Power system automation equipment network card hardware architecture, message processing method and system

Abstract

The invention discloses a power system automation equipment network card hardware architecture and a message processing method and system, and the system comprises a network interface subsystem, a hardware encryption / decryption subsystem, a programmable network processor subsystem, a management control subsystem, a message information memory, a message processing strategy table, an equipment interface subsystem, an internal bus and a power supply circuit. And the subsystems are interconnected through a data bus and a control bus for data interaction. The network card equipment based on programmable network processing can adapt to various industrial communication networks, analyze and process received messages, realize network traffic flow sensing and security defense capabilities, realize deep sensing and preprocessing of network messages through hardware network processing acceleration under the condition of not influencing the communication performance of the equipment, and improve the communication efficiency of the equipment. Flexible message distribution is achieved, flexible expandability is achieved, and new technologies and equipment are easy to integrate; hardware encryption and security protection measures meet the urgent demand of security protection enhancement of the novel power system.

Description

Technical Field

[0001] The present invention relates to a network card hardware architecture and a message processing method and system, and in particular to a network card hardware architecture of power system automation equipment and a message processing method and system. Background Art

[0002] The automation of power systems is one of the important guarantees for the efficient operation of modern power grids. With the development of technology, the automation equipment in new power systems has been significantly improved in function, performance and technology compared with traditional power system automation equipment. Distributed architecture is often adopted, and multiple intelligent devices can independently process information and make decisions, reducing the dependence on the central control system. Two-way communication capability supports two-way data exchange, which can not only collect data from the terminal, but also send instructions or data to the terminal. With advanced analysis and decision-making capabilities, advanced technologies such as big data analysis and artificial intelligence are used for advanced applications such as predictive maintenance and fault diagnosis. With flexible scalability, new automation equipment often has better interoperability and scalability, and is easy to integrate new technologies and equipment. At the same time, the need for enhanced security protection is more urgent. Considering the importance of network security, new equipment is usually equipped with more advanced encryption technology and security protection measures.

[0003] In summary, the current power system automation equipment cannot meet the development requirements of the new power system in terms of network communication status perception, message processing performance, network security, etc. Among them, network data processing acceleration and multi-dimensional data processing are the basis for ensuring efficient, reliable and safe operation of the system. Summary of the invention

[0004] Purpose of the invention: The purpose of the present invention is to provide a network card hardware architecture, message processing method and system for power system automation equipment, so as to realize deep perception and preprocessing of network messages and flexible message distribution.

[0005] Technical solution: The present invention includes a network interface subsystem, a hardware encryption / decryption subsystem, a programmable network processor subsystem, a management control subsystem, a message information storage device, a message processing strategy table, a device interface subsystem, an internal bus and a power supply circuit. The subsystems are interconnected through a data bus and a control bus for data exchange.

[0006] The network processor in the programmable network processor subsystem is a programmable hardware network message processor, and the network processor execution program is updated by the management control subsystem; there is a data read and write interface with the memory and the policy table device; the network processor processes the message information of the received message according to the execution program and the function configuration information and stores the processing result in the memory; the policy table is searched by the message field according to the function configuration information, and the message matching the policy table is processed according to the policy.

[0007] The network interface module in the network interface subsystem is adapted to the external communication network interface; the device interface subsystem is an interface for communicating with the message processing unit in the automation equipment; the hardware encryption / decryption subsystem performs decryption, encryption and message encapsulation of network sent and received messages according to the configured keys and algorithms; the message processing policy table stores the hardware algorithm lookup table of message processing rules; the message processing rules are issued by the management control module; the table lookup information issued by the programmable network processor is received, the table is looked up by the hardware algorithm and the table lookup result is returned.

[0008] The management and control subsystem is implemented by a multi-core processor and peripheral circuits. It receives the configuration information sent by the device CPU through the network card driver configuration interface and converts it into network card configuration and sends it to each functional module; reads the message information in the memory according to the control information and returns it to the device CPU; receives the message forwarded by the network processor and analyzes it. The analysis results are stored in the memory and sent to the device CPU according to the configuration.

[0009] A message processing method for a network card of an electric power system automation device comprises the following steps:

[0010] Network card driver: configure and manage the hardware subsystems of the network card, provide network card configuration management interface, message collection information event interface and service, message data sending and receiving interface;

[0011] Management control and analysis: Analyze and process the collected information and messages according to the information collection instructions and message processing instructions issued by the configuration, and record and store them;

[0012] Message processing: Process received and sent messages according to the configured strategy, analyze the processing results and store and record them;

[0013] Encryption processing: Provide hardware encryption and decryption function interfaces to other functional modules, encrypt and decrypt input messages or data according to the configured keys and algorithms. The encryption and decryption keys and algorithms are configured and issued by the automation equipment application system through the network card driver module.

