A secure access method and system for distributed energy resources in virtual power plants

Abstract

A secure access method and system for distributed energy resources in a virtual power plant is disclosed. The method includes: obtaining encrypted status information from each sensor at the distributed energy source; performing vertical encryption authentication processing on the status information; performing security detection on the vertically encrypted and authenticated data based on LSTM; and transmitting the data that passes the security detection to the production control area and the information management area via unidirectional data transmission for coordinated control of the virtual power plant. This solves the network security risks introduced when aggregating distributed energy resources in a virtual power plant.

Description

Technical Field

[0001] This invention belongs to the field of secure access technology for distributed energy in virtual power plants, and relates to a secure access method and system for distributed energy in virtual power plants. Background Technology

[0002] Virtual power plants utilize advanced information and communication technologies and software systems to achieve coordinated control and economic management of distributed energy sources (DERs) such as distributed generators (DG), energy storage systems, controllable loads, and electric vehicles.

[0003] While secure access technologies for grid-connected terminals are relatively mature, secure access solutions for distributed energy resources in virtual power plants (VPGs) have not yet been addressed. In the VPG network architecture where distributed energy resources are connected to the grid, the wide distribution and large number of resources mean that malicious access by distributed energy resources can lead to faster and wider spread of network attacks. Therefore, proposing a secure and reliable secure access solution for distributed energy resources in VPGs is of great significance. When designing a secure access solution, on the one hand, existing identity authentication based on traditional public key infrastructures (PKIs) relies on third-party authentication authorities, and each authentication object needs to create a separate authentication certificate. If a PKI manages too many resources, it can lead to excessive resource consumption and affect the performance of the PKI. Therefore, a new identity authentication scheme is needed to solve this problem. On the other hand, the aggregation of a large number of distributed resources in virtual power plants brings network security risks, necessitating the development of an attack detection method that can effectively detect different types of network attacks. Summary of the Invention

[0004] To address the shortcomings of existing technologies, this invention provides a secure access method and system for distributed energy resources in virtual power plants.

[0005] The present invention adopts the following technical solution.

[0006] A secure access method for distributed energy resources in virtual power plants, the method comprising the following steps:

[0007] Obtain the status information of each sensor at the encrypted distributed energy source;

[0008] The status information is subjected to vertical encryption authentication processing;

[0009] Security checks are performed on data after vertical encryption authentication based on LSTM.

[0010] The data from the safety inspection is transmitted to the production control area and the information management area via one-way data transmission for coordinated control of the virtual power plant.

[0011] Preferably, each sensor at the distributed energy terminal automatically dials into the operator's power wireless network via a dedicated SIM card;

[0012] Obtain the status information of each sensor at the encrypted distributed energy source, including:

[0013] Obtain the status information of each sensor at the distributed energy source;

[0014] The status information is encrypted using the SM9 algorithm, and the encrypted data is transmitted to the virtual power plant control and coordination center via the power wireless network.

[0015] Preferably, the encryption includes digital signature generation, key encapsulation, and key exchange;

[0016] The digital signature generation process includes:

[0017] Step 1.1: Generate random numbers r∈[1,N-1], and compute the group G. T The element w = g r Convert the data type of w to a bit string; the message to be signed is the bit string M, the digital signature of message M is (h, S), and the range of the bilinear pair e is the Nth-order multiplicative cyclic group G. T G T The element g = e(P1, P) pub );

[0018] P1 is the generated data of the Nth-order cyclic subgroup G1, P pub The master public key; and e is G1×G2 to G T The mapping of the Nth order cyclic subgroup G2 generates data P2;

[0019] Step 1.2: Calculate integer h = H2(M||w,N) and L = (rh)modN. If L = 0, it indicates a data error, and return to step 1.1; otherwise, proceed to step 1.3. Here, H2() is the password encryption function.

[0020] Step 1.3: Calculate the element S = [L]d in group G1 A Convert the data types of h and S to byte strings, and the message signature is (h, S), thus completing the digital signature generation. A The private key generated for the distributed power source.

[0021] Preferably, the key encapsulation process includes:

[0022] Calculate the data Q in G1 B =H1P1(ID) B ||hid,N)+P pubAnd randomly generate corresponding numbers r∈[1,N-1]; where H1 is the first hash function derived from the cryptographic hash function, ID B For identification purposes;

[0023] Calculate G1 data C = [r]Q B This converts C data types into bit strings.

[0024] Computational group G T The element g = e(P) pub ,P2) and ω=g r , converts the data type of ω to a bit string; where e() is an elliptic bilinear pair;

[0025] Calculate K = KDF(C||w||ID) B KDF() is a key derivation function. If K is a string of all zeros, it returns the first step of the key encapsulation process; if it is not all zeros, it outputs the encapsulation key K and completes the key encapsulation. KDF() is the key derivation function and klen is the bit length of the key to be encapsulated.

[0026] Preferably, the key exchange process includes:

[0027] Calculate element Q in G1 B =[H1(ID) B ||hid,N)]P1+P pub And generate random numbers r∈[1,N-1];

[0028] Elements R in computational group G1 A =[r]Q B , will R A It is sent to the control and coordination center as an exchange key.

[0029] Preferably, the vertical encryption authentication process includes digital signature verification, key decapsulation, and data decryption;

[0030] The digital signature verification process includes:

[0031] Step 2.1: Convert the data type of h′ in the data signature from binary to decimal form, and check whether h′∈[1,N-1]. If it is not true, the program ends, indicating that the verification has failed. If it is true, proceed to step 2.2.

