Remote operation command abnormal identification locking method, storage medium and power control system

Abstract

The present invention discloses a remote operation instruction abnormal identification and locking method, storage medium and power control system, wherein the method includes: establishing a trusted white list of operation sources, setting a timeliness threshold of the operation instruction, and calculating an operation frequency threshold; the server receives the operation instruction, obtains the operation source information, control object information, time mark and operation frequency of the target device of the operation instruction, and performs operation source, validity, timeliness and single device frequency verification on the operation instruction; obtains the control frequency of the target plant station of the operation instruction, and performs plant station frequency verification; releases the operation instructions that pass all verifications, and locks the operation instructions that fail any verification. The above-mentioned locking method verifies the remote operation instruction on the server side before control, and verifies the operation frequency of the plant station, comprehensively preventing the invasion of the power system by non-trusted abnormal instructions and the replay of external recorded control instructions, and further improves the reliability and safety of the power system.

Description

Technical Field

[0001] The invention relates to the technical field of power system operation control, a remote operation instruction abnormality identification and locking method, a storage medium and a power control system. Background Art

[0002] Modern society is increasingly dependent on the power system. The safe and stable operation of the power grid is related to the national economy and people's livelihood. The safety of remote operation of equipment involves the stable operation of the power grid. Any remote control misoperation may lead to serious consequences and pose a threat to the safe and stable operation of the power grid. From the initiation of operation control to the correct response of substation equipment, the entire process involves many links and there are potential safety hazards.

[0003] The existing remote operation verification mainly focuses on verification during the operation process, and the verification is only carried out on the validity of the instruction itself, abnormal repeated control, etc., which is still not safe and reliable enough. Summary of the invention

[0004] Purpose of the invention: The purpose of the present invention is to propose a remote operation command abnormal identification and locking method, which verifies the remote operation command before control and verifies the operation frequency of the plant station to further improve reliability and safety.

[0005] Another object of the present invention is to provide a storage medium storing instructions or computer programs of the above-mentioned abnormality identification and locking method and a power control system that can implement the above-mentioned locking method.

[0006] Technical solution: The power system disclosed in the present invention is a remote operation command abnormality identification and locking method, which specifically includes the following steps:

[0007] Establish a trusted whitelist of operation sources, set a timeliness threshold for operation instructions, and calculate an operation frequency threshold;

[0008] The server receives the operation instruction, obtains the operation source information, control object information, time mark and operation frequency of the target device of the operation instruction, and verifies the operation source, validity, timeliness and single device frequency of the operation instruction;

[0009] Obtain the control frequency of the target plant of the operation instruction and perform plant frequency verification;

[0010] Release the operating instructions that pass all the inspections, and block the operating instructions that fail any inspection.

[0011] Furthermore, the step of obtaining the control frequency of the target plant of the operation instruction and performing the plant frequency check further includes: obtaining the control operation frequency of the downlink export of the entire control system and performing the system frequency check.

[0012] Furthermore, in the step, the server receives the operation instruction, obtains the operation source information, control object information, time mark and operation frequency of the target device of the operation instruction, and performs operation source, timeliness and single device frequency verification on the operation instruction. The operation source information includes user source, operation node source, application source and operation application source.

[0013] Furthermore, in the step, the server receives the operation instruction, obtains the operation source information, control object information, time mark and operation frequency of the target device of the operation instruction, and performs operation source, timeliness and single device frequency verification on the operation instruction, and the control object information includes device information, control target value, application information and various attributes of the operation.

[0014] Furthermore, the device information includes a device telesignaling value, a telesignaling quality code, a control point number and a channel status.

[0015] Furthermore, the step of obtaining the control frequency of the target plant of the operation instruction also includes: checking whether a brake instruction is issued for the operation control instruction before performing the plant frequency check.

[0016] Furthermore, the steps establish a trusted whitelist of operation sources, set a timeliness threshold for operation instructions, set an operation frequency band calculation time range and calculate the operation frequency threshold, wherein the operation frequency threshold includes the equipment operation frequency threshold, the plant equipment operation frequency threshold and the operating system operation frequency threshold. The equipment operation frequency threshold, the plant equipment operation frequency threshold and the operating system operation frequency threshold are respectively the maximum number of operations of the equipment, plant and operating system within a unit time on the current date multiplied by their corresponding alarm weighting coefficients and locking weighting coefficients.

[0017] Furthermore, the steps establish a trusted whitelist of operation sources, set a timeliness threshold for operation instructions, set an operation frequency band calculation time range, and calculate an update cycle of the operation frequency threshold in the operation frequency threshold to once a day.

