Electric power communication network system

Abstract

The invention discloses an electric power communication network system, which comprises an optical transmission network unit, a security access network unit, a 5G backup communication unit, a communication network management platform and a network security unit, the communication network management platform manages optical signal or electric signal transmission of the optical transmission network unit, the optical transmission network unit is in signal connection with the security access network unit, and the optical signal or the electric signal is transmitted to the user terminal through the security access network unit; the 5G backup communication unit is in signal connection with the optical transmission network unit to realize the reliability of network communication; and the network security unit is in signal connection with the security access network unit to realize the security of the security access network unit and the 5G backup communication unit. Wherein the security access network unit comprises a full-line optical network, the full-line optical network comprises an optical line terminal, an optical distribution network and an optical network unit at a user side which are in signal communication in sequence, and the other end of the optical line terminal is in signal connection with the optical transmission network unit.

Description

Technical Field

[0001] The present invention relates to the technical field of power systems, and in particular to a power communication network system. Background Art

[0002] As an indispensable and important part of the power system, the communication network system provides the guarantee basis for special communication services in the entire process of power generation, transformation, transmission, distribution and consumption. The power information communication system transmits a large amount of power grid information. For production automation, power marketing business, dispatching automation, office automation and other businesses, they all rely on high-speed, real-time, two-way information communication, creating a basic environment for the construction of power system infrastructure, the introduction of advanced technology, and the application of intelligent equipment, making power information communication and power grid construction inseparable.

[0003] With the development of new power systems, higher requirements are placed on the information and communication technology of power grids. In particular, the power production structure has undergone major changes, which has greatly changed the form of power communication networks, and has placed higher requirements on the performance of power communication networks that carry important production services. At the same time, the new power system has increased its demand for communication channels, and has also placed higher requirements on the coverage, security, latency, and reliability of communication networks. The existing communication network system is difficult to meet the level of communication network operation and maintenance guarantee, and thus cannot meet the needs of safe, stable, and efficient operation of large power grids. Summary of the invention

[0004] The purpose of the present invention is to provide an electric power communication network system, which solves the increasing demand for communication channels in new electric power systems and improves the coverage, security, latency and reliability of the communication network.

[0005] In order to achieve the above-mentioned purpose, the present invention provides a power communication network system, including: an optical transmission network unit, a secure access network unit, a 5G backup communication unit, a communication network management platform and a network security unit; the communication network management platform manages the transmission of optical signals or electrical signals of the optical transmission network unit, the optical transmission network unit and the secure access network unit are signal-connected, and the optical signal or electrical signal is transmitted to the user terminal through the secure access network unit; the 5G backup communication unit is signal-connected to the optical transmission network unit to achieve the reliability of network communication; the network security unit is signal-connected to the secure access network unit to achieve the security of the secure access network unit and the 5G backup communication unit;

[0006] The secure access network unit comprises: a full-line optical network; the full-line optical network distributes optical signals to multiple users through a passive optical splitter, including:

[0007] An optical line terminal is connected to the optical transmission network unit signal to perform conversion, frame processing and transmission management on the entire line optical network;

[0008] The optical network unit on the user side converts the optical signal transmitted by the optical fiber into an electrical signal and sends the electrical signal to each user;

[0009] The optical distribution network is respectively connected to the optical line terminal and the optical network unit on the user side, and provides an optical transmission medium for the optical network unit on the user side.

[0010] Optionally, the method for achieving communication network reliability includes:

[0011] The combination of 5G network, intelligent switching device and BFD intelligent host combines the high bandwidth and low latency characteristics of 5G network with the intelligent scheduling and fault detection capabilities of intelligent switching device and bidirectional forwarding detection intelligent host to achieve intelligent scheduling of network traffic and rapid recovery of faults.

[0012] The 5G network and optical fiber physical isolation technology realizes the isolation of the communication network at the physical level by carrying different services and data through the 5G network and the optical fiber network respectively.

[0013] Optionally, the 5G backup communication unit includes:

[0014] 5G slicing private network is a private network channel based on 5G slicing technology. It is connected to the optical transmission network unit signal and can allocate different virtual resources according to different scenario requirements on a unified communication network infrastructure.

[0015] Remote stations transmit data wirelessly with the 5G slice private network, enabling signals to cover remote areas and provide communication services.

[0016] Optionally, the method for implementing the security of the secure access network unit and the 5G backup communication unit includes: a trusted wireless local area network, and the protection method of the trusted wireless local area network includes:

[0017] Encryption technology, using strong encryption algorithms to encrypt data streams in wireless LANs;

[0018] Network isolation, using security protocol technology in wireless LAN to divide different users and devices into different network areas;

[0019] Update and maintain equipment regularly, and regularly update and perform necessary security maintenance on the firmware and software of wireless LAN equipment;

[0020] Authentication mechanism ensures that authorized devices can access the network.