[0032] Step 2.2: Transform the binary number S′ in the data signature into a point on the ellipse, and check whether S′∈G1 is true. If it is not true, the program ends, which means that the verification has failed. If it is true, proceed to step 2.3.

[0033] Step 2.3: Calculate G T The element g = e(P1, P)pub ) and element t = g h′ ;

[0034] Step 2.4: Calculate the integer h1 = H1(ID) in group G1. A The element P = [h1]P2 + P in ||hid,N) and G2 is denoted as ||hid,N) and G2. pub Among them, ID A () represents the identifier of the distributed power source, and G2 is the cyclic subgroup of the control and coordination center;

[0035] Step 2.5: Calculate group G T The elements u = e(S′, P) and ω′ = u·t are used to convert the data type of ω′ into a bit string;

[0036] Step 2.6: Execute the calculation of h2 = H2(M′||w′,N) and check whether the equation h2 = h′ is true. If it is true, the verification is successful; otherwise, the verification is unsuccessful. Here, M′ is the updated bit string.

[0037] Preferably, the key decapsulation process includes:

[0038] Verify whether the encapsulated ciphertext C∈G1 is true. If it is not true, report an error and exit the program.

[0039] Computational group G T The element ω′=e(C,d) B ), convert the data type of ω′ to a bit string; where C is the distributed power source sending to encapsulate ciphertext, d B A private key generated for the control center;

[0040] Convert C from a binary number to a bit string, and encapsulate the key K′ = KDF(C||ω′||ID). B The program performs the operation (klen). If the key K′ is a zero-bit string, it means there is no information, so the program exits and reports an error. If the key K′ is not all zeros, K′ is output, and the key desealing is completed.

[0041] Preferably, the data decryption process includes:

[0042] Calculate element Q in G1 A =[H1(ID) A ||hid,N)]P1+P pub And generate random numbers r∈[1,N-1];

[0043] Elements R in computational group G1 B =[r B Q A Verify R A If ∈G1 holds true, the negotiation fails; otherwise, the group G is computed.T The element g1 = e(R) A ,d B ) and g2=e(P2,P pub ), Convert the data types g1, g2, 3g to bit strings; where r B These are random numbers generated at the control center.

[0044] R A and R B Convert the data type to a bit string;

[0045] Calculate S B =Hash(0x82||ID) A ||ID B ||R A ||R B The key authentication process is performed by calling the function `||g1||g2)` and verifying whether the equation holds true. If the equation does not hold true, the key authentication fails; otherwise, it succeeds. The `Hash()` algorithm is a hash algorithm, and R... A ||R B For elements in the group.

[0046] Preferably, the security detection process includes:

[0047] The system acquires normal data transmitted when it is not under attack and attacked data transmitted when it is under attack. After supplementing the data through linear calculation, feature extraction and filtering are performed.

[0048] The selected feature values ​​are compared with the feature values ​​predicted by the LSTM network. If the error exceeds the threshold, the judgment that the current attack has occurred is output when the selected feature value is negative and three consecutive feature values ​​are negative. Otherwise, the number of consecutive negative feature values ​​is incremented by one and the judgment that the current attack has not occurred is output.

[0049] If the error does not exceed the threshold, the judgment that the current system has not been attacked will be output when the selected feature value is positive and the number of consecutive negative feature values ​​is cleared to zero.

[0050] A secure access system for distributed energy resources in virtual power plants includes:

[0051] The control and coordination center secure access area is used to obtain the status information of each sensor in the encrypted distributed energy terminal; the status information is subjected to vertical encryption authentication processing; the data after vertical encryption authentication processing is subjected to security detection based on LSTM; the data that passes the security detection is transmitted to the production control area and the information management area through unidirectional data transmission for the coordinated control of the virtual power plant.

[0052] Preferably, the secure access area of ​​the control and coordination center is divided into a production control module and an information management module based on CCC. Both the production control module and the information management module are equipped with an intrusion prevention unit and a border gateway. A vertical encryption authentication device is provided between the intrusion prevention unit in each module and the virtual power plant CCC access router, and a forward and reverse isolation device is provided between the border gateways in each module. The virtual power plant CCC access router is used to obtain the status information of each sensor in the encrypted distributed energy terminal. The vertical encryption authentication device is used to perform vertical encryption authentication processing on the status information. The intrusion prevention unit is used to perform security detection on the data after vertical encryption authentication processing based on LSTM. The data that passes the security detection is transmitted to the production control area and the information management area through the data transmission border gateway and the forward and reverse isolation device for the coordinated control of the virtual power plant.

[0053] Preferably, the system further includes:

[0054] The distributed energy terminal secure access area contains a secure encryption chip in each distributed energy sensor.

[0055] Preferably, the system further includes:

[0056] The communication network enables data transmission between the secure access area of ​​the control and coordination center and the secure access area of ​​the distributed energy source.

[0057] The beneficial effects of this invention are compared with those of the prior art:

[0058] (1) This invention combines the existing secure access system architecture with a virtual power plant to provide a secure access solution for a large number of distributed energy sources in a virtual power plant. The platform is based on the operator’s dedicated wireless network and performs both horizontal isolation and vertical authentication, which solves the network security risk problem introduced when aggregating distributed energy sources in a virtual power plant.

