Access control device, access control method, and program

Abstract

An access control device according to one aspect disclosed herein is an access control device in a distributed energy system composed of one or more distributed power supply systems and an energy management system that controls the distributed power supply systems. The access control device comprises: a power generation state discerning unit that discerns the power generation state of each of the distributed power supply systems; and an access authorization unit that determines whether to permit or deny access to information or control functions of the distributed power supply systems according to the power generation state.

Description

Access control device, access control method, and program

[0001] The present disclosure relates to an access control device, an access control method, and a program in a distributed energy system.

[0002] Transitioning to distributed energy systems is being considered as a means of ensuring a stable energy supply during natural disasters, utilizing renewable energy toward decarbonization, and reducing costs through efficient energy supply. In distributed energy systems, energy supply devices known as distributed energy resources (DERs) are connected to a network and integrated and controlled by an energy management system, enabling efficient distribution of electricity within a region or facility. Examples of DERs include solar power generation systems, storage batteries, fuel cells, EV charging infrastructure, and demand response devices. However, as DERs become smarter and networked, cybersecurity risks arise. Unauthorized control of DERs could not only disrupt the power supply from the distributed energy system, but could also result in DER equipment failure and the release of environmental pollutants, potentially threatening human life and safety. Furthermore, if the distributed energy system is connected to a grid, damage to the grid could affect consumers over a wider area.

[0003] Conventionally, there is a concept called zero trust architecture to reduce security risks (see, for example, Non-Patent Document 1). In conventional zero trust architecture, it is considered to determine whether to allow access to a resource from an access source based on information about the access source.

[0004] Scott Rose, Oliver Borchert, Stu Mitchell, Sean Connelly, “Zero Trust Architecture”, NIST Special Publication 800-207 (https: / / doi.org / 10.6028 / NIST.SP.800-207)

[0005] It is conceivable to apply zero trust architecture to distributed energy systems to enhance safety. However, distributed energy systems are environments that differ from conventional IT environments, such as those requiring real-time communications and using a variety of DERs and communication protocols, making it difficult to apply conventional technologies as they are.

[0006] The present disclosure provides an access authorization device and the like for realizing a secure distributed energy system.

[0007] An access control device according to one embodiment of the present disclosure is an access control device in a distributed energy system consisting of one or more distributed power supply systems and an energy management system that controls the distributed power supply systems, and the access control device includes a power generation status grasping unit that grasps the power generation status of each of the distributed power supply systems, and an access authorization unit that determines the control function of the distributed power supply systems and whether to grant or deny access to information depending on the power generation status.

[0008] An access control method according to one aspect of the present disclosure is an access control method in a distributed energy system comprising one or more distributed power supply systems and an energy management system that controls the distributed power supply systems, the access control method including a power generation status grasping step for grasping the power generation status of each of the distributed power supply systems, and an access authorization step for determining whether to grant or deny access to the control functions and information of the distributed power supply systems based on the power generation status.

[0009] A program according to one aspect of the present disclosure is a program for causing a computer to execute an access control method according to one aspect of the present disclosure.

[0010] An access permission device according to one aspect of the present disclosure can make it easier to keep a distributed energy system secure.

[0011] FIG. 1 is a diagram illustrating a configuration of a distributed energy system according to an embodiment. FIG. 2 is a block diagram illustrating a functional configuration of an energy management system according to an embodiment. FIG. 3 is a block diagram illustrating a functional configuration of an edge controller according to an embodiment. FIG. 4 is a block diagram illustrating a functional configuration of a fuel cell system according to an embodiment. FIG. 5 is a block diagram illustrating a functional configuration of a solar cell system according to an embodiment. FIG. 6 is a block diagram illustrating a functional configuration of a storage battery system according to an embodiment. FIG. 7 is a diagram illustrating an example of a power state according to an embodiment. FIG. 8 is a diagram illustrating an example of a weather forecast according to an embodiment. FIG. 9 is a diagram illustrating an example of demand data according to an embodiment. FIG. 10 is a diagram illustrating an example of an electricity price according to an embodiment. FIG. 11 is a diagram illustrating an example of a schedule according to an embodiment. FIG. 12 is a diagram illustrating an example of an operating state according to an embodiment. FIG. 13 is a diagram illustrating an example of a filter rule according to an embodiment. FIG. 14 is a diagram illustrating an example of a fuel cell state according to an embodiment. FIG. 15 is a diagram illustrating an example of a solar cell state according to an embodiment. FIG. 16 is a diagram illustrating an example of a storage battery state according to an embodiment. FIG. 17 is a sequence diagram illustrating access control to a distributed energy system by an edge controller according to an embodiment. FIG. 18 is a processing flowchart of access control by the edge controller according to an embodiment. FIG. 19 is a processing flowchart of access control by the edge controller according to an embodiment. Fig. 20 is a processing flowchart of access control by an edge controller according to an embodiment. Fig. 21 is a processing flowchart of access control by an edge controller according to an embodiment. Fig. 22 is a processing flowchart of access control by an edge controller according to an embodiment. Fig. 23 is a diagram showing an example of a security alert display output when access control is denied according to an embodiment.

[0012] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings.

[0013] It should be noted that the embodiments described below are intended to illustrate specific examples of the present disclosure. The numerical values, shapes, components, steps, and step orders shown in the following embodiments are merely examples and are not intended to limit the present disclosure. Furthermore, among the components in the following embodiments, components that are not recited in independent claims are described as optional components. Furthermore, the contents of each embodiment can be combined. Furthermore, various modifications made to each embodiment of the present disclosure within the scope conceivable by a person skilled in the art are also included in the present disclosure, as long as they do not deviate from the spirit of the present disclosure.

[0014] (Embodiment) [Configuration] First, the configuration of a distributed energy system according to an embodiment will be described.

[0015] FIG. 1 is a diagram showing the overall configuration of a distributed energy system according to an embodiment.

[0016] The distributed energy system 1 is a system in which an energy management system 10, an edge controller 20, a fuel cell system 30, a solar cell system 40, a storage battery system 50, a meter 60, and a load device 70 communicate with each other. The fuel cell system 30, the solar cell system 40, and the storage battery system 50 are connected to the load device 70 via a power network via the meter 60, and receive and supply electric power. The distributed energy system 1 is also connected to a power grid 80 via a power network, and receives electric power depending on the status of the distributed energy system 1. Conversely, surplus electric power in the distributed energy system 1 may be sold to the power grid. The distributed energy system 1 does not necessarily have to be connected to the power grid 80, and may be operated independently.

