Communication method, device, equipment and storage medium for power generation control system

Abstract

The present invention discloses a communication method, device, electronic device and storage medium for a power generation control system. The method includes: if the target function service receives a function service request from a target client, and detects that the target function service has not established a connection with the target client, the target function service sends a trusted verification request to a trusted management service according to the function service request to verify the trustworthiness of the target client; the trusted management service receives the trusted verification request, and according to the trusted verification request, determines the trustworthiness of the target client in a trusted list, and feeds back the trusted verification result to the target function service; the target function service determines the connection establishment result according to the trusted verification result, and then determines the response result of the function service request. This technical solution solves the problem of poor reliability of communication security protection in the power generation control system, and implements system-level trusted protection and ensures the security and reliability of communication by accessing a trusted management service in the power generation control system.

Description

Technical Field

[0001] The present invention relates to the field of renewable energy power generation technology, and in particular to a communication method, device, electronic equipment and storage medium for a power generation control system. Background Art

[0002] Renewable energy generation is different from traditional power generation. It has the characteristics of decentralized power generation sites, remote locations, and high automation. Therefore, the power generation control system plays an important role in daily operation and maintenance management. The power generation control system usually covers a certain area and is a distributed automation system, including a centralized control center and multiple site interface machines within the area. The centralized control center includes servers and workstations for various purposes.

[0003] At present, existing technologies mainly use two methods to protect the communication security of power generation control systems: (1) The centralized control center and the station interface machine are divided into a safe zone, and a one-way isolation network gate is used to control the content and flow of communication data. A dedicated power line or a leased line from an external operator is used in the safe zone. In order to ensure the security of information crossing the dedicated line, a vertical encryption communication device is set up on the centralized control center side and the station side, or a one-way isolation network gate is set up on the station side. (2) By adding trusted computing, the system's computing equipment and network equipment are upgraded to trusted nodes, and the active security protection capabilities of the system platform are improved in conjunction with trusted configuration management, security auditing, situational awareness and other systems.

[0004] However, the security protection methods of vertical encryption or one-way isolation network gates only manage and control the network boundaries at the hardware level, and lack security protection at the software level. The trusted solutions in the prior art only provide security protection for trusted nodes installed with trusted software and hardware. For applications, if there is access to untrusted nodes, they still cannot be identified and controlled, causing the power generation control system to fail to meet the overall trust standard and be vulnerable to security attacks. Summary of the invention

[0005] The present invention provides a communication method, device, electronic device and storage medium for a power generation control system to solve the problem of poor reliability of communication security protection in the power generation control system. By accessing a trusted management service in the power generation control system, comprehensive security protection is performed on the communication of the power generation control system, and the overall trusted operation of the power generation control system is achieved, thereby ensuring the security and reliability of the communication.

[0006] According to one aspect of the present invention, a communication method of a power generation control system is provided, the method being executed by the power generation control system, the power generation control system comprising a trusted management service, at least one functional service and at least one client; the method comprising:

[0007] If a function service request of the target client is received through the target function service, and it is detected that the target function service and the target client are not connected, a trusted verification request is sent to the trusted management service through the target function service according to the function service request to verify the trustworthiness of the target client;

[0008] The trusted management service receives the trusted verification request, determines the trustworthiness of the target client in the trusted list according to the trusted verification request, and feeds back the trusted verification result to the target functional service;

[0009] The target functional service determines a connection establishment result according to the trusted verification result, and determines a response result of the functional service request according to the connection establishment result.

[0010] According to another aspect of the present invention, a communication device for a power generation control system is provided, wherein the device is configured in the power generation control system, wherein the power generation control system includes a trusted management service, at least one functional service, and at least one client; the device includes:

[0011] A trusted verification request sending module is used to send a trusted verification request to a trusted management service through the target function service according to the function service request to verify the credibility of the target client if a function service request of the target client is received through the target function service and it is detected that the target function service and the target client are not connected;

[0012] A trusted verification result feedback module, used to receive the trusted verification request through the trusted management service, and determine the trustworthiness of the target client in the trusted list according to the trusted verification request, and feedback the trusted verification result to the target functional service;

[0013] The function service request response module is used to determine the connection establishment result according to the trusted verification result through the target function service, and determine the response result of the function service request according to the connection establishment result.

