Identity identification method and system suitable for controlled unit of new energy plant station

Abstract

The invention discloses an identity identification method and system suitable for a controlled unit of a new energy plant station. The method comprises the following steps: generating a unique identity identifier of the controlled unit; constructing a sending real-time authentication channel and a receiving real-time authentication channel; each controlled unit generates a public and private key pair through an asymmetric encryption algorithm, sends a public key of the controlled unit to the optical fiber ring network, and receives and stores public keys of other controlled units; each controlled unit generates a digital signature through a private key of the controlled unit and sends the signature to the optical fiber ring network, and other controlled units use public keys of senders to verify the signature and judge the validity of the identity of the controlled unit; if the identity is abnormal, sending report information for reporting; and judging that the identity of the controlled unit is abnormal after the report information of more than 1 / 2 of the controlled unit in the optical fiber ring network to the controlled unit is received. According to the invention, effective identification of malicious tampering of the controlled unit of the new energy plant station can be realized, and the service security level of the new energy plant station is improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of power system protection and control technology, and more specifically, relates to a method and system for identifying the identity of a controlled unit suitable for a new energy plant. Background Art

[0002] With the continuous development of power systems, the electrical controlled units of smart substations are gradually becoming intelligent, digital and networked, and realizing seamless data communication over Ethernet. In this context, protecting and controlling the authenticity and latency of information data is becoming increasingly important for smart substations. Especially in new energy plants, the controlled units on the controlled unit side communicate through GOOSE messages of the IEC61850 protocol. However, through in-depth research on the communication process of the controlled units on the control unit side, it was found that there is a weak point in communication security - there is a lack of a controlled unit identity identification mechanism, and it is impossible to confirm whether the controlled unit has been illegally tampered with. How to ensure the authenticity and latency of transmitted information data while realizing identity identification in the controlled units of new energy plants has become a thorny issue. With the continuous development of smart grids, the security defects of identity identification of the controlled units on the controlled units of new energy plants have gradually become prominent, forcing us to seek more effective solutions.

[0003] Therefore, in order to ensure the stable operation and security of smart substations, while strengthening the identity recognition mechanism in the controlled units of new energy plants, the security of communication links should be strengthened by introducing enhanced data encryption technology and identity authentication measures. This comprehensive security strategy will help eliminate potential security risks in communications and protect the system from potential cyber attack threats. As smart grids mature and develop, we must continue to improve security protection mechanisms to ensure the reliability and stability of the power system and meet the challenges of the future power industry.

[0004] Existing technologies for data encryption and authentication include:

[0005] The patent with publication number CN118381618A discloses an identity recognition method for threshold SM2 signature, which includes: after obtaining the public key and broadcast content of the SM2 signature, using the public parameters, broadcast content and public key of the recorder and all users as the data basis, completing the user identity information participating in the signature, and generating an encrypted identity information and SM2 signature information triplet; based on the encrypted identity information and the SM2 signature information triplet, completing the user identity information verification of the participating signature, obtaining the verification result, and determining whether the recorder is malicious based on the verification result; when it is determined that the recorder is malicious or there is an abnormality in the user signature, running the user identity information decryption algorithm participating in the signature to obtain the identity information plaintext of the participating users of the SM2 signature.

[0006] The patent with authorization announcement number CN110572468B discloses a server cluster file synchronization method and device, electronic device and storage medium, wherein the method includes: carrying a server cluster with each server host as a host node; collecting data changes or data modifications occurring in the changed host in the server cluster, and integrating the data changes or data modifications occurring in the changed host into a file module; verifying the legitimacy of the file module based on an asymmetric encryption algorithm; performing a consensus vote based on a consensus algorithm on the file module that passes the legitimacy verification, and triggering a smart contract when the consensus reaches a preset ratio; and completing the synchronization of the server cluster file and the file module according to the smart contract.

