Method and system for multi-level management and control of CMS protocol message control command

Abstract

The invention discloses a CMS protocol message control command multi-level management and control method and system, and belongs to the technical field of power grid network security. The method comprises the following steps of: accessing a CMS protocol message management and control device to a network in a serial mode, and importing a full-station SCD file into the device and analyzing the full-station SCD file; after the device detects a CMS protocol control message, the CMS protocol control message is compared with an SCD analysis result, if the comparison is not passed, management and control measures are implemented, and otherwise, the next step is continued; the device detects whether the controlled device is online or not, if not, management and control measures are taken, and otherwise, the next step is continued; the device detects control time deviation, if the deviation is larger than a threshold value, management and control measures are taken, and otherwise, the next step is continued; the device detects whether the control command is enabled or not, if not, management and control measures are implemented, and otherwise, the next step is continued; and the device implements management and control measures when detecting the attack of the CMS protocol control message, or releases the CMS protocol control message. According to the method, the multi-level security check of the CMS protocol control message is realized, and the communication security of the autonomous controllable transformer substation is ensured.

Description

Technical Field

[0001] The present invention belongs to the technical field of power grid network security, and in particular relates to a method for multi-level management and control of CMS protocol message control commands. Background Art

[0002] As substation equipment and protocols gradually become autonomous and controllable, the original MMS (Manufacturing Message Specification) protocol is replaced by the CMS protocol. At the same time, substation control commands have received widespread attention, as erroneous or malicious control commands may cause serious power grid accidents, and any unauthorized or malicious control attacks will pose a threat to substations.

[0003] The existing CMS protocol is designed with two communication modes: plain text and cipher text. The cipher text mode has taken security into consideration, including encryption and signature, but the plain text mode lacks a security verification mechanism for the control mechanism. The communication messages actually used on site are often mainly plain text, which poses a hidden danger to the safe operation of the substation. Summary of the invention

[0004] In order to solve the deficiencies in the prior art for controlling the control messages of the CMS protocol, the present invention provides a method for multi-level control of CMS protocol message control commands, which performs whitelist comparison and comprehensive analysis on various fields of the control message and the behavior of the control message, thereby realizing multi-level security verification of the CMS protocol control message and ensuring the communication security of the autonomous and controllable substation.

[0005] The present invention adopts the following technical solution.

[0006] A first aspect of the present invention provides a method for multi-level control of CMS protocol message control commands, comprising:

[0007] Step 1: Connect the CMS protocol message control device to the network in serial mode, import the whole station SCD file into the CMS protocol message control device and parse it to obtain the SCD parsing result;

[0008] Step 2: After the CMS protocol message control device detects the CMS protocol control message, it compares the CMS protocol control message with the SCD parsing result. If the comparison fails, control measures are implemented. If the comparison passes, the next step is continued;

[0009] Step 3: The CMS protocol message control device detects whether the device controlled by the CMS protocol control message is online. If it is not online, control measures are implemented. If it is online, the next step is continued;

[0010] Step 4: The CMS protocol message control device detects the control time deviation from the CMS protocol control message. If the deviation is greater than the time threshold, control measures are implemented. If the deviation is less than the time threshold, the next step is continued.

[0011] Step 5: The CMS protocol message control device detects whether the control command in the CMS protocol control message is enabled. If not, control measures are implemented. If enabled, proceed to the next step.

[0012] Step 6: When the CMS protocol message control device detects a CMS protocol control message attack, it implements control measures, otherwise it releases the CMS protocol control message to implement CMS protocol message control command control.

[0013] Preferably, in step 1, the CMS protocol message control device is connected to the network in a serial manner, and the network traffic flows in from one network port of the CMS protocol message control device and flows out from another network port, and the CMS protocol message control device analyzes and controls the messages therein.

[0014] Preferably, in step 2, the CMS protocol control message is compared with the SCD parsing result, the communication parameters and control parameters of the CMS protocol control message are checked, and it is detected whether the communication parameters and control parameters exist in the SCD parsing result. If they exist in the SCD parsing result, the comparison passes, otherwise the comparison fails.

[0015] Preferably, in step 3, the CMS protocol message control device detects whether the device controlled by the CMS protocol control message is online, and the detection methods include: link detection, ARP detection and ICMP detection.