[0018] The computer-readable storage medium of the present invention stores a computer program, and the computer program is configured to implement the remote operation instruction abnormality identification and locking method according to any one of claims 1 to 8 when running.

[0019] The power control system described in the present invention, its controller includes the storage medium according to claim 9.

[0020] Beneficial effects: Compared with the prior art, the present invention has the following advantages: verification is performed before the operation instruction is controlled, further improving the safety and reliability of the system. While verifying the operation frequency of a single device, the operation frequency of the plant station and the entire operating system is also verified to prevent abnormal control caused by abnormally high number of operations per unit time in the plant station and the operating system. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 The present invention is a flowchart of a remote operation command abnormality identification and locking method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0022] The technical solution of the present invention is further described below in conjunction with the accompanying drawings.

[0023] According to an embodiment of the present invention, a remote operation command abnormality identification and locking method comprises the following steps:

[0024] Establish a trusted whitelist of operation sources, set a timeliness threshold for operation instructions, set a time range for operation frequency calculation, and calculate an operation frequency threshold;

[0025] The server receives the operation instruction, obtains the operation source information, control object information, time mark and operation frequency of the target device of the operation instruction, and verifies the operation source, validity, timeliness and single device frequency of the operation instruction;

[0026] Obtain the control frequency of the target plant of the operation instruction and perform plant frequency verification;

[0027] Release the operating instructions that pass all checks, and block the operating instructions that fail any check.

[0028] In some embodiments, the operation source information specifically includes user source, operation node source, application source, and operation application source. Correspondingly, the operation source trusted whitelist also has corresponding user source whitelist, operation node source whitelist, application source whitelist, and operation application source whitelist. During the operation source verification, any operation instruction whose operation source information is not in the corresponding whitelist is blocked to prevent it from being sent to the corresponding device through the downlink exit, so as to avoid illegal instructions operating the device and causing abnormalities in the power system.

[0029] In some embodiments, the control object information includes device information, control target value, application information and various attributes of the operation, wherein the device information also includes device telemetering value, telemetering quality code, control point number and channel status, etc. During the validity check, the control object information is compared with the information of the corresponding device in the database. When the information is consistent, the verification is passed. When the information is inconsistent, the operation instruction is locked.

[0030] Timeliness check means that when the time stamp of the operation instruction is within the timeliness threshold, the operation instruction whose time stamp exceeds the timeliness threshold is blocked through verification. Single device frequency check and plant frequency check means comparing whether the operation frequency of the target device and the operation frequency of the target plant in the current time period exceeds their respective operation frequency thresholds, blocking the operation instructions that exceed the frequency threshold, avoiding abnormal high-frequency operation of the equipment or plant in a unit time, and preventing external intrusion of recorded control instructions to replay and invade the power system, causing power system failure.

[0031] According to the remote operation command abnormal identification and blocking method of the above technical solution, the operation command issued by the client is checked and blocked at the server end. Even if the operation command can break through the client's command interaction mechanism and send the control command to the server end, it will be blocked and intercepted by the server end. At the same time, on the basis of the conventional operation source, validity, timeliness and operation frequency verification of a single device, the operation frequency of the target plant is also verified to prevent external intrusion from recording control commands to replay commands to multiple devices in the same plant to invade the power system, causing system failures, and further improve the stability and reliability of the power system.

[0032] Reference Figure 1 In some embodiments, the remote operation instruction abnormal identification and locking method further includes: obtaining the control operation frequency of the downlink export of the entire control system and performing system frequency verification. That is, before sending down the operation instruction, verify whether the number of operation instructions sent out by the downlink export of the server of the control system per unit time is abnormal, so as to timely avoid sending more operation instructions in a short time, and further improve the reliability of the system.

[0033] Reference Figure 1 In some embodiments, the remote operation command abnormal identification and locking method further includes: checking whether the operation control command is issued a brake command. When a brake command is issued, all operation commands are locked. It can be understood that in some embodiments, some emergency operation commands may not be counted in the operation frequency count of equipment, plants and control systems, and are directly released without frequency verification. Such as the load batch shedding operation during the UHV DC locking fault handling or the operation of a large number of equipment in extremely severe weather.

[0034] In some embodiments, the operation frequency threshold of the equipment, plant, station and control system is obtained by multiplying the maximum operation coefficient of the equipment, plant, station and control system within a unit time on the current date by the corresponding alarm weighting coefficient and lockout weighting coefficient. The unit can be preferably 5 minutes, and the alarm weighting coefficient and the lockout weighting coefficient are respectively set to 0.8 and 1.1 by default, and can be set and modified by personnel according to actual operating experience. The maximum operation coefficient of the equipment, plant, station and control system within a unit time can be determined by the statistical value of the remote operation historical alarm record in the recent period of time, or it can be set manually according to actual operating experience. The operation frequency threshold of the equipment, plant, station and control system is preferably updated once a day.

