Security enhancement methods and systems for the IEC 104 protocol on the master station side of power monitoring systems

Abstract

This invention discloses a security enhancement method and system for the IEC 104 protocol on the master station side of a power monitoring system, comprising: generating input data, dynamically selecting a security mode and issuing configuration commands, generating original ASDU messages, calling application-layer security plugins to generate enhanced ASDU messages, encapsulating them into complete APDUs, generating security messages via transport-layer security plugins, and sending them to the station. This invention adopts a plug-in embedded architecture, integrating IEC 62351-5 application-layer and IEC 62351-3 transport-layer security plugins into the protocol processing module and communication processing module respectively, achieving decoupling of security functions and business functions; establishing a policy-driven mechanism, adding a security policy management module and an operation monitoring module, and providing port differentiation to adapt to different terminals to meet the needs of gradual transformation; controlling terminal concurrent connection latency at the millisecond level to meet the needs of large-scale high-concurrency access at the master station, and establishing a layered security protection system that coordinates the transport layer and application layer, ensuring message security even if transport layer security fails.

Description

Technical Field

[0001] This invention relates to a security enhancement method and system for the IEC 104 protocol, specifically to a security enhancement method and system for the IEC 104 protocol on the master station side of a power monitoring system. Background Technology

[0002] The IEC 104 protocol is the core communication standard for data acquisition and monitoring between the dispatch master station of the power monitoring system and substations and distribution terminals. However, it lacks authentication and message integrity protection mechanisms, making it vulnerable to attacks and seriously threatening the safe and stable operation of the power system. The IEC 62351 series of standards provides security guidelines and technical specifications for power system communication protocols. Specifically, IEC 62351-3 defines transport layer security mechanisms, and IEC 62351-5 defines application layer security mechanisms.

[0003] Currently, most security enhancement practices and research on power communication protocols focus on the substation side or the IEC 61850 protocol framework. Security enhancement solutions for the IEC 104 protocol at the master station side are relatively scarce, lacking effective solutions for engineering challenges such as large-scale terminal access, high-concurrency processing, compatibility between new and old terminals, and session reliability assurance. Existing security enhancement solutions either have strong intrusiveness to the original master station system, affecting stability and maintainability; or they struggle to balance security and processing performance, failing to meet the high-concurrency requirements of the master station; furthermore, they lack flexible policy configuration mechanisms, making it difficult to adapt to the actual scenario of mixed operation of new and old terminals during gradual upgrades. Summary of the Invention

[0004] Purpose of the invention: The purpose of this invention is to provide a security enhancement method for the IEC 104 protocol on the master station side of a power monitoring system that can improve security protection capabilities and enhance dynamic adaptation and high-concurrency processing performance; the second purpose of the inventor is to provide a security enhancement system for the IEC 104 protocol on the master station side of a power monitoring system that can reduce system intrusion, reduce modification risks, and improve business continuity and data transmission stability.

[0005] Technical solution: The security enhancement method for the IEC 104 protocol on the master station side of the power monitoring system described in this invention includes the following steps:

[0006] (1) The terminal generates business data and sends it to the main station application layer through the access port;

[0007] (2) Based on the input mode, service requirements and port configuration, dynamically select the security mode and issue configuration instructions to the IEC 62351-3 transport layer security plugin and the IEC 62351-5 application layer security plugin; the security modes include: full security, transport layer security only, application layer security only and compatibility mode;

[0008] (3) Encapsulate the data and generate the original ASDU message;

[0009] (4) Call the IEC 62351-5 application layer security plugin to classify ASDU messages into non-critical ASDU messages and critical ASDU messages, select critical ASDU messages, execute the application layer security processing flow, and generate enhanced ASDU messages.

[0010] (5) Construct an APDU field using an enhanced ASDU message, encapsulate it with an APCI field to form a complete APDU, and input it into the transport layer;

[0011] (6) Call the IEC 62351-3 transport layer security plugin to execute the transport layer security processing flow, generate a security message, and send it to the station.

[0012] In step (1), the terminal concurrent connection latency is controlled at the millisecond level to meet the large-scale high-concurrency access requirements of the main station.