[0014] According to another aspect of the present invention, there is provided an electronic device, the electronic device comprising:

[0015] At least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the communication method of the power generation control system described in any embodiment of the present invention.

[0016] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions for enabling a processor to implement the communication method of the power generation control system described in any embodiment of the present invention when the computer instructions are executed.

[0017] The technical solution of the embodiment of the present invention is that if a function service request of a target client is received through a target function service, and it is detected that the target function service has not established a connection with the target client, then the target function service sends a trusted verification request to a trusted management service according to the function service request to verify the trustworthiness of the target client; the trusted verification request is received through the trusted management service, and the trustworthiness of the target client is determined in a trusted list according to the trusted verification request, and the trusted verification result is fed back to the target function service; the target function service determines the connection establishment result according to the trusted verification result, and determines the response result of the function service request according to the connection establishment result. This technical solution solves the problem of poor reliability of communication security protection in the power generation control system. By accessing a trusted management service in the power generation control system, comprehensive security protection is performed on the communication of the power generation control system, and the overall trusted operation of the power generation control system is achieved, ensuring the security and reliability of the communication.

[0018] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0020] Figure 1A is a flow chart of a communication method of a power generation control system provided according to Embodiment 1 of the present invention;

[0021] Figure 1B is a structural schematic diagram of a power generation control system provided according to Embodiment 1 of the present invention;

[0022] Figure 1C This is a signaling diagram for communication between devices in a power generation control system provided in Embodiment 1 of the present invention;

[0023] Figure 2A is a flow chart of a communication method of a power generation control system provided according to Embodiment 2 of the present invention;

[0024] Figure 2B This is a signaling diagram for communication between devices in a power generation control system according to Embodiment 2 of the present invention;

[0025] Figure 3 is a structural schematic diagram of a communication device of a power generation control system provided according to a third embodiment of the present invention;

[0026] Figure 4 It is a structural schematic diagram of an electronic device for implementing the communication method of the power generation control system according to an embodiment of the present invention. DETAILED DESCRIPTION

[0027] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0028] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices. The acquisition, storage, use, processing, etc. of data in the technical solution of this application comply with the relevant provisions of national laws and regulations.

[0029] Embodiment 1

[0030] Figure 1A The present invention provides a flowchart of a communication method for a power generation control system in the first embodiment. This embodiment is applicable to power generation system communication in wind power, solar power and other renewable energy power generation scenarios. The method can be executed by a communication device of a power generation control system, which can be implemented in the form of hardware and / or software, and can be configured in an electronic device. Figure 1A As shown, the method includes:

[0031] S110. If a function service request of a target client is received through a target function service, and it is detected that no connection is established between the target function service and the target client, a trusted verification request is sent to a trusted management service through the target function service according to the function service request to verify the trustworthiness of the target client.

[0032] The existing trusted communication scheme can only ensure the security and trustworthiness of devices equipped with trusted chips. If there are untrusted devices connected to the power generation control system, the power generation control system cannot identify and control them. Therefore, the power generation control system as a whole cannot meet the trust standard and is still vulnerable to security attacks. At the same time, the data in the power generation control system is only interacted through the API (Application Programming Interface) interface or communication protocol. The credibility of the data is difficult to guarantee and it is easy to be used illegally, threatening the communication security of the power generation control system.

[0033] In order to achieve comprehensive security protection at the system level, a trusted management service is added to the power generation control system of this solution to perform trusted management of each functional service and each client. In addition, the power generation control system also includes at least one functional service and at least one client. Among them, the trusted management service functional service can include historical data services, data acquisition and control services, application services, and communication front-end services. The client can include terminals such as operation workstations, configuration management stations, and site interface machines.