[0016] Preferably, in step 4, the CMS protocol message control device detects the control time deviation from the CMS protocol control message, and pre-sets a time threshold for the control time deviation by comparing the CMS protocol message control device time with the timestamp in the CMS protocol control message.

[0017] Preferably, in step 5, the CMS protocol message control device detects whether the control command in the CMS protocol control message is enabled, including:

[0018] Use the configuration tool to set the control permission flag in the CMS protocol message control device to enabled. The control permission flag is normally disabled. Determine whether the CMS protocol message control device performs a control operation based on the control command in the CMS protocol control message. When it is determined that the CMS protocol message control device performs a control operation, the control permission flag is set to enabled and a timeout period is set. After the timeout, the control permission flag automatically becomes disabled.

[0019] Preferably, in step 6, if the number of unconfirmed control messages sent within a unit time exceeds a set number threshold, it is determined to be a CMS protocol control message attack.

[0020] Preferably, the control measures include session blocking, link blocking and network port blocking, and the CMS protocol messages are controlled according to the configured control measures.

[0021] Preferably, the session blocking in the control measure only blocks the current TCP connection;

[0022] Link blocking blocks all CMS links between the source and destination;

[0023] Network port blocking sets the network port of the CMS protocol message control device to a closed state.

[0024] A second aspect of the present invention provides a system for multi-level control of CMS protocol message control commands, which is used to run a method for multi-level control of CMS protocol message control commands, including:

[0025] SCD parsing module: used to connect the CMS protocol message control device to the network in serial mode, import the whole station SCD file into the CMS protocol message control device and parse it to obtain the SCD parsing result;

[0026] Message comparison module: After the CMS protocol message control device detects the CMS protocol control message, it compares the CMS protocol control message with the SCD parsing result to obtain the comparison result;

[0027] Online detection module: used by the CMS protocol message control device to detect whether the device controlled by the CMS protocol control message is online and obtain the online result;

[0028] Time deviation detection module: used for the CMS protocol message control device to detect the control time deviation of the CMS protocol control message and obtain the time deviation detection result;

[0029] Enable detection module: used for the CMS protocol message control device to detect whether the control command in the CMS protocol control message is enabled, and obtain the enable detection result;

[0030] Attack message detection module: used for the CMS protocol message control device to detect whether the CMS protocol control message is a message attack and obtain the message attack result;

[0031] Management and control module: used to implement CMS protocol message control command management when the comparison result is failed, the online result is offline, the deviation result is greater than the time threshold, the enable result is disabled, and the message attack result is message attack.

[0032] The beneficial effect of the present invention is that, compared with the prior art, the present invention controls the issuance of CMS protocol control commands, provides a method for multi-level control of CMS protocol message control commands, and achieves the purpose of controlling such messages by serially accessing the control device in the communication channel and analyzing the various fields and behaviors of the control messages, thereby further enhancing the communication security of the substation. In order to solve the above problems, it is necessary to control the issuance of CMS protocol control commands. By serially accessing the control device in the communication channel and analyzing the various fields and behaviors of the control messages, the purpose of controlling such messages is achieved, thereby further enhancing the communication security of the substation. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 This is a schematic diagram of multi-level blocking of CMS protocol control messages. DETAILED DESCRIPTION

[0034] In order to make the purpose, technical scheme and advantages of the present invention clearer, the technical scheme of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. The embodiments described in this application are only part of the embodiments of the present invention, not all of them. Based on the spirit of the present invention, other embodiments obtained by ordinary technicians in this field without creative work are all within the scope of protection of the present invention.

[0035] The present invention is further described below. The following examples are only used to more clearly illustrate the technical solution of the present invention, and are not intended to limit the protection scope of the present invention.