[0013] In step (2), when the input mode is switched from synchronous data input to batch input, the data type is identified. If the data type is a performance-sensitive service, the security mode is "transport layer security only". The latency of concurrent terminal connections can be controlled at the millisecond level to meet the needs of large-scale high-concurrency access of the main station. The port configuration includes plaintext ports adapted to compatibility mode and encrypted terminals adapted to full security, transport layer security only, or application layer security only. The ports can be adapted to different terminals in a differentiated manner to meet the needs of gradual transformation. The configuration command is determined by the security mode. When the security mode is "compatibility mode", the configuration command is to disable the ports of the IEC 62351-3 transport layer security plugin and the IEC 62351-5 application layer security plugin. When the security mode is "full security mode", the configuration command is to enable the ports of the IEC 62351-3 transport layer security plugin and the IEC 62351-5 application layer security plugin. When the security mode is "application layer security only", the configuration command is to disable the IEC 62351-3 transport layer security plugin and enable the IEC 62351-5 application layer security plugin. When the security mode is "transport layer security mode only", the port of the IEC 62351-5 application layer security plugin is configured to enable the IEC 62351-3 transport layer security plugin and disable the port of the IEC 62351-5 application layer security plugin; to achieve compatible access for different terminals and differentiated security protection; the performance-sensitive services include: batch historical data synchronization, high-frequency periodic telemetry reporting, fault waveform file upload and resource-constrained terminal services.

[0014] In step (4), the IEC 62351-5 application layer security plugin performs ASDU message classification operation through its object-level security engine; the application layer security processing flow is as follows: select an authentication mode for identity authentication, generate authentication information by combining the two-level key system consisting of the update key and the application layer session key, and embed the security extension field containing the authentication information into the key ASDU message.

[0015] The authentication mode is either challenge / response mode or active authentication mode; the application layer session key is obtained through a key negotiation algorithm in accordance with the IEC62351-5 standard; the update key is established by pre-configuration or asymmetric negotiation, encrypting the application layer session key to generate the application layer key; the authentication information is generated by a message authentication code or digital signature based on the application layer key.

[0016] When the identity authentication fails or the key expires, a real-time alarm is triggered, a retry mechanism is started, or security parameters are dynamically adjusted, and an anomaly log is recorded for subsequent investigation.

[0017] In step (4), the application layer security processing flow also adopts a four-state machine, which performs timing control based on the preset "state-event-action" model to ensure that the timing of key negotiation, authentication and update is consistent. The four-state machine includes: secure idle state, waiting key state, waiting key update confirmation state and waiting response state. The specific process of the "state-event-action" model is as follows: set the initial state to secure idle state and wait for the security process to be triggered; initiate key query, enter the waiting key state and obtain the station key information; send key update instruction, enter the waiting key update confirmation state and receive confirmation; send authentication request, enter the waiting response state, and if the verification is successful, return to secure idle state; otherwise, issue an alarm or retry.

[0018] In step (6), the IEC 62351-3 transport layer security plugin executes the transport layer security processing flow through its TLS engine. The transport layer security processing flow is as follows: verifying identity information based on digital certificates, verifying message content and generating verification values, generating transport layer session keys using key negotiation algorithms in accordance with the IEC 62351-3 standard, and generating ciphertext messages by combining encryption algorithms, appending the verification values ​​to the ciphertext messages, and encapsulating them into secure messages. The transport layer session keys support transport layer session renegotiation and transport layer session recovery. The dynamic triggering methods for transport layer session renegotiation include transport layer periodic triggering and transport layer event triggering. The transport layer periodic triggering refers to triggering based on a preset time interval. Update the transport layer session key; the transport layer event trigger refers to the start when the transport layer security-related parameters change; the transport layer session recovery achieves rapid connection reconstruction after a brief link interruption by caching the transport layer session identifier, avoiding the continuation of the TLS handshake process; the transport layer security-related parameters are parameters that affect the transport layer secure communication configuration.

[0019] The security parameters of the IEC 62351-3 transport layer security plugin and the IEC 62351-5 application layer security plugin are stored in the security policy configuration table of the main station database. The security parameters include: TLS protocol version, cipher suite, session duration, MAC algorithm, key type and update cycle. Each security plugin can update its security policy online during operation without restarting.

