A network security solution method and system suitable for remote electric energy data terminal

Abstract

The application discloses a network security solution method suitable for a remote electric energy data terminal, and comprises the following steps: S1, establishing a network monitoring thread according to a network card IP address and port information; S2, a network board acquires connection information and a collection command of a second system based on the network monitoring thread, encapsulates the collection command, and transmits the encapsulated collection command to a first system; S3, the first system analyzes the encapsulated collection command to obtain the collection command, assembles reply data according to the collection command, encapsulates the reply data, and transmits the encapsulated reply data to the network board; S4, the network board analyzes the encapsulated reply data, determines the second system receiving the reply data, inserts the reply data into a data queue, and the data queue transmits the reply data to the second system. The application has the beneficial effect that network attacks on the remote electric energy data terminal by the electric power data network can be avoided under the premise of ensuring communication between the remote electric energy data terminal and the electric energy master station.

Description

Technical Field

[0001] This invention relates to the field of network communication security technology, and in particular to a network security solution and system applicable to remote power data terminals. Background Technology

[0002] Currently, with the development of the social economy, smart grids, and electricity markets, more refined requirements have been put forward for electricity metering and management. Remote electricity data terminals deployed in substations and power plants are key systems for the collection and transmission of electricity data to the main grid, and network security issues in electricity data transmission have also received special attention.

[0003] In existing technologies, to enhance the network security of remote power data terminals deployed in substations and power plants, the system employs a customized embedded Linux system, removing unnecessary system services that impact network security, updating essential services to the latest versions to reduce system vulnerabilities, and strengthening system firewall settings and increasing network protection levels. While this network security hardening provides temporary security within the power data network, the original network settings and versions must be updated promptly upon the emergence of new network security vulnerabilities, requiring significant manpower and resources. Furthermore, it presents a problem where it is impossible to prevent network attacks on remote power data terminals using the power data network while ensuring communication between the remote power data terminal and the power master station.

[0004] For example, a "power energy data acquisition and control terminal" disclosed in Chinese patent literature, with publication number CN211427480U and application date of February 18, 2020, adopts parallel processing of multiple serial table reads, which can better realize the real-time processing of large amounts of data. This ensures the stability and reliability of the system in both hardware and software aspects, and realizes large-capacity data storage and fast data exchange. However, it has the problem of not being able to prevent network attacks on the remote power energy data terminal using the power data network while ensuring communication between the remote power energy data terminal and the power energy master station. Summary of the Invention

[0005] To address the shortcomings of existing technologies that cannot prevent network attacks on remote power data terminals using power data networks while ensuring communication between the remote power data terminal and the power master station, this invention proposes a network security solution and system suitable for remote power data terminals. This solution can prevent network attacks on remote power data terminals using power data networks while ensuring communication between the remote power data terminal and the power master station.

[0006] The following is the technical solution of the present invention, a network security solution applicable to remote power data terminals, comprising the following steps:

[0007] S1: Configure the network card IP address and port information that the network board needs to monitor, and establish a network monitoring thread based on the network card IP address and port information;

[0008] S2: The network board obtains the connection information and acquisition commands of the second system based on the network listening thread, encapsulates the acquisition commands, and transmits the encapsulated acquisition commands to the first system;

[0009] S3: The first system parses the encapsulated acquisition command to obtain the acquisition command, assembles the response data according to the acquisition command, encapsulates the response data, and transmits the encapsulated response data to the network board;

[0010] S4: The network board parses the encapsulated response data, determines the second system that will receive the response data, inserts the response data into the data queue, and the data queue transmits the response data to the second system.