[0036] Embodiment 1 of the present invention provides a method for multi-level control of CMS protocol message control commands, which implements security control of CMS control operations by serially accessing a CMS protocol message control device in a communication channel, performing layer-by-layer analysis, logical judgment, and behavior analysis on the CMS control messages passing through, and includes the following contents:

[0037] Step 1: The CMS protocol message control device is serially connected to the network, the whole station SCD file is imported, and the SCD analysis result is obtained after analysis;

[0038] The CMS protocol message control device is connected to the network in serial mode. The network traffic flows in from one network port of the CMS protocol message control device and flows out from another network port. The CMS protocol message control device can analyze and control the messages therein. The whole station SCD (substation configuration description) file is imported into the CMS protocol message control device and parsed. Here, the communication pair and remote control parameters of the CMS link in the SCD file are mainly parsed. For example, the IP of the CMS server is parsed to be 192.168.1.100, 192.168.1.101... The IP of the CMS client is 192.168.1.200. For example, if it is parsed that the remote control object in the device at 192.168.1.100 is CSWI0$CO$Pos$SBOW, the parsing result of SCD is stored in the CMS protocol message control device.

[0039] Step 2: After the CMS protocol message control device detects the CMS protocol control message, it compares it with the SCD analysis result obtained in step 1. If the comparison fails, control measures are implemented. If the comparison passes, the next step is continued.

[0040] After the device detects the CMS protocol control message, it compares it with the SCD parsing result and verifies the communication parameters and control parameters of the CMS protocol control message. The communication parameters correspond to the communication pairs in the SCD parsing result, and the control parameters correspond to the remote control parameters in the SCD parsing result. The verification here is to ensure that both the communication parameters and the control parameters exist in the SCD parsing result. Only if they exist in the SCD parsing result are they legal, such as detecting whether the client and server IP addresses of the CMS protocol control message are in the SCD parsing result, and whether the remote control object corresponding to the device in the CMS protocol control message exists. If it exists in the SCD parsing result, the comparison passes, otherwise the comparison fails. If the comparison fails, control measures are implemented. If the comparison passes, continue to the next step; if it is not a CMS protocol control message, the message is released.

[0041] Step 3: When the comparison result of step 2 fails, control measures are implemented. When the comparison result passes, the CMS protocol message control device detects whether the control device is online and obtains the online detection result;

[0042] The device detects whether the device controlled by the CMS protocol control message is online, and the detection method includes at least: link detection, ARP detection, and ICMP detection. The link detection can obtain information based on the TCP link that has been established by the two communicating parties. If there is a link 192.168.1.200:31942-192.168.1.100:8102, and the link is not closed, it can be determined that the controlled object 192.168.1.100 is online. ARP detection and ICMP detection can be used as auxiliary judgment methods, and the device periodically detects the offline status of the controlled object. The results of the main judgment method and the auxiliary judgment method may be inconsistent. For example, if there is a forged link, it is necessary to comprehensively evaluate all information and combine other security measures to make a final judgment. The main judgment method is the main one, and the auxiliary judgment method is used as verification. If the main method cannot be determined, refer to the results of the auxiliary means. The initiator of the control message is the client, and the control device is between the client and the server. If it is not online, implement control measures. If it is online, continue to the next step;

[0043] Step 4: The CMS protocol message control device detects the control time deviation from the CMS protocol control message. If the deviation is greater than the time threshold, control measures are implemented. If the deviation is less than the time threshold, the next step is continued.

[0044] The CMS protocol message control device detects and controls time deviation, which is obtained by comparing the CMS protocol message control device time with the timestamp in the CMS protocol control message. The CMS protocol message control device detects the time deviation with the CMS protocol control message, and the time threshold can be set in advance. The premise of time deviation judgment is that all substation devices are configured with time synchronization. If all devices are synchronized, it means that the time of both parties of CMS communication is consistent with the time of the message control device. The substation device includes both parties of CMS communication, and its communication messages will pass through the CMS protocol message control device. The judgment of time deviation can prevent replay attacks to a certain extent. If the deviation is greater than the time threshold, control measures are implemented. If the deviation is less than the time threshold, proceed to the next step;

[0045] Step 5: The CMS protocol message control device detects whether the control command in the CMS protocol control message is enabled. If not, control measures are implemented. If enabled, proceed to the next step.