[0020] The present invention discloses a security enhancement system for the master station side of a power monitoring system conforming to the IEC 104 protocol, comprising:

[0021] The existing business modules are used to implement the core functions of the main station's original IEC 104 protocol processing, ensuring that the main station's IEC 104 protocol processing logic remains unchanged. These modules include: a message encoding / decoding unit, a business data processing unit, and a terminal communication interface unit. The message encoding / decoding unit interacts with the IEC 62351-5 application layer security plugin through a standardized interface, and is used to encapsulate and parse IEC 104 protocol messages. The business data processing unit is used to execute the original data processing logic. The terminal communication interface unit is used to provide compatible access for different terminals.

[0022] The protocol processing module integrates the IEC 62351-5 application layer security plugin for low-intrusion enhancement, including: an object-level security engine, a state machine management unit, and an authentication mode management unit; the object-level security engine is used to classify IEC104 protocol messages using ASDU; the state machine management unit is used to standardize the timing logic of key negotiation, authentication, and key update; the authentication mode management unit is used to adaptively match challenge / response modes or active authentication modes.

[0023] The communication processing module integrates the IEC 62351-3 transport layer security plugin for low-intrusion enhancement, including: a TLS engine, a certificate management unit, and a session management unit; the TLS engine is used to classify and process IEC 104 APDUs; the certificate management unit is used to import station-side digital certificates and periodically verify certificate status; the session management unit is used to implement session renegotiation and session recovery functions.

[0024] The security policy management module is used for dynamic switching of security modes and real-time updating of security parameters. It includes: a policy configuration table, a dynamic decision-making unit, and a layered execution interface. The policy configuration table stores key security parameters defined by the IEC 62351-3 and IEC 62351-5 standards. The dynamic decision-making unit automatically matches four preset security modes—full security, transport layer security only, application layer security only, or compatibility—based on input modes, business requirements, and port configurations. The layered execution interface issues security parameters for the configured transport layer security plugin and the IEC 62351-5 application layer security plugin via standardized commands.

[0025] The operation monitoring module works in conjunction with the security policy management module, communication processing module, and protocol processing module to monitor terminal access status, link communication quality, security policy execution status, and key lifecycle status in real time. It also promptly triggers session renegotiation and session recovery between the application layer and the transport layer, dynamic adjustment of security mode, and alarms and handling of abnormal situations.

[0026] Beneficial Effects: Compared with existing technologies, this invention has the following significant advantages: 1. It adopts a plug-in embedded architecture, integrating an IEC 62351-5 application layer security plug-in into the protocol processing module and an IEC 62351-3 transport layer security plug-in into the communication processing module. This achieves end-to-end protection at the application layer object level, channel encryption and authentication at the transport layer, and decoupling of security functions from service functions, reducing transformation risks and maintenance costs. 2. It establishes a policy-driven mechanism, adding a security policy management module and an operation monitoring module to achieve dynamic adjustment of security modes and optimization of session, key, and message processing mechanisms. This allows ports to be adapted to different terminals, meeting the needs of gradual transformation. At the same time, it controls the terminal concurrent connection latency to the millisecond level, meeting the needs of large-scale high-concurrency access of the main station. 3. It establishes a deep security protection system that coordinates the transport layer and the application layer. When the security of the transport layer fails, the application layer can still ensure message security. At the same time, it can be quickly rebuilt in milliseconds after the link is interrupted, achieving zero packet loss in the case of link interruption. Attached Figure Description

[0027] Figure 1 This is a diagram of the overall architecture of the present invention;

[0028] Figure 2 This is a flowchart illustrating the processing of the key ASDU message in this invention. Detailed Implementation

[0029] The technical solution of the present invention will be further described below with reference to the accompanying drawings.

[0030] Example 1

[0031] In this embodiment, the security enhancement method of the IEC 104 protocol on the master station side of the power monitoring system is as follows: Figure 1 As shown, it includes the following steps:

[0032] S1: Terminals such as the Supervisory Control and Data Acquisition (SCADA) system and the Distribution Management System (DMS) generate data that needs to be sent out for execution (e.g., control commands and business data) based on the power grid operating status, and input it to the master station through the port. At this time, the latency of the terminal concurrent connection can be controlled at the millisecond level, which meets the needs of the master station for large-scale high-concurrency access.