[0011] In this solution, the network board is configured to monitor the IP addresses and ports of the network interface cards (NICs). A network monitoring thread is established based on these IP addresses and port information. The network board uses this thread to obtain connection information and acquisition commands from the second system. The acquisition commands are encapsulated and transmitted to the first system. The first system parses the encapsulated commands, assembles and encapsulates response data, and transmits the encapsulated response data to the network board. The network board parses the encapsulated response data, identifies the second system receiving the response data, and inserts the response data into a data queue. The data queue then transmits the response data to the second system. This approach ensures communication between the remote power data terminal and the power master station while preventing network attacks on the remote power data terminal using the power data network.

[0012] Preferably, S1 includes the following steps:

[0013] S11: The network board sends a request command to the first system via the RS485 high-speed serial port;

[0014] S12: The first system obtains the network card IP address and port information from the first configuration module and transmits it to the network board;

[0015] S13: The network board executes the ifconfig command to dynamically set the corresponding network card IP address and establishes a network listening thread based on the IP address and port information.

[0016] In this solution, the network board sends a request command to the first system via an RS485 high-speed serial port, querying the first system for the IP address and port information of the network interface card (NIC) to be monitored. The first system obtains the NIC IP address and port information from the first configuration module and transmits it to the network board. The network board executes the `ifconfig` command to dynamically set the corresponding NIC IP address and establishes a network monitoring thread based on the IP address and port information. It is capable of configuring the NIC IP address and port information to be monitored.

[0017] Preferably, S2 includes the following steps:

[0018] S21: The network board determines whether the second system is connected through the network listening thread. If it is, it obtains the connection information of the second system and waits to receive the collection command from the second system. If not, it proceeds to step S21.

[0019] S22: Does the network board receive the acquisition command within T seconds after connecting to the second system? If yes, encapsulate the acquisition command into a private protocol frame and send the encapsulated acquisition command to the first system via the RS485 high-speed serial port. If no, disconnect the connection to the second system.

[0020] In this solution, the network board uses a network listening thread to determine if the second system is connected. If the second system is connected, it acquires the connection information and waits to receive acquisition commands from the second system. Otherwise, it continuously checks the connection status via the network listening thread. Once the second system is connected, if the network board does not receive an acquisition command from the second system within 10 seconds, it disconnects. If it receives the acquisition command, it encapsulates it into a private protocol frame and sends the encapsulated acquisition command to the first system via an RS485 high-speed serial port. This ensures a valid connection to the second system and the ability to obtain acquisition commands from it.

[0021] Preferably, S3 includes the following steps:

[0022] S31: The first system parses the encapsulated acquisition command to obtain the acquisition command and the private protocol frame;

[0023] S32: The first system assembles and responds with data based on the acquisition command;

[0024] S33: The first system encapsulates the response data into a private protocol frame and transmits the encapsulated response data to the network board.

[0025] In this solution, the first system parses the acquisition command encapsulated with a private protocol frame to obtain the acquisition command. Different response data is assembled according to different acquisition command types. After the response data is assembled, it is encapsulated with the same private protocol frame, and then the response data encapsulated with the private protocol frame is transmitted to the network board via an RS485 high-speed serial port. The first system can parse the acquisition command and assemble the response data, ensuring the effectiveness of the system.

[0026] Preferably, S4 includes the following steps:

[0027] S41: The network board parses and encapsulates the encapsulated private protocol frame to obtain the reply data;

[0028] S42: The network board determines the second system for receiving reply data based on the connection number;

[0029] S43: The network board inserts the response data into the data queue according to priority;

[0030] S44: The data queue transmits the response data to the second system through the network port according to priority.

[0031] In this solution, the network board parses the encapsulated private protocol frame to obtain the response data. Based on the connection number in the private protocol frame, it determines the second system receiving the response data. According to the data priority in the private protocol frame, the response data is added to a data queue. The data queue then transmits the response data to the second system through the network port according to priority. This allows for the mapping of response data to the second system, improving data accuracy and effectiveness.

[0032] Preferably, the private protocol frame includes data priority, connection number, data length, and integrity check code.