[0007] However, the above-mentioned existing technologies cannot match the system architecture based on GOOSE communication in the optical fiber ring network. The system requires real-time performance within 10 milliseconds. If other interactive mechanisms are added during the business communication process, key command messages may be blocked, thereby affecting the execution of key businesses. Summary of the invention

[0008] In order to solve the deficiencies in the prior art, the present invention provides a method and system for identifying the identity of a controlled unit in a new energy plant.

[0009] The present invention adopts the following technical solution.

[0010] The first aspect of the present invention proposes a method for identifying the identity of a controlled unit in a new energy plant, wherein the terminals of each controlled unit in the new energy plant are connected via an optical fiber ring network; the method comprises:

[0011] Each controlled unit in the plant generates its own unique identifier S based on its own hardware information in the offline state. i , the unique identifier S of each controlled unit is collected by the staff or emergency monitoring device i , and the unique identifier S of each controlled unit i Corresponding to the APPID specified in the SCD file of the corresponding controlled unit, a mapping table TBS of the unique identifier of the controlled unit of the plant is formed;

[0012] The equipment unique identifier mapping table TBS and the plant station SCD file are input into each controlled unit to construct a real-time authentication channel SD for each controlled unit. i Receive real-time authentication channel RD i ;

[0013] Generate a public and private key pair (PK) of each controlled unit through an asymmetric encryption algorithm i , S.K. i ), each controlled unit sends a real-time authentication channel SD i The public key PK iSend to the optical fiber ring network;

[0014] Each controlled unit receives the real-time authentication channel RD through the corresponding i Receive and parse the public keys sent by other controlled units in the optical fiber ring network, store them, and form a controlled unit public key mapping table TBK;

[0015] The controlled unit i has its own controlled unit unique identifier S i Using the private key SK i Signature, generate digital signature SG i , within the set time of the abnormal judgment cycle, by sending the real-time authentication channel SD i Sent to the optical fiber ring network, other controlled units receive the corresponding real-time authentication channel RD i After obtaining, determine whether the signature data is received and use the controlled unit public key mapping table TBK to query the public key PK of the controlled unit i i Whether the signature data is successfully verified and the unique identifier S′ obtained by the verification i and the result S of querying the unique identifier mapping table TBS i Whether there is consistency, if one of the judgment results is no, then the other controlled units judge that the controlled unit i may be abnormal;

[0016] All controlled units judge whether controlled unit i has the possibility of abnormality, and judge whether controlled unit i is abnormal through consensus voting.

[0017] Preferably, the generating of the controlled unit unique identifier S i A 256-bit digest value generated by the SM3 algorithm and consisting of a string consisting of the network card MAC, CPU ID, hard disk serial number, motherboard ID, and memory ID of the controlled unit i.

[0018] Preferably, the controlled unit unique identifier S i Regeneration is performed at every power cycle.

[0019] Preferably, the real-time authentication channel SD i Receive real-time authentication channel RD i The specific generation process is:

[0020] The real-time authentication channel is generated based on the SCD file of the plant station, constructed based on the float32 low byte effective bit of GOOSE, and extracts all N data fields of type float32 of the controlled unit i through the provisions of the SCD file of the plant station for the GOOSE private information of the set controlled unit, and uses the low n bits of the data field as the transmission carrier of the information. When the information with a transmission length of LEN bytes is transmitted, the information is segmented and modified to the low n bits of the field, and the N fThe frame GOOSE message is transmitted completely, where N f The calculation formula is as follows:

[0021]

[0022] Preferably, the selection rule of n is specifically:

[0023]

[0024] Here, α represents the allowable error in the transmitted data.

[0025] Preferably, the sending real-time authentication channel is generated by the SCD file for the GOOSE private information of the controlled unit i, and the receiving real-time authentication channel is generated by the SCD file for the GOOSE private information of other controlled units except the controlled unit i, and corresponds to each controlled unit one by one.