[0059] (2) This invention considers enhancements to identity authentication, employing an identity authentication method based on the national cryptographic standard SM9. The algorithm uses a unique identifier as the public key for data encryption, decryption, and authentication; it also uses bilinear pairing of elliptic curves for computation. Specifically, in step 1, the encryption process of distributed energy data transmission requires sending a digital signature; then, the key is sent, and the key exchange is also encrypted. This encryption process ensures that information is not stolen during transmission and also ensures the correctness of the identity. Step 2 enables the information recipient to decrypt according to the sender's encryption algorithm. Because bilinear pairing of elliptic curves has a unique mapping and the algorithm is complex, it is difficult for malicious attackers who do not obtain the decryption method in advance to crack the encryption process. This also ensures the security of information transmission and the correctness of identity authentication, making it a superior authentication algorithm compared to traditional public key infrastructure methods.

[0060] (3) This invention considers the detection and alarm of virtual power plants under network attacks. It uses an algorithm based on a Long Short-Term Memory (LSTM) neural network. By collecting historical information on the normal operation of distributed energy and real-time information on network attacks, it iterates to obtain learning results. Comparing the output with a threshold can accurately and effectively detect network attacks. Compared with traditional network attack detection algorithms, the neural network algorithm is more accurate. Furthermore, the LSTM algorithm iterates faster than the RNN algorithm. Attached Figure Description

[0061] Figure 1 This is an overall architecture diagram of the secure access system for distributed energy resources in virtual power plants according to the present invention;

[0062] Figure 2 This is a flowchart of the distributed power supply authentication process based on the SM9 algorithm in the method of this invention;

[0063] Figure 3 This is a flowchart of the identity authentication process at the control and coordination center based on the SM9 algorithm in the method of this invention;

[0064] Figure 4 This is a flowchart of the virtual power plant attack detection and alarm process based on the LSTM algorithm in the method of this invention. Detailed Implementation

[0065] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of this invention. The embodiments described in this application are merely some embodiments of this invention, and not all embodiments. Based on the spirit of this invention, other embodiments obtained by those skilled in the art without creative effort are all within the protection scope of this invention.

[0066] Embodiment 1 of the present invention provides a secure access method for distributed energy resources in virtual power plants, based on, for example, Figure 1 The illustrated secure access system for distributed energy resources in a virtual power plant is based on a centralized control coordination center (CCC) structure. This secure access system for distributed energy resources in a virtual power plant includes:

[0067] The control and coordination center's secure access area is divided into two parts based on CCC: a production control module and an information management module. The production control module contains a large number of sensor devices placed at the main nodes of the power system, responsible for collecting key information about the power system, including voltage, frequency, and power. The information management module is responsible for managing information that affects the virtual power plant's power generation, such as wind speed, air humidity, and light intensity.

[0068] The communication network and virtual power plant are widely distributed across different energy sources. Therefore, the transmission channel from the distributed energy source to the control and coordination center is selected from the operator's wireless APN private network channel (4G). The wireless network link is provided and maintained by the operator, while the power information and communication formula is responsible for leasing it.

[0069] The distributed energy access zone is a large area where distributed energy sources in a virtual power plant include DG, energy storage devices, and controllable loads. Therefore, no security zone is set up in this area.

[0070] Each distributed energy source is equipped with a security chip for accessing the power wireless network. This chip facilitates information exchange with the virtual power plant control center, while the SM9 algorithm is used for data encryption.

[0071] In a preferred but non-limiting embodiment of the present invention, the secure access method includes the following steps:

[0072] Step 1: Each sensor at the distributed energy terminal collects its own status information, encrypts the data, and then transmits it to the virtual power plant control and coordination center.

[0073] The status information includes data such as voltage, frequency, output power, and state of charge;

[0074] Each sensor at the distributed energy end automatically dials into the operator's power wireless network via a dedicated SIM card. At the same time, the SM9 algorithm is used for data encryption, including generating digital signatures, key encapsulation, and key exchange. The encrypted data is then transmitted to the virtual power plant control and coordination center via the power wireless network.

[0075] Figure 2 This is a flowchart of the distributed power supply authentication process based on the SM9 algorithm provided in this embodiment of the invention. Elliptic curves with bilinear pairing characteristics are suitable for encryption and decryption; therefore, the national standard SM9 cryptographic algorithm proposed in this invention involves operations on finite fields and bilinear pairings. The specific algorithm is as follows:

[0076] The digital signature generation algorithm includes the following steps, and any distributed source A acting as the signer should strictly follow these steps:

[0077] Step 1.1: Generate a random number r∈[1,N-1], and compute the group G.T The element w = g r This step increases the randomness of the data, making it more difficult to crack. Then, the data type of w is converted to a bit string;

[0078] The message to be signed is a bit string M, and the digital signature of message M is (h, S). A digital signature is a method of applying the everyday "signature" to information, which can confirm the sender of the information; the range of the bilinear pair e is the Nth-order multiplicative cyclic group G. T G T The element g = e(P1, P) pub );

[0079] P1 is the generated data of the Nth-order cyclic subgroup G1, P pub The master public key; and e is G1×G2 to G T The mapping is such that the generated data of the Nth-order cyclic subgroup G2 is P2; G T It is an intermediate dataset; the bit string is information encoded according to ANSI and converted into binary, thus storing the data in memory. It can be seen that the algorithm calculates whether the G1×G2 collected by the receiving end matches G... T The data is compared to the others to verify its correctness. Then, encryption functions and algorithms are used to make this process extremely difficult to crack, ensuring the security of data transmission.

[0080] Step 1.2: In this step, the obtained w is encrypted, and the integers h = H2(M||w,N) and L = (rh)mod N are calculated. If L = 0, the data is incorrect, and the process returns to step 1.1; otherwise, the process proceeds to step 1.3.

[0081] H2() is a cryptographic encryption function that can encrypt data.