[0034] Figure 1B is a schematic diagram of a power generation control system provided according to the first embodiment of the present invention. Figure 1B In the distributed power generation control system shown, historical data services, Supervisory Control And Data Acquisition (SCADA), application services, communication front-end services, trusted management services, operation workstations, and configuration management stations are usually deployed in the centralized control center. The station interface machines are distributed in each renewable energy power generation station and are used to realize power generation control in the power generation station. To ensure the safety of power generation, the communication between the centralized control center and the power generation station can be carried out through a dedicated line link for data transmission. A vertical encryption device or a one-way isolation network switch is set between the centralized control center and the power generation station to ensure the security of information crossing the dedicated line.

[0035] Each device in the power generation control system that is configured with a trusted environment, such as functional services and clients, can generate trusted information after power-on and send the trusted information to the trusted management service. The trusted management service can register the trusted devices based on the trusted information of each device and generate a trusted list. After the trusted registration, when the devices in the power generation control system communicate with each other, they need to verify the trustworthiness of the other device with the trusted management service to ensure the security of the communication.

[0036] Specifically, when the target functional service receives the functional service request from the target client, it can detect whether the target functional service has established a connection with the target client. If the connection has been established, the functional service request of the target client can be directly responded to. If the connection is not established, the target functional service can send a trusted verification request to the trusted management service based on the functional service request to verify the credibility of the target client. It can be understood that the functional service request sent by the target client may include information such as the request time, the request initiator, the request recipient, and the request type. The target functional service can extract the request initiator in the functional service request and generate a trusted verification request for the request initiator to verify the target client, or it can directly forward the functional service request to the trusted management service, and the trusted management service will perform trusted verification on the request initiator.

[0037] It should be noted that for the reliability of the power generation control system, before sending a function request, the target client can request a trusted function service list from the trusted management service in advance, and select the target function service from the trusted function service list fed back by the trusted management service to initiate a function service request.

[0038] S120: Receive the trusted verification request through the trusted management service, determine the trustworthiness of the target client in the trusted list according to the trusted verification request, and feed back the trusted verification result to the target functional service.

[0039] The trusted management service can receive a trusted verification request sent by the target functional service, determine the trustworthiness of the target client in the trusted list based on the target client information in the trusted verification request, and feed back the trusted verification result to the target functional service so that the target functional service can determine whether to respond to the target client's functional service request based on the trusted verification result.

[0040] In a feasible solution, determining the credibility of the target client in a trusted list according to the trusted verification request includes:

[0041] Extracting target client information from the trusted verification request through a trusted management service, and searching for the target client in a trusted list according to the target client information;

[0042] If the target client is in the trusted list, the target client is determined to be trusted;

[0043] If the target client is not in the trusted list, it is determined that the target client is not trusted.

[0044] It is easy to understand that the trusted verification request may include information such as the request time and the verification object. The trusted management service can extract the verification object information, that is, the target client information, from the trusted verification request, and search for the target client in the trusted list according to the target client information. If the target client exists in the trusted list, the target client is trusted; if the target client does not exist in the trusted list, the target client is untrusted.

[0045] S130. Determine a connection establishment result according to the trusted verification result through the target functional service, and determine a response result of the functional service request according to the connection establishment result.

[0046] The target functional service can receive the trusted verification result fed back by the trusted management service, and determine whether to establish a connection with the target client based on the trusted verification result. If a connection is established, the target functional service will respond to the functional service request sent by the target client. If a connection is not established, the target functional service will not respond to the functional service request sent by the target client.

[0047] In this embodiment, optionally, determining a connection establishment result according to the trusted verification result through the target functional service, and determining a response result of the functional service request according to the connection establishment result, includes:

[0048] If the target client is determined to be credible according to the credible verification result through the target functional service, it is determined that the connection is established successfully, and a response result is fed back to the target client according to the functional service request;

[0049] If the target functional service determines that the target client is not trustworthy based on the trusted verification result, it is determined that the connection establishment has failed and the functional service request is not responded to.

