to evaluate the credibility of the sub-region state estimator. Therefore, the solution in this chapter needs to add a smart contract based on the cross-domain authentication solution in Chapter 3:

[0120] Credibility contract: The adjacent sub-region state estimator judges the state variables of the boundary nodes from sub-region i. If it exceeds the threshold specified by the KL divergence, the credibility contract is called to record the failure. When the credibility contract records the failure from sub-region i exceeding the specified upper limit k err , the cancellation contract is called, and the state estimator of sub-region i is considered untrustworthy. The boundary node information from sub-region i is no longer used, and the boundary node state information before the attack is used instead.

[0121] In the embodiment of the present invention, the distributed security state estimation scheme based on cross-domain authentication and asynchronous ADMM proposed in the embodiment of the present invention is evaluated from two aspects: the convergence speed and anti-attack performance of the sub-area state estimator. A laptop (Ubuntu 22.04 64-bit system or Windows 10 64-bit system, 2.11GHz Intel I5 CPU, 16GB RAM) is used to simulate the sub-area state estimator collaboration process. The laptop with Ubuntu system is used to simulate KGC; the laptop with Windows system is used to simulate the edge gateway EG and the sub-area state estimator, and the scheme proposed in the embodiment of the present invention is experimentally verified. The IEEE-118 node system

[88] is used for simulation, and the results of the example analysis are as follows:

[0122] First, the IEEE-118 node system is partitioned according to the large-scale power grid area partitioning method based on K-means given above. The power grid is divided into 5 sub-areas; and the non-diagonal elements of the weight matrix are all set to 0.01, indicating that the cost of destroying the connection between nodes is the same. Nodes 1, 103, 76, 18, and 35 are selected as reference nodes, and the partition results are as follows: Figure 7 shown.

[0123] Assume that the active power measurement error of the sub-area node follows N(0,0.03 2 ) of Gaussian distribution, the branch active power measurement error follows N(0,0.03 2 ) is a Gaussian distribution. The penalty parameter ρ is 10. The results of synchronous ADMM and asynchronous ADMM are compared, as shown in Figure 8-19 shown.

[0124] According to the experimental results, synchronous ADMM requires 25 iterations to reach convergence, which takes 14.4331 seconds. The iteration steps of each sub-area in asynchronous ADMM are 54, 29, 29, 29, and 28, respectively, which takes 11.2140 seconds. It can be seen that although asynchronous ADMM has more iterations, it takes a much shorter time than synchronous ADMM, and can better adapt to the delay caused by insufficient network resources or cross-domain security authentication when the state estimators of each sub-area cooperate, and is more adaptable to the increasingly complex network environment of CPPS.

[0125] In order to verify the proposed scheme's ability to cope with packet loss and passive defense detection performance, it is assumed that the state estimator of sub-area 4 is a node compromised by the backdoor attack, and a 10% attack intensity is applied to the boundary node state information after the 2nd, 10th, 12th, 15th, and 20th iterations sent to sub-area 1. At the same time, a 10% attack intensity is also applied to the 2nd, 3rd, 4th, 5th, 6th, 12th, 17th, 18th, 19th, 21st, and 27th iterations sent to sub-area 3. The experimental results are shown in Figure 2. Figure 20-25 shown.

[0126] According to the experimental results, each FDI attack can be detected by the KL divergence detector, and the data is regarded as packet loss. Each sub-region state estimator requires 51, 29, 29, 29, and 29 iterations to converge, respectively, with a total time consumption of 11.2149 seconds. Compared with the case without attack, the number of iterations and the iteration time consumption have only slight changes. It can be seen that the distributed security state estimation scheme proposed in the embodiment of the present invention can effectively resist data packet loss, DoS attacks and FDI attacks.

[0127] The beneficial effects brought about by the technical solution provided by the embodiment of the present invention include at least:

[0128] (1) In the present invention, active defense mechanism and passive detection technology are combined to address the security issues in distributed state estimation. A distributed security state estimation scheme based on cross-domain authentication and asynchronous alternating direction multiplier method (ADMM) is proposed. This scheme not only effectively resists the problem of data packet loss, but also effectively prevents two common network attacks, denial of service attack (DoS attack) and false data injection attack (FDI attack). By combining active defense mechanism with passive detection technology, the overall security protection level of the distributed system is significantly improved, thereby ensuring the stable operation of the system under various complex attack environments;