[0033] In this solution, the second system sends acquisition commands to the network board via an Ethernet port. For different second systems, the network board encapsulates the received acquisition commands with a private protocol frame. This private protocol frame includes information such as data priority, connection number, data length, and integrity checksum. This allows the network board to match response data with the second system based on the connection number and submit data according to its priority, improving data accuracy and effectiveness.

[0034] As a preferred option, in S43, the data queue is sorted and the data is replied to in order of priority from high to low. The method for determining the priority is: the smaller the data priority number, the higher the priority. When the data priority numbers are the same, the reply data that enters the data queue later has a higher priority.

[0035] The data priority is a positive number.

[0036] In this scheme, data priority is represented by positive numbers; the smaller the number, the higher the data priority. When data priorities are the same, they are sorted according to the order in which the response data encapsulated with the private protocol frame entered the queue, with later-entering data having higher priority to avoid data congestion. Response data with higher priority is inserted at the front of the data queue. This scheme allows for the definition of data priorities and the prevention of data queue congestion.

[0037] A network security solution system for remote power data terminals includes: a first system connecting a network board and a first configuration module, and a second configuration module and a second system connecting the network board.

[0038] In this solution, the network board is used for network connection and data forwarding; the first configuration module is used to configure the IP address and port information of the network card to be monitored; the second configuration module is used to configure the data priority and connection number of the second system and connects to the network board; the first system is used to assemble reply data and connects to the network board and the first configuration module; the second system is used to send acquisition commands and receive reply data and connects to the network board.

[0039] Preferably, the network board and the first system are connected to an RS485 high-speed serial port for data exchange via a proprietary protocol.

[0040] In this solution, the network board and the first system are connected via a high-speed RS485 serial port and exchange data through a proprietary protocol. This physically prevents network attacks on the first system using the power data network, ensuring the stability and security of the first system.

[0041] Preferably, the network board is connected to the second system via an Ethernet port.

[0042] In this solution, the network board connects to the second system via an Ethernet port. The second system sends acquisition commands to the network board via the Ethernet port, but only accepts data forwarded by the network board through the network port. This improves the validity and security of the data.

[0043] The beneficial effect of this invention is that it can prevent network attacks on remote power data terminals by utilizing the power data network, while ensuring communication between the remote power data terminal and the power master station. Attached Figure Description

[0044] Figure 1 This invention provides a schematic diagram of a network security solution system applicable to remote power data terminals.

[0045] Figure 2 The present invention provides a flowchart of a network security solution applicable to remote power data terminals.

[0046] In the diagram: 1. Network board; 2. First configuration module; 3. Second configuration module; 4. First system; 5. Second system. Detailed Implementation

[0047] The technical solution of the present invention will be further described in detail below through embodiments and in conjunction with the accompanying drawings.

[0048] Example: Figure 1 As shown, a network security solution system for remote power data terminals includes:

[0049] Network board 1 is used for network connection and data forwarding;

[0050] The first configuration module 2 is used to configure the IP address and port information of the network card to be monitored;

[0051] The second configuration module 3 is used to configure the data priority and connection number of the second system 5 and connects to the network board 1.

[0052] The first system 4 is used to assemble response data and connects the network board 1 and the first configuration module 2.

[0053] The second system 5 is used to send acquisition commands and receive response data, and is connected to the network board 1.

[0054] Network board 1 is used for network connection and data forwarding. Network board 1 provides a certain number of Ethernet ports for connecting to the second system 5. Network board 1 stores computer programs used for network connection and data forwarding.

[0055] The first system 4 can be a remote power data terminal used to assemble and respond to data. The network board 1 and the first system 4 are connected via an RS485 high-speed serial port and exchange data through a proprietary protocol.

[0056] The first configuration module 2 is used to configure the IP address and port information of the network card to be monitored and connect to the first system 4.