[0026] Preferably, the controlled unit i has its own controlled unit unique identifier S i Using the private key SK i Signature, generate digital signature SG i , and using the public key PK i The SM2 algorithm is used for signature verification.

[0027] Preferably, the specific content of determining whether the signature data is received is: after the digital signature is generated, the real-time authentication channel SD is sent within the time when the abnormal period threshold is T. i Sent to the optical fiber ring network, if within 2T time, if other controlled units in the optical fiber ring network have not received the signature data sent by the controlled unit i, then the controlled unit determines that the controlled unit i may be abnormal, where T is the abnormality judgment period threshold.

[0028] Preferably, the value of the abnormality judging period threshold T is smaller than the value of the allowed survival field specified in the GOOSE message.

[0029] Preferably, all the controlled units judge whether the controlled unit i is likely to be abnormal, and judge whether the controlled unit i is abnormal by consensus voting, specifically:

[0030] The number of all controlled units in the optical fiber ring network is M. When a controlled unit m determines that a controlled unit i is abnormal, the controlled unit m sends a real-time authentication channel SD corresponding to the control unit m. m Send abnormal reporting information to report the controlled unit i. The total number of controlled units in the optical fiber ring network reporting the controlled unit i is F. If F>(M-1) / 2 is satisfied, it means that the controlled unit i has an abnormality.

[0031] Preferably, the real-time authentication channel SD is sent iThe public key PK i , Digital Signature SG i The abnormal report information is sent to the optical fiber ring network, and the public key PK is used for sending. i , Digital Signature SG i The header of the abnormal reporting information is added with the information header field and the complete check field, and the end of the information is added with the information end field.

[0032] The second aspect of the present invention provides a system for identifying the identity of a controlled unit in a new energy plant using the method described in the first aspect of the present invention, comprising the following modules:

[0033] A unique identity generation module, used to generate a unique identifier of a controlled unit;

[0034] A real-time authentication channel construction module is used to construct a sending real-time authentication channel and a receiving real-time authentication channel;

[0035] A public-private key pair generation module, used to generate public keys and private keys;

[0036] An information sending module is used to send the public key, digital signature and abnormal reporting information to the optical fiber ring network through a real-time authentication channel;

[0037] The storage module is used to store the unique identity and public key of all controlled units, forming a controlled unit unique identifier mapping table TBS and a controlled unit public key mapping table TBK respectively.

[0038] An information receiving module, used for obtaining a public key and a digital signature from the optical fiber ring network through a corresponding receiving real-time authentication channel;

[0039] The identity anomaly judgment module determines whether the signature data is received, whether the signature data is successfully verified by the sender's controlled unit public key queried from the controlled unit public key mapping table TBK, and whether the unique identifier obtained by the signature verification is consistent with the result of querying the unique identifier mapping table TBS, so as to determine whether the controlled unit has the possibility of identity anomaly;

[0040] The formula voting module determines whether an abnormality occurs in a controlled unit based on the number of abnormality reports from all controlled units to the controlled unit.

[0041] The beneficial effect of the present invention is that, compared with the prior art,

[0042] (1) The present invention utilizes the low-byte bits of float32 to transmit several set bits of real-time authentication information each time a floating-point number is transmitted, thereby constructing a real-time authentication channel based on the low-byte effective bits of float32 of GOOSE, thereby improving the transmission rate of the real-time authentication channel without affecting the authenticity and accuracy of business data, and the real-time authentication information is carried on the GOOSE message, which has no impact on the original business, thereby ensuring the delay of data transmission.

[0043] (2) The present invention uses an authentication channel and public-private key pairs to encrypt and decrypt information, thereby improving the security and confidentiality of information transmission.