[0017] The energy management system 10 is a system that controls DERs so that the distributed energy system 1 can efficiently generate and supply power to the load devices 70. Specifically, the energy management system 10 predicts the power demand of the load devices 70 and determines a control schedule for each DER so that power can be generated efficiently while utilizing power price and weather information. The energy management system is connected to the Internet or the like and acquires power price and weather information in real time. The energy management system may be mounted on the edge controller 20 or may be implemented as a cloud system. The energy management system 10 may also perform demand response control to control the demand of the load devices 70.

[0018] The edge controller 20 is a device physically located close to the DERs and serves as a gateway to the energy management system 10. It communicates with the energy management system via wired or wireless connections, receives a control schedule, and controls each DER in accordance with the control schedule. It also notifies the energy management system 10 of information regarding the status of each DER.

[0019] The fuel cell system 30 is one of the DERs in the distributed energy system 1 and generates electric power. For example, it is a pure hydrogen fuel cell.

[0020] The solar cell system 40 is one of the DERs of the distributed energy system 1 and generates electric power.

[0021] The storage battery system 50 is one of the DERs in the distributed energy system 1 and generates electric power. It can also store surplus electric power in the distributed energy system 1. For example, it is a lithium-ion battery storage system, but other energy storage systems may also be used.

[0022] In this embodiment, three types of DERs are used: a fuel cell system, a solar cell system, and a storage battery system. However, the combination is not limited to this. For example, there may be more or fewer types than three. For example, other examples of DERs include charging infrastructure for electric vehicles, generators, cogeneration systems, geothermal power generation systems, wind power generation systems, and demand response devices such as heat pumps, and any of the above may be combined in any desired manner.

[0023] The meter 60 has a function of measuring and communicating the power status of the distributed energy system 1. It also serves as a hub of the power network, a connection point with the grid 80, and has a function of switching the connection on and off.

[0024] The load devices 70 are a group of devices to which the distributed energy system 1 mainly supplies energy. For example, the load devices 70 may be large facilities such as factories, hospitals, and commercial facilities, or may be homes. The load devices 70 may also be a regional power network including multiple homes and commercial facilities. The load devices 70 may also be subjected to demand response control for adjusting supply and demand. In this embodiment, the load devices 70 are included as components of the distributed energy system 1, but are not an essential component. For example, the distributed energy system may be a power generation-only distributed energy system that does not include load devices and simply sells the generated power to the grid without consuming it.

[0025] The grid 80 is a commercial grid, such as a power transmission and distribution network. When the power demand of the distributed energy system 1 exceeds the power generation amount, the grid 80 supplies power to the distributed energy system 1. Conversely, when the power supply of the grid is likely to become unstable, the grid 80 receives power from the distributed energy system 1.

[0026] The edge controller 20 and each DER (fuel cell system 30, solar cell system 40, and storage battery system 50) are connected by wire or wirelessly and can communicate with each other. A variety of communication protocols are used, such as HTTP (Hypertext Transfer Protocol), Modbus, BACnet, IEEE1815, IEEE2030.5, OpenADR, OCPP (Open Charge Point Protocol), and Echonet Lite.

[0027] FIG. 2 is a block diagram showing a functional configuration of the energy management system 10 according to the embodiment.

[0028] The energy management system 10 includes a communication unit 101, a control optimization unit 102, a UI unit 103, a power status storage unit 104, a weather forecast information storage unit 105, a demand data storage unit 106, a power price storage unit 107, and a schedule storage unit 108.

[0029] The communication unit 101 is a communication interface between the energy management system 10 and the outside, and communicates with, for example, the edge controller 20 and the Internet.

[0030] The control optimization unit 102 outputs an optimized schedule for each DER so as to enable efficient power generation and power consumption in the distributed energy system 1. The optimization may be performed periodically to update the schedule, or the optimization process may be performed in response to some event. The optimization refers to the current power state of the distributed energy system 1 stored in the power state storage unit 104, the weather forecast information stored in the weather forecast information storage unit 105, the demand forecast data stored in the demand data storage unit 106, and the power price data stored in the power price storage unit 107, and determines a control schedule for each DER so as to generate power that satisfies the power demand while maximizing the use of renewable energy and minimizing the power supply from the grid (minimizing the power purchase cost).

[0031] The UI unit 103 displays a dashboard for checking the status of the distributed energy system 1 to the manager of the distributed energy system 1 and consumers who receive energy supply from the distributed energy system 1. The UI unit 103 also provides the manager of the distributed energy system 1 with a management interface for changing the settings of the distributed energy system 1.

[0032] The power status storage unit 104 stores information relating to the operation status and power generation status of each DER in the distributed energy system 1, and details thereof will be described later with reference to FIG.

[0033] The weather forecast information storage unit 105 stores weather information for the location where the distributed energy system is installed, and is used to predict power demand and the amount of power generated by the solar cell system 40. Details will be described later using FIG. 8 .

[0034] The demand data storage unit 106 stores data predicting how much power the load device 70 will use, and details of this will be described later with reference to FIG.

[0035] The power price holding unit 107 holds information on the power unit price for each time period when power is used from a commercial grid, and details will be described later with reference to FIG.

[0036] The schedule storage unit 108 stores information relating to the control schedule of each DER output by the control optimization unit 102, and details will be described later with reference to FIG.

[0037] FIG. 3 is a block diagram showing the functional configuration of the edge controller 20 according to the embodiment.

[0038] The edge controller 20 includes a communication unit 201 , a control instruction unit 202 , a packet filter unit 203 , an operation status storage unit 204 , a schedule storage unit 205 , and a filter rule storage unit 206 .

[0039] The communication unit 201 is a communication interface between the energy management system 10 and each DER and meter.

[0040] The control instruction unit 202 generates and transmits messages for controlling each DER according to the control schedule stored in the schedule storage unit 205. It also monitors control communications for each DER and controls access to the DER. For example, when the energy management system 10 transmits communications for controlling a DER, it determines the validity of the control communications from the state of the distributed energy system 1, and performs access control such as blocking the communications if it determines that the control is inappropriate. Furthermore, if it detects inappropriate communications, it takes action such as issuing a security alert or storing a log.

[0041] The packet filter unit 203 filters packets sent and received by the communication unit 201. Specifically, the packet filter unit 203 realizes a firewall function that determines whether or not a packet can be sent and received, according to the filter rules stored in the filter rule holding unit 206.

[0042] The operation state storage unit 204 stores information relating to the state of the distributed energy system 1, and details thereof will be described later with reference to FIG.

[0043] The schedule holding unit 205 holds information about the control schedule of each DER, and basically holds the same content as the control schedule notified from the energy management system 10. Therefore, the same information as that of the schedule holding unit 108 is held.