[0033] S2: Based on terminal type, service requirements, and port configuration, dynamically select a security mode, including: full security, transport layer security only, application layer security only, and compatibility mode, and issue configuration commands to the IEC 62351-3 transport layer security plugin and the IEC 62351-5 application layer security plugin to achieve differentiated security protection. When the security mode is "compatibility mode," the configuration command disables the ports of the transport layer security plugin and the application layer security plugin; when the security mode is "full security mode," the configuration command enables the ports of the transport layer security plugin and the application layer security plugin; when the security mode is "application layer security only," the configuration command disables the transport layer security plugin and enables the port of the application layer security plugin; when the security mode is "transport layer security only," the configuration command enables the transport layer security plugin and disables the port of the application layer security plugin. When an abnormal situation of policy configuration conflict occurs, a retry mechanism is initiated or the system switches to a backup security policy, and an anomaly log is recorded for subsequent troubleshooting. This embodiment uses "full security mode" as an example to illustrate the above security enhancement method.

[0034] Specifically, when the same terminal switches from synchronous input data to batch input, the data recognition function is activated. When there are performance-sensitive services with extremely high requirements for communication real-time performance and processing efficiency, including: batch historical data synchronization, high-frequency periodic telemetry reporting, fault waveform file uploading, and real-time monitoring services implemented by resource-constrained terminals, a security mode switching operation is triggered, automatically switching to "transport layer security only". Port configuration is divided into plaintext ports for compatibility mode and ciphertext ports for full security, transport layer security only, or application layer security only. By default, ports such as 2404, 2400, and 2442 are plaintext ports, and ports such as 19998, 19993, and 2423 are ciphertext ports, allowing ports to be adapted to different terminals and meeting the needs of gradual transformation.

[0035] S3: Encapsulate data and generate the original ASDU message.

[0036] S4: Invoke the object-level security engine of the IEC 62351-5 application layer security plugin to perform ASDU message classification, classifying ASDU messages into non-critical ASDU messages and critical ASDU messages, and processing them accordingly:

[0037] 1. Select non-critical ASDU messages such as periodic telemetry and tele-signaling, and generate plaintext ASDU messages using standard processing procedures or by adding only lightweight integrity checks.

[0038] 2. Select key ASDU messages such as remote control and point setting, e.g. Figure 2 The following application-layer security processing flow is executed:

[0039] First, based on the authentication requirements, a choice is made between challenge / response mode and proactive authentication mode. Challenge / response mode is a "request-response" authentication method, where the client initiates an authentication challenge to the master site, and the master site responds, requiring two message exchanges to achieve identity verification between the master site and the client. Proactive authentication mode involves the master site actively attaching authentication information to the message, without requiring the client to initiate a challenge, and is used to verify the validity of the message information. Therefore, if the requirement is two-way authentication, the challenge / response mode is selected; if the requirement is one-way authentication, the proactive authentication mode is selected.

[0040] Then, combined with the updated key Application layer session key A two-level key system is used to generate authentication information. Among them, For the first At each site, the update key is established through pre-configuration or asymmetric negotiation and is used to encrypt the application layer session key and generate the application layer key. The application layer session key conforms to the IEC 62351-5 standard and uses the Elliptic Curve Diffie-Hellman Key Exchange Algorithm (ECDHE) to generate a public / private key pair between the communicating parties. The shared key is then derived from the public key. It is then derived through a key derivation function (e.g., SHA384).

[0041] Finally, based on the IEC 62351-5 standard, a security extension field containing user identifier, timestamp, and authentication information is embedded in the key ASDU message to generate an enhanced ASDU message. The authentication information is generated by a message authentication code or digital signature based on the application layer key.

[0042] This application-layer security process also uses a four-state machine to ensure the timing consistency of key negotiation, authentication, and update, including: secure idle state, waiting for key, waiting for key update confirmation, and waiting for response. The "state-event-action" model forces the flow according to the following fixed process: The initial state is set to secure idle, waiting for the security process to be triggered; when a message triggers the application-layer security process, a query is initiated to check the validity of the session key, entering the waiting for key state. After obtaining the session key information from the corresponding station, the validity of the session key is verified; if the session key is invalid, a key update command is sent, entering the waiting for key update confirmation state. Upon receiving confirmation, the session key is updated; a session key authentication request is sent, entering the waiting for response state. If the verification passes, it returns to secure idle; otherwise, a real-time alarm is triggered or a retry mechanism is initiated, and an exception log is recorded for subsequent investigation.