[0021] Optionally, the method for implementing the security of the secure access network unit and the 5G backup communication unit further includes: a hyper-converged firewall, and the protection method of the hyper-converged firewall includes:

[0022] Deep packet inspection, which identifies and blocks potentially malicious traffic by deeply analyzing the contents of data packets;

[0023] Intelligent threat defense, which uses machine learning and artificial intelligence technologies to automatically identify and respond to new threats;

[0024] The integration of multiple security functions provides users with comprehensive security protection through intrusion detection and defense systems, virtual private networks and anti-virus functions.

[0025] Optionally, the network security unit includes: a wireless network security module, and the wireless network security module includes:

[0026] The certificate issuance function of the application server issues digital identity certificates for wireless access points and terminal devices by providing WAPI certificate issuance services;

[0027] The identity authentication function of the application server adopts a public key certificate system based on elliptic curves and uses a secure message hashing algorithm to ensure the integrity of the message;

[0028] User isolation function isolates different devices connected to the same wireless access point.

[0029] Optionally, the network security unit further includes:

[0030] The whole network security module provides a network function slice isolation mechanism for the 5G backup communication unit, and uses the IP-MAC binding function to associate the IP address and MAC address together;

[0031] Distributed denial of service attack protection module, connected to the secure access network unit signal, can expand the network bandwidth and increase server resources;

[0032] The external scanning attack defense module monitors user behavior by monitoring the rate at which network users initiate connections to the target system.

[0033] Optionally, the optical transmission network unit includes:

[0034] The optical layer can use substations to convert data from electrical signals to optical signals and transmit data through optical fibers;

[0035] The electrical layer, working in conjunction with the optical layer, can receive optical signals, convert the received optical signals into electrical signals, and process the electrical signals.

[0036] Optionally, the communication network management platform includes:

[0037] The topology centralized monitoring module is connected to the optical layer signal of the optical transmission network unit, which can monitor the operating status of all devices in real time and provide appropriate methods to modify the configuration of network parameters according to changes in the communication network operating environment;

[0038] The fault management module is connected to the electrical layer signal of the optical transmission network unit, and can monitor the faults and operating status of the entire network equipment in real time, collect statistics on historical data, and provide means to assist in troubleshooting;

[0039] The network performance management module is connected to the optical layer signal of the optical transmission network unit and can provide a means of monitoring the performance of large-scale communication networks;

[0040] The northbound interface is connected to the topology centralized monitoring module, the fault management module, and the network performance management module, so that the communication network management platform can complete fault, topology and resource queries;

[0041] The report management module is connected with the topology centralized monitoring module, fault management module, and network performance management module, and can provide template-based report development and Web-based report generation and distribution;

[0042] The device configuration file management module can provide rich configuration management capabilities for network devices and track device configuration changes.

[0043] Optionally, the full-line optical network also includes: the Internet of Things, which is connected to the electrical layer signals of the optical transmission network, supports mobile edge computing, supports Internet of Things services and 5G transmission, and can meet the unified access requirements of Internet of Things services such as intelligent inspection, mobile operations, and video surveillance.

[0044] Compared with the prior art, the technical solution of the present invention has at least the following beneficial effects:

[0045] In the passive optical LAN solution of the power communication network system described in the present invention, the substation constructs a backbone access network through an optical line terminal, and the terminal service access is realized through the optical network unit on the user side of different service types. The passive optical LAN uses an optical fiber passive optical splitter as its convergence layer, and does not require the multi-level active convergence nodes of the traditional campus network, making the communication network more flat; from the perspective of communication network investment, it can save the convergence layer, and at the same time save the corresponding machine room, power supply and air conditioning, thereby saving the total cost of ownership and making the communication network more green and environmentally friendly; the optical distribution network composed of passive optical splitters has a clear structure and is suitable for different business structures. WAPI adopts a ternary security architecture, and the three physical entities have independent identities, which truly realizes the direct two-way authentication of mobile terminals and wireless access points, effectively ensures the security of the air interface, and prevents counterfeit APs and phishing APs. At the same time, based on the combination of safe and controllable WAPI+POL technology, high-speed wired and wireless network coverage in the substation is realized, and EC is introduced at the service access level to realize the simultaneous access of IP services, Internet of Things services, auxiliary control services, and environmental monitoring services.

[0046] The electric power communication network system described in the present invention utilizes the communication network management platform to monitor the topology in a centralized manner, can monitor the operating status of all equipment in real time, and provide a suitable method to configure and modify network parameters according to changes in the communication network operating environment, to ensure that the communication network operates normally with optimal performance; at the same time, the fault management module monitors the faults and operating status of the entire network equipment in real time, historical statistics are collected, and means of assisting in troubleshooting are provided; the communication network performance management component provides a large-scale communication network performance monitoring means, monitors network performance from multiple levels of equipment, links, paths, and services, and serves as an indicator for judging the network operation quality status.