[0057] The second system 5 can be an electrical energy master station, used to send acquisition commands and receive response data. The second system 5 and the network board 1 are connected via an Ethernet port. The second system 5 sends acquisition commands to the network board 1 through the Ethernet port, and the second system 5 only accepts data forwarded through the network port.

[0058] The second configuration module 3 is used to configure the data priority and connection number of the second system 5 and connect to the network board 1. The configuration information includes data priority and connection number.

[0059] Network board 1 sends a request command to the first system 4 via RS485 high-speed serial port, querying the first system 4 for the IP address and port information of the network card to be monitored. The first system 4 obtains the IP address and port information of the network card from the first configuration module 2, and transmits the obtained IP address and port information to network board 1. Network board 1 executes the ifconfig command to dynamically set the corresponding network card IP address, and establishes a network monitoring thread based on the IP address and port information.

[0060] The second system 5 sends acquisition commands to the network board 1 via the Ethernet port. For different second systems 5, the network board 1 encapsulates the received acquisition command with a private protocol frame. The private protocol frame includes information such as data priority, connection number, data length, and integrity check code. The acquisition command encapsulated with the private protocol frame is then sent to the first system 4. The first system 4 parses the acquisition command encapsulated with the private protocol frame to obtain the acquisition command. Different response data is assembled according to different acquisition command types. After the response data is assembled, it is encapsulated with the same private protocol frame and then transmitted to the network board 1 via the RS485 high-speed serial port. The network board 1 parses the response data encapsulated with the private protocol frame to obtain the private protocol frame and response data. Based on the connection number in the private protocol frame, it determines the second system 5 receiving the response data. Based on the data priority in the private protocol frame, it adds the response data to the data queue. The data queue then transmits the response data to the second system 5 via the Ethernet port according to the priority.

[0061] Data priority is represented by a positive number; the smaller the number, the higher the data priority. When data priorities are the same, they are sorted according to the order in which the response data encapsulated with the private protocol frame entered the queue. Data that entered the queue earlier has lower priority, and data that entered the queue later has higher priority. The response data with the highest priority is then inserted at the front of the queue.

[0062] like Figure 2 As shown, a network security solution for remote power data terminals includes the following steps:

[0063] S1: Configure the network card IP address and port information that network board 1 needs to monitor, and establish a network monitoring thread based on the network card IP address and port information;

[0064] S2: Network board 1 obtains the connection information and acquisition command of the second system 5 based on the network listening thread, encapsulates the acquisition command, and transmits the encapsulated acquisition command to the first system 4;

[0065] S3: The first system 4 parses the encapsulated acquisition command to obtain the acquisition command, assembles the response data according to the acquisition command, encapsulates the response data, and transmits the encapsulated response data to the network board 1;

[0066] S4: Network board 1 parses the encapsulated response data, determines the second system 5 that receives the response data, inserts the response data into the data queue, and the data queue transmits the response data to the second system 5.

[0067] S1: Configure the network card IP address and port information that network board 1 needs to monitor, and establish a network monitoring thread based on the network card IP address and port information.

[0068] Specifically, network board 1 sends a request command to the first system 4 via an RS485 high-speed serial port, querying the first system 4 for the IP address and port information of the network card to be monitored. The first system 4 obtains the network card IP address and port information from the first configuration module 2, and transmits the obtained network card IP address and port information to network board 1. Network board 1 executes the ifconfig command to dynamically set the corresponding network card IP address, and establishes a network monitoring thread based on the IP address and port information. This includes the following steps:

[0069] S11: Network board 1 sends a request command to the first system 4 via RS485 high-speed serial port;

[0070] S12: The first system 4 obtains the network card IP address and port information from the first configuration module 2 and transmits it to the network board 1;

[0071] S13: Network board 1 executes the ifconfig command to dynamically set the corresponding network card IP address and establishes a network listening thread based on the IP address and port information.

[0072] S2: Network board 1 obtains the connection information and acquisition command of the second system 5 based on the network listening thread, encapsulates the acquisition command, and transmits the encapsulated acquisition command to the first system 4.