[0044] The filter rule storage unit 206 stores information for filtering communication packets transmitted and received by the edge controller 20, and will be described in detail later with reference to FIG.

[0045] In this embodiment, information for authenticating the communication partner is omitted, but mutual authentication may be performed during communication. For example, the edge controller 20 may hold the public key of the energy management system 10 and authenticate the energy management system 10, or conversely, the energy management system 10 may hold the public key of the edge controller 20 and authenticate the edge controller 20. Furthermore, communication between the energy management system 10 and the edge controller 20 may be performed via a closed network.

[0046] FIG. 4 is a block diagram showing the functional configuration of a fuel cell system 30 according to an embodiment.

[0047] The fuel cell system 30 comprises a communication control unit 301, a hydrogen storage unit 302, a hydrogen fuel cell 303, and a fuel cell status holding unit 304. It should be noted that there may be a plurality of hydrogen fuel cells 303.

[0048] The communication control unit 301 interprets control instructions from the edge controller 20 to the fuel cell system, and controls the start and stop of power generation by the operation of the hydrogen fuel cell 303. The communication control unit 301 also stores the operating status in the fuel cell status storage unit 304 and notifies the edge controller 20 of the operating status.

[0049] The hydrogen storage unit 302 is a storage tank for hydrogen that serves as fuel for the hydrogen fuel cell 303. Hydrogen is transported by trailer or the like and periodically replenished into the storage tank.

[0050] The hydrogen fuel cell 303 generates electricity using hydrogen as fuel.

[0051] The fuel cell status storage unit 304 stores information such as the operating status of each hydrogen fuel cell 303 and the amount of hydrogen stored in the hydrogen storage unit 302, and details will be described later using FIG. 14. Note that while this embodiment shows an example in which hydrogen is stored in the hydrogen storage unit 302, hydrogen may also be supplied via a pipeline. Also, a hydrogen generation device may be installed, or a device that generates hydrogen using surplus power from the distributed energy system 1 may be installed.

[0052] FIG. 5 is a block diagram showing a functional configuration of a solar cell system 40 according to an embodiment.

[0053] The solar cell system 40 includes a communication control unit 401, a solar cell 402, and a solar cell status holding unit 403. Note that there may be a plurality of solar cells 402.

[0054] The communication control unit 401 interprets control instructions from the edge controller 20 to the solar cell system 40, and controls the start and stop of power generation by the operation of the solar cell 402. The communication control unit 401 also stores the operation status in the solar cell status storage unit 403 and notifies the edge controller 20 of the operation status.

[0055] The solar cell 402 converts sunlight into electricity to generate power.

[0056] The solar cell status holding unit 403 holds information on the operating status of each solar cell 402, the details of which will be described later with reference to FIG.

[0057] FIG. 6 is a block diagram showing the functional configuration of a storage battery system 50 according to an embodiment.

[0058] The storage battery system 50 includes a communication control unit 501, a storage battery 502, and a storage battery status holding unit 503. Note that there may be multiple storage batteries 502.

[0059] The communication control unit 501 interprets control instructions from the edge controller 20 to the storage battery system 50, and controls the start and stop of power generation or the start and stop of charging by the operation of the storage battery 502. The communication control unit 501 also stores the operating status in the storage battery status storage unit 503 and notifies the edge controller 20 of the operating status.

[0060] The storage battery 502 can store and output power.

[0061] The storage battery status storage unit 503 stores information on the operating status of each storage battery 502, and details will be described later with reference to FIG.

[0062] [Specific Examples of Various Information] Next, various information used in the distributed energy system according to the embodiment will be described.

[0063] 7 is a diagram illustrating an example of a power state according to an embodiment of the present invention, specifically, information stored in the power state storage unit 104.

[0064] The power status includes the amount of power generated by each DER in the distributed energy system 1, its operating status, and its load value.

[0065] For example, FIG. 7 shows an example in which the grid connection is off, the load is 120 kW, the power generation amount of the fuel cell system is 0 kW, the hydrogen storage amount is 50,000 liters, the power generation amount of the solar cell system is 150 kW, the power generation amount of the storage battery system is 0 kW, the charge amount of the storage battery system is 30 kW, the current electricity price is X yen, and the weather is sunny.

[0066] The power state may be stored in an encrypted form.

[0067] 8 is a diagram showing an example of a weather forecast according to the embodiment. Specifically, the information shown in FIG. 8 is information stored in the weather forecast information storage unit 105.

[0068] The weather forecast information stores weather forecasts for each time period at the location of the distributed energy system 1. The energy management system 10 acquires the information from, for example, an external weather forecast site. Specifically, the weather forecast information stores sunny, cloudy, rainy, and the probability of precipitation. FIG. 8 shows an example in which today's weather is sunny from midnight to 6:00 with a 0% chance of precipitation, sunny from 6:00 to 12:00 with a 0% chance of precipitation, sunny from 12:00 to 18:00 with a 0% chance of precipitation, and cloudy from 18:00 to 24:00 with a 30% chance of precipitation; tomorrow's weather is rainy from midnight to 6:00 with a 60% chance of precipitation, rainy from 6:00 to 12:00 with an 80% chance of precipitation, rainy from 12:00 to 18:00 with a 90% chance of precipitation, and rainy from 18:00 to 24:00 with a 40% chance of precipitation; and the weather the day after tomorrow is cloudy from midnight to 6:00 with a 20% chance of precipitation, cloudy from 6:00 to 12:00 with a 20% chance of precipitation, cloudy from 12:00 to 18:00 with a 10% chance of precipitation, and cloudy from 18:00 to 24:00 with a 10% chance of precipitation.

[0069] The weather forecast information is not limited to the above examples, and may include information on temperature, humidity, whether there is sunshine, etc. This makes it possible to accurately predict power demand and the amount of power generated by solar cells.

[0070] Furthermore, forecasts for smaller time periods may be stored instead of six-hourly forecasts, which will improve the accuracy of control optimization.

[0071] 9 is a diagram illustrating an example of demand data according to an embodiment of the present invention. Specifically, the information shown in FIG. 9 is information stored in the demand data storage unit 106.

[0072] Specifically, the demand data holds forecast data of power demand for each time period.

[0073] FIG. 9 shows an example in which the predicted power demand today is 50 kW at 1:00, 50 kW at 2:00, 200 kW at 12:00, and 50 kW at midnight; tomorrow is 50 kW at 1:00, 50 kW at 2:00, 200 kW at 12:00, and 50 kW at midnight; and the day after tomorrow is 50 kW at 1:00, 50 kW at 2:00, 100 kW at 12:00, and 50 kW at midnight.