[0047] The electric power communication network system of the present invention utilizes a combination of 5G network and intelligent switching device + BFD intelligent host to realize intelligent scheduling of communication network traffic and rapid recovery of faults. At the same time, the electric power communication network system realizes physical isolation from optical fiber through 5G network, effectively preventing interference and conflict between different services and data, and improving the security and reliability of the communication network. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 It is a schematic diagram of the structure of the power communication network system of the present invention.

[0049] Figure 2 It is a schematic diagram of the structure of the optical transmission network unit in the electric power communication network system of the present invention.

[0050] Figure 3 It is a schematic diagram of the structure of a secure access network unit in the electric power communication network system of the present invention.

[0051] Figure 4 It is a structural schematic diagram of a 5G backup communication unit in the electric power communication network system of the present invention.

[0052] Figure 5 It is a structural schematic diagram of a communication network management platform in the electric power communication network system of the present invention.

[0053] Figure 6 It is a structural schematic diagram of a network security unit in the electric power communication network system of the present invention.

[0054] Figure 7 It is a schematic diagram of the architecture of the power communication network system of the present invention. DETAILED DESCRIPTION

[0055] The technical solution of the present invention will be described clearly and completely below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0056] In the description of the present invention, it should be noted that the terms "upper", "lower", "left", "right", "vertical", "horizontal", "inner", "outer", etc., indicating the orientation or positional relationship, are based on the orientation or positional relationship shown in the drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, the terms "first", "second", and "third" are used for descriptive purposes only, and cannot be understood as indicating or implying relative importance.

[0057] In the description of the present invention, it should be noted that, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0058] like Figure 1As shown, the present invention provides an electric power communication network system, including: an optical transmission network unit, a secure access network unit, a 5G backup communication unit, a communication network management platform and a network security unit. The communication network management platform can centrally dispatch and allocate communication resources, and can manage the transmission of communication signals (specifically optical signals or electrical signals) of the optical transmission network unit; the optical transmission network unit and the secure access network unit are signal-connected; the 5G backup communication unit and the optical transmission network are signal-connected; and the network security unit and the secure access network unit are signal-connected. The communication signal is output by the optical transmission network unit, and the communication signal is transmitted to the user terminal through the secure access network unit; at the same time, the optical transmission network unit realizes the reliability of 5G network communication through the 5G backup communication unit; the secure access network unit realizes the security of 5G network communication through the network security unit.

[0059] like Figure 2 As shown, the optical transmission network unit is an OSU optical transmission unit (Optical Service Unit), which has the ability to transmit hard pipes and the intensive ability of packet multiplexing, and can match the ability requirements of the power communication network. The optical transmission network unit achieves reliability in the following ways: key link protection and key board 1+1.

[0060] The critical link protection is to implement special protection measures on the critical links in the transmission path in the optical fiber communication network to ensure that these critical links can quickly restore communication when a failure occurs, thereby ensuring the stability and reliability of the entire network. The specific methods of critical link protection include: redundant links and automatic protection switching mechanisms. The redundant links are redundant optical cables and transmission paths deployed on the critical links. When the main link fails, it can automatically and manually switch to the backup link to achieve seamless switching; the automatic protection switching mechanism can monitor the communication status of the critical link in real time. Once a fault is found, the protection mechanism is immediately triggered to switch to the backup link.

[0061] The key board 1+1 is a dual-board redundant protection mechanism implemented on the key board of the fiber-optic communication equipment. Under this protection mode, each key board is equipped with a backup board. The main and backup boards work at the same time but only transmit the same data stream, and at the receiving end, the one with better signal quality is selected for reception. When the main board fails, the backup board will immediately take over the business to ensure that communication is not interrupted. The protection methods of the key board 1+1 include: concurrent transmission and single-end switching. The concurrent transmission is to send the same data stream to the main board and the backup board at the same time; the single-end switching monitors the signal quality at the receiving end, and automatically switches to the backup board to receive data when the signal quality of the main board decreases or fails.

[0062] The optical transmission network unit includes: an optical layer and an electrical layer. The optical layer can use the substation to convert data from electrical signals to optical signals and transmit the data through optical fibers. The initial bandwidth of the optical layer is 3×10G bandwidth, and each bandwidth channel can exclusively occupy a 10Gbps bandwidth channel to ensure the independence and efficiency of data transmission; at the same time, the optical layer can support upgrades to N×100G bandwidth configuration; where N is a variable, indicating that it can be upgraded to multiple 100Gbps bandwidth channels. The electrical layer works in conjunction with the optical layer, can receive optical signals, convert the received optical signals into electrical signals, and process the electrical signals; the electrical layer can support multiple rates and types of interfaces, including: 64k, E1, FE, GE, 10GE, STM-N.