[0046] The CMS protocol message control device detects whether the control command in the CMS protocol control message is enabled. The specific implementation includes:

[0047] The control permission flag in the CMS protocol message control device is set to enabled through the configuration tool. The control permission flag is normally in the disabled state and is enabled only when a control operation is required. The control command in the CMS protocol control message determines whether the CMS protocol message control device needs to perform a control operation. When it is determined that the CMS protocol message control device needs to perform a control operation, the control permission flag is enabled. When the timeout period is exceeded, the flag automatically becomes disabled. The timeout period can be configured. The implementation of this function depends on the operation permission tool installed on the CMS protocol message control device. When remote control operation is required, the remote control monitoring personnel open the control authority. If remote control is allowed at this time, it is necessary to use the tool to set this state in the CMS protocol message control device to remote control enablement first, because the CMS protocol control message passes through the message control device, and this device can control the CMS protocol control message. One of the bases for control is the state of remote control enablement. If it is not enabled, implement control measures. If it is enabled, proceed to the next step.

[0048] Step 6: When the CMS protocol message control device detects a CMS protocol control message attack, it implements control measures, otherwise it releases the message to implement CMS protocol message command control.

[0049] When the CMS protocol message control device detects a CMS protocol control message attack, it means that the number of unconfirmed CMS protocol control messages sent within a unit time exceeds the set threshold. Usually, during remote control operation, only one object is operated at a time, and the control of the next object is continued after the current object is operated. The message of each control process has a command message sent and a remote control confirmation message replied. If there are a large number of CMS protocol control messages but no corresponding reply messages, it is possible that the network has been attacked and control measures need to be implemented;

[0050] The above control measures include session blocking, link blocking, and network port blocking, which can be configured and implemented according to the configured control measures. Session blocking in the control measures is to block the CMS link. At this time, only the current TCP link is blocked, such as disconnecting the above 192.168.1.200:31942-192.168.1.100:8102; link blocking is to block all CMS links between the source and the destination, such as disconnecting all 192.168.1.200 and 192.168.1.100 links, and these two devices can no longer establish new links; network port blocking is to set the device's network port to a closed state.

[0051] Embodiment 2 of the present invention provides a system for multi-level control of CMS protocol message control commands, which is used to run a method for multi-level control of CMS protocol message control commands provided in Embodiment 1, including:

[0052] SCD parsing module: used to connect the CMS protocol message control device to the network in serial mode, import the whole station SCD file into the CMS protocol message control device and parse it to obtain the SCD parsing result;

[0053] Message comparison module: After the CMS protocol message control device detects the CMS protocol control message, it compares the CMS protocol control message with the SCD parsing result to obtain the comparison result;

[0054] Online detection module: used by the CMS protocol message control device to detect whether the device controlled by the CMS protocol control message is online and obtain the online result;

[0055] Time deviation detection module: used for the CMS protocol message control device to detect the control time deviation of the CMS protocol control message and obtain the time deviation detection result;

[0056] Enable detection module: used for the CMS protocol message control device to detect whether the control command in the CMS protocol control message is enabled, and obtain the enable detection result;

[0057] Attack message detection module: used for the CMS protocol message control device to detect whether the CMS protocol control message is a message attack and obtain the message attack result;

[0058] Management and control module: used to implement CMS protocol message control command management when the comparison result is failed, the online result is offline, the deviation result is greater than the time threshold, the enable result is disabled, and the message attack result is message attack.

[0059] The beneficial effect of the present invention is that, compared with the prior art, the present invention controls the issuance of CMS protocol control commands, provides a method for multi-level control of CMS protocol message control commands, and achieves the purpose of controlling such messages by serially accessing the control device in the communication channel and analyzing the various fields and behaviors of the control messages, thereby further enhancing the communication security of the substation. In order to solve the above problems, it is necessary to control the issuance of CMS protocol control commands. By serially accessing the control device in the communication channel and analyzing the various fields and behaviors of the control messages, the purpose of controlling such messages is achieved, thereby further enhancing the communication security of the substation.

[0060] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for multi-level control of CMS protocol message control commands, characterized in that: include: Step 1: Connect the CMS protocol message control device to the network in serial mode, import the whole station SCD file into the CMS protocol message control device and parse it to obtain the SCD parsing result; Step 2: After the CMS protocol message control device detects the CMS protocol control message, it compares the CMS protocol control message with the SCD parsing result. If the comparison fails, control measures are implemented. If the comparison passes, the next step is continued; Step 3: The CMS protocol message control device detects whether the device controlled by the CMS protocol control message is online. If it is not online, control measures are implemented. If it is online, the next step is continued; Step 4: The CMS protocol message control device detects the control time deviation from the CMS protocol control message. If the deviation is greater than the time threshold, control measures are implemented. If the deviation is less than the time threshold, the next step is continued. Step 5: The CMS protocol message control device detects whether the control command in the CMS protocol control message is enabled. If not, control measures are implemented. If enabled, proceed to the next step. Step 6: When the CMS protocol message control device detects a CMS protocol control message attack, it implements control measures to achieve CMS protocol message control command control.