[0073] Specifically, network board 1 uses a network listening thread to determine if the second system 5 is connected. If the second system 5 is connected, it acquires the connection information and waits to receive the acquisition command from the second system 5. Otherwise, it continues to use the network listening thread to determine if the second system 5 is connected. After the second system 5 connects, if network board 1 does not receive the acquisition command from the second system 5 within 10 seconds, it disconnects from the second system 5. If it receives the acquisition command from the second system 5, it encapsulates the acquisition command into a private protocol frame and sends the encapsulated acquisition command to the first system 4 via an RS485 high-speed serial port. The second system 5 sends the acquisition command to network board 1 via an Ethernet port. For different second systems 5, network board 1 encapsulates the received acquisition command into another layer of private protocol frames. The private protocol frame includes information such as data priority, connection number, data length, and integrity check code. The encapsulated acquisition command is then sent to the first system 4 via an RS485 high-speed serial port. This includes the following steps:

[0074] S21: Network board 1 determines whether the second system 5 is connected through the network listening thread. If it is connected, it obtains the connection information of the second system 5 and waits to receive the collection command from the second system 5. If it is not connected, it proceeds to step S21.

[0075] S22: Does network board 1 receive a data acquisition command within T seconds after connecting to the second system 5? If yes, encapsulate the data acquisition command into a private protocol frame and send the encapsulated data acquisition command to the first system 4 via the RS485 high-speed serial port. If no, disconnect the connection to the second system 5.

[0076] S3: The first system 4 parses the encapsulated acquisition command to obtain the acquisition command, assembles the response data according to the acquisition command, encapsulates the response data, and transmits the encapsulated response data to the network board 1.

[0077] Specifically, the first system 4 parses the acquisition command encapsulated with a private protocol frame to obtain the acquisition command. Different response data is assembled according to different acquisition command types. After the response data is assembled, the same private protocol frame is encapsulated in the response data, and then the response data encapsulated with the private protocol frame is transmitted to the network board 1 via an RS485 high-speed serial port. This includes the following steps:

[0078] S31: The first system 4 parses the encapsulated acquisition command to obtain the acquisition command and the private protocol frame;

[0079] S32: The first system 4 assembles and responds to the data according to the acquisition command;

[0080] S33: The first system 4 encapsulates the reply data into private protocol frames and transmits the encapsulated reply data to network board 1.

[0081] S4: Network board 1 parses the encapsulated response data, determines the second system 5 that receives the response data, inserts the response data into the data queue, and the data queue transmits the response data to the second system 5.

[0082] Specifically, network board 1 parses the encapsulated private protocol frame to obtain reply data. Based on the connection number in the private protocol frame, it determines the second system receiving the reply data. According to the data priority in the private protocol frame, it adds the reply data to a data queue. The data queue then transmits the reply data to the second system through the network port according to priority. This allows for the mapping of reply data to the second system, improving data accuracy and validity. The process includes the following steps:

[0083] S41: Network board 1 parses and encapsulates the encapsulated private protocol frame to obtain reply data;

[0084] S42: Network board 1 determines the second system 5 for receiving reply data based on the connection number;

[0085] S43: Network board 1 inserts the response data into the data queue according to priority;

[0086] S44: The data queue transmits the response data to the second system 5 through the network port according to priority.

[0087] The method for determining the priority of several second system 5 data points is as follows: Data priority is represented by a positive number, with smaller numbers indicating higher priority. When data priorities are the same, they are sorted according to the order in which the response data encapsulated with the private protocol frame entered the queue. Data entering the queue earlier has lower priority, and data entering later has higher priority. The response data with higher priority is then inserted at the front of the data queue.

[0088] A computer-readable storage medium storing a computer program that, when executed by a processor, implements steps for a network security solution applicable to a remote power data terminal.