[0063] The business capabilities of the optical transmission network unit include: supporting dispatching voice, supporting communication protocols, supporting dispatching data network and integrated data network services, supporting OSU (optical service unit) technology, being able to transmit voice signals, carry real-time control services of the power grid, and carry administrative office information data and financial, marketing and other management information data.

[0064] The communication protocols include: IEC-60870-101 and IEC-60870-104. The IEC-60870-101 is a protocol standard for communication between telecontrol equipment and systems in power systems, and is used for remote control, remote protection and related communications in power systems. The IEC-60870-104 is a communication protocol commonly used in power automation systems, and is used to monitor and control various devices in power systems.

[0065] The OSU technology uses OSU cards to support 2M / 10M / 100M high-efficiency small-granularity services. The OSU technology divides the OPUk (optical channel payload unit) payload area in the existing OTN (Optical Transport Network) system into multiple payload blocks, and defines the PB (Payload Block) base rate as 2.6Mbps, when one PB corresponds to one branch. When mapping multiplexed OSU flex to OPUk / flex payload, in order to identify the correspondence between OSU flex and branches, it is necessary to add TPN (branch port number) based on each OSU flex to identify the correspondence between each OSU flex and branch. TPN needs to ensure unique identification within the service layer to ensure that the receiving end can correctly distinguish the branch port number. The PB of the same TPN corresponds to one OSU flex pipeline. The role of TPN is the same as the MSI function of OTN, where MSI represents a signal with a rate of approximately n×100G.

[0066] The OSU TPN length is 12 bits, and each OPUk pipeline in a single-level mapping supports approximately 4k OSU connections (2 12 =4096), but the current chip needs to comprehensively consider the implementation complexity and the number of OSU links supported. The number of single OPUk pipeline connections supported by current equipment manufacturers is 1k. Taking single-level mapping as an example, a single-wave 100G can provide 1000 service connections, and a single optical fiber can achieve 120,000 hard slices (120 waves × 1000 = 120,000). Compared with traditional OTN (80 waves × 80 = 6,400), the number of service connections can be increased by 18.75 times, while supporting smaller-granular service access, it can also support more innovative applications in vertical industries.

[0067] like Figure 3 As shown, the secure access network unit adopts a combination of secure and controllable WAPI+POL network technologies to achieve high-speed wired and wireless network coverage within the power facilities, and introduces EC at the service access level to achieve simultaneous access to IP services, Internet of Things services, auxiliary control services and environmental monitoring services.

[0068] The secure access network unit is signal-connected to the optical transmission network unit, including: a full-line optical network (PON, Passive Optical LAN) and an Internet of Things. The full-line optical network is connected to the optical layer signal of the optical transmission network unit; the full-line optical network is a broadband access network that uses optical fiber as the transmission medium, and distributes optical signals to multiple users through a passive optical splitter to achieve sharing of a single optical fiber. The Internet of Things is connected to the electrical layer signal of the optical transmission network, and can receive electrical signals emitted by the electrical layer; the Internet of Things supports mobile edge computing (MEC, Mobile Edge Computing), supports Internet of Things services, supports 5G transmission, and can meet the unified access requirements of Internet of Things services such as intelligent inspection, mobile operations, and video surveillance.

[0069] like Figure 7 As shown, the full-line optical network includes: an optical line terminal (OLT), an optical network unit (ONU) on the user side, and an optical distribution network (ODN).

[0070] like Figure 7 As shown, the optical line terminal is set in the substation and is the starting point of the passive optical network. The optical line terminal is connected to the optical layer signal of the optical transmission network unit and connected to the core switch (POS) through an Ethernet cable. It can convert, frame process and transmit the entire line optical network, and coordinate the optical network terminal (i.e. Figure 7The optical network unit on the user side converts the optical signal transmitted by the optical fiber into an electrical signal and sends the electrical signal to each user. The optical distribution network is set in the passive optical splitter to establish a signal connection between the optical line terminal and the optical network unit on the user side, and can provide an optical transmission medium for the physical connection between the optical network unit on the user side and the optical line terminal at a distance of 20 kilometers or more.

[0071] Furthermore, the set of WAPI+POL network technologies can be divided into WAPI (security protocol in wireless LAN) technology and POL (passive optical LAN) solutions. In the passive optical LAN solution, the substation builds a backbone access network through an optical line terminal, and the terminal service access is realized through the optical network unit on the user side of different service types; the passive optical LAN uses a fiber passive optical splitter as its convergence layer, without the need for multi-level active convergence nodes of the traditional campus network, making the network flatter; from the perspective of network investment, saving the convergence layer also saves the corresponding computer room, power supply and air conditioning, saving the total cost of ownership (TCO), and making the network more green and environmentally friendly; the optical distribution network composed of passive optical splitters has a clear structure and is suitable for different business structures. The wireless LAN technology adopts a ternary security architecture, and the three physical entities have independent identities, which truly realizes the direct two-way authentication of mobile terminals and wireless access points, effectively ensures the security of the air interface, and prevents fake APs and phishing APs from the security mechanism.