[0050] It can be understood that the trusted verification result can include trusted and untrusted. If the target client is trusted, the target functional service can establish a connection with the target client, and after the connection is successfully established, respond to the functional service request and send the response result to the target client. If the target client is untrusted, the target functional service can stop establishing a connection with the target client. Due to the failure to establish the connection, the target functional service does not respond to the functional service request to ensure the security of the communication data.

[0051] In this solution, optionally, a trusted chip is deployed in each functional service; wherein the trusted chip is used to perform a trusted measurement on the functional service to generate first trusted information;

[0052] Before receiving the function service request of the target client through the target function service, the method further includes:

[0053] If it is detected that the target function service is ready to start, the target function service sends a first trusted authentication request to the trusted management service according to the first trusted information;

[0054] If the target function service is determined to be trustworthy according to the first trusted authentication request through the trusted management service, the target function service is added to the trusted list.

[0055] Figure 1C 1 is a signaling diagram of device communication in a power generation control system according to Embodiment 1 of the present invention. Figure 1C As shown, when the target function service is ready to start, the trusted chip in the target function service can measure the BIOS (Basic Input Output System), operating system and application of the target function service to generate the first trusted information. The target function service can send a first trusted authentication request to the trusted management service based on the first trusted information to perform trusted registration. The trusted management service can determine whether the target function service is trusted based on the first trusted authentication request. If it is trusted, the target function service is added to the trusted list. If it is not trusted, the target function service is not added to the trusted list.

[0056] On the basis of the above solution, optionally, a trusted chip is deployed in each client; wherein the trusted chip is used to perform a trust measurement on the client to generate second trusted information;

[0057] Before receiving the function service request of the target client through the target function service, the method further includes:

[0058] If it is detected that the target client is ready to start, the target client sends a second trusted authentication request to the trusted management service according to the second trusted information;

[0059] If the target client is determined to be trustworthy according to the second trusted authentication request through the trusted management service, the target client is added to the trusted list.

[0060] like Figure 1CAs shown, when the target client is ready to start, the trusted chip in the target client can measure the BIOS (Basic Input Output System), operating system and application of the target client to generate second trusted information. The target client can send a second trusted authentication request to the trusted management service based on the second trusted information to perform trusted registration. The trusted management service can determine whether the target client is trusted based on the second trusted authentication request. If it is trusted, the target client is added to the trusted list. If it is not trusted, the target client is not added to the trusted list.

[0061] In a preferred solution, after adding the target function service to the trusted list, the method further includes:

[0062] If a change in the first trusted information is detected through the target function service, the first change information is sent to the trusted management service;

[0063] If it is determined through the trusted management service according to the first change information that the target function service is not trusted, the target function service is removed from the trusted list;

[0064] After adding the target client to the trusted list, the method further includes:

[0065] If a change in the second trusted information is detected through the target client, the second change information is sent to the trusted management service;

[0066] If the target client is determined to be untrustworthy according to the second change information by the trusted management service, the target client is removed from the trusted list.

[0067] It is easy to understand that the trusted status of each device in the power generation control system may change. Therefore, the trusted chip can periodically measure the trusted status of the device so that the trusted management service can continuously monitor the trustworthiness of each device.

[0068] Specifically, if the target function service detects a change in the first trusted information, the first change information is sent to the trusted management service. If the trusted management service determines that the target function service is untrustworthy based on the first change information, the target function service is removed from the trusted list to timely eliminate the communication risk brought by the untrustworthy function service.

[0069] If the target client detects a change in the second trusted information, the second change information is sent to the trusted management service. If the trusted management service determines that the target client is untrustworthy based on the second change information, the target client is removed from the trusted list to timely eliminate the communication risk brought by the untrustworthy client.