[0129] (2) In the present invention, by introducing the asynchronous ADMM algorithm and cross-domain authentication technology, the delay effect caused by the network transmission and cross-domain security authentication calculation cost is effectively reduced. The application of asynchronous ADMM allows asynchronous calculation of local state estimation without the need for all adjacent sub-region state estimators to complete the calculation, thereby significantly reducing the delay caused by the data transmission and authentication process. This mechanism optimizes the operating efficiency of the system, improves the real-time performance of data processing, and ensures the efficient operation of the system under high load and high complexity environments;

[0130] (3) In the present invention, a faster convergence speed and excellent anti-attack ability are shown in the distributed state estimation. The design of this scheme takes into account various complex situations in practical applications. It can quickly restore to normal state and maintain the stability of the system when facing network attacks and data transmission challenges. Its innovative algorithm design and efficient authentication mechanism not only enhance the system's defense capabilities against attacks, but also optimize the data processing process, thereby improving the reliability and response speed of the system in practical applications.

[0131] The above contents are only specific embodiments of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art who is familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

[0132] There are a few points to note:

[0133] (1) The drawings of the embodiments of the present invention only relate to the structures related to the embodiments of the present invention, and other structures may refer to the general design.

[0134] (2) For the sake of clarity, in the drawings used to describe the embodiments of the present invention, the thickness of the layers or regions is exaggerated or reduced, that is, these drawings are not drawn according to the actual scale. It is understood that when an element such as a layer, film, region or substrate is referred to as being "on" or "under" another element, the element may be "directly" "on" or "under" the other element or there may be intermediate elements.

[0135] (3) In the absence of conflict, the embodiments of the present invention and the features therein may be combined with each other to obtain new embodiments.

[0136] The above are only specific embodiments of the present invention, but the protection scope of the present invention is not limited thereto. The protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A CPPS distributed security state estimation method based on cross-domain authentication and asynchronous ADMM, characterized in that: include: S1. K-means-based power grid area division, which divides the entire power grid area into several sub-areas, thereby reducing the global communication cost and computing load; S2. Establishing a distributed security state estimation framework through a state estimator in each of the sub-areas, the framework comprising a physical layer, a network layer and a service layer, and each of the sub-areas comprises a state estimator; S3, authentication and state iteration of the sub-region state estimator: S3a, the state estimator of the sub-area registers with the KGC; S3b, the state estimator of the sub-area performs cross-domain authentication and exchanges boundary node state information; S3c, the state estimator of the sub-area performs KL divergence calculation on the received state information of the boundary node to determine whether it is within the threshold range; S3d, update the state according to the received information of some adjacent sub-region boundary nodes, and judge whether it converges. If not, enter the next iteration; S4. Introducing the asynchronous alternating direction method of multipliers (ADMM) algorithm, so that the state estimator of each sub-region can perform the next iteration without waiting for the states of all adjacent sub-regions to be updated.

2. According to claim 1, a CPPS distributed security state estimation method based on cross-domain authentication and asynchronous ADMM is characterized in that: The S1 specifically includes: S1a, collecting node data of the power grid area, wherein the node data includes the location, load data and power generation information of the node, and determining relevant weights according to the distance between the nodes, the current size and the importance parameters of the load; S1b, select k cluster centers; S1c, for each node, calculate the distance to each cluster center, and assign it to the cluster where the nearest cluster center is located, and obtain the index index of the cluster center corresponding to each node; S1d, calculating the cost C of disconnection according to the index index cost ; S1e, repeat cluster allocation and cost calculation until the termination condition is met, where the k clusters do not change or the cost C cost Function is less than the threshold.

3. According to claim 1, a CPPS distributed security state estimation method based on cross-domain authentication and asynchronous ADMM is characterized in that: The S2 specifically includes: The physical layer: represents the power grid area, the power grid area is divided into the sub-areas, each of the sub-areas includes internal nodes and boundary nodes, and each of the sub-areas includes a state estimator, and exchanges the state information of the boundary nodes with the state estimator of the adjacent sub-area; The network layer: each state estimator is regarded as an intelligent terminal in the sub-area, and is registered with the KGC in the sub-area by the gateway to which it belongs, and mutually authenticates with the state estimator in the adjacent sub-area, and exchanges and negotiates data with the state estimator in the adjacent sub-area; The business layer includes the registration information of the sub-area state estimator published on the chain by KGC and the registration information of other STs in CPPS.

4. According to claim 1, a CPPS distributed security state estimation method based on cross-domain authentication and asynchronous ADMM is characterized in that: The S3c specifically includes: The KL divergence is used to determine whether the boundary point state variable received by the sub-region state estimator is attacked: Among them, τ max and τ min is the alarm threshold for bad data attack detection. In the absence of FDI attack, D KL (p(y)||q(y0)) should be within the threshold interval. If D KL If (p(y)||q(y0)) exceeds the range, it is considered to be attacked, and y is the increment of the state variable of the border node of the adjacent sub-region that currently contains bad data. p(y) is the probability distribution of the increment of the boundary node state variable, y0 is the increment of the historical normal boundary node state variable, and q(y0) is the probability distribution of the increment of the historical normal boundary node state variable.