[0072] The secure access network unit implements security by means of a trusted wireless local area network (WLAN) and a hyper-converged firewall. The trusted wireless local area network is used to ensure the confidentiality, integrity and availability of data transmission and improve the security and reliability of the wireless network. The protection methods specifically include encryption technology, network isolation, authentication mechanism, and regular update and maintenance of equipment.

[0073] The encryption technology uses a strong encryption algorithm to encrypt the data stream of the wireless local area network, which can effectively protect the transmitted data from being eavesdropped and tampered with; the application of encryption technology ensures the confidentiality of the data, and even if the data is intercepted during transmission, it cannot be easily decrypted.

[0074] The authentication mechanism can ensure that authorized devices can access the network, reduce the risk of unauthorized devices accessing the communication network, and thus improve the security of the communication network.

[0075] The network isolation can divide different users and devices into different network areas through wireless local area network technology, thereby reducing mutual interference and potential security threats.

[0076] The periodic update and maintenance equipment is to regularly update the firmware and software of the wireless LAN equipment and perform necessary security maintenance, so that users can promptly discover and repair potential security vulnerabilities and improve the overall security of the network.

[0077] The hyper-converged firewall can provide basic access control functions and achieve more advanced security protection. The hyper-converged firewall usually adopts a high-performance hardware platform and software architecture, which can handle a large amount of network traffic and provide flexible expansion capabilities to meet the security needs of networks of different sizes, making the hyper-converged firewall high-performance and scalable; at the same time, it provides an intuitive management interface and rich management tools, allowing users to easily configure and manage, and supports multiple deployment methods to adapt to different application scenarios, making the hyper-converged firewall easy to manage and deploy. The hyper-converged firewall protection methods specifically include: deep packet inspection, multi-security function integration, and intelligent threat defense.

[0078] The deep packet inspection can identify and block potential malicious traffic through in-depth analysis of the data packet content. The multi-security function integration provides users with comprehensive security protection through multiple security functions such as intrusion detection and defense system, virtual private network (VPN) and anti-virus. The intelligent threat defense can use machine learning and artificial intelligence technology to automatically identify and respond to new threats and improve the intelligence level of defense.

[0079] The ways to achieve reliability of the secure access network unit include: Class C protection, Class D protection, key board 1+1, active-standby AC backup technology, 5G backup technology, BFD intelligent host and intelligent switching device. Among them, the computer security levels corresponding to Class C protection and Class D protection, Class D protection is the lowest level of security protection, indicating that the system does not impose any actual security measures; the Class C protection is divided into two subsystems, Class C1 and Class C2. The Class C1 subsystem can separate users and data, protect or limit the spread of user rights, and the Class C2 subsystem can be controlled security protection, personal account management, auditing and resource isolation, and has a more detailed access control environment.

[0080] The key board 1+1 adopts a dual configuration, that is, each key component has a main board and a backup board. When the main board fails, the backup board can immediately take over the work to ensure the continuous operation of the communication network system.

[0081] The active-standby AC backup technology includes: active AC (Access Controller), one or more standby ACs. In a wireless communication system, AC is a key device for managing multiple wireless access points (APs) and terminal devices (STAs). By additionally configuring a standby AC for a wireless access point, the reliability of the system is ensured. When the active AC fails, the standby AC can quickly take over the work, continue to manage the wireless access point and maintain normal services, thereby avoiding service interruption.

[0082] The 5G backup technology uses the 5G network as a backup transmission channel and backup access method to improve the reliability of the system. When the main transmission channel and access method fail, the system can quickly switch to the 5G backup channel to continue operating, ensuring business continuity and stability.

[0083] The BFD intelligent host and intelligent switching equipment enable the system to monitor the status of the network link in real time and quickly perform switching operations when a fault is detected to restore communication and business through the application of the BFD intelligent host and the intelligent switching device.

[0084] The secure access network unit realizes business capabilities through optical network units on the user side of different business types, and the business capabilities include: supporting electricity consumption information collection, AGV inspection, drone inspection, Internet of Things sensors, video surveillance, smart wearables and wireless office.

[0085] The 5G backup communication unit is connected to the electrical layer signal of the optical transmission network unit, and can receive the electrical signal output by the electrical layer, while using the 5G network to provide support for the reliability of the communication network. The 5G backup communication unit can switch the power monitoring service and dispatch telephone service to the 5G network emergency bearer in the event of a break in the optical cable at the substation outlet, quickly restore the service, provide dual-channel protection for IP services in the secure access network unit (i.e., substation), and achieve physical isolation between the 5G network and the optical fiber communication in the substation.