[0070] The technical solution of the embodiment of the present invention is that if a function service request of a target client is received through a target function service, and it is detected that the target function service has not established a connection with the target client, then the target function service sends a trusted verification request to a trusted management service according to the function service request to verify the trustworthiness of the target client; the trusted verification request is received through the trusted management service, and the trustworthiness of the target client is determined in a trusted list according to the trusted verification request, and the trusted verification result is fed back to the target function service; the target function service determines the connection establishment result according to the trusted verification result, and determines the response result of the function service request according to the connection establishment result. This technical solution solves the problem of poor reliability of communication security protection in the power generation control system. By accessing a trusted management service in the power generation control system, comprehensive security protection is performed on the communication of the power generation control system, and the overall trusted operation of the power generation control system is achieved, ensuring the security and reliability of the communication.

[0071] Embodiment 2

[0072] Figure 2A This is a flow chart of a communication method for a power generation control system provided in the second embodiment of the present invention. This embodiment refines the communication process of controlling the station interface machine based on the above embodiment. Figure 2A As shown, the method includes:

[0073] S210. If an interface machine control request of the operation workstation is received through the communication front-end service, and it is detected that no connection is established between the communication front-end service and the operation workstation, a trusted verification request is sent to the trusted management service through the communication front-end service according to the interface machine control request to verify the credibility of the operation workstation.

[0074] Figure 2B 1 is a signaling diagram of device communication in a power generation control system according to Embodiment 2 of the present invention. Figure 2B As shown, after being powered on, the communication front-end service, the operation workstation and the site interface machine all register with the trusted management service for trustworthiness.

[0075] In this scheme, if Figure 2B As shown, the operation workstation at the centralized control center initiates an interface machine control request to the communication front-end service, wherein the interface machine control request may include information such as request time, request initiator, request receiver, and control object.

[0076] After receiving the interface machine control request, if the communication front-end service detects that there is no connection with the operation workstation, it will send a trusted verification request to the trusted management service according to the interface machine control request to verify the trustworthiness of the operation workstation. If it detects that there is a connection with the operation workstation, it will directly respond to the interface machine control request.

[0077] It should be noted that the communication front-end service can extract the control object information, such as the target station interface machine, from the interface machine control request. According to the connection establishment between the communication front-end service and the control object, the trusted verification of the control object is added to the trusted verification request to ensure the reliability of the control instruction issuance.

[0078] S220: Receive the trusted verification request through the trusted management service, determine the trustworthiness of the operation workstation in the trusted list according to the trusted verification request, and feed back the trusted verification result to the communication front-end service.

[0079] After receiving the trust verification request, the trust management service may determine the trustworthiness of the operation workstation in the trust list according to the trust verification request, and feed back the trust verification result to the communication front-end service.

[0080] If the communication front-end service adds trusted verification of the control object in the trusted verification request, the trusted management service can also determine the trustworthiness of the target site interface machine in the trusted list. The trusted verification result includes not only the trustworthiness of the operating workstation, but also the trustworthiness of the target site interface machine.

[0081] S230. Determine a connection establishment result according to the trusted verification result through the communication front-end service, and determine the site control data of the interface machine control request according to the connection establishment result.

[0082] If the operation workstation is credible, the communication front-end service determines whether to establish a connection with the operation workstation based on the credible verification result. If the connection is established, the station control data is parsed in the interface machine control request. If the connection is not established, the interface machine control request sent by the operation workstation is not responded to.

[0083] If the communication front-end service adds a trusted verification of the control object in the trusted verification request, the communication front-end service determines whether to establish a connection with the target station interface machine based on the trustworthiness of the target station interface machine. If both the operation workstation and the target station interface machine are trustworthy, the connection between the communication front-end service and the operation workstation and between the communication front-end service and the target station interface is successfully established. The communication front-end service sends the station control data to the target station interface. If the operation workstation is trustworthy and the target station interface machine is not trustworthy, the station control data is not sent to the target station interface, and the connection between the communication front-end service and the operation workstation is successfully established, and the control failure information is fed back to the operation workstation.

[0084] S240. Sign the station control data through the communication front-end service to obtain the signed data, and send the signed data to the target station interface machine so that the signed data is verified by the target station interface machine to obtain the station control data and execute the station control data.