[0082] Step 1.3: Calculate the element S = [L]d in group G1 A Convert the data types of h and S to byte strings, and the message signature is (h, S), thus completing the digital signature generation. It can be seen that digital signature generation involves the occurrence of a set of G1 and G... T The specific reasons for the data have been explained in step 1.1.

[0083] Where, d A The private key generated for the distributed power source;

[0084] In the identity authentication of the virtual power plant, the traditional key encapsulation and decapsulation method based on public key infrastructure is modified to a key encapsulation and decapsulation method based on the SM9 elliptic analytic geometry algorithm. First, the distributed energy source needs to send and encrypt the collected information to the control and coordination center, thereby generating a key known only to the other party. After receiving the information, the control and coordination center uses a pre-designed algorithm to decrypt the key into readable information, thus facilitating information exchange. As the information encryptor, the encryption system of distributed energy source A must strictly operate according to the following procedure:

[0085] Step 1.4: Quickly calculate the data Q in G1 B =H1P1(ID) B ||hid,N)+P pub And randomly generate the corresponding number r∈[1,N-1];

[0086] Where H1 is the first hash function derived from the cryptographic hash function, hid is the identifier of the distributed power private key, and ID is... B For identification purposes;

[0087] It can be seen that the method for calculating G1 data in step 1.4 is different from, but similar to, steps 1.1 to 1.3. The main reason lies in the different levels of encryption used for the digital signature and the key. The key requires a more difficult-to-break hash function for encryption.

[0088] Step 1.5: Calculate the G1 data C = [r]Q B This converts C data types into bit strings.

[0089] Step 1.6: Calculate group G T The element g = e(P) pub ,P2) and ω=g r , convert the data type of ω to a bit string;

[0090] Where e() is an elliptic bilinear pair, and P2 is the group G T The generator, P pub The master public key for the distributed power supply and control coordination center;

[0091] Step 1.7: Calculate K = KDF(C||w||ID) B If K is a string of all zeros (klen), return to step 1.4; otherwise, the program will send (K, C), i.e., output the encapsulation key K, completing the key encapsulation; at this point, a set of G1 and G... has also been sent. T The data is different, only the encryption algorithm is different.

[0092] Where KDF() is the key derivation function, and klen is the bit length of the key to be encapsulated.

[0093] In addition to encapsulating the key, the key exchange protocol also needs to be configured to ensure that the key exchange process is also strictly protected. The distributed power supply and control center can use the private key and the information sharing algorithm used in this invention to perform a three-way handshake to obtain a key specific to the distributed power supply and control center.

[0094] Step 1.8: Calculate element Q in G1 B =[H1(ID) B ||hid,N)]P1+P pub And generate random numbers r∈[1,N-1];

[0095] Step 1.9: Calculate the element R in group G1 A =[r]Q B , will R A It is sent to the control and coordination center as an exchange key.

[0096] A set of G1 and G2 was sent during both the digital signature and key exchange processes. T The data differs only in the encryption algorithm. The recipient decrypts the received data and compares it to form a unique mapping G2, ensuring data security.

[0097] Step 2: After receiving the data, the virtual power plant control and coordination center first performs vertical encryption authentication processing, i.e., identity authentication, including digital signature verification, key decapsulation and data decryption.

[0098] Figure 3 This is a flowchart of the identity authentication process of the control and coordination center based on the SM9 national cryptographic algorithm provided in an embodiment of the present invention.

[0099] The control and coordination center verification system, acting as the verifier, should strictly follow the following procedures to verify digital signatures, which include the following sequence:

[0100] Step 2.1: Change the data type. Change the data type of h′ in the data signature from binary to decimal. Check if h′∈[1,N-1]. If not, the program ends, indicating that the verification has failed. If it is true, proceed to step 2.2. This step only verifies whether the data is in the range of the bilinear pair e. As long as the encryption process in step 1 is strictly followed, any data will be within this range.

[0101] Step 2.2: Change the data format, transforming S′ in the data signature from a binary number to a point on an ellipse, and check if S′∈G1 holds true. If not, the program ends, indicating that this verification has failed; if true, proceed to step 2.3. Similarly, this step verifies whether the other signature data sent by the sender is within the value range. If both of the above steps are successful, it indicates that the received data is initially correct.

[0102] Step 2.3: Calculate G T The element g = e(P1, P) pub ) and element t = g h′ This step involves decrypting and detecting the sent data.

[0103] Step 2.4: Calculate an integer h1 = H1(ID) in group G1. A The element P = [h1]P2 + P in ||hid,N) and G2 is denoted as ||hid,N) and G2. pub At this point, we obtain the elements in G2;

[0104] Among them, ID A () represents the identifier of the distributed power source, hid represents the identification symbol of the distributed power source's private key, and G2 represents the cyclic subgroup of the control and coordination center.

[0105] Step 2.5: Calculate group G T The elements u = e(S′, P) and ω′ = u·t are used to convert the data type of ω′ into a bit string;

[0106] Step 2.6: The program calculates h2 = H2(M′||w′,N) and checks whether the equation h2 = h′ is true. If it is true, the program completes, indicating that the verification passed; otherwise, the verification failed. That is, it verifies whether G1 × G2 equals G... T They are equal. If the equation holds true, then the data is proven to be available.

[0107] Where M′ is the updated bit string.

[0108] The control and coordination center will simultaneously receive a ciphertext C from a distributed energy source and needs to perform the following operations to decrypt the ciphertext:

[0109] Step 2.7: Verify whether the encapsulated ciphertext C∈G1 is valid. If it is not valid, the entire program will immediately report an error and exit the program. Any data sent by the distributed energy source must be in G1; otherwise, the data must be erroneous.