[0086] like Figure 4 As shown, the 5G backup communication unit includes: a 5G slice private network and a remote station. The 5G slice private network is a private network channel implemented based on 5G slicing technology, which is connected to the electrical layer signal of the optical transmission network unit; the 5G slice private network can allocate different virtual resources according to different scenario requirements, and switch the power service to the 5G network in an emergency. The remote station can provide signal coverage in remote areas and provide communication services. Data is transmitted wirelessly between the remote station and the 5G slice private network, reducing dependence on optical cables. Remote stations are set up in remote areas where optical cables are difficult to lay and costly. The high bandwidth and low latency characteristics of 5G technology are used to enable remote stations to efficiently transmit large amounts of data to meet the application requirements of remote monitoring and real-time control, and to solve the shortage of optical cables and achieve unmanned operation.

[0087] The 5G backup communication unit implements security in the same way as the secure access network unit, specifically including: trusted wireless LAN and hyper-converged firewall. Trusted wireless LAN can improve the security and reliability of wireless networks. The hyper-converged firewall can provide basic access control functions to achieve more advanced security protection.

[0088] The 5G backup communication unit achieves reliability in the following ways: key board 1+1, active-standby AC backup, wireless mesh network, 5G network and smart switching device + BFD smart host combination, and 5G network and optical fiber to achieve physical isolation technology.

[0089] The key board 1+1 adopts a dual configuration, that is, each key component has a main board and a backup board. When the main board fails, the backup board can immediately take over the work to ensure the continuous operation of the communication network system.

[0090] The active / standby AC backup ensures system reliability by additionally configuring a backup AC for the wireless access point. When the active AC fails, the backup AC can quickly take over the work, continue to manage the wireless access point and maintain normal business, thereby avoiding business interruption.

[0091] The wireless mesh network (i.e. mesh network) is a multi-node, self-organizing, self-repairing network structure. In a wireless mesh network, each node can communicate directly with other nodes to form multiple communication paths. When a node or link fails, the network can automatically adjust the route to ensure normal data transmission.

[0092] The 5G network and smart switching device + BFD smart host combination combines the high bandwidth and low latency characteristics of the 5G network with the smart switching device and the intelligent scheduling and fault detection capabilities of the bidirectional forwarding detection (BFD) smart host to achieve intelligent scheduling of network traffic and rapid recovery of faults.

[0093] The 5G network and optical fiber physical isolation technology realizes the isolation of the communication network at the physical level by carrying different services and data through the 5G network and the optical fiber network respectively. This isolation method can effectively prevent interference and conflict between different services and data, and improve the security and reliability of the communication network.

[0094] The business capabilities of the 5G backup communication unit include: supporting electricity consumption information collection, AGV inspection, drone inspection, IoT sensors, video surveillance, smart wearables and wireless office.

[0095] The communication network management platform (NMS) is connected to the optical transmission network unit signal and can manage the communication network system in an all-round way, including providing network management functions such as topology, configuration, assets, faults, performance, events, traffic and reports. Figure 5 As shown, the communication network management platform specifically includes: a topology centralized monitoring module, a fault management module, a network performance management module, a report management module, a device configuration file management module, and a northbound interface.

[0096] The topology centralized monitoring module is connected to the optical layer signal of the optical transmission network unit, and can provide a unified topology discovery function, obtain and maintain the information and connection relationship of each node in the communication network, and realize the monitoring of the whole network. The topology centralized monitoring module can monitor the operation status of all devices in real time, and provide a suitable way to modify the configuration of network parameters according to the changes in the operation environment of the communication network, so as to ensure the normal operation of the network with the best performance.

[0097] The fault management module is connected to the electrical layer signal of the optical transmission network unit, and can monitor the faults and operating status of the entire network equipment in real time, and at the same time collect statistics on historical data to provide a means to assist in troubleshooting.

[0098] The network performance management module is implemented through a network performance component and connected to the optical layer signal of the optical transmission network unit. It can provide a means of large-scale communication network performance monitoring, monitor the communication network performance from multiple levels of equipment, links, paths, and services, and use the monitoring data at the equipment level, link level, path level, and service level as indicators for judging the network operation status.

[0099] The northbound interface includes interface definition, protocol implementation, service encapsulation and integration of upper-layer applications, and can support SNMP (Simple Network Management Protocol) northbound interface protocol and CORBA (Common Object Request Broker Architecture) northbound interface protocol. The northbound interface is signal-connected with the topology centralized monitoring module, fault management module, and network performance management module, so that the communication network management platform can complete fault, topology and resource queries.

[0100] The device configuration file management module can provide rich configuration management capabilities for network devices, track device configuration changes, and immediately restore the communication network devices to normal through historical configuration backup when a communication network failure occurs.

[0101] The report management module is connected with the topology centralized monitoring module, the fault management module and the network performance management module by signals, and can provide template-based report development and Web-based report generation and distribution, and store and process data in the communication network.

[0102] The IoT signal connection between the network security unit and the security access network unit provides support for the security of the security access network unit and the 5G backup communication unit, thereby ensuring the overall security of the communication network system. Figure 6 As shown, the network security unit includes: a wireless network security module, a full network security module, a DdoS protection module and an external scanning attack defense module.