[0085] If the connection between the communication front-end service and the operation workstation and between the communication front-end service and the target station interface are successfully established, the communication front-end service can sign the station control data to obtain the signature data, and send the signature data to the target station interface machine. After receiving the signature data, the target station interface machine can verify the signature data to obtain the station control data and execute the station control data, thereby realizing a station interface control. After the station control data is executed, the target station interface machine can generate a control execution result and send the control execution result to the communication front-end service, which will feed back the control execution result to the operation workstation so that the operation workstation can perform the next station interface control according to the control execution result.

[0086] The technical solution of the embodiment of the present invention is that if an interface machine control request of an operation workstation is received through a communication front-end service, and it is detected that the communication front-end service and the operation workstation are not connected, then a trusted verification request is sent to a trusted management service through the communication front-end service according to the interface machine control request to verify the trustworthiness of the operation workstation. The trusted verification request is received through the trusted management service, and the trustworthiness of the operation workstation is determined in a trusted list according to the trusted verification request, and the trusted verification result is fed back to the communication front-end service. The communication front-end service determines the connection establishment result according to the trusted verification result, and determines the site control data of the interface machine control request according to the connection establishment result. The site control data is signed by the communication front-end service to obtain the signature data, and the signature data is sent to the target site interface machine, so that the signature data is verified by the target site interface machine to obtain the site control data, and the site control data is executed. This technical solution solves the problem of poor reliability of communication security protection in the power generation control system. By accessing the trusted management service within the power generation control system, comprehensive security protection is provided for the communication of the power generation control system, the overall trusted operation of the power generation control system is achieved, and the security and reliability of the communication are guaranteed.

[0087] Embodiment 3

[0088] Figure 3 The structure diagram of a communication device of a power generation control system provided in the third embodiment of the present invention is shown in FIG. The device is configured in the power generation control system, and the power generation control system includes a trusted management service, at least one functional service, and at least one client. Figure 3As shown, the device comprises:

[0089] A trusted verification request sending module 310 is used to send a trusted verification request to a trusted management service through the target function service according to the function service request to verify the credibility of the target client if a function service request of the target client is received through the target function service and it is detected that the target function service and the target client are not connected;

[0090] The trusted verification result feedback module 320 is used to receive the trusted verification request through the trusted management service, determine the trustworthiness of the target client in the trusted list according to the trusted verification request, and feedback the trusted verification result to the target functional service;

[0091] The function service request response module 330 is used to determine a connection establishment result according to the trusted verification result through the target function service, and determine a response result of the function service request according to the connection establishment result.

[0092] In this solution, optionally, a trusted chip is deployed in each functional service; wherein the trusted chip is used to perform a trusted measurement on the functional service to generate the first trusted information;

[0093] The device also includes:

[0094] A function service trusted registration module, configured to send a first trusted authentication request to a trusted management service through the target function service according to first trusted information before receiving a function service request from a target client through the target function service, if it is detected that the target function service is ready to start;

[0095] If the target function service is determined to be trustworthy according to the first trusted authentication request through the trusted management service, the target function service is added to the trusted list.

[0096] Optionally, a trusted chip is deployed in each client; wherein the trusted chip is used to perform a trust measurement on the client to generate second trusted information;

[0097] The device also includes:

[0098] The client trusted registration module is used to send a second trusted authentication request to the trusted management service through the target client according to the second trusted information if it is detected that the target client is ready to start before receiving the function service request of the target client through the target function service;

[0099] If the target client is determined to be trustworthy according to the second trusted authentication request through the trusted management service, the target client is added to the trusted list.

[0100] Based on the above solution, the trusted verification result feedback module 320 is specifically used to:

[0101] Extracting target client information from the trusted verification request through a trusted management service, and searching for the target client in a trusted list according to the target client information;

[0102] If the target client is in the trusted list, the target client is determined to be trusted;

[0103] If the target client is not in the trusted list, it is determined that the target client is not trusted.