[0110] Step 2.8: Calculate group G T The element ω′=e(C,d) B ), convert the data type of ω′ to a bit string;

[0111] Where C represents the distributed power source sending the encapsulated ciphertext, and d... B A private key generated for the control center;

[0112] Step 2.9: Change the data format, converting C from a binary number into a complete bit string, and apply this to the encapsulation key K′=KDF(C||ω′||ID). B The program performs the operation (klen). If the key K′ is a zero-bit string, it means there is no information. In this case, the program execution will fail, and the program needs to exit immediately and report the error. If the key K′ is not all zeros, the K′ bit string is output and sent to the control and coordination center to complete the key desealing.

[0113] The control and coordination center received R from a distributed energy source A. A The key exchange is performed according to the following steps:

[0114] Step 2.10: Calculate element Q in G1 A =[H1(ID) A ||hid,N)]P1+P pub And generate random numbers r∈[1,N-1];

[0115] Step 2.11: Calculate the element R in group G1 B =[r B Q A Verify R A If ∈G1 holds true, the negotiation fails; otherwise, the group G is computed. T The element g1 = e(R) A ,d B ) and g2=e(P2,P pub ), Convert the data types of g1, g2, and g3 into bit strings; the principle is the same as described above.

[0116] Where, r B The random numbers generated at the control center are calculated in the same way as the random numbers generated by the distributed power source.

[0117] Step 2.12: Put R A and R B Convert the data type to a bit string;

[0118] Step 2.13: Calculate S B =Hash(0x82||ID) A ||ID B ||R A ||R B The key authentication process is performed by checking if the equation is true (||g1||g2). If the equation is false, the key authentication fails; otherwise, it succeeds.

[0119] Among them, Hash() is a hash algorithm that maps binary value strings of arbitrary length to fixed-length binary value strings to maintain data consistency; ID is the identity label for the distributed power source and control center; R A ||R B For elements in the group.

[0120] Step 3: The intrusion prevention unit performs directional detection and data behavior analysis on the data accessed by the distributed energy terminal via the public wireless network, with the aim of blocking malicious attacks from the external network; when a malicious attack is detected, an alarm is promptly sent to the control center;

[0121] To ensure the security of the virtual power plant (CPS) system, an intrusion prevention unit must be set up. All data sent to the control center must first pass through this intrusion prevention unit, undergoing security detection using a pre-designed reliable algorithm. When malicious attacks are detected, an alarm is promptly sent to the control center. For this system, the security monitoring algorithm is crucial. The security detection process involves acquiring normal data transmitted by the system when it is not under attack and attacked data transmitted by the system when it is under attack. After data supplementation through linear calculation, feature extraction and filtering are performed.

[0122] The selected feature values ​​are compared with the feature values ​​predicted by the LSTM network. If the error exceeds the threshold, the judgment that the current attack has occurred is output when the selected feature value is negative and three consecutive feature values ​​are negative. Otherwise, the number of consecutive negative feature values ​​is incremented by one and the judgment that the current attack has not occurred is output.

[0123] If the error does not exceed the threshold, the judgment that the current system has not been attacked will be output when the selected feature value is positive and the number of consecutive negative feature values ​​is cleared to zero.

[0124] By using nonlinear learning of deep neural networks to detect cyberattacks on virtual power plants, uncovering deep-seated patterns of malicious attack behavior, and issuing alerts when attacked, the impact of cyberattacks on virtual power plants can be minimized.

[0125] Figure 4 This is a flowchart of the virtual power plant attack detection and alarm process provided in this embodiment of the invention. Based on the Long Short-Term Memory Recurrent Neural Network in deep neural networks, the virtual power plant attack detection and alarm process includes:

[0126] Step 3.1: Attack Data Collection and Attack Sample Data Selection: On the power generation side, distributed energy sources use sensors to collect a large amount of data and transmit it to the control and coordination center. This data is called packets at the network layer. When not under attack, the system transmits normal data, which can serve as sample data for neural network algorithms. However, attackers can inject attack signals into the sensors and communications of the distributed power source, disrupting normal data and affecting the normal operation of the virtual power plant. This data is the attack signal, which can be used as attack samples for the neural network system to learn from. Therefore, the algorithm requires a large number of attacked packets, making data selection crucial.

[0127] The collected attack data can be categorized into four types of attacks: DoS (Denial of Service), FDIA (Fake Data Injection), Marirthe-Middle (MITM) attack, and replay attack.

[0128] For each packet sample, the most important data includes duration (connection duration), protocol_type (protocol type), service (target host service type), flag (connection state indicator), and src_bytes (packet size transferred from source host to target host in bytes).

[0129] Step 3.2: After collecting the data sent by the distributed power source, the neural network system classifies and selects representative data. Simultaneously, it uses algorithms to supplement key but missing data. This supplemented data closely resembles other real data and is added to the sample database as a feature variable. This invention supplements data using only linear calculation, as shown in the following formula:

[0130]

[0131] In the formula, y0 and x0 together represent the position of the matrix containing the previous data at the position where the supplementary data is inserted, and y1 and x1 together represent the position of the matrix containing the next data at the position where the supplementary data is inserted. The position where the supplementary data is to be inserted can be located by using these two data.

[0132] Step 3.3: Feature Extraction: By acquiring normal data and the attacked database, a large number of data feature values ​​are obtained. Therefore, the feature values ​​need to be compressed to ensure the fastest program running speed. This is feature extraction.