[0014] The network card driver is specifically as follows: after power-on, the network card driver module first initializes the network card, registers device information to the automation device application system, and the automation device application function sends configuration information through the network card driver module.

[0015] The management control and analysis are specifically as follows: according to the configuration information, information collection instructions and message processing instructions, the collected network message information is analyzed and processed, and the processing results are recorded and stored in the database; deep message analysis is performed on the messages forwarded by the message processing module, and the analysis processing results are recorded and stored in the database, or message events are sent to the automation equipment application system application through the message collection information event interface.

[0016] The message processing is specifically as follows: classifying the received and sent messages, extracting and recording key information, and performing statistics based on feature information; processing the messages that search the policy table and match the policy table items according to the policy actions, and for the messages with encryption and decryption configurations in the policy actions, encrypting and decrypting the messages through the interface provided by the encryption processing module, and copying the messages according to the policy actions and forwarding them to the management control and analysis module or other functional modules.

[0017] The configuration strategy includes message matching rules and corresponding policy actions, each matching rule corresponds to a policy action; the matching rules include one or more of time period, message source MAC, message destination MAC, Ethernet type, source IP address, destination IP address, IP protocol, source port, and destination port.

[0018] A message processing system for a network card of an electric power system automation device comprises: a network card driving module, a management control and analysis module, a message processing module, and an encryption processing module.

[0019] Beneficial effects: The network card device based on programmable network processing of the present invention can adapt to various industrial communication networks, analyze and process received messages, realize network business flow perception and security defense capabilities, and accelerate network processing through hardware. Without affecting the communication performance of the equipment, it can realize deep perception and preprocessing of network messages, realize flexible message distribution, have flexible scalability, and be easy to integrate new technologies and equipment; hardware encryption and security protection measures meet the urgent needs of strengthening security protection of new power systems, and have a promoting effect on improving the security of new power system communication networks and ensuring the reliable and stable operation of power systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 A block diagram of the hardware architecture of a network card for an electric power system automation device according to an embodiment of the present invention;

[0021] Figure 2 The present invention is a flow chart of a method for processing network card messages of power system automation equipment according to an embodiment of the present invention. DETAILED DESCRIPTION

[0022] The present invention will be further described below in conjunction with the accompanying drawings.

[0023] like Figure 1As shown, the network card hardware architecture of the power system automation equipment of the present invention includes a network interface subsystem, a hardware encryption / decryption subsystem, a programmable network processor subsystem, a management control subsystem, a message information storage device, a message processing strategy table, a device interface subsystem, an internal bus and a power supply circuit, and each subsystem is interconnected through a data bus and a control bus for data exchange. Among them, the power system automation equipment includes servers, workstations, substation secondary equipment and other equipment used in the power system that exchange data through the network.

[0024] The network interface module in the network interface subsystem adapts to the external communication network interface, and the communication network interface includes Ethernet electrical port and optical port; the communication network module marks the receiving timestamp of the received message; according to the configuration of whether to bypass the hardware encryption / decryption module issued by the management control module, the message is sent to the programmable network processor or the hardware encryption / decryption module; the network interface module integrates the IEEE1588 protocol function and performs network time synchronization according to the configuration; the network interface module has the HSR / PRP interface function and is connected to a high-reliability redundant network.

[0025] The hardware encryption / decryption subsystem performs decryption, encryption and message encapsulation of network sent and received messages according to the configured keys and algorithms; encrypts or decrypts the message content transmitted by the programmable network processor according to the configured keys and algorithms and returns the results to the programmable network processor.

[0026] Programmable network processor subsystem, the network processor is a programmable hardware network message processor, the network processor execution program is updated by the management and control subsystem; it has a data read and write interface with the memory and policy table device; the network processor parses, classifies, counts and processes the received message information according to the execution program and function configuration information and saves the processing results in the memory; it retrieves the policy table from the message field according to the function configuration information, and the message matching the policy table is processed according to the policy, such as message forwarding, traffic speed limit, redirection, and discard.

[0027] The management and control subsystem is implemented by a multi-core processor and peripheral circuits. It receives the configuration information sent by the device CPU through the network card driver configuration interface and converts it into network card configuration and sends it to each functional module; reads the message information in the memory according to the control information and returns it to the device CPU; receives the message forwarded by the network processor and analyzes it. The analysis results are stored in the memory and sent to the device CPU according to the configuration.