[0043] S5: Fill the plaintext ASDU message and the enhanced ASDU message into the APDU application data field, and encapsulate them with the application protocol control information APCI field to form a complete APDU based on plaintext ASDU message and an APDU based on enhanced ASDU message, and then enter the transport layer.

[0044] S6: The TLS engine of the IEC 62351-3 transport layer security plugin is invoked to perform the following classification and processing flow for APDU, with the default protocol being TLS 1.2:

[0045] 1. For APDU based on plaintext ASDU messages, send the message directly to the station.

[0046] 2. For APDUs based on Enhanced ASDU messages, execute the transport layer security processing procedure:

[0047] First, identity information is verified based on digital certificates. In offline mode, different websites will use X.509 digital certificates, including: the website's public key, certificate validity period, and hash algorithm. The CA's digital signature on the certificate, etc., are imported into the main site's certificate management unit. During authentication, the main site uses the public key to restore the hash value of the digital signature. Then use a hash algorithm Calculate the certificate content at this time to obtain the hash value. Finally, compare and If they are equal, the certificate is valid, the website's identity is genuine, and a connection can be established. If they are not equal, the certificate has been tampered with, the website's identity is questionable, and the connection is refused.

[0048] Secondly, verify the message content and generate a verification value. This is done using a hash function. (e.g., SHA256) Calculates the hash value of the APDU based on the Enhanced ASDU message. .

[0049] Then, following the IEC 62351-3 standard, the public / private key pair between the communicating parties is generated using the Elliptic Curve Diffie-Hellman Key Exchange Algorithm (ECDHE). A shared key is then generated based on the public key, and finally, a transport layer session key is generated using a key derivation function (e.g., SHA384). The encrypted message is obtained by encrypting the APDU based on the enhanced ASDU message using encryption algorithms (such as AES and GCM). The transport layer session key is used in this encryption. Supports transport layer session renegotiation and transport layer session recovery. Transport layer session keys support transport layer session renegotiation and recovery. Dynamic triggering methods for transport layer session renegotiation include transport layer periodic triggering and transport layer event triggering. Transport layer periodic triggering refers to triggering based on a preset time interval. Update the transport layer session key (e.g.: Transport layer event triggering refers to the process that begins when transport layer security-related parameters change. Transport layer session recovery utilizes a cached transport layer session identifier and sets the session recovery interval to [value missing]. seconds (e.g.: This enables rapid connection reconstruction after a brief link interruption, avoiding the need to continue the TLS handshake process. Transport layer security-related parameters are those that affect the configuration of transport layer secure communication, such as the TLS protocol version and transport layer session key. This includes encryption algorithms, certificate status changes triggered by Certificate Revocation List (CRL) updates, and critical ASDU count exceeding limits, among other things.

[0050] Finally, the verification value is appended to the ciphertext message, encapsulated into a secure message, and sent to the station. When abnormal scenarios such as link interruption or device restart are detected, an attempt is made to initiate session recovery. If the session times out, the complete handshake process is executed, followed by session renegotiation. If the session does not time out, the session is reused directly, and listening continues. When abnormal situations such as authentication failure or key expiration are detected, real-time alarms are triggered, a retry mechanism is initiated, or a backup security policy is switched to, and anomaly logs are recorded for subsequent investigation.

[0051] After the station receives the message, it first performs the following judgment:

[0052] If the message is in plaintext mode, proceed directly to the next step of processing, and perform the inverse operation of the above operation.

[0053] If the message is in secure mode, first verify the message integrity, then decrypt and restore the APDU, and perform the reverse operation of the above security enhancement operation.