[0074] Although the present embodiment shows an example in which only the predicted power demand is recorded, actual power demand data may also be stored. Furthermore, the power demand may be predicted by the energy management system 10. Furthermore, the power demand data may be encrypted and stored. Furthermore, the power demand may not be hourly predicted, but may be stored for a shorter period.

[0075] 10 is a diagram showing an example of power prices according to the embodiment. Specifically, the information shown in FIG. 10 is stored in the power price storage unit 107.

[0076] The energy management system 10 acquires the grid electricity usage price from an external network. Specifically, the energy management system 10 stores the hourly electricity price.

[0077] FIG. 10 shows an example in which the electricity unit price at 1 o'clock is 20 yen / kWh, the electricity unit price at 2 o'clock is 20 yen / kWh, the electricity unit price at 12 o'clock is 40 yen / kWh, and the electricity unit price at 24 o'clock is 20 yen / kWh.

[0078] Fig. 11 is a diagram showing an example of a schedule according to an embodiment. Specifically, Fig. 11 shows information stored in the schedule storage units 108 and 205. Specifically, the schedule stores a control schedule for each DER.

[0079] Figure 11 shows an example in which, at 1:00, the fuel cell is operating with an output of 100 kW, the solar cell is stopped, and the storage battery is operating and discharging; at 12:00, the fuel cell is operating and outputting 50 kW of power, the solar cell is outputting 150 kW of power, and the storage battery is charging; and at 24:00, the fuel cell is outputting 100 kW of power, the solar cell is stopped, and the storage battery is discharging.

[0080] Although the present embodiment shows an example in which an hourly control schedule is stored, the schedule may be stored for a shorter period of time. Furthermore, the schedule may be signed by the energy management system. This makes it possible to detect tampering with the schedule.

[0081] Fig. 12 is a diagram showing an example of an operation state according to the embodiment. Specifically, Fig. 12 shows information stored in the operation state storage unit 204. Specifically, the operation state stores a log of the operation state, events, and control history of each DER constituting the distributed energy system 1.

[0082] In Figure 12, the operating state of the fuel cell system is stopped, a security alert has been detected as an event, and the control history shows that control was stopped at 9:00; the operating state of the solar cell system is operating, 150 kW of power is being output, no particular event has occurred, and the control history shows that operation began at 9:00; and the operating state of the storage battery system is charging, 30 kW of power is being consumed, no particular event has occurred, and the control history shows that charging began at 9:00.

[0083] Although omitted in this embodiment, information such as the current weather conditions, the electricity unit price, whether or not the system is connected, the power pressure in the system, and the load power may also be stored.

[0084] The operating state may be encrypted and stored.

[0085] 13 is a diagram showing an example of filter rules according to an embodiment. Specifically, FIG. 13 shows information stored in the filter rule storage unit 206. Specifically, the filter rules stored indicate the processing to be applied when the source and destination included in a packet match. Rules are compared starting with the lowest rule number, and if a matching rule exists, subsequent rules are not applied. In other words, if a packet matching rule number 3 is received, subsequent rules number 4 and number 5 are not applied.

[0086] In Figure 13, rule number 1 allows communication for packets whose source is an energy management system and whose destination is an edge controller, rule number 2 allows communication whose source is an edge controller and whose destination is an energy management system, rule number 3 allows communication whose source is a smart meter and whose destination is an electric power company, rule number 4 allows communication whose source is a fuel cell system, a solar cell system, a storage battery system, or a smart meter and whose destination is an edge controller, and rule number 5 rejects communication whose source is Any, i.e., all, and whose destination is an edge controller.

[0087] In this embodiment, a whitelist-type rule is configured, but the rule is not limited to the whitelist type. Also, the source and destination may be expressed by IP addresses or MAC addresses.

[0088] Fig. 14 is a diagram showing an example of the fuel cell state according to the embodiment. Specifically, Fig. 14 shows information stored in the fuel cell state storage unit 304. Specifically, the fuel cell state stores the operating states of the devices that make up the fuel cell system.

[0089] FIG. 14 shows an example in which the operation state of fuel cell 1 is stopped, the operation state of fuel cell N is stopped, and the hydrogen storage amount is 50,000 liters.

[0090] Fig. 15 is a diagram showing an example of the solar cell status according to the embodiment. Specifically, Fig. 15 shows information stored in the solar cell status storage unit 403. The solar cell status specifically stores the operating states of the devices constituting the solar cell system 40.

[0091] FIG. 15 shows an example in which the operating state of solar cell 1 is power generation with an output of 5 kW, and the operating state of solar cell N is power generation with an output of 5 kW.

[0092] Fig. 16 is a diagram showing an example of the storage battery state according to the embodiment. Specifically, Fig. 16 shows information stored in the storage battery state storage unit 503. Specifically, the storage battery state stores the operating states of the devices constituting the storage battery system 50.

[0093] Figure 16 shows an example in which storage battery 1 is in an operating state of charging, consuming 1 kW, and has a current charge level of 70%, and storage battery N is in an operating state of charging, consuming 1 kW, and has a current charge level of 70%.

[0094] [Processing Procedure] Next, a processing procedure of the distributed energy system according to the embodiment will be described.

[0095] 17 is a sequence diagram showing the procedure for access permission according to the embodiment. Specifically, FIG. 17 is a sequence diagram showing the procedure when the energy management system 10 controls the fuel cell system 30.

[0096] First, the energy management system 10 distributes the results of optimizing the control schedule of the distributed energy system, that is, the control schedule of each DER, to the edge controller 20 (S100).

[0097] The edge controller 20 stores the received control schedule and controls each DER, that is, the fuel cell system 30, the solar cell system 40, and the storage battery system 50, in accordance with the control schedule (S101).

[0098] The fuel cell system 30 stops power generation under the control of the edge controller 20 (S102).

[0099] The solar cell system 40 starts generating power under the control of the edge controller 20 (S103).

[0100] The storage battery system 50 starts charging under the control of the edge controller 20 (S104).

[0101] Thereafter, for example, the energy management system 10 transmits an unauthorized control message to the fuel cell system 30 due to a security breach (S105).

[0102] The edge controller 20 verifies whether the content of the received control message is valid (S106). At this time, the edge controller determines the validity of the control message not only by authenticating the energy management system 10 but also by taking into consideration the control content included in the message, the operating status of each DER, the load state, the weather state, price information, the power shortage state in the grid, the season, the time of day, etc.

[0103] As a result of verifying the validity of the control message, the edge controller 20 determines that the control of the fuel cell system 30 by the energy management system 10 is not currently valid, and blocks functional access from the energy management system 10 to the fuel cell system 30 (S107).

[0104] FIG. 18 is a first flowchart of a determination process of access control by the edge controller 20 according to the embodiment.