[0044] (3) The present invention uses three criteria to determine whether there is a possibility of abnormality in the identity, and determines whether an abnormality occurs through the number of abnormal reports of a certain controlled unit by all controlled units, thereby improving the identity identification mechanism and enhancing the security of information transmission in new energy plants. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 This is a schematic diagram of the overall process of Example 1 of the present invention;

[0046] Figure 2 This is a schematic diagram of a GOOSE protocol real-time authentication channel according to Embodiment 1 of the present invention;

[0047] Figure 3 This is a schematic diagram showing the impact of the low byte of the FLOAT32 value in Example 1 of the present invention; DETAILED DESCRIPTION

[0048] In order to make the purpose, technical scheme and advantages of the present invention clearer, the technical scheme of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. The embodiments described in this application are only embodiments of a part of the present invention, rather than all embodiments. Based on the spirit of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work belong to the protection scope of the present invention.

[0049] like Figure 1 As shown, Embodiment 1 of the present invention provides a method for identifying the identity of a controlled unit in a new energy plant. The terminals of each controlled unit in the new energy plant are connected through an optical fiber ring network, including:

[0050] Each controlled unit in the plant generates its own unique identifier S based on its own hardware information in the offline state. i , the unique identifier S of each controlled unit is collected by the staff or emergency monitoring device i , and the unique identifier S of each controlled unit iCorresponding to the APPID specified in the SCD file of the corresponding controlled unit, a unique identifier mapping table TBS of the plant controlled unit is formed.

[0051] Preferably, the generating of the controlled unit unique identifier S i A 256-bit digest value generated by the SM3 algorithm and consisting of a string consisting of the network card MAC, CPU ID, hard disk serial number, motherboard ID, and memory ID of the controlled unit i.

[0052] Preferably, the controlled unit unique identifier S i Regeneration is performed at every power cycle.

[0053] like Figure 2 As shown, the device unique identifier mapping table TBS and the plant station SCD file are input into each controlled unit to construct a sending real-time authentication channel SD for each controlled unit. i Receive real-time authentication channel RD i .

[0054] Preferably, the real-time authentication channel SD i Receive real-time authentication channel RD i The specific generation process is:

[0055] The real-time authentication channel is generated based on the SCD file of the plant station, constructed based on the float32 low byte effective bit of GOOSE, and extracts all N data fields of type float32 of the controlled unit i through the provisions of the SCD file of the plant station for the GOOSE private information of the set controlled unit, and uses the low n bits of the data field as the transmission carrier of the information. When the information with a transmission length of LEN bytes is transmitted, the information is segmented and modified to the low n bits of the field, and the N f The frame GOOSE message is transmitted completely, where N f The calculation formula is as follows:

[0056]

[0057] Preferably, the selection rule of n is specifically:

[0058]

[0059] Here, α represents the allowable error in the transmitted data.

[0060] It should be noted that if Figure 3As shown, in the actual business of the controlled unit of the new energy plant, the numerical content of the last few digits of the mantissa is generally insensitive to the actual FLOAT32 value. Taking the 4-byte FLOAT32 value represented by 43A0 E6 69 in hexadecimal as an example, the change of the FLOAT32 value caused by its modification has no effect on business judgment and calculation. Therefore, without affecting the authenticity and accuracy of the business data, it can be segmented and converted into low bytes for transmission to speed up the transmission speed.

[0061] Preferably, the sending real-time authentication channel SD i The GOOSE private information of the controlled unit i is generated by the SCD file, and the receiving real-time authentication channel RD i The SCD file generates GOOSE private information of other controlled units except controlled unit i, and corresponds to each controlled unit one by one;

[0062] Generate a public and private key pair (PK) of each controlled unit through an asymmetric encryption algorithm i , S.K. i ), each controlled unit sends a real-time authentication channel SD i The public key PK i Send to the fiber ring network.

[0063] Each controlled unit receives the real-time authentication channel RD through the corresponding i Receive and parse the public keys sent by other controlled units in the optical fiber ring network, and store them to form a controlled unit public key mapping table TBK.