[0133] First, we build an initial feature database with probability density functions as eigenvalues. The eigenvalues ​​are defined as follows:

[0134]

[0135] From equation (2), we can see that the eigenvalue f j It is a piecewise function whose value represents the relationship between the real-time active power consumption collected by the distributed power sensor and all power consumption information.

[0136] This invention uses t j The definition is as follows:

[0137]

[0138] Step 3.4: Feature Selection: As the dimensionality of sample features increases, the model faces a higher risk of overfitting, necessitating feature selection. A greedy search algorithm, based on sparse coding, treats feature selection as an optimization problem, finding a set of features that minimizes the model's validation error.

[0139] The feature values ​​are filtered, and the filtering process is shown in the following formula:

[0140]

[0141] To obtain the optimal w, the feature vector obtained through the previous steps can be put into the above equation (4). This coefficient vector containing multiple dimensions is the key to the information storage and "forgetting" of neural network neurons. If the value of a certain bit is one, it means that the information needs to be stored, and then the information is the key feature vector; if the value of a certain bit is zero, it means that the coefficient needs to be "forgotten" and is a non-key feature value; through long-term repeated information storage and "forgetting", the optimal feature vector is obtained.

[0142] Finally, calculations can significantly reduce the number of features;

[0143] Step 3.5: Monitoring Sample Sequence Selection: Side-channel positive sample information is used to perform security monitoring of the distributed power source in the virtual power plant. The temporal characteristics of the side-channel information are captured, and the value of the information collected by the distributed power source at a certain time t is predicted and compared with the actual value to complete the attack monitoring.

[0144] The distributed power source collects its own timing power consumption information at a rate of 250 ksa / s and sends it to the control and coordination center. By selecting information, the sample sequence input to the LSTM model is obtained, as shown in the following formula:

[0145] X={x (1) ,x (2) ,...,x (n)} (5)

[0146] Where x (n) The power consumption of the distributed power source is obtained through information filtering.

[0147] The time series information for the current time period is represented as x. (n) It is an m-dimensional vector.

[0148] Step 3.6: LSTM Neural Network Learning Process: The neural network algorithm is implemented by opening and closing a door. The output of the door is a real number between 0 and 1, where 0 indicates the door is closed and information is not allowed to pass through, and 1 indicates the door is open and information can continue to be transmitted.

[0149] g(x)=σ(Wx+b) (6)

[0150] Where W is the weight of the gate, and b is the bias term. When the gate output is 0, all information cannot pass through; when the gate output is 1, any information can pass through. Therefore, the gate filters information.

[0151] Forget gate control neural network unit selects the forgotten part unit c t-1 Moving to the next moment, the formula is as follows:

[0152] f t =σ(W f ·[h t-1 ,x t ]+b f (7)

[0153] Among them W f For the weight of the forget gate, [h t-1 ,x t ] indicates that for vector h t-1 sum vector x t To splice, b f σ is the bias term, and σ is the binary activation function sigmoid.

[0154] The weight matrix consists of coefficients that need to be iteratively updated during neural network learning, and can be represented as:

[0155]

[0156] The input neuron state is obtained by linearly adding the previous neuron output and the current neuron input, and then passing the result through a gate function.

[0157]

[0158] The current state is formed by a linear combination of the previous cell state and the current input cell state:

[0159]

[0160] The final output of the LSTM is obtained by element-wise multiplying the output gate and the cell state elements:

[0161] h t =σ(W o ·[h t-1 ,x t ]+b o )·tanh(c t (11)

[0162] Step 3.7: Monitoring Method: Calculate the eigenvalue h predicted by the LSTM model. t By comparing the measured true value, the error vector is obtained. A threshold τ is set, which must take into account the impact of system disturbances. The set τ is compared with the error vector one by one. If the calculated error vector value is higher than τ, it indicates that the distributed power supply is in normal operation and the alarm signal remains at 0; otherwise, it indicates that a network attack has occurred and an alarm is sent to the control and coordination center.

[0163]

[0164] Step 3.8: Alarm: The intrusion prevention unit generates a binary alarm signal and continuously sends it to the control area. If an attack on the distributed energy source is detected, the alarm signal is set to 0, and the control area takes measures to defend against the attack. If no attack on the distributed energy source is detected, the alarm signal is set to 1. The alarm signal is shown in the following formula:

[0165]

[0166] When three consecutive timing signals are all 0, it is determined that an attack has occurred.

[0167] Step 4: The data transmission boundary gateway converts the input data between text format and network data stream format, and then sends the data to the production control area and information management area through the forward and reverse isolation device for coordinated control of the virtual power plant.

[0168] like Figure 1 As shown, Embodiment 2 of the present invention provides a secure access system for distributed energy resources in virtual power plants, comprising:

[0169] The secure access area of ​​the control and coordination center is divided into two modules based on CCC: production control module and information management module. Both the production control module and the information management module are equipped with intrusion prevention unit and border gateway machine. The intrusion prevention unit in each module is equipped with a vertical encryption authentication device between itself and the virtual power plant CCC access router. The border gateway machines in each module are equipped with forward and reverse isolation devices.

[0170] The communication network serves as a data transmission channel between the secure access area of ​​the control and coordination center and the secure access area of ​​the distributed energy source.

[0171] The distributed energy terminal security access area contains a security chip for encryption in each distributed energy sensing device.

[0172] A terminal includes a processor and a storage medium; the storage medium is used to store instructions; the processor is used to perform operations according to the instructions to execute the steps of the method.

[0173] A computer-readable storage medium having a computer program stored thereon that, when executed by a processor, implements the steps of the method.