[0103] The wireless network security module includes: an application server (AS) certificate issuance function, an application server identity authentication function, and a user isolation function.

[0104] The certificate issuance function of the application server issues digital identity credentials for wireless access points and terminal devices by providing WAPI certificate issuance services. At the same time, the SM4 symmetric encryption algorithm is used to encrypt and decrypt the transmitted data, fully ensuring the security of data transmission and the integrity of user information. For smart dedicated terminal devices, it supports built-in password modules, generates keys and P10 requests inside the terminal devices, and sends them to the application server for certificate application and issuance.

[0105] The identity authentication function of the application server uses a digital identity credential as the user identity credential, adopts a public key certificate system based on an elliptic curve during the authentication process, and uses a secure message hashing algorithm to ensure the integrity of the message, making it difficult for attackers to modify and forge the authentication information, thereby improving security strength.

[0106] The user isolation function can isolate different devices connected to the same wireless access point so that a terminal device can only access its corresponding network, effectively avoiding Address Resolution Protocol (ARP) attacks, DHCP starvation attacks, and Layer 2 attacks such as broadcast storms.

[0107] In a preferred embodiment, when there is a malicious intruder who sets up a fake wireless access point (AP) to trick users who use the wireless network into accessing the fake illegal wireless access point and then intercepts the user's relevant information, the MSG smart access gateway with the user isolation function can enable the detection function for the illegal AP that impersonates the phishing AP. When an illegal AP is found and the legitimate service set identifier (SSID, Service Set Identifier) ​​of the business hall is used, the MSG smart access gateway can promptly issue an alarm to the network administrator. When the illegal AP suppression function of the MSG smart access gateway is enabled, after an illegal AP with a phishing AP is found, the MSG smart access gateway can send a forged deauthentication data packet to the illegal AP and the client connected to the illegal AP to disconnect it, and can suppress the access function of the illegal AP to the client.

[0108] The full-network security module provides a network function slice isolation mechanism for the 5G slice private network, and realizes active protection through hyper-converged firewall technology; the full-network security module utilizes the IP-MAC binding function to associate the IP address and MAC address together, so that the user must open the IP address associated with the MAC address through the corresponding MAC address device for network communication, and realize multi-level protection against ARP attacks, preventing address resolution protocol spoofing (ARP-Flood) attacks from causing communication network failures, thereby threatening the security of the communication network.

[0109] The DdoS (distributed denial of service attack) protection module is connected to the IoT signal of the security access network unit, and by expanding the network bandwidth and increasing server resources, the communication network can better share and process the large traffic requests caused by the DdoS attack.

[0110] The external scanning attack defense module monitors the rate at which network users initiate connections to the target system, thereby monitoring user behavior. After configuring the IP address scanning attack prevention parameters, the device detects incoming TCP (Transmission Control Protocol), UDP (User Datagram Protocol) and ICMP (Control Message Protocol) messages. When the abnormal frequency exceeds the predefined threshold, it is considered to be under scanning attack, and the excess is discarded. This not only reduces the risk of potential security vulnerabilities in the target system being exposed, but also effectively protects against scanning attacks that occupy a large amount of system resources, ensuring the normal operation of the network.

[0111] In summary, the communication network system of the present invention adopts a fiber optic passive splitter as the aggregation layer of the passive optical local area network to flatten the communication network; the topology is centrally monitored through the communication network management platform, and the network parameters are adjusted in real time to ensure the normal operation of the communication network with optimal performance; at the same time, the 5G network and the combination of the intelligent switching device + BFD intelligent host are used to realize the intelligent scheduling of communication network traffic and the rapid recovery of faults, thereby notifying the security and reliability of the communication network system.

[0112] Although the content of the present invention has been described in detail through the above preferred embodiments, it should be appreciated that the above description should not be considered as a limitation of the present invention. After reading the above content, it will be apparent to those skilled in the art that various modifications and substitutions of the present invention will occur. Therefore, the protection scope of the present invention should be limited by the appended claims.

Claims

1. A power communication network system, characterized in that: include: Optical transmission network unit, secure access network unit, 5G backup communication unit, communication network management platform and network security unit; The communication network management platform manages the transmission of optical or electrical signals of the optical transmission network unit. The optical transmission network unit is connected to the security access network unit by signal, and the optical or electrical signals are transmitted to the user terminal through the security access network unit. The 5G backup communication unit is connected to the optical transmission network unit by signal to achieve the reliability of network communication. The network security unit is connected with the security access network unit by signal to achieve the security of the security access network unit and the 5G backup communication unit; The secure access network unit comprises: a full-line optical network; the full-line optical network distributes optical signals to multiple users through a passive optical splitter, including: An optical line terminal is connected to the optical transmission network unit signal to perform conversion, frame processing and transmission management on the entire line optical network; The optical network unit on the user side converts the optical signal transmitted by the optical fiber into an electrical signal and sends the electrical signal to each user; The optical distribution network is respectively connected to the optical line terminal and the optical network unit on the user side, and provides an optical transmission medium for the optical network unit on the user side.