[0105] First, the edge controller 20 receives a message from the energy management system 10 (S200).

[0106] The edge controller 20 checks whether the received message indicates a schedule update timing (S201).

[0107] If the received message is a schedule update (Yes in S201), the edge controller 20 checks whether the current time is a predetermined schedule update timing (S202). For example, the edge controller 20 is set to update the schedule at predetermined times, such as every 30 minutes.

[0108] If the timing of receiving the schedule update message is the predetermined schedule update timing (Yes in S202), the edge controller 20 updates the schedule according to the received schedule (S203) and ends the process. On the other hand, if the timing of receiving the message is not the predetermined schedule update timing (No in S202), the edge controller 20 rejects the schedule update (S204) and ends the process.

[0109] When the received message is not a schedule update message (No in S201), the edge controller 20 checks whether the message is a control instruction for a DER included in the distributed energy system 1 (S205).

[0110] If the message is a control instruction (Yes in S205), the edge controller 20 verifies the validity of the message (S206), (performs access control based on the validity verification), and ends the process. On the other hand, if the message is not a control instruction (No in S205), the edge controller 20 updates the operating status according to the message (S207), and ends the process. Examples of the operating status include price information, weather information, and power shortage status.

[0111] 19 is a flowchart (part 2) showing details of the access control executed by the edge controller 20 according to the embodiment. Specifically, the details of the process of S206 in FIG. 18 will be described.

[0112] First, the edge controller 20 checks whether the control message from the energy management system 10 is an instruction to increase the power generation output for the distributed energy system 1 (S300).

[0113] If the control message is an instruction to increase the power generation output (Yes in S300), the edge controller 20 checks whether the control message is an instruction to increase the power generation output of the fuel cell system 30 (S301).

[0114] Next, if the control message is an instruction to increase the power generation output of the fuel cell system 30 (Yes in S301), the edge controller 20 checks whether the power generated by the solar cell system 40 is sufficient to handle the load at present or for a predetermined period (S302). For example, this applies to a situation where the weather is fine, the output of the solar cell system 40 is expected to be stable for a while, and no increase in the load is expected.

[0115] When the edge controller 20 determines that the solar cell system 40 is generating enough power to handle the load (Yes in S302), the edge controller 20 checks whether the grid is in a power tight state (S303).

[0116] If the grid is in a power-stressed state (Yes in S303), the edge controller 20 permits control (S304) and terminates the process. This allows surplus power to be generated in the distributed energy system 1 and transferred to the grid, thereby contributing to ensuring grid stability. On the other hand, if the grid is not in a power-stressed state (No in S303), the edge controller 20 determines that the control instruction from the energy management system 10 is invalid and rejects the control instruction (S305), and terminates the process. Specifically, the edge controller 20 takes measures such as not sending a control instruction signal to the fuel cell system 30, notifying the security system of the rejection of control, and recording the rejection in a log. This makes it possible to prevent excessive power generation in the distributed energy system 1, contributing to ensuring the stability of the distributed energy system 1.

[0117] If the edge controller 20 determines that the solar cell system 40 is not generating enough power to meet the load (No in S302), it checks whether sufficient power is being generated, including the power of the storage battery system 50 (S306).

[0118] When the edge controller 20 determines that the combined output of the solar cell system 40 and the storage battery system 50 can generate enough power to meet the load (Yes in S306), it checks whether the grid is in a power-stressed state (S303). On the other hand, when it determines that the combined output of the solar cell system 40 and the storage battery system 50 cannot generate enough power to meet the load (No in S306), it permits control (S307) and ends the process.

[0119] If the control message is not an instruction to the fuel cell system 30 to increase power generation output (No in S301), the edge controller 20 determines whether the instruction in the control message will result in the power generated by the distributed energy system 1 exceeding the load and making it impossible to maintain balance (S308).

[0120] If, as a result of the control instruction, the edge controller 20 determines that the power generated by the distributed energy system 1 exceeds the load (Yes in S308), it checks whether the power in the grid is under pressure (S309); if it does not determine that the power exceeds the load (No in S308), it allows the control (S307) and terminates.

[0121] If the grid power is in a tight state (Yes in S309), the edge controller 20 permits the control (S307) and ends the process. On the other hand, if the grid power is not in a tight state (No in S309), the edge controller 20 denies the control (S310) and ends the process.

[0122] If the control message does not include an instruction to increase the output of the distributed energy system 1 (No in S300), the edge controller 20 executes the process of flowchart 3 (S311).

[0123] 20 is a flowchart (part 3) showing details of access control executed by the edge controller 20 according to the embodiment. Specifically, this is a processing flowchart for the case in which the control instruction from the energy management system 10 in FIG. 19 is not to increase the output of the distributed energy system 1 (No in S300).

[0124] First, the edge controller 20 checks whether the control instruction from the energy management system 10 is to suppress the output of the distributed energy system 1 (S400).

[0125] If the control instruction is to suppress the output of the distributed energy system 1 (Yes in S400), the edge controller 20 determines whether the control instruction will cause the output of the distributed energy system 1 to fall below the load (S401).

[0126] When the edge controller 20 determines that the output of the distributed energy system 1 will fall below the load (Yes in S401), it checks whether the distributed energy system 1 is connected to the grid (S402). When the output of the distributed energy system 1 will not fall below the load (No in S401), it permits control (S405) and ends the process.

[0127] If the distributed energy system 1 is connected to the grid (Yes in S402), the edge controller 20 permits the control (S403) and ends the process. On the other hand, if the distributed energy system 1 is not connected to the grid (No in S402), the edge controller 20 denies the control (S404) and ends the process.

[0128] If the control instruction from the energy management system 10 is not to suppress the output of the distributed energy system 1 (No in S400), the edge controller 20 executes the process of flowchart 4 (S406).

[0129] 21 is a flowchart (part 4) showing details of the access control executed by the edge controller 20 according to the embodiment, specifically, the details of the process of S406 in FIG.

[0130] First, the edge controller 20 checks whether the control instruction from the energy management system 10 is an instruction to disconnect from the grid (S500).

[0131] When the control instruction is an instruction to disconnect from the grid (Yes in S500), the edge controller 20 determines whether the output of the distributed energy system 1 is expected to fall below the load (S501).

[0132] If the output of the distributed energy system 1 is expected to fall below the load (Yes in S501), the edge controller 20 determines whether an abnormal event has occurred in the distributed energy system 1 (S502). An abnormal event is, for example, a failure of the DER system or an event related to a cybersecurity event in the distributed energy system 1. On the other hand, if the output of the distributed energy system 1 is not expected to fall below the load, the edge controller 20 permits control (S505) and ends the process.