5. According to claim 1, a CPPS distributed security state estimation method based on cross-domain authentication and asynchronous ADMM is characterized in that: The S4 specifically includes: S4a, convert the nonlinear relationship of the AC model into the linear relationship of the DC model: Wherein, z includes the measurement of node injection power and branch power, H is the measurement matrix, and v is the measurement error, thereby obtaining the relationship between the measurement value and the state value of each sub-area: z i =H i θ i +v i Among them, z i is the measurement value of sub-region i, H i is the measurement matrix of sub-region i, θ i is the state variable of the extended area, including the state variables of the nodes inside the sub-area θ i,int and the state variables θ of the boundary nodes adjacent to subregion i i [j](j∈N i , N i is the set of sub-regions adjacent to sub-region i), v i is the measurement noise of sub-region i, subject to v i ~N(0,R i )’s Gaussian distribution; S4b, construct an objective function with boundary constraints based on the principle of minimum sum of squared errors: Among them, J(θ i ) is the objective function of state estimation in sub-region i, W i is the corresponding weight matrix, S4c, introduce intermediate variable θ ij and the boundary connectivity matrix D ij , so that θ i [j] = θ j [i] = θ ij =D ij θ i , we can infer that: S4d. According to the alternating vector multiplier method, substitute the objective function into the augmented Lagrangian matrix and scale the Lagrangian multiplier to obtain: Among them, ρ is the penalty parameter, u i,j is the stretching Lagrange multiplier; S4e, after corresponding iterations, we get: It can be seen from the above formula that the state variables of each sub-region are solved completely independently, and distributed computing can be performed, and it is only necessary to exchange boundary state information with the adjacent sub-region.

6. A CPPS distributed security state estimation method based on cross-domain authentication and asynchronous ADMM according to claim 5, characterized in that: The S4 further comprises: S4f. In order to solve the problem that the classic ADMM algorithm cannot cope well with data packet loss and transmission delay and the problem of long iteration time, the classic ADMM algorithm is transformed to achieve asynchronous computing: Assume that there are N adjacent to the sub-region i. i | sub-regions, received p i The boundary node information of adjacent sub-areas is required to receive at least p[|N i |](1≤p[|N i |]≤N i ) adjacent sub-regions’ boundary node information can be updated next time, that is, i ≥p[|N i |], let N k represents the set of sub-regions that meet the update conditions at the kth iteration, and we get: The asynchronous ADMM algorithm does not need to wait for all the adjacent sub-regions in the current region to complete KL divergence detection, cross-domain authentication, sub-region calculation and mutual communication. Compared with the synchronous ADMM iterative update, the asynchronous ADMM algorithm uses the boundary node state variables in the previous iteration step of the adjacent sub-region state estimator.

7. According to claim 5, a CPPS distributed security state estimation method based on cross-domain authentication and asynchronous ADMM is characterized in that: The S4a comprises: Assume that the voltage phase difference between the two nodes is very small, that is, sinθ ij ≈θ ij ,cosθ ij ≈1; The voltage amplitude of the node is close to the unit quantity 1p.u.; For the transmission branch, the branch conductance is much smaller than the branch susceptance, i.e. g ij <<b ij ; The charging power is converted to the load power to obtain the equivalent model of the transmission line. The current, resumption rate and active power of the branch from node i to node j in the AC model are: After substituting the simplified conditions, the active power and reactive power of the DC model branch are obtained: Q ij ＝0 Therefore, the active power injected into node i is: in, is an N-dimensional vector, the DC model of the power grid is obtained according to the above formula.

8. According to claim 4, a CPPS distributed security state estimation method based on cross-domain authentication and asynchronous ADMM is characterized in that: Specifically include: In order to prevent the KL divergence detection threshold from exceeding the threshold when an attack occurs because the confidence range is 99%, a smart contract is added to evaluate the credibility of the sub-region state estimator: The adjacent sub-region state estimator judges the state variables of the boundary nodes from sub-region i. If the state variables exceed the threshold specified by the KL divergence, the credibility contract is called to record the failure. When the credibility contract records the failure from the sub-region i exceeding the specified upper limit k err , the cancellation contract is called, and the state estimator of the sub-region i is considered untrustworthy. The boundary node information from the sub-region i is no longer used, and the boundary node state information before the attack is used instead.

Images