[0174] The beneficial effects of this invention are compared with those of the prior art:

[0175] (1) This invention combines the existing secure access system architecture with a virtual power plant to provide a secure access solution for a large number of distributed energy sources in a virtual power plant. The platform is based on the operator’s dedicated wireless network and performs both horizontal isolation and vertical authentication, which solves the network security risk problem introduced when aggregating distributed energy sources in a virtual power plant.

[0176] (2) This invention considers enhancements to identity authentication, using an identity authentication method based on the national cryptographic standard SM9. The algorithm uses a unique identifier as the public key for data encryption, decryption, and authentication; it also employs bilinear pairing of elliptic curves for computation. Specifically, in step 1, the encryption process of distributed energy data transmission requires sending a digital signature; then, the key is sent, and the key exchange is also encrypted. This encryption process ensures that information is not stolen during transmission and also ensures the correctness of the identity. Step 2 enables the information receiver to decrypt according to the sender's encryption algorithm. Because elliptic bilinear pairing has a unique mapping and the algorithm is complex, it is difficult for malicious attackers who have not obtained the decryption method in advance to crack the encryption process. This also ensures the security of information transmission and the correctness of identity authentication, making it a superior authentication algorithm compared to traditional public key infrastructure methods.

[0177] (3) This invention considers the detection and alarm of virtual power plants under network attacks. It uses an algorithm based on a Long Short-Term Memory (LSTM) neural network. By collecting historical information on the normal operation of distributed energy and real-time information on network attacks, it iterates to obtain learning results. Comparing the output with a threshold can accurately and effectively detect network attacks. Compared with traditional network attack detection algorithms, the neural network algorithm is more accurate. Furthermore, the LSTM algorithm iterates faster than the RNN algorithm.

[0178] This disclosure can be a system, method, and / or computer program product. A computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for causing a processor to implement various aspects of this disclosure.

[0179] Computer-readable storage media can be tangible devices capable of holding and storing instructions for use by an instruction execution device. Computer-readable storage media can be, for example—but not limited to—electrical storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of computer-readable storage media include: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disc read-only memory (CD-ROM), digital multifunction disc (DVD), memory sticks, floppy disks, mechanical encoding devices, such as punch cards or recessed protrusions storing instructions thereon, and any suitable combination of the foregoing. The computer-readable storage media used herein are not to be construed as transient signals themselves, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (e.g., light pulses through fiber optic cables), or electrical signals transmitted through wires.

[0180] The computer-readable program instructions described herein can be downloaded from computer-readable storage media to various computing / processing devices, or downloaded via a network, such as the Internet, local area network, wide area network, and / or wireless network, to an external computer or external storage device. The network may include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards them to the computer-readable storage media in the respective computing / processing device.

[0181] Computer program instructions used to perform the operations of this disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, status setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk, C++, etc., and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The computer-readable program instructions may execute entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, electronic circuitry, such as programmable logic circuitry, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), is personalized by utilizing the status information of the computer-readable program instructions to implement various aspects of this disclosure.

[0182] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the protection scope of the claims of the present invention.

Claims

1. A secure access method for distributed energy resources in virtual power plants, characterized in that: The method includes the following steps: Obtain the status information of each sensor at the encrypted distributed energy terminal; the encryption includes digital signature generation, key encapsulation, and key exchange; wherein the digital signature generation process includes: Step 1.1: Generate random numbers r∈[1,N-1], and compute the group G. T The element w = g r Convert the data type of w to a bit string; the message to be signed is the bit string M, the digital signature of message M is (h, S), and the range of the bilinear pair e is the Nth-order multiplicative cyclic group G. T G T The element g = e(P1, P) pub ); P1 is the generated data of the Nth-order cyclic subgroup G1, P pub The master public key; and e is G1×G2 to G T The mapping of the Nth order cyclic subgroup G2 generates data P2; Step 1.2: Calculate integer h = H2(M‖w,N) and L = (rh)modN. If L = 0, it indicates a data error, and return to step 1.1; otherwise, proceed to step 1.

3. Here, H2() is the password encryption function. Step 1.3: Calculate the element S = [L]d in group G1 A Convert the data types of h and S to byte strings, and the message signature is (h, S), thus completing the digital signature generation. A The private key generated for the distributed power source; The key encapsulation process includes: Calculate the data Q in G1 B =H1P1(ID) B ||hid,N)+P pub And randomly generate corresponding numbers r∈[1,N-1], where H1 is the first hash function derived from the cryptographic hash function, ID B For identification purposes; Calculate G1 data C = [r]Q B This converts C data types into bit strings. Computational group G T The element g = e(P) pub ,P2) and ω=g r , converts the data type of ω to a bit string; where e() is an elliptic bilinear pair; Calculate K = KDF(C‖w‖ID) B KDF() is a key derivation function. If K is a string of all zeros, it returns the first step of the key encapsulation process. If K is not all zeros, it outputs the encapsulation key K and completes the key encapsulation. KDF() is the key derivation function and klen is the bit length of the key to be encapsulated. The status information is subjected to vertical encryption authentication processing; the vertical encryption authentication processing includes digital signature verification, key decapsulation and data decryption; The digital signature verification process includes: Step 2.1: Convert the data type of h′ in the data signature from binary to decimal form, and check whether h′∈[1,N-1]. If it is not true, the program ends, indicating that the verification has failed. If it is true, proceed to step 2.

2. Step 2.2: Transform the binary number S′ in the data signature into a point on the ellipse, and check whether S′∈G1 is true. If it is not true, the program ends, which means that the verification has failed. If it is true, proceed to step 2.