[0064] The controlled unit i has its own controlled unit unique identifier S i Using the private key SK i Signature, generate digital signature SG i , within the set time of the abnormal judgment cycle, by sending the real-time authentication channel SD i Sent to the optical fiber ring network, other controlled units receive the corresponding real-time authentication channel RD i After obtaining, determine whether the signature data is received and use the controlled unit public key mapping table TBK to query the public key PK of the controlled unit i i Whether the signature data is successfully verified and the unique identifier S′ obtained by the verification i and the result S of querying the unique identifier mapping table TBS i Whether there is consistency, if one of the judgment results is no, then the other controlled units judge that the controlled unit i may be abnormal.

[0065] Preferably, the controlled unit i has its own controlled unit unique identifier S i Using the private key SK i Signature, generate digital signature SG i, and using the public key PK i The SM2 algorithm is used for signature verification.

[0066] Preferably, the specific content of determining whether the signature data is received is: after the digital signature is generated, the real-time authentication channel SD is sent within the time when the abnormal period threshold is T. i Sent to the optical fiber ring network, if within 2T time, if other controlled units in the optical fiber ring network have not received the signature data sent by the controlled unit i, then the controlled unit determines that the controlled unit i may be abnormal, where T is the abnormality judgment period threshold.

[0067] Preferably, the value of the abnormality judging period threshold T is smaller than the value of the allowed survival field specified in the GOOSE message.

[0068] All controlled units judge whether controlled unit i has the possibility of abnormality, and judge whether controlled unit i is abnormal through consensus voting.

[0069] Preferably, all the controlled units judge whether the controlled unit i is likely to be abnormal, and judge whether the controlled unit i is abnormal by consensus voting, specifically:

[0070] The number of all controlled units in the optical fiber ring network is M. When a controlled unit m determines that a controlled unit i is abnormal, the controlled unit m sends a real-time authentication channel SD corresponding to the control unit m. m Send abnormal reporting information to report the controlled unit i. The total number of controlled units in the optical fiber ring network reporting the controlled unit i is F. If F>(M-1) / 2 is satisfied, it means that the controlled unit i has an abnormality.

[0071] Preferably, the real-time authentication channel SD is sent i The public key PK i , Digital Signature SG i The abnormal report information is sent to the optical fiber ring network, and the public key PK is used for sending. i , Digital Signature SG i The header of the abnormal reporting information is added with the information header field and the complete check field, and the end of the information is added with the information end field.

[0072] Embodiment 2 of the present invention provides an identity recognition system for a controlled unit of a new energy plant using the method described in Embodiment 1, comprising the following modules:

[0073] A unique identity generation module, used to generate a unique identifier of a controlled unit;

[0074] A real-time authentication channel construction module is used to construct a sending real-time authentication channel and a receiving real-time authentication channel;

[0075] A public-private key pair generation module, used to generate public keys and private keys;

[0076] An information sending module is used to send the public key, digital signature and abnormal reporting information to the optical fiber ring network through a real-time authentication channel;

[0077] The storage module is used to store the unique identity and public key of all controlled units, forming a controlled unit unique identifier mapping table TBS and a controlled unit public key mapping table TBK respectively.

[0078] An information receiving module, used for obtaining a public key and a digital signature from the optical fiber ring network through a corresponding receiving real-time authentication channel;

[0079] The identity anomaly judgment module determines whether the signature data is received, whether the signature data is successfully verified by the sender's controlled unit public key queried from the controlled unit public key mapping table TBK, and whether the unique identifier obtained by the signature verification is consistent with the result of querying the unique identifier mapping table TBS, so as to determine whether the controlled unit has the possibility of identity anomaly;

[0080] The formula voting module determines whether an abnormality occurs in a controlled unit based on the number of abnormality reports from all controlled units to the controlled unit.

[0081] The present disclosure may be a system, a method and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for causing a processor to implement various aspects of the present disclosure.