[0133] If an abnormal event has occurred in the distributed energy system 1 (Yes in S502), the edge controller 20 permits the control (S503) and terminates the process. This makes it possible to prevent the effects of the abnormal event that has occurred in the distributed energy system 1 from spreading to the grid. On the other hand, if no abnormal event has occurred (No in S502), the edge controller 20 denies the control (S504) and terminates the process. This makes it possible to maintain the stability of the power supply of the distributed energy system 1 even when the grid is disconnected.

[0134] If the control instruction from the energy management system 10 is not an instruction to disconnect from the grid (No in S500), the edge controller 20 checks whether the control instruction is an instruction to connect to the grid (S506).

[0135] If the control instruction is to connect to the grid (Yes in S506), the edge controller 20 determines whether the current output of the distributed energy system 1 is expected to fall below the load (S507).

[0136] If the output of the distributed energy system 1 is expected to fall below the load (Yes in S507), the edge controller 20 determines (S508) whether the difference between the output and the load can be made up for by the remaining output capacity (unoperated output) of the fuel cell system 30 and the storage battery system 50 in the distributed energy system 1. On the other hand, if the output of the distributed energy system 1 is not expected to fall below the load (No in S507), the edge controller 20 rejects the control (S510) and ends the process.

[0137] If the difference between the output and the load cannot be compensated for by the output margin of the fuel cell system 30 and the storage battery system 50 (Yes in S508), the edge controller 20 permits the control (S509) and ends the process. On the other hand, if the difference between the output and the load can be compensated for (No in S508), the edge controller 20 denies the control (S510) and ends the process. Note that in this embodiment, the control is simply denied (i.e., connection to the grid is denied) in S510, but connection to the grid may also be permitted depending on whether the grid is under pressure. This makes it possible to supply surplus power to the grid, which contributes to grid stability.

[0138] If the control instruction from the energy management system 10 is not an instruction to connect to the grid (No in S506), the edge controller 20 performs the process of flowchart 5 (S511).

[0139] 22 is a flowchart showing the details of the access control process executed by the edge controller 20 according to the embodiment, specifically, the details of the process of S511 in FIG.

[0140] First, the edge controller 20 checks whether the control instruction for the energy management system 10 is a control instruction related to a plurality of different DER systems (S600).

[0141] If the control instruction is related to a plurality of different DER systems (Yes in S600), the edge controller 20 checks whether a predetermined number of control instructions or less have been received within a predetermined period (S601). On the other hand, if the control instruction is not related to a plurality of different DER systems (No in S600), the edge controller 20 permits the control (S602) and ends the process.

[0142] If the edge controller 20 determines that the number of control instructions received within a predetermined period is equal to or less than a predetermined number (Yes in S601), the edge controller 20 permits control (S602) and ends the process.

[0143] If the edge controller 20 determines that it has received more than a predetermined number of control instructions within a predetermined period (No in S601), it determines whether the amount of load fluctuation within the predetermined period was greater than or equal to a predetermined value (S603).

[0144] If the load fluctuation amount is equal to or greater than a predetermined value within a predetermined period (Yes in S603), the edge controller 20 permits control (S602) and ends the process.

[0145] If the load fluctuation amount is not greater than a predetermined value within the specified period (No in S603), the edge controller 20 determines whether the output change amount of the solar cell system 40 within the specified period is greater than a predetermined value (S604).

[0146] If the amount of change in the output of the solar cell system 40 within the predetermined period is equal to or greater than a predetermined value (Yes in S604), the edge controller 20 permits control (S602) and ends the process.

[0147] If the change in output from the solar cell system 40 is not greater than a predetermined value (No in S604), the edge controller 20 determines whether the amount of hydrogen stored in the fuel cell system 30 and the amount of electricity stored in the storage battery system 50 are less than or equal to a predetermined value (S605).

[0148] If the amounts of electricity stored in the fuel cell system 30 and the storage battery system 50 are equal to or less than a predetermined value (Yes in S605), the edge controller 20 permits the control (S602) and ends the process. On the other hand, if the amounts of electricity stored in the fuel cell system 30 and the storage battery system 50 are not equal to or less than the predetermined value (No in S605), the edge controller 20 denies the control (S603) and ends the process.

[0149] [Other Examples] Next, examples other than the above examples used in the distributed energy system according to the embodiment, and specific examples of images used for security monitoring in the distributed energy system will be described.

[0150] 23 is a diagram showing an example of an analysis screen displayed when the edge controller 20 denies access to a control instruction from the energy management system 10 and notifies the security monitoring system of the denial of the situation. Although the present embodiment does not include a security monitoring system, a security monitoring system that monitors the security of the distributed energy system may be provided. For example, security operations of the distributed energy system may be performed by an organization called a Security Information Event Management (SIEM) that aggregates security events from the edge controller, or a Security Operations Center (SOC) that uses the SIEM to analyze security events.

[0151] FIG. 23 shows an example of the display of a security alert that is notified when unauthorized access to a function of a distributed energy system is detected by the access control of this embodiment. FIG. 23 shows that the reason for detecting the security alert is an excessive power generation request in the distributed energy system. In addition, a means for performing manual approval is provided so that control can be executed if the control request is legitimate. Furthermore, the security alert displays details of the rejected control command and the status of the distributed energy system at that time. This makes it easy to understand the status of the distributed energy system when a control command is notified to the distributed energy system, and makes it easy to analyze whether the control command is unauthorized.

[0152] [Effects, etc.] Below, examples of techniques that can be obtained from the disclosure of this specification will be given, and effects, etc. that can be obtained from these techniques will be described.

[0153] Technology 1 is an access control device in a distributed energy system including one or more distributed power supply systems and an energy management system that controls the distributed power supply systems, the access control device including a power generation status grasping unit that grasps the power generation status of each distributed power supply system, and an access authorization unit that determines whether to grant or deny access to control functions of the distributed power supply systems and information according to the power generation status. In the above embodiment, the access control device is an edge controller 20.

[0154] Conventionally, this type of access control device has restricted access based on the attributes of the access source and the security status, but has not considered the impact on the stability and efficiency of the energy supply in a distributed energy system. Therefore, an access control device in one aspect of the present disclosure performs access control based on the power generation status of the distributed energy system. This makes it possible to achieve highly reliable access control that takes into account the stability of the energy supply.

[0155] Technology 2 is an access control device according to Technology 1, in which the power generation status includes the power load in the load system to which the distributed energy system supplies power, the generated power of each distributed power supply system, and the additional reserve power that can be generated, and the access authorization unit denies access to a control function that instructs the distributed power supply system to generate reserve power in a situation where the generated power is sufficient for the power load.