[0054] Example 2

[0055] This embodiment provides a security enhancement system for the IEC 104 protocol on the master station side of a power monitoring system, including:

[0056] The existing business modules retain the core functions of the main station's original IEC 104 protocol processing logic, including: a message encoding / decoding unit, a business data processing unit, and a terminal communication interface unit. The message encoding / decoding unit interacts with the IEC 62351-5 application layer security plugin of the protocol processing module through a standardized interface to achieve non-intrusive integration of enhanced ASDU messages and plaintext ASDU messages. It is also used to fill enhanced ASDU messages and plaintext ASDU messages into the APDU application data field and to complete the encapsulation and parsing of application protocol control information (APCI). The business data processing unit handles the original business logic such as telemetry and tele-signaling data processing, and remote control and remote adjustment command execution and control. The terminal communication interface unit provides multi-port access capabilities, supports the parallel operation of plaintext and encrypted ports, provides compatible access for different terminals, and ensures that the upgraded system can maintain the continuity of the original business and the stability of its own system.

[0057] The protocol processing module integrates the IEC 62351-5 application layer security plugin, including: an object-level security engine, a state machine management unit, and an authentication mode management unit. The object-level security engine is responsible for classifying IEC 104 protocol messages into ASDUs. For critical ASDU messages such as remote control and remote adjustment messages, it triggers security enhancement processes, specifically including: selecting an authentication mode and updating the key. Application layer session key The system generates authentication information by combining user identifier, timestamp, and authentication information into a secure extended domain and embedding it into critical ASDU messages to generate enhanced ASDU messages. It performs standard processing or lightweight integrity checks on non-critical messages such as telemetry and tele-signaling. The state machine management unit uses a preset four-state machine "state-event-action" model to regulate the timing logic of key negotiation, authentication initiation, key update, and response verification processes to ensure the compliance of secure interactions at the application layer. The authentication mode management unit adaptively matches challenge / response modes or proactive authentication modes based on business security requirements and communication efficiency needs.

[0058] The communication processing module integrates the IEC 62351-3 transport layer security plugin to undertake transport layer security protection responsibilities, including: TLS engine, certificate management unit and session management unit. The TLS engine is used to classify and process IEC 104 APDUs: plaintext ASDU messages are sent directly to the station, while enhanced ASDU messages undergo a standardized encryption process. This process includes: generating public / private key pairs for both communicating parties using the Elliptic Curve Diffie-Hellman Key Exchange (ECDHE) algorithm; generating a shared key based on the public key; deriving a session key using a key derivation function (e.g., SHA384); and using the session key as the encryption algorithm key (e.g., AES256) to encrypt messages, generating ciphertext messages. A hash function is also used to ensure message transmission integrity. The certificate management unit imports X.509 digital certificates from the station to the master station's certificate management unit offline. Offline verification of certificate status is achieved through periodic updates to the Certificate Revocation List (CRL), avoiding communication delays or single points of failure caused by online queries. The session management unit features session renegotiation and session recovery functions, supporting both periodic and event-triggered session renegotiation modes. It also quickly rebuilds interrupted links by caching session identifiers, thereby reducing connection recovery latency and system resource consumption.

[0059] The security policy management module, as the core of system security configuration and scheduling, includes: a policy configuration table, a dynamic decision-making unit, and a layered execution interface. The policy configuration table stores key security parameters defined by the IEC 62351-3 and IEC 62351-5 standards, including TLS protocol version, cipher suite type, session duration, MAC algorithm, key parameters, and update rules. It supports structured storage and online modification. The dynamic decision-making unit obtains real-time information on terminal access ports, terminal types, and business scenarios, and automatically matches four preset security modes: full security, transport layer security only, application layer security only, or compatibility. The layered execution interface sends security configuration parameters to the protocol processing module and communication processing module via standardized commands to achieve coordinated execution of application layer and transport layer security policies.

[0060] The monitoring module works in conjunction with the security policy management module, communication processing module, and protocol processing module to monitor terminal access status, link communication quality, security policy execution, and key lifecycle status in real time. Specifically, it triggers a session renegotiation process when security parameter adjustment events such as substation certificate updates or TLS protocol version changes are detected, or when a preset period is reached. When abnormal scenarios such as link interruption or device restart are detected, session recovery processing is performed. If the session times out, a full handshake and session renegotiation are performed; if the session does not time out, the session is reused and listening continues. When abnormal situations such as authentication failure or key expiration are detected, alarms are triggered, retry is performed, or a backup security policy is switched, and an exception log is recorded. When a terminal switches to a performance-sensitive service, feedback is sent to the security policy management module, triggering dynamic adjustment of the security mode to achieve a dynamic balance between system security and operational efficiency.