[0028] The message processing strategy table stores the hardware algorithm lookup table of the message processing rules; the message processing rules are issued by the management control module; the table lookup information issued by the programmable network processor is received, the table lookup is performed through the hardware algorithm, and the table lookup result is returned.

[0029] The device interface subsystem is an interface for communicating with the message processing unit in the automation equipment, including data channels and control channels. Interface types include but are not limited to high-speed interfaces such as PCIE, USB, and Serdes.

[0030] like Figure 2 As shown, the message processing method of the power system automation equipment network card of the present invention comprises the following steps:

[0031] S1. Network card driver: configure and manage the hardware subsystems of the network card, provide network card configuration management interface, message collection information event interface and service, message data sending and receiving interface, specifically:

[0032] After power-on, the network card driver module first initializes the network card and registers the device information to the automation equipment application system. The automation equipment application function sends configuration information such as message encryption and decryption function configuration, message information collection function configuration, and message distribution and processing function through the network card driver module.

[0033] The message collection information includes message flow feature information, message flow traffic statistics, message flow message first entry time, message flow information update time, etc. Message flow feature information includes message source MAC, message destination MAC, Ethernet type, source IP address, destination IP address, IP protocol, source port, and destination port.

[0034] The message collection information event interface and service provide the automation equipment application system with interfaces for reading and deleting message collection information and an interface for sending message flow change events. The message data receiving and sending interface is a data message receiving and sending interface provided to the automation equipment application system.

[0035] S2. Management control and analysis: According to the information collection instructions and message processing instructions issued by the configuration, the collected information and messages are analyzed, processed, recorded and stored, specifically:

[0036] According to the configuration information, information collection instructions and message processing instructions, the collected network message information is analyzed and processed, and the processing results are recorded and stored in the database; deep message analysis is performed on the messages forwarded by the message processing module, and the analysis and processing results are recorded and stored in the database, or message events are sent to the automation equipment application system application through the message collection information event interface.

[0037] S3, message processing: Analyze, count, copy and forward received and sent messages according to the configuration strategy, and store and record the analysis and processing results, specifically:

[0038] Classify the received and sent messages, extract and record key information, and perform statistics based on feature information; process the messages that search the policy table and match the policy table items according to the policy action. For messages with encryption and decryption configuration in the policy action, encrypt and decrypt the messages through the interface provided by the encryption processing module. Copy the messages according to the policy action and forward them to the management control and analysis module or other functional modules.

[0039] The configuration strategy includes message matching rules and corresponding policy actions. Each matching rule corresponds to a policy action. The matching rules include one or more of time period, message source MAC, message destination MAC, Ethernet type, source IP address, destination IP address, IP protocol, source port, and destination port. The policy actions include message encryption and decryption, discard, statistics, bandwidth limitation, redirection, copy and forwarding, etc.

[0040] S4, encryption processing: Provide hardware encryption and decryption function interfaces to other functional modules, encrypt and decrypt input messages or data according to the configured keys and algorithms. The encryption and decryption keys and algorithms are configured and issued by the automation equipment application system through the network card driver module. The automation equipment application system runs on the main control CPU of the automation equipment, including the operating system and automation business application functions.

[0041] The message processing system of the network card of the power system automation equipment of the present invention comprises: a network card driving module, a management control and analysis module, a message processing module, and an encryption processing module.

[0042] Example

[0043] like Figure 1 As shown, a network card hardware architecture of power system automation equipment includes a network interface subsystem, a hardware encryption / decryption subsystem, a programmable network processor subsystem, a management control subsystem, a message information storage device, a message processing strategy table, a device interface subsystem, an internal bus and peripheral circuits of each module. The subsystems are interconnected through a data bus and a control bus for data exchange.

[0044] In this embodiment, the network interface subsystem is composed of a programmable device FPGA, a PHY chip and its peripheral circuits, and the network side interface includes a standard Ethernet electrical port and an optical port; the interface function implemented by the FPGA provides a configuration interface, and the interface configuration parameters are issued by the network card management and control subsystem; the FPGA implements the receiving timestamp of the received message when it enters the network card; according to the bypass hardware encryption / decryption module configuration issued by the management and control subsystem, the message is sent to the programmable network processor or the hardware encryption / decryption module; the IEEE1588 protocol function is implemented on the FPGA, and the network time synchronization is performed according to the configuration; the HSR / PRP interface function is implemented on the FPGA to realize the reception and copying and sending of redundant network messages, and access to a high-reliability redundant network.