[0089] Network board 1 provides a certain number of Ethernet ports. Network board 1 and the first system 4 are connected via a high-speed RS485 serial port, exchanging data through a proprietary protocol. Network board 1 only runs network connection and data forwarding applications. Data communication between the second system 5 and the first system 4 is completed through the application on network board 1. The first system 4 connects to the second system 5 via the Ethernet ports of network board 1, but the second system 5 only accepts data transmitted by network board 1 via the Ethernet ports. This approach ensures communication between the first system 4 and the second system 5 while preventing network attacks on the first system 4 using the power data network.

Claims

1. A network security solution applicable to remote power data terminals, characterized in that, Includes the following steps: S1: Configure the network card IP address and port information that the network board needs to monitor, and establish a network monitoring thread based on the network card IP address and port information; S1 includes the following steps: S11: The network board sends a request command to the first system via the RS485 high-speed serial port; S12: The first system obtains the network card IP address and port information from the first configuration module and transmits it to the network board; S13: The network board executes the ifconfig command to dynamically set the corresponding network card IP address and establishes a network listening thread based on the IP address and port information; S2: The network board obtains the connection information and acquisition command of the second system based on the network listening thread, encapsulates the acquisition command, and transmits the encapsulated acquisition command to the first system, which is a remote power data terminal. S3: The first system parses the encapsulated acquisition command to obtain the acquisition command, assembles the response data according to the acquisition command, encapsulates the response data, and transmits the encapsulated response data to the network board; S4: The network board parses the encapsulated response data, determines the second system that will receive the response data, inserts the response data into the data queue, and the data queue transmits the response data to the second system.

2. The network security solution for a remote power data terminal according to claim 1, characterized in that, S2 includes the following steps: S21: The network board determines whether the second system is connected through the network listening thread. If it is, it obtains the connection information of the second system and waits to receive the collection command from the second system. If not, it proceeds to step S21. S22: Determine whether the network board receives the acquisition command within T seconds after connecting to the second system. If yes, encapsulate the acquisition command into a private protocol frame and send the encapsulated acquisition command to the first system via the RS485 high-speed serial port. If no, disconnect the connection to the second system.

3. The network security solution for a remote power data terminal according to claim 1, characterized in that, S3 includes the following steps: S31: The first system parses the encapsulated acquisition command to obtain the acquisition command and the private protocol frame; S32: The first system assembles and responds with data based on the acquisition command; S33: The first system encapsulates the response data into a private protocol frame and transmits the encapsulated response data to the network board.

4. A network security solution for remote power data terminals according to claim 1, characterized in that, S4 includes the following steps: S41: The network board parses and encapsulates the encapsulated private protocol frame to obtain the reply data; S42: The network board determines the second system for receiving reply data based on the connection number; S43: The network board inserts the response data into the data queue according to priority; S44: The data queue transmits the response data to the second system through the network port according to priority.

5. A network security solution for remote power data terminals according to claim 2 or 4, characterized in that, The private protocol frame includes data priority, connection number, data length, and integrity check code.

6. A network security solution for remote power data terminals according to claim 4, characterized in that, In S43, the data queue responds to data in order of priority from high to low. The method for determining the priority is: the smaller the data priority number, the higher the priority. When the data priority numbers are the same, the response data that enters the data queue later has a higher priority. The data priority is a positive number.

7. A network security solution system for remote power data terminals, applicable to the network security solution for remote power data terminals as described in any one of claims 1-6, characterized in that, include: A first system connecting the network board and the first configuration module, and a second system connecting the network board and the second configuration module.

8. A network security solution system for remote power data terminals according to claim 7, characterized in that, The network board and the first system are connected to an RS485 high-speed serial port and exchange data via a proprietary protocol.

9. A network security solution system for remote power data terminals according to claim 7 or 8, characterized in that, The network board is connected to the second system via an Ethernet port, and the second system only accepts data transmitted by the network board via the Ethernet port.

Images