Claims

1. A security enhancement method for the IEC 104 protocol on the master station side of a power monitoring system, characterized in that, Includes the following steps: (1) The terminal generates business data and sends it to the main station application layer through the access port; (2) Based on the input mode, service requirements and port configuration, dynamically select the security mode and issue configuration instructions to the IEC 62351-3 transport layer security plugin and the IEC 62351-5 application layer security plugin; the security modes include: full security, transport layer security only, application layer security only and compatibility mode; (3) Encapsulate the data and generate the original ASDU message; (4) Call the IEC 62351-5 application layer security plugin to classify ASDU messages into non-critical ASDU messages and critical ASDU messages, select critical ASDU messages, execute the application layer security processing flow, and generate enhanced ASDU messages. (5) Construct an APDU field using an enhanced ASDU message, encapsulate it with an APCI field to form a complete APDU, and input it into the transport layer; (6) Call the IEC 62351-3 transport layer security plugin to execute the transport layer security processing flow, generate a security message, and send it to the station.

2. The security enhancement method for the IEC 104 protocol on the master station side of the power monitoring system according to claim 1, characterized in that, In step (1), the latency of concurrent terminal connections is controlled at the millisecond level.

3. The security enhancement method for the IEC 104 protocol on the master station side of the power monitoring system according to claim 1, characterized in that, In step (2), when the input mode is switched from synchronous data input to batch input, the data type is identified. If the data type is a performance-sensitive service, the security mode is "transport layer security only". The port configuration includes plaintext ports adapted to compatibility mode and encrypted terminals adapted to full security, transport layer security only, or application layer security only. The configuration command is determined by the security mode. When the security mode is "compatibility mode", the configuration command is to disable the ports of the IEC 62351-3 transport layer security plugin and the IEC 62351-5 application layer security plugin. When the security mode is "full security mode", the configuration command is to enable the ports of the IEC 62351-3 transport layer security plugin and the IEC 62351-5 application layer security plugin. When the security mode is "application layer security only", the configuration command is to disable the IEC 62351-3 transport layer security plugin and enable the ports of the IEC 62351-5 application layer security plugin. When the security mode is "transport layer security only", the configuration command is to enable the IEC 62351-3 transport layer security plugin and enable the ports of the IEC 62351-5 application layer security plugin. Disable the IEC 62351-3 transport layer security plugin and disable the ports of the IEC 62351-5 application layer security plugin; The performance-sensitive services include: batch historical data synchronization, high-frequency periodic telemetry reporting, fault waveform file uploading, and resource-constrained terminal services.

4. The security enhancement method for the IEC 104 protocol on the master station side of the power monitoring system according to claim 1, characterized in that, In step (4), the IEC 62351-5 application layer security plugin performs ASDU message classification operation through its object-level security engine; the application layer security processing flow is as follows: select an authentication mode for identity authentication, generate authentication information by combining the two-level key system consisting of the update key and the application layer session key, and embed the security extension field containing the authentication information into the key ASDU message.

5. The security enhancement method for the IEC 104 protocol on the master station side of the power monitoring system according to claim 4, characterized in that, The authentication mode is either challenge / response mode or active authentication mode; the application layer session key is obtained through a key negotiation algorithm in accordance with the IEC 62351-5 standard; the update key is established by pre-configuration or asymmetric negotiation, encrypting the application layer session key and generating the application layer key; The authentication information is generated from a message authentication code or digital signature based on an application-layer key.

6. The security enhancement method for the IEC 104 protocol on the master station side of the power monitoring system according to claim 4, characterized in that, When the identity authentication fails or the session key expires, a real-time alarm is triggered or a retry mechanism is initiated, and an exception log is recorded for subsequent investigation.