3. Step 2.3: Calculate G T The element g = e(P1, P) pub ) and element t = g h′ ; Step 2.4: Calculate the integer h1 = H1(ID) in group G1. A The element P = [h1]P2 + P in hid, N) and G2 pub Among them, ID A () represents the identifier of the distributed power source, and G2 is the cyclic subgroup of the control and coordination center; Step 2.5: Calculate group G T The elements u = e(S′, P) and ω′ = u·t are used to convert the data type of ω′ into a bit string; Step 2.6: Execute h2 = H2(M) ′ ||w ′ The calculation of N) verifies whether the equation h2 = h′ is true. If it is true, the verification is successful; otherwise, the verification is unsuccessful. Here, M′ is the updated bit string. The key decapsulation process includes: Verify whether the encapsulated ciphertext C∈G1 is true. If it is not true, report an error and exit the program. Computational group G T The element ω′=e(C,d) B ), convert the data type of ω′ to a bit string; where C is the distributed power source sending to encapsulate ciphertext, d B A private key generated for the control center; Convert C from a binary number to a bit string, and encapsulate the key K′ = KDF(C||ω′||ID). B The program performs the operation (klen). If the key K′ is a zero-bit string, it means there is no information, so the program exits and reports an error. If the key K′ is not all zeros, K′ is output, and the key decryption is completed. Security checks are performed on the data after vertical encryption authentication based on LSTM; the security check process includes: The system acquires normal data transmitted when it is not under attack and attacked data transmitted when it is under attack. After supplementing the data through linear calculation, feature extraction and filtering are performed. The selected feature values ​​are compared with the feature values ​​predicted by the LSTM network. If the error exceeds the threshold, the judgment that the current attack has occurred is output when the selected feature value is negative and three consecutive feature values ​​are negative. Otherwise, the number of consecutive negative feature values ​​is incremented by one and the judgment that the current attack has not occurred is output. If the error does not exceed the threshold, the judgment that the current attack has not occurred will be output when the selected feature value is positive and the number of consecutive negative feature values ​​is cleared to zero. The data from the safety inspection is transmitted to the production control area and the information management area via one-way data transmission for coordinated control of the virtual power plant.

2. The secure access method for distributed energy resources in virtual power plants according to claim 1, characterized in that: Each sensor at the distributed energy terminal automatically dials into the operator's power wireless network via a dedicated SIM card. Obtain the status information of each sensor at the encrypted distributed energy source, including: Obtain the status information of each sensor at the distributed energy source; The status information is encrypted using the SM9 algorithm, and the encrypted data is transmitted to the virtual power plant control and coordination center via the power wireless network.

3. The secure access method for distributed energy resources in virtual power plants according to claim 1, characterized in that: The key exchange process includes: Calculate element Q in G1 B =[H1(ID) B ||hid,N)]P1+P pub And generate random numbers r∈[1,N-1]; Elements R in computational group G1 A =[r]Q B , will R A It is sent to the control and coordination center as an exchange key.

4. The secure access method for distributed energy resources in virtual power plants according to claim 1, characterized in that: The data decryption process includes: Calculate element Q in G1 A =[H1(ID) A ||hid,N)]P1+P pub And generate random numbers r∈[1,N-1]; Elements R in computational group G1 B =[r B Q A Verify R A If ∈G1 holds true, the negotiation fails; otherwise, the group G is computed. T The element g1 = e(R) A ,d B ) and g2=e(P2,P pub ), Convert the data types g1, g2, 3g to bit strings; where r B These are random numbers generated at the control center. R A and R B Convert the data type to a bit string; Calculate S B =Hash(0x82||ID) A ||ID B ||R A ||R B The key authentication process is performed by calling the function `||g1||g2)` and verifying whether the equation holds true. If the equation does not hold true, the key authentication fails; otherwise, it succeeds. The `Hash()` algorithm is a hash algorithm, and R... A ||R B For elements in the group.

5. A secure access system for distributed energy resources in virtual power plants, comprising the method described in any one of claims 1-4, characterized in that: include: The control and coordination center has a secure access zone for obtaining encrypted status information from each sensor in the distributed energy source. The status information is subjected to vertical encryption authentication processing; The data after vertical encryption authentication is security tested using LSTM; the data that passes the security test is then transmitted to the production control area and the information management area via unidirectional data transmission for coordinated control of the virtual power plant.

6. A secure access system for distributed energy resources in virtual power plants according to claim 5, characterized in that: The secure access area of ​​the control and coordination center is divided into a production control module and an information management module based on CCC. Both the production control module and the information management module are equipped with intrusion prevention units and border gateways. A vertical encryption authentication device is provided between the intrusion prevention unit in each module and the virtual power plant CCC access router. A forward and reverse isolation device is provided between the border gateways in each module. The virtual power plant CCC access router is used to obtain the status information of each sensor in the encrypted distributed energy terminal. The vertical encryption authentication device is used to perform vertical encryption authentication processing on the status information. The intrusion prevention unit is used to perform security detection on the data after vertical encryption authentication processing based on LSTM. The data that passes the security detection is transmitted to the production control area and the information management area through the data transmission border gateway and the forward and reverse isolation device for the coordinated control of the virtual power plant.

7. A secure access system for distributed energy resources in virtual power plants according to claim 5, characterized in that: Also includes: The distributed energy terminal secure access area contains a secure encryption chip in each distributed energy sensor.

8. A secure access system for distributed energy resources in virtual power plants according to claim 6, characterized in that: Also includes: The communication network enables data transmission between the secure access area of ​​the control and coordination center and the secure access area of ​​the distributed energy source.

Images