[0082] A computer-readable storage medium may be a tangible device that can hold and store instructions used by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples of computer-readable storage media (a non-exhaustive list) include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disk read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device, such as a punch card or a raised structure in a groove on which instructions are stored, and any suitable combination of the foregoing. As used herein, a computer-readable storage medium is not to be interpreted as a transient signal per se, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse through a fiber optic cable), or an electrical signal transmitted through a wire.

[0083] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0084] The computer program instructions for performing the operation of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages, such as Smalltalk, C++, etc., and conventional procedural programming languages, such as "C" language or similar programming languages. Computer-readable program instructions may be executed completely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or completely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect via the Internet). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may be customized by utilizing the state information of the computer-readable program instructions, and the electronic circuit may execute the computer-readable program instructions, thereby realizing various aspects of the present disclosure.

[0085] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents, and any modifications or equivalent replacements that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A method for identifying the identity of a controlled unit in a new energy plant, wherein the terminals of each controlled unit in the new energy plant are connected via an optical fiber ring network; characterized in that: include: Each controlled unit in the plant generates its own unique identifier S based on its own hardware information in the offline state. i , the unique identifier S of each controlled unit is collected by the staff or emergency monitoring device i , and the unique identifier S of each controlled unit i Corresponding to the APPID specified in the SCD file of the corresponding controlled unit, a mapping table TBS of the unique identifier of the controlled unit of the plant is formed; The equipment unique identifier mapping table TBS and the plant station SCD file are input into each controlled unit to construct a real-time authentication channel SD for each controlled unit. i Receive real-time authentication channel RD i ; Generate a public and private key pair (PK) of each controlled unit through an asymmetric encryption algorithm i , S.K. i ), each controlled unit sends a real-time authentication channel SD i The public key PK i Send to the optical fiber ring network; Each controlled unit receives the real-time authentication channel RD through the corresponding i Receive and parse the public keys sent by other controlled units in the optical fiber ring network, store them, and form a controlled unit public key mapping table TBK; The controlled unit i has its own controlled unit unique identifier S i Using the private key SK i Signature, generate digital signature SG i , within the set time of the abnormal judgment cycle, by sending the real-time authentication channel SD i Sent to the optical fiber ring network, other controlled units receive the corresponding real-time authentication channel RD i After obtaining, determine whether the signature data is received and use the controlled unit public key mapping table TBK to query the public key PK of the controlled unit i i Whether the signature data is successfully verified and the unique identifier S′ obtained by the verification i and the result S of querying the unique identifier mapping table TBS i Whether there is consistency, if one of the judgment results is no, then the other controlled units judge that the controlled unit i may be abnormal; All controlled units judge whether controlled unit i has the possibility of abnormality, and judge whether controlled unit i is abnormal through consensus voting.

2. A method for identifying the identity of a controlled unit in a new energy plant as claimed in claim 1, characterized in that: The generated controlled unit unique identifier S i A 256-bit digest value generated by the SM3 algorithm and consisting of a string consisting of the network card MAC, CPU ID, hard disk serial number, motherboard ID, and memory ID of the controlled unit i.

3. A method for identifying the identity of a controlled unit in a new energy plant as claimed in claim 2, characterized in that: The controlled unit unique identifier S i Regeneration is performed at every power cycle.

4. A method for identifying the identity of a controlled unit in a new energy plant as claimed in claim 1, characterized in that: The sending real-time authentication channel SD i Receive real-time authentication channel RD i The specific generation process is: The real-time authentication channel is generated based on the SCD file of the plant station, constructed based on the float32 low byte effective bit of GOOSE, and extracts all N data fields of type float32 of the controlled unit i through the provisions of the SCD file of the plant station for the GOOSE private information of the set controlled unit, and uses the low n bits of the data field as the transmission carrier of the information. When the information with a transmission length of LEN bytes is transmitted, the information is segmented and modified to the low n bits of the field, and the N f The frame GOOSE message is transmitted completely, where N f The calculation formula is as follows:

5. A method for identifying the identity of a controlled unit in a new energy plant as claimed in claim 4, characterized in that: The selection rule of n is specifically as follows: Here, α represents the allowable error in the transmitted data.