[0104] In this embodiment, the functional service request response module 330 is specifically used to:

[0105] If the target client is determined to be credible according to the credible verification result through the target functional service, it is determined that the connection is established successfully, and a response result is fed back to the target client according to the functional service request;

[0106] If the target functional service determines that the target client is not trustworthy based on the trusted verification result, it is determined that the connection establishment has failed and the functional service request is not responded to.

[0107] In a feasible solution, the target functional service is a communication pre-service, the target client is an operation workstation, the functional service request is an interface machine control request; and the response result is site control data;

[0108] The device also includes:

[0109] The station control module is used to sign the station control data through the communication front-end service after determining the response result of the functional service request, obtain the signed data, and send the signed data to the target station interface machine so that the signed data can be verified by the target station interface machine to obtain the station control data and execute the station control data.

[0110] In a preferred embodiment, the device further comprises:

[0111] A first trusted change management module is used to send first change information to a trusted management service if a first trusted information change is detected through the target function service after the target function service is added to the trusted list;

[0112] If the trusted management service determines that the target function service is not trusted according to the first change information, the target function service is removed from the trusted list.

[0113] The device also includes:

[0114] A second trusted change management module is used to send second change information to the trusted management service if a change of the second trusted information is detected through the target client after the target functional service is added to the trusted list;

[0115] If the target client is determined to be untrustworthy according to the second change information by the trusted management service, the target client is removed from the trusted list.

[0116] The communication device of the power generation control system provided in the embodiment of the present invention can execute the communication method of the power generation control system provided in any embodiment of the present invention, and has the functional modules and beneficial effects corresponding to the execution method.

[0117] Embodiment 4

[0118] Figure 4 A schematic diagram of the structure of an electronic device 410 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0119] like Figure 4 As shown, the electronic device 410 includes at least one processor 411, and a memory connected to the at least one processor 411 in communication, such as a read-only memory (ROM) 412, a random access memory (RAM) 413, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 411 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 412 or the computer program loaded from the storage unit 418 to the random access memory (RAM) 413. In the RAM 413, various programs and data required for the operation of the electronic device 410 can also be stored. The processor 411, the ROM 412, and the RAM 413 are connected to each other via a bus 414. An input / output (I / O) interface 415 is also connected to the bus 414.

[0120] Multiple components in the electronic device 410 are connected to the I / O interface 415, including: an input unit 416, such as a keyboard, a mouse, etc.; an output unit 417, such as various types of displays, speakers, etc.; a storage unit 418, such as a disk, an optical disk, etc.; and a communication unit 419, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 419 allows the electronic device 410 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0121] The processor 411 may be a variety of general and / or dedicated processing components with processing and computing capabilities. Some examples of the processor 411 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 411 executes the various methods and processes described above, such as the communication method of the power generation control system.

[0122] In some embodiments, the communication method of the power generation control system may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 418. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 410 via the ROM 412 and / or the communication unit 419. When the computer program is loaded into the RAM 413 and executed by the processor 411, one or more steps of the communication method of the power generation control system described above may be performed. Alternatively, in other embodiments, the processor 411 may be configured to execute the communication method of the power generation control system in any other appropriate manner (e.g., by means of firmware).

[0123] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0124] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other communication device of a programmable power generation control system, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine as a stand-alone software package and partially on a remote machine, or entirely on a remote machine or server.

[0125] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, device, or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0126] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0127] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0128] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0129] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0130] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A communication method for a power generation control system, characterized in that: The method is performed by a power generation control system, the power generation control system includes a trusted management service, at least one functional service and at least one client; the method includes: If a function service request of the target client is received through the target function service, and it is detected that the target function service and the target client are not connected, a trusted verification request is sent to the trusted management service through the target function service according to the function service request to verify the trustworthiness of the target client; The trusted management service receives the trusted verification request, determines the trustworthiness of the target client in the trusted list according to the trusted verification request, and feeds back the trusted verification result to the target functional service; Determine, by the target functional service, a connection establishment result according to the trusted verification result, and determine, according to the connection establishment result, a response result of the functional service request; Wherein, the method further comprises: Before sending the function service request through the target client, the target client requests the trusted management service for a trusted function service list, and selects the target function service from the trusted function service list fed back by the trusted management service to send the function service request.