[0045] The hardware encryption / decryption subsystem is implemented using programmable logic devices FPGA and commercial hardware encryption and decryption chips, and decrypts, encrypts and encapsulates network sent and received messages according to the configured keys and algorithms; the function control program implemented by FPGA encrypts or decrypts the message content transmitted by the programmable network processor according to the configured keys and algorithms and returns the results to the programmable network processor.

[0046] Programmable network processor subsystem: The programmable network processor adopts the commercial NP (network processor) of Ezchip Company. It parses, classifies, counts and processes the received messages according to the executed network processor function program and function configuration information and saves the processing results in the memory. It retrieves the policy table for message field search according to the function configuration information, and forwards, limits the flow rate, redirects, discards and other processes according to the policy for the messages matching the policy table.

[0047] The management and control subsystem is implemented by a multi-core ARM processor and peripheral circuits. It receives the configuration information sent by the automation equipment application system through the network card driver configuration interface and converts it into network card configuration and sends it to each functional subsystem; reads the message collection information in the memory according to the control information and returns it to the automation equipment application system; receives the message forwarded by the network processor and analyzes it. The analysis results are stored in the memory and sent to the automation equipment application system according to the configuration.

[0048] The message processing strategy table is implemented by FPGA as a hardware lookup algorithm and strategy table, and the management and control subsystem sends the message processing rule table item configuration; it receives the table lookup information of the programmable network processor, looks up the table through the hardware algorithm and returns the table lookup result to the programmable network processor.

[0049] In this embodiment, the device interface subsystem is implemented using a PCIE interface and peripheral circuits, is connected and installed with an automation equipment backplane using a standard PCIE network card interface, and provides a control bus and a data bus through the PCIE interface.

[0050] like Figure 2 As shown, a method for processing network card messages of power system automation equipment includes the following steps:

[0051] S1. Network card driver: configure and manage the hardware subsystems of the network card, provide network card configuration management interface, message collection information event interface and service, and message data sending and receiving interface.

[0052] S2. Management control and analysis: According to the information collection instructions and message processing instructions issued by the configuration, the collected information and messages are analyzed, processed, recorded and stored.

[0053] S3. Message processing: Analyze, count, copy and forward received and sent messages according to the configured strategy, and store and record the analysis and processing results.

[0054] S4, encryption processing: provide hardware encryption and decryption function interfaces to other functional modules, encrypt and decrypt input messages or data according to the configured keys and algorithms. The encryption and decryption keys and algorithms are configured and issued by the automation equipment application system through the network card driver module.

[0055] A network card message processing system for power system automation equipment comprises: a network card driving module, a management control and analysis module, a message processing module, and an encryption processing module.

[0056] The application function configures and manages the network card through the control interface provided by the network card driver, sets the interface parameters such as the network card working mode, network message processing function parameters, encryption module parameters and other network card configuration parameters, and sends and reads them; obtains the data flow event information collected by the network card through the message flow event service interface, including new message flows, aging message flows, business flow traffic exceeding the limit, real-time business flow bandwidth and other events; and sends and receives messages interactively with the network card through the data bus interface.

[0057] The network card driver module runs on the device CPU and provides the network card control interface, the network card message flow event service interface and the data bus interface for message sending and receiving. In addition to the configuration and management of the network card operation function, it also provides the system with the network card message collection information event interface and service. The application function of the automation equipment sends the message encryption processing configuration, message information collection configuration, and message distribution processing configuration through the network card driver module.

[0058] The management, control and analysis module runs on the multi-core ARM processor on the network card, manages and controls the various functional modules of the network card, receives the configuration function parameters sent by the device CPU and sends them to the functional modules of the corresponding network card according to the functions, responds to the configuration reading instructions of the device CPU and returns the configuration information; monitors the message flow information collected by the management message processing module and provides message flow event services, deeply analyzes the received messages and records the analysis results.

[0059] The message processing module functions are implemented on the network processor. The multi-core processor integrated on the network card manages and controls the various functional modules of the network card, receives the configuration function parameters issued by the device CPU and issues them to the functional modules of the corresponding network card according to the functions, responds to the configuration reading instructions of the device CPU and returns the configuration information; monitors the message flow information collected by the management message processing module and provides message flow event services, performs in-depth analysis on the received messages and records the analysis results.

[0060] The encryption processing module provides hardware encryption and decryption services, and encrypts and decrypts the input messages or data according to the configured keys and algorithms. When the network-side encryption function is configured, the messages from the network processing module are encrypted according to the keys and encryption algorithms and transmitted to the network interface, and the messages from the network interface are decrypted. After decryption, the messages are transmitted to the message processing module; when the encryption service function is configured, the data transmitted by the message processing module is encrypted and decrypted, and returned to the message processing module.