[0156] This allows for control of access to the power generation function at unnecessary times, and protects the distributed energy system from unauthorized control that could destabilize its operation.

[0157] Technology 3 is the access control device described in Technology 2, in which the distributed energy system is further connected to a grid and is capable of exchanging power, the power generation status further includes a power pressure status of the grid, and the access authorization unit, when the power pressure status of the grid is equal to or greater than a predetermined value, permits access to a control function that instructs the distributed power supply system to generate reserve power in a situation where the generated power is sufficient for the power load.

[0158] This makes it possible to generate electricity to supply power to the grid, even when the output of the distributed energy system is sufficient, depending on the power situation in the grid, thereby maintaining the stability of the grid.

[0159] Technology 4 is the access control device described in Technology 2, in which the distributed power system includes a distributed power system based on variable renewable energy, the power generation status further includes weather information related to the generation conditions of the variable renewable energy, and the access authorization unit denies access to a control function that instructs the distributed power system to generate reserve power in a situation in which it can be determined from the weather information that the output of the distributed power system based on variable renewable energy can be sufficiently secured for the power load.

[0160] This makes it possible to predict the power generation status of a distributed power generation system based on variable renewable energy, thereby preventing unnecessary power generation and improving the stability of the distributed energy system.

[0161] Technology 5 is an access control device described in Technology 1, in which the power generation status includes the power load in the load system to which the distributed energy system supplies power, the generated power of each distributed power system, and the reserve power that can be generated in addition, and the access authorization unit denies access to a control function that supports the suppression of generated power for the distributed power system in a situation in which the generated power falls below a predetermined range for the power load.

[0162] This makes it possible to deny access to the output suppression function in situations that would destabilize the power supply from the distributed energy system, thereby improving the stability of the power supply.

[0163] Technology 6 is the access control device according to Technology 1, in which the distributed energy system is further connected to a grid and is capable of exchanging power, the power generation status includes the power load in the load system to which the distributed energy system supplies power, the generated power of each distributed power source system, and the reserve power that can be generated in addition, and the access authorization unit denies access to the control function that instructs connection of the distributed energy system to the grid in a situation in which the sum of the generated power and the reserve power exceeds a predetermined range for the power load.

[0164] This makes it possible to prevent unnecessary grid connection, thereby improving the stability of the distributed energy system and the grid power supply.

[0165] Technology 7 is the access control device described in Technology 1, in which the distributed energy system is further connected to a grid and is capable of exchanging power, the power generation status includes the power load in the load system to which the distributed energy system supplies power, the generated power of each distributed power source system, and the reserve power that can be generated in addition, and the access authorization unit denies access to the control function that instructs disconnection of the distributed energy system from the grid in a situation in which the sum of the generated power and the reserve power falls below a predetermined range for the power load.

[0166] This makes it possible to prevent the distributed energy system from being disconnected from the grid at times when its output becomes unstable, thereby improving safety.

[0167] Technology 8 is an access control device described in Technology 1, in which the power generation status includes the power load in the load system to which the distributed energy system supplies power, the generated power of each distributed power supply system, and the additional reserve power that can be generated, and the access authorization unit denies access to more than a predetermined number of control functions for the distributed power supply system when the fluctuation amount of any of the power load, the generated power, or the reserve power that can be generated is below a predetermined amount.

[0168] This makes it possible to prevent unnecessary control of the distributed energy system in situations where there are few changes in the power generation situation, thereby improving stability.

[0169] Technique 9 is an access control method in a distributed energy system consisting of one or more distributed power supply systems and an energy management system that controls the distributed power supply systems, the access control method including a power generation status grasping step that grasps the power generation status of each distributed power supply system, and an access authorization step that determines whether to grant or deny access to the control functions and information of the distributed power supply systems depending on the power generation status.

[0170] Such an access control method provides the same effects as the access control device according to one aspect of the present disclosure.

[0171] Technique 10 is a program for causing a computer to execute the access control method described in Technique 9.

[0172] Such an access control method provides the same effects as the access control device according to one aspect of the present disclosure.

[0173] Note that the general or specific aspects of the present disclosure may be realized as a system, an apparatus, a method, an integrated circuit, a computer program, or a non-transitory recording medium such as a computer-readable CD-ROM, or as any combination of a system, an apparatus, a method, an integrated circuit, a computer program, and a recording medium.

[0174] Other Embodiments Although the present disclosure has been described above based on the embodiments, the present disclosure is not limited to the above-described embodiments.

[0175] For example, an example of an energy system that combines a distributed power supply system including a fuel cell system, a solar cell system, and a storage battery system as components of a distributed energy system has been shown, but the method of combining a distributed power supply system is not limited to this embodiment. For example, it is sufficient if the system includes at least a power generation system using variable renewable energy, an energy storage system, and a demand response device. Examples of power generation systems using variable renewable energy include solar cell systems and wind power generation systems. Examples of energy storage systems include battery-type storage battery systems, fuel cell systems, and electric vehicle charging infrastructure systems connected to electric vehicles equipped with batteries. Demand response devices include all devices that can be controlled to reduce their power consumption, such as air conditioners, heat pumps, and refrigerators.

[0176] Furthermore, in the above embodiment, the edge controller unit includes a control instruction unit that determines access control, but the location where access control is performed is not limited to the edge controller. For example, it may be located within each DER system. For example, access control may be performed in the communication control units of the fuel cell system, solar cell system, and storage battery system. This is effective in preventing function control through unauthorized communication, even if an unauthorized command is sent over the communication path between the edge controller and each DER system. In this case, each DER system may also be provided with a mechanism for acquiring and storing the operating status of the distributed energy system 1.

[0177] Furthermore, in the access control determination method according to the above embodiment, control that contradicts a more efficient control schedule may be rejected. For example, a situation in which power is purchased from the grid at a time when the power price is higher than the average despite there being a power surplus in a distributed energy system may be restricted as an unauthorized function access.

[0178] Although the above embodiment has shown an example of the function of the access destination related to the control of the distributed energy system, access to information on the distributed energy system may be restricted. For example, access control may be implemented for obtaining information on the power generation status, fault status, load usage status, etc.

[0179] In the above embodiment, weather information is included in determining whether the solar cell system can secure sufficient power, but weather information may also include information such as sunshine hours. For example, if the time until sunset is within a predetermined time, the solar cell system may determine that it will not be able to secure sufficient power. Similarly, if wind power weakens within a predetermined time, the wind power system may determine that it will not be able to secure sufficient power.