[0035] The computer-readable storage medium according to the embodiment of the present invention stores a computer program, which is a coded program of the above-mentioned remote operation instruction abnormality identification and locking method. The power control system according to the embodiment of the present invention, its controller contains the above-mentioned storage medium, and the controller can call the computer program in the storage medium to control the server to implement the above-mentioned remote operation instruction abnormality identification and locking method.

Claims

1. A remote operation command abnormality identification and locking method, characterized in that: The steps include: Establish a trusted whitelist of operation sources, set a timeliness threshold for operation instructions, and calculate an operation frequency threshold; The server receives the operation instruction, obtains the operation source information, control object information, time mark and operation frequency of the target device of the operation instruction, and verifies the operation source, validity, timeliness and single device frequency of the operation instruction; Obtain the control frequency of the target plant of the operation instruction and perform plant frequency verification; Release the operation instructions that pass all the checks, and block the operation instructions that fail any check; The operation sources include user sources, operation node sources, application sources and operation application source, and the operation source trusted whitelist also has corresponding user source whitelist, operation node source whitelist, application source whitelist and operation application source whitelist; During the operation source verification, any operation instruction whose operation source information is not in the corresponding white list is blocked to prevent it from being sent to the corresponding device through the downlink exit; During the validity check, the information of the controlled object is compared with the information of the corresponding device in the database. If the information is consistent, the verification is passed. If the information is inconsistent, the operation instruction is blocked. Timeliness check means that when the time stamp of the operation instruction is within the timeliness threshold, the operation instruction with the time stamp exceeding the timeliness threshold is blocked through the check; Single-device frequency verification and plant frequency verification compare whether the operation frequency of the target device and the target plant in the current time period exceeds their respective operation frequency thresholds, and locks the operation instructions that exceed the frequency threshold to avoid abnormal high-frequency operation of the equipment or plant in unit time, and prevent external intrusion from invading the power system by replaying recorded control instructions.

2. The remote operation command abnormality identification and locking method according to claim 1, characterized in that: The step obtains the control frequency of the target plant station of the operation instruction, and after performing the plant station frequency check, it also includes: obtaining the control operation frequency of the downlink export of the entire control system and performing the system frequency check.

3. The remote operation command abnormality identification and locking method according to claim 1, characterized in that: The server receives the operation instruction, obtains the operation source information, control object information, time mark and operation frequency of the target device of the operation instruction, and performs operation source, timeliness and single device frequency verification on the operation instruction. The operation source information includes user source, operation node source, application source and operation application source.

4. The remote operation command abnormality identification and locking method according to claim 1, characterized in that: The server receives the operation instruction, obtains the operation source information, control object information, time mark and operation frequency of the target device of the operation instruction, and performs operation source, timeliness and single device frequency verification on the operation instruction. The control object information includes device information, control target value, application information and various attributes of the operation.

5. The remote operation command abnormality identification and locking method according to claim 4 is characterized in that: The device information includes the device telesignal value, telesignal quality code, control point number and channel status.

6. The remote operation command abnormality identification and locking method according to claim 1, characterized in that: The method of obtaining the control frequency of the target plant station of the operation instruction also includes: checking whether a brake instruction is issued for the operation control instruction before performing the plant station frequency check.

7. The remote operation command abnormality identification and locking method according to claim 1, characterized in that: The steps establish a trusted whitelist of operation sources, set a timeliness threshold for operation instructions, set an operation frequency calculation time range, and calculate the operation frequency threshold, wherein the operation frequency threshold includes the equipment operation frequency threshold, the plant equipment operation frequency threshold, and the operating system operation frequency threshold. The equipment operation frequency threshold, the plant equipment operation frequency threshold, and the operating system operation frequency threshold are respectively the maximum number of operations of the equipment, plant, and operating system per unit time on the current date multiplied by their corresponding alarm weighting coefficients and blocking weighting coefficients.

8. The remote operation command abnormality identification and locking method according to claim 1, characterized in that: The steps establish a trusted whitelist of operation sources, set a timeliness threshold for operation instructions, set an operation frequency band calculation time range, and calculate an update cycle of the operation frequency threshold in the operation frequency threshold as once a day.

9. A computer-readable storage medium storing a computer program, characterized in that: The computer program is configured to implement the remote operation instruction abnormality identification and locking method according to any one of claims 1 to 8 when running.

10. A power control system, characterized in that: Its controller includes the storage medium according to claim 9.

Images