7. The security enhancement method for the IEC 104 protocol on the master station side of the power monitoring system according to claim 1, characterized in that, In step (4), the application layer security processing flow also adopts a four-state machine, which performs timing control based on the preset "state-event-action" model to ensure that the timing of key negotiation, authentication and update is consistent. The four-state machine includes: secure idle state, waiting key state, waiting key update confirmation state and waiting response state. The specific process of the "state-event-action" model is as follows: set the initial state to secure idle state and wait for the security process to be triggered; initiate key query, enter the waiting key state and obtain the station key information; send key update instruction, enter the waiting key update confirmation state and receive confirmation; send authentication request, enter the waiting response state, and if the verification is successful, return to secure idle state; otherwise, issue an alarm or retry.

8. The security enhancement method for the IEC 104 protocol on the master station side of the power monitoring system according to claim 1, characterized in that, In step (6), the IEC 62351-3 transport layer security plugin executes the transport layer security processing flow through its TLS engine; The transport layer security processing flow is as follows: Identity information is verified based on digital certificates; message content is verified and a verification value is generated; a transport layer session key is generated using a key negotiation algorithm following the IEC 62351-3 standard; and an encryption algorithm is used to generate a ciphertext message. The verification value is appended to the ciphertext message, and then encapsulated into a secure message. The transport layer session key supports transport layer session renegotiation and transport layer session recovery. The dynamic triggering methods for transport layer session renegotiation include transport layer periodic triggering and transport layer event triggering. Transport layer periodic triggering refers to updating the transport layer session key based on a preset time interval; transport layer event triggering refers to initiating the process when transport layer security-related parameters change. Transport layer session recovery achieves rapid connection reconstruction after a brief link interruption by caching the transport layer session identifier, avoiding the continuation of the TLS handshake process. The transport layer security-related parameters are those that affect the transport layer secure communication configuration.

9. The security enhancement method for the IEC 104 protocol on the master station side of the power monitoring system according to claim 1, characterized in that, The security parameters of the IEC 62351-3 transport layer security plugin and the IEC 62351-5 application layer security plugin are stored in the security policy configuration table of the main station database; The security parameters include: TLS protocol version, cipher suite, session duration, MAC algorithm, key type, and update cycle.

10. A security enhancement system for the master station side of a power monitoring system conforming to the IEC 104 protocol, characterized in that, The system includes: The existing business modules are used to implement the core functions of the main station's original IEC 104 protocol processing, including: a message encoding / decoding unit, a business data processing unit, and a terminal communication interface unit; the message encoding / decoding unit interacts with the IEC 62351-5 application layer security plugin through a standardized interface, and is used to encapsulate and parse IEC 104 protocol messages; the business data processing unit is used to execute the original data processing logic; the terminal communication interface unit is used to provide compatible access for different terminals; The protocol processing module integrates an IEC 62351-5 application layer security plugin, including: an object-level security engine, a state machine management unit, and an authentication mode management unit; the object-level security engine is used to classify IEC 104 protocol messages using ASDU; the state machine management unit is used to standardize the timing logic of key negotiation, authentication, and key update; and the authentication mode management unit is used to adaptively match challenge / response modes or active authentication modes. The communication processing module integrates the IEC 62351-3 transport layer security plugin, including: a TLS engine, a certificate management unit, and a session management unit; the TLS engine is used to classify and process IEC 104 APDUs; the certificate management unit is used to import station-side digital certificates and periodically verify certificate status; the session management unit is used to implement session renegotiation and session recovery of application layer and transport layer session keys; The security policy management module is used for dynamic switching of security modes and real-time updating of security parameters. It includes: a policy configuration table, a dynamic decision-making unit, and a layered execution interface. The policy configuration table stores key security parameters defined by the IEC 62351-3 and IEC 62351-5 standards. The dynamic decision-making unit automatically matches four preset security modes—full security, transport layer security only, application layer security only, or compatibility—based on input modes, business requirements, and port configurations. The layered execution interface issues security parameters for the configured transport layer security plugin and the IEC 62351-5 application layer security plugin via standardized commands. The operation monitoring module works in conjunction with the security policy management module, communication processing module, and protocol processing module to monitor terminal access status, link communication quality, security policy execution status, and key lifecycle status in real time. It also promptly triggers session renegotiation and session recovery between the application layer and the transport layer, dynamic adjustment of security mode, and alarms and handling of abnormal situations.

Images