2. The power communication network system according to claim 1, characterized in that: Methods for achieving communication network reliability include: The combination of 5G network, intelligent switching device and BFD intelligent host combines the high bandwidth and low latency characteristics of 5G network with the intelligent scheduling and fault detection capabilities of intelligent switching device and bidirectional forwarding detection intelligent host to achieve intelligent scheduling of network traffic and rapid recovery of faults. The 5G network and optical fiber physical isolation technology realizes the isolation of the communication network at the physical level by carrying different services and data through the 5G network and the optical fiber network respectively.

3. The power communication network system according to claim 1, characterized in that: The 5G backup communication unit includes: 5G slicing private network is a private network channel based on 5G slicing technology. It is connected to the optical transmission network unit signal and can allocate different virtual resources according to different scenario requirements on a unified communication network infrastructure. Remote stations transmit data wirelessly with the 5G slice private network, enabling signals to cover remote areas and provide communication services.

4. The power communication network system according to claim 1, characterized in that: The method for implementing the security of the secure access network unit and the 5G backup communication unit includes: a trusted wireless local area network, and the protection method of the trusted wireless local area network includes: Encryption technology, using strong encryption algorithms to encrypt data streams in wireless LANs; Network isolation, using security protocol technology in wireless LAN to divide different users and devices into different network areas; Update and maintain equipment regularly, and regularly update and perform necessary security maintenance on the firmware and software of wireless LAN equipment; Authentication mechanism ensures that authorized devices can access the network.

5. The power communication network system according to claim 4, characterized in that: The method for realizing the security of the secure access network unit and the 5G backup communication unit also includes: a hyper-converged firewall, and the protection method of the hyper-converged firewall includes: Deep packet inspection, which identifies and blocks potentially malicious traffic by deeply analyzing the contents of data packets; Intelligent threat defense, which uses machine learning and artificial intelligence technologies to automatically identify and respond to new threats; The integration of multiple security functions provides users with comprehensive security protection through intrusion detection and defense systems, virtual private networks and anti-virus functions.

6. The power communication network system according to claim 1, characterized in that: The network security unit includes: a wireless network security module, and the wireless network security module includes: The certificate issuance function of the application server issues digital identity certificates for wireless access points and terminal devices by providing WAPI certificate issuance services; The identity authentication function of the application server adopts a public key certificate system based on elliptic curves and uses a secure message hashing algorithm to ensure the integrity of the message; User isolation function isolates different devices connected to the same wireless access point.

7. The electric power communication network system according to claim 6, characterized in that: The network security unit also includes: The whole network security module provides a network function slice isolation mechanism for the 5G backup communication unit, and uses the IP-MAC binding function to associate the IP address and MAC address together; Distributed denial of service attack protection module, connected to the secure access network unit signal, can expand the network bandwidth and increase server resources; The external scanning attack defense module monitors user behavior by monitoring the rate at which network users initiate connections to the target system.

8. The power communication network system according to claim 1, characterized in that: The optical transmission network unit comprises: The optical layer can use substations to convert data from electrical signals to optical signals and transmit data through optical fibers; The electrical layer, working in conjunction with the optical layer, can receive optical signals, convert the received optical signals into electrical signals, and process the electrical signals.

9. The electric power communication network system according to claim 8, characterized in that: The communication network management platform comprises: The topology centralized monitoring module is connected to the optical layer signal of the optical transmission network unit, which can monitor the operating status of all devices in real time and provide appropriate methods to modify the configuration of network parameters according to changes in the communication network operating environment; The fault management module is connected to the electrical layer signal of the optical transmission network unit, and can monitor the faults and operating status of the entire network equipment in real time, collect statistics on historical data, and provide means to assist in troubleshooting; The network performance management module is connected to the optical layer signal of the optical transmission network unit and can provide a means of monitoring the performance of large-scale communication networks; The northbound interface is connected to the topology centralized monitoring module, the fault management module, and the network performance management module, so that the communication network management platform can complete fault, topology and resource queries; The report management module is connected with the topology centralized monitoring module, fault management module, and network performance management module, and can provide template-based report development and Web-based report generation and distribution; The device configuration file management module can provide rich configuration management capabilities for network devices and track device configuration changes.

10. The electric power communication network system according to claim 8, characterized in that: The full-line optical network also includes: the Internet of Things, which is connected to the electrical layer signal of the optical transmission network, supports mobile edge computing, supports Internet of Things services and 5G transmission, and can meet the unified access requirements of Internet of Things services such as intelligent inspection, mobile operation, and video surveillance.

Images