2. The method according to claim 1, characterized in that: A trusted chip is deployed in each functional service; wherein the trusted chip is used to perform a trusted measurement on the functional service and generate first trusted information; Before receiving the function service request of the target client through the target function service, the method further includes: If it is detected that the target function service is ready to start, the target function service sends a first trusted authentication request to the trusted management service according to the first trusted information; If the target function service is determined to be trustworthy according to the first trusted authentication request through the trusted management service, the target function service is added to the trusted list.

3. The method according to claim 2, characterized in that A trusted chip is deployed in each client; wherein the trusted chip is used to perform a trusted measurement on the client to generate second trusted information; Before receiving the function service request of the target client through the target function service, the method further includes: If it is detected that the target client is ready to start, the target client sends a second trusted authentication request to the trusted management service according to the second trusted information; If the target client is determined to be trustworthy according to the second trusted authentication request through the trusted management service, the target client is added to the trusted list.

4. The method according to claim 3, characterized in that Determining the credibility of the target client in a trusted list according to the trusted verification request includes: Extracting target client information from the trusted verification request through a trusted management service, and searching for the target client in a trusted list according to the target client information; If the target client is in the trusted list, the target client is determined to be trusted; If the target client is not in the trusted list, it is determined that the target client is not trusted.

5. The method according to claim 4, characterized in that The determining, by the target functional service, a connection establishment result according to the trusted verification result, and determining a response result of the functional service request according to the connection establishment result, includes: If the target client is determined to be credible according to the credible verification result through the target functional service, it is determined that the connection is established successfully, and a response result is fed back to the target client according to the functional service request; If the target functional service determines that the target client is not trustworthy based on the trusted verification result, it is determined that the connection establishment has failed and the functional service request is not responded to.

6. The method according to claim 1, characterized in that The target functional service is a communication pre-service, the target client is an operation workstation, and the functional service request is an interface machine control request; The response result is station control data; After determining the response result of the functional service request, the method further includes: The station control data is signed through the communication front-end service to obtain the signed data, and the signed data is sent to the target station interface machine so that the signed data is verified by the target station interface machine to obtain the station control data and execute the station control data.

7. The method according to claim 3, characterized in that After adding the target function service to the trusted list, the method further includes: If a change in the first trusted information is detected through the target function service, a first trusted change request is sent to the trusted management service; If it is determined through the trusted management service according to the first trusted change request that the target functional service is not trusted, removing the target functional service from the trusted list; After adding the target client to the trusted list, the method further includes: If a change in the second trusted information is detected through the target client, a second trusted change request is sent to the trusted management service; If the target client is determined to be untrustworthy according to the second trusted change request through the trusted management service, the target client is removed from the trusted list.

8. A communication device for a power generation control system, characterized in that: The device is configured in a power generation control system, the power generation control system includes a trusted management service, at least one functional service and at least one client; the device includes: A trusted verification request sending module is used to send a trusted verification request to a trusted management service through the target function service according to the function service request to verify the credibility of the target client if a function service request of the target client is received through the target function service and it is detected that the target function service and the target client are not connected; A trusted verification result feedback module, used to receive the trusted verification request through the trusted management service, and determine the trustworthiness of the target client in the trusted list according to the trusted verification request, and feedback the trusted verification result to the target functional service; A function service request response module, used to determine a connection establishment result according to the trusted verification result through a target function service, and determine a response result of the function service request according to the connection establishment result; The device is further used to: before sending a function service request through the target client, request a trusted function service list from the trusted management service through the target client, and select a target function service from the trusted function service list fed back by the trusted management service to send the function service request.

9. An electronic device, characterized in that: The electronic device comprises: At least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the communication method of the power generation control system described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the communication method of the power generation control system according to any one of claims 1 to 7 when executed.

Images