6. A method for identifying the identity of a controlled unit in a new energy plant as claimed in claim 5, characterized in that: The sending real-time authentication channel is generated by the SCD file for the GOOSE private information of the controlled unit i, and the receiving real-time authentication channel is generated by the SCD file for the GOOSE private information of other controlled units except the controlled unit i, and corresponds to each controlled unit one by one.

7. A method for identifying the identity of a controlled unit in a new energy plant as claimed in claim 1, characterized in that: The controlled unit i has its own controlled unit unique identifier S i Using the private key SK i Signature, generate digital signature SG i , and using the public key PK i The SM2 algorithm is used for signature verification.

8. The method for identifying the identity of a controlled unit in a new energy plant as claimed in claim 1, characterized in that: The specific content of judging whether the signature data is received is: after the digital signature is generated, the real-time authentication channel SD is sent within the time of the abnormal period threshold T. i Sent to the optical fiber ring network, if within 2T time, if other controlled units in the optical fiber ring network have not received the signature data sent by the controlled unit i, then the controlled unit determines that the controlled unit i may be abnormal, where T is the abnormality judgment period threshold.

9. A method for identifying the identity of a controlled unit in a new energy plant as claimed in claim 8, characterized in that: The value of the abnormality judging period threshold T is smaller than the value of the allowed survival field specified in the GOOSE message.

10. The method for identifying the identity of a controlled unit in a new energy plant as claimed in claim 1, characterized in that: All the controlled units judge whether the controlled unit i is abnormal or not, and judge whether the controlled unit i is abnormal or not through consensus voting, specifically: The number of all controlled units in the optical fiber ring network is M. When a controlled unit m determines that a controlled unit i is abnormal, the controlled unit m sends a real-time authentication channel SD corresponding to the control unit m. m Send abnormal reporting information to report the controlled unit i. The total number of controlled units in the optical fiber ring network reporting the controlled unit i is F. If F>(M-1) / 2 is satisfied, it means that the controlled unit i has an abnormality.

11. A method for identifying the identity of a controlled unit in a new energy plant as claimed in any one of claims 1 to 8, characterized in that: The real-time authentication channel SD is sent i The public key PK i , Digital Signature SG i The abnormal report information is sent to the optical fiber ring network, and the public key PK is used for sending. i , Digital Signature SG i The header of the abnormal reporting information is added with the information header field and the complete check field, and the end of the information is added with the information end field.

12. A system for identifying controlled units in new energy plants and stations using the method described in any one of claims 1 to 11, characterized in that: Includes the following modules: A unique identity generation module, used to generate a unique identifier of a controlled unit; A real-time authentication channel construction module is used to construct a sending real-time authentication channel and a receiving real-time authentication channel; A public-private key pair generation module, used to generate public keys and private keys; An information sending module is used to send the public key, digital signature and abnormal reporting information to the optical fiber ring network through a real-time authentication channel; The storage module is used to store the unique identity and public key of all controlled units, forming a controlled unit unique identifier mapping table TBS and a controlled unit public key mapping table TBK respectively. An information receiving module, used for obtaining a public key and a digital signature from the optical fiber ring network through a corresponding receiving real-time authentication channel; The identity anomaly judgment module determines whether the signature data is received, whether the signature data is successfully verified by the sender's controlled unit public key queried from the controlled unit public key mapping table TBK, and whether the unique identifier obtained by the signature verification is consistent with the result of querying the unique identifier mapping table TBS, so as to determine whether the controlled unit has the possibility of identity anomaly; The formula voting module determines whether an abnormality occurs in a controlled unit based on the number of abnormality reports from all controlled units to the controlled unit.

Images