[0061] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0062] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0063] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0064] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

Claims

1. A network card hardware architecture for power system automation equipment, characterized in that: It includes a network interface subsystem, a hardware encryption / decryption subsystem, a programmable network processor subsystem, a management and control subsystem, a message information storage device, a message processing strategy table, a device interface subsystem, an internal bus and a power supply circuit. The subsystems are interconnected through a data bus and a control bus for data exchange.

2. The power system automation equipment network card hardware architecture according to claim 1, characterized in that: The network processor in the programmable network processor subsystem is a programmable hardware network message processor, and the network processor execution program is updated by the management control subsystem; there is a data read and write interface with the memory and the policy table device; the network processor processes the message information of the received message according to the execution program and the function configuration information and stores the processing result in the memory; the policy table is searched by the message field according to the function configuration information, and the message matching the policy table is processed according to the policy.

3. The power system automation equipment network card hardware architecture according to claim 1, characterized in that: The network interface module in the network interface subsystem is adapted to the external communication network interface.

4. The power system automation equipment network card hardware architecture according to claim 1, characterized in that: The device interface subsystem is an interface for communicating with a message processing unit in an automation device.

5. The power system automation equipment network card hardware architecture according to claim 1, characterized in that: The hardware encryption / decryption subsystem performs decryption, encryption and message encapsulation of network received and sent messages according to the configured keys and algorithms.

6. The power system automation equipment network card hardware architecture according to claim 1, characterized in that: The message processing strategy table stores a hardware algorithm lookup table of message processing rules; the management control module issues message processing rules; receives table lookup information issued by the programmable network processor, looks up the table through the hardware algorithm and returns the table lookup result.

7. The power system automation equipment network card hardware architecture according to claim 1, characterized in that: The management and control subsystem is implemented by a multi-core processor and peripheral circuits. It receives the configuration information sent by the device CPU through the network card driver configuration interface and converts it into network card configuration and sends it to each functional module; reads the message information in the memory according to the control information and returns it to the device CPU; receives the message forwarded by the network processor and analyzes it. The analysis results are stored in the memory and sent to the device CPU according to the configuration.

8. A message processing method for a network card of an electric power system automation device, characterized in that: The following steps are involved: Network card driver: configure and manage the hardware subsystems of the network card, provide network card configuration management interface, message collection information event interface and service, message data sending and receiving interface; Management control and analysis: Analyze and process the collected information and messages according to the information collection instructions and message processing instructions issued by the configuration, and record and store them; Message processing: Process received and sent messages according to the configured strategy, analyze the processing results and store and record them; Encryption processing: Provide hardware encryption and decryption function interfaces to other functional modules, encrypt and decrypt input messages or data according to the configured keys and algorithms. The encryption and decryption keys and algorithms are configured and issued by the automation equipment application system through the network card driver module.

9. A message processing method for a network card of an electric power system automation device according to claim 8, characterized in that: The network card driver is specifically as follows: after power-on, the network card driver module first initializes the network card, registers device information to the automation device application system, and the automation device application function sends configuration information through the network card driver module.

10. The message processing method of a power system automation equipment network card according to claim 8, characterized in that: The management control and analysis specifically includes: analyzing and processing the collected network message information according to the configuration information, information collection instructions and message processing instructions, and recording and storing the processing results in the database; Perform deep message analysis on the messages forwarded by the message processing module, record and store the analysis results in the database, or send message events to the automation equipment application system application through the message collection information event interface.

11. The message processing method of a network card of an electric power system automation device according to claim 8, characterized in that: The message processing is specifically as follows: classifying received and sent messages, extracting and recording key information, and performing statistics based on feature information; processing messages that search the policy table and match the policy table items according to policy actions, and for messages with encryption and decryption configurations in the policy actions, encrypting and decrypting the messages through the interface provided by the encryption processing module, and copying the messages according to the policy actions and forwarding them to the management control and analysis module or other functional modules.

12. A message processing method for a network card of an electric power system automation device according to claim 11, characterized in that: The configuration strategy includes message matching rules and corresponding policy actions, each matching rule corresponds to a policy action; the matching rules include one or more of time period, message source MAC, message destination MAC, Ethernet type, source IP address, destination IP address, IP protocol, source port, and destination port.

13. A message processing system for a network card of an electric power system automation equipment, characterized in that: include: Network card driver module, management control and analysis module, message processing module, encryption processing module.

Images