[0180] The access control method according to the above embodiment may be used in combination with a conventional access control device. For example, role-based access control may be applied, and whether or not access to a function is permitted may be determined according to the attributes of the entity accessing the function. Furthermore, whether or not access is permitted may be determined according to the attributes of the user accessing the function. Furthermore, whether or not access is permitted may be ultimately determined according to the time period when the function is accessed and the security status of the entity.

[0181] Furthermore, the communication method and communication standard between the devices in the above-described embodiments are not particularly limited. Wireless communication or wired communication may be performed between the devices. Furthermore, wireless communication and wired communication may be combined between the devices.

[0182] Furthermore, for example, all of the numbers used above are examples for specifically explaining the present disclosure, and the embodiments of the present disclosure are not limited to the exemplified numbers.

[0183] Furthermore, for example, the division of functional blocks in the block diagram is merely an example, and multiple functional blocks may be realized as a single functional block, one functional block may be divided into multiple blocks, or some functions may be moved to another functional block.Furthermore, the functions of multiple functional blocks having similar functions may be processed in parallel or in time-sharing by a single piece of hardware or software.

[0184] Furthermore, for example, the order in which each step is performed in the flowchart is merely an example for specifically explaining the present disclosure, and an order other than the above may be used. Furthermore, some of the steps may be performed simultaneously (in parallel) with other steps.

[0185] Furthermore, for example, the components included in each device described in the above embodiments may be distributed among multiple devices in any manner without departing from the spirit of the present disclosure.

[0186] In the above-described embodiment, the processing performed by a specific processing unit may be performed by another processing unit. The order of multiple processing operations may be changed, or multiple processing operations may be performed in parallel.

[0187] In the above-described embodiments, each component (each processing unit) may be realized by executing a software program suitable for that component. Each component may be realized by a program execution unit such as a CPU (Central Processing Unit) or a processor reading and executing a software program recorded on a recording medium such as a hard disk or semiconductor memory.

[0188] Furthermore, each component may be realized by hardware. Each component may be a circuit (or integrated circuit). These circuits may form a single circuit as a whole, or each may be a separate circuit. Furthermore, each of these circuits may be a general-purpose circuit or a dedicated circuit.

[0189] Furthermore, the general or specific aspects of the present disclosure may be realized as a system, an apparatus, a method, an integrated circuit, a computer program, or a non-transitory recording medium such as a computer-readable CD-ROM, or as any combination of a system, an apparatus, a method, an integrated circuit, a computer program, and a recording medium.

[0190] In addition, this disclosure also includes forms obtained by applying various modifications to each embodiment that a person skilled in the art would think of, or forms realized by arbitrarily combining the components and functions of each embodiment within the scope of this disclosure.

[0191] The present disclosure is applicable to a control device that controls a distributed energy system.

[0192] REFERENCE SIGNS LIST 1 Distributed energy system 10 Energy management system 20 Edge controller 30 Fuel cell system 40 Solar cell system 50 Storage battery system 60 Meter 70 Load device 80 System 101, 201 Communication unit 102 Control optimization unit 103 UI unit 104 Power status storage unit 105 Weather forecast information storage unit 106 Demand data storage unit 107 Power price storage unit 108, 205 Schedule storage unit 202 Control instruction unit 203 Packet filter unit 204 Operation status storage unit 206 Filter rule storage unit 301, 401, 501 Communication control unit 302 Hydrogen storage unit 303 Hydrogen fuel cell 304 Fuel cell status storage unit 402 Solar cell 403 Solar cell status storage unit 502 Storage battery 503 Storage battery status storage unit

Claims

1. An access control device in a distributed energy system consisting of one or more distributed power supply systems and an energy management system that controls the distributed power supply systems, the access control device comprising: a power generation status grasping unit that grasps the power generation status of each of the distributed power supply systems; and an access authorization unit that determines whether to grant or deny access to the control functions of the distributed power supply systems and to access information according to the power generation status.

2. The access control device described in claim 1, wherein the power generation status includes the power load in a load system to which the distributed energy system supplies power, the generated power of each distributed power system, and the reserve power that can be generated in addition, and the access authorization unit denies access to a control function that instructs the distributed power system to generate the reserve power in a situation where the generated power is sufficient for the power load.

3. The access control device according to claim 2, wherein the distributed energy system is further connected to a grid and is capable of exchanging power, the power generation status further includes a power pressure status of the grid, and the access authorization unit, when the power pressure status of the grid is equal to or greater than a predetermined value, permits access to a control function that instructs the distributed power supply system to generate the reserve power in a situation where the generated power is sufficient for the power load.

4. The access control device according to claim 2, wherein the distributed power system includes a distributed power system based on variable renewable energy, the power generation status further includes weather information related to the conditions for generating variable renewable energy, and the access authorization unit denies access to a control function that instructs the distributed power system to generate the reserve power in a situation where it can be determined from the weather information that sufficient output from the distributed power system based on variable renewable energy can be secured for the power load.

5. The access control device described in claim 1, wherein the power generation status includes the power load in a load system to which the distributed energy system supplies power, the generated power of each distributed power system, and the reserve power that can be generated in addition, and the access authorization unit denies access to a control function that supports the suppression of the generated power of the distributed power system in a situation where the generated power falls below a predetermined range for the power load.

6. The access control device according to claim 1, wherein the distributed energy system is further connected to a grid and is capable of exchanging power, the power generation status includes the power load of a load system to which the distributed energy system supplies power, the generated power of each distributed power source system, and the reserve power that can be generated in addition, and the access authorization unit denies access to a control function that instructs connection of the distributed energy system to the grid in a situation where the sum of the generated power and the reserve power exceeds a predetermined range for the power load.

7. The access control device according to claim 1, wherein the distributed energy system is further connected to a grid and is capable of exchanging power, the power generation status includes the power load of a load system to which the distributed energy system supplies power, the generated power of each distributed power source system, and the reserve power that can be generated in addition, and the access authorization unit denies access to a control function that instructs disconnection of the distributed energy system from the grid when the sum of the generated power and the reserve power falls below a predetermined range for the power load.

8. The access control device described in claim 1, wherein the power generation status includes the power load of a load system to which the distributed energy system supplies power, the generated power of each distributed power system, and the additional reserve power that can be generated, and the access authorization unit denies access to more than a predetermined number of control functions for the distributed power system when the fluctuation amount of any of the power load, the generated power, and the reserve power that can be generated is below a predetermined amount.

9. An access control method in a distributed energy system consisting of one or more distributed power supply systems and an energy management system that controls the distributed power supply systems, the access control method comprising: a power generation status ascertaining step for ascertaining the power generation status of each of the distributed power supply systems; and an access authorization step for determining whether to grant or deny access to the control functions and information of the distributed power supply systems according to the power generation status.

10. A program for causing a computer to execute the access control method according to claim 9.

Images