2. According to claim 1, a method for multi-level control of CMS protocol message control commands is characterized in that: In step 1, the CMS protocol message control device is connected to the network in serial mode, and the network traffic flows in from one network port of the CMS protocol message control device and flows out from another network port. The CMS protocol message control device analyzes and controls the messages therein.

3. According to claim 1, a method for multi-level control of CMS protocol message control commands is characterized in that: In step 2, the CMS protocol control message is compared with the SCD parsing result, the communication parameters and control parameters of the CMS protocol control message are checked, and it is detected whether the communication parameters and control parameters exist in the SCD parsing result. If they exist in the SCD parsing result, the comparison passes, otherwise the comparison fails.

4. A method for multi-level management and control of CMS protocol message control commands according to claim 1, characterized in that: In step 3, the CMS protocol message control device detects whether the device controlled by the CMS protocol control message is online, and the detection methods include: link detection, ARP detection and ICMP detection.

5. A method for multi-level control of CMS protocol message control commands according to claim 1, characterized in that: In step 4, the CMS protocol message control device detects the control time deviation from the CMS protocol control message, and pre-sets the time threshold of the control time deviation by comparing the CMS protocol message control device time with the timestamp in the CMS protocol control message.

6. A method for multi-level control of CMS protocol message control commands according to claim 1, characterized in that: In step 5, the CMS protocol message control device detects whether the control command in the CMS protocol control message is enabled, including: Use the configuration tool to set the control permission flag in the CMS protocol message control device to enabled. The control permission flag is normally disabled. Determine whether the CMS protocol message control device performs a control operation based on the control command in the CMS protocol control message. When it is determined that the CMS protocol message control device performs a control operation, the control permission flag is set to enabled and a timeout period is set. After the timeout, the control permission flag automatically becomes disabled.

7. A method for multi-level management and control of CMS protocol message control commands according to claim 1, characterized in that: In step 6, if the number of unconfirmed control messages sent within a unit time exceeds the set number threshold, it is determined to be a CMS protocol control message attack.

8. A method for multi-level management and control of CMS protocol message control commands according to claim 1, characterized in that: The control measures include session blocking, link blocking, and network port blocking. CMS protocol messages are controlled according to the configured control measures.

9. A method for multi-level management and control of CMS protocol message control commands according to claim 8, characterized in that: The session blocking in the control measures only blocks the current TCP connection; Link blocking blocks all CMS links between the source and destination; Network port blocking sets the network port of the CMS protocol message control device to a closed state.

10. A system for multi-level control of CMS protocol message control commands, used to run a method for multi-level control of CMS protocol message control commands according to any one of claims 1 to 9, characterized in that: SCD parsing module: used to connect the CMS protocol message control device to the network in serial mode, import the whole station SCD file into the CMS protocol message control device and parse it to obtain the SCD parsing result; Message comparison module: After the CMS protocol message control device detects the CMS protocol control message, it compares the CMS protocol control message with the SCD parsing result to obtain the comparison result; Online detection module: used by the CMS protocol message control device to detect whether the device controlled by the CMS protocol control message is online and obtain the online result; Time deviation detection module: used for the CMS protocol message control device to detect the control time deviation of the CMS protocol control message and obtain the time deviation detection result; Enable detection module: used for the CMS protocol message control device to detect whether the control command in the CMS protocol control message is enabled, and obtain the enable detection result; Attack message detection module: used for the CMS protocol message control device to detect whether the CMS protocol control message is a message attack and obtain the message attack result; Management and control module: used to implement CMS protocol message control command management when the comparison result is failed, the online result is offline, the deviation result is greater than the time threshold, the enable result is disabled, and the message attack result is message attack.

Images