Safety control method and system between load control terminal and management master station

Abstract

The invention relates to a safety control method and system between a load control terminal and a management master station. The method comprises the following steps that: a load control terminal encrypts data to be transmitted by using an encryption algorithm of a VPN (Virtual Private Network) channel to obtain an encrypted data packet, and sends the encrypted data packet to a management master station through the VPN channel; the management master station verifies the identity of the load control terminal accessed to the VPN channel according to the authentication mode of the VPN channel; under the condition that the identity verification is passed, receiving an encrypted data packet sent by the load control terminal; the management master station carries out integrity verification on the encrypted data packet, and carries out decryption and analysis processing on the encrypted data packet under the condition that the integrity verification is passed; under the condition that the integrity verification is not passed, detecting the communication data based on a behavior detection method; when data intrusion and network threat are detected, an emergency plan is initiated. By adopting the method, the security of the power grid data can be improved.

Description

Technical Field

[0001] The present invention relates to the technical field of electric power communication, and in particular to a safety control method and system between a load control terminal and a management master station. Background Art

[0002] With the development of smart grid, data transmission between load control terminals and management master stations is becoming more and more important. However, when using wireless public networks for communication, data is vulnerable to threats such as eavesdropping and tampering, and illegal devices may also access the system.

[0003] Currently commonly used security measures such as encrypted communications and identity authentication are difficult to fully cover all security threats, and there are problems such as complex configuration and inconvenient management.

[0004] Therefore, a system is needed that integrates multiple security functions, including encrypted communication, identity authentication, data integrity verification, and intrusion detection, to improve the security and reliability of communications. Summary of the invention

[0005] In view of the above existing problems, the present invention is proposed.

[0006] Therefore, the present invention provides a security control method between the load control terminal and the management master station, which can solve the problems that currently commonly used security measures such as encrypted communication and identity authentication are difficult to fully cover all security threats and have complex configuration and inconvenient management.

[0007] In order to solve the above technical problems, the present invention provides the following technical solutions, a safety control method between a load control terminal and a management master station, comprising:

[0008] The load control terminal uses the encryption algorithm of the VPN channel to encrypt the data to be transmitted to obtain an encrypted data packet; the VPN channel is a dedicated channel between the load control terminal and the management master station;

[0009] The load control terminal sends the encrypted data packet to the management main station through the VPN channel;

[0010] The management main station authenticates the load control terminal connected to the VPN channel according to the authentication method of the VPN channel;

[0011] The management master station receives the encrypted data packet sent by the load control terminal when the identity authentication is passed;

[0012] The management main station performs integrity check on the encrypted data packet;

[0013] The management main station decrypts and analyzes the encrypted data packet if the integrity check passes;

[0014] When the integrity check fails, the management master station detects the communication data based on a behavior-based detection method;

[0015] When the management master station detects data intrusion and network threats, it activates an emergency plan, which includes switching backup power supplies, adjusting load distribution, and initiating emergency maintenance.

[0016] As a preferred solution of the security control method between the load control terminal and the management master station of the present invention, the management master station performs integrity check on the encrypted data packet, including:

[0017] The management main station extracts the check code in the encrypted data packet, and uses a check algorithm to calculate the encrypted data packet to generate a verification check code, and compares the consistency of the check code with the verification check code;

[0018] When the check code is consistent with the verification check code, the management host station determines that the integrity check of the encrypted data packet passes;

[0019] When the check code is inconsistent with the verification check code, the management host station determines that the integrity check of the encrypted data packet fails.

[0020] As a preferred solution of the security control method between the load control terminal and the management master station described in the present invention, the management master station determines that it is a network failure when no data intrusion and network threat are detected.

[0021] As a preferred solution of the security control method between the load control terminal and the management master station described in the present invention, the load control terminal uses the encryption algorithm of the VPN channel to encrypt the data to be transmitted to obtain the encrypted data packet, including:

[0022] The load control terminal uses the encryption algorithm of the VPN channel to encrypt the data to be transmitted, and encapsulates the encrypted data packet according to the format required by the protocol of the VPN channel to obtain the encrypted data packet.

[0023] As a preferred solution of the safety control method between the load control terminal and the management master station of the present invention, wherein: the load control terminal generates a check code according to the data in the preset algorithm data packet;

[0024] The load control terminal adds the check code to the target position of the encapsulated data packet to obtain the encrypted data packet, wherein the target position includes the end, the head and the dedicated field of the check code of the encapsulated data packet.

[0025] As a preferred solution of the security control method between the load control terminal and the management main station described in the present invention, wherein: the load control terminal detects the communication status of the VPN channel, and when the communication status of the VPN channel is normal, sends the encrypted data packet to the management main station through the VPN channel.

[0026] As a preferred solution of the security control method between the load control terminal and the management master station of the present invention, wherein: the load control terminal compresses and encrypts the data to be transmitted to obtain the data to be backed up;

[0027] The load control terminal verifies the integrity and availability of the data to be backed up;

[0028] The load control terminal performs data recovery when the data to be backed up is incomplete or unavailable.

[0029] As a preferred solution of the safety control system between the load control terminal and the management master station of the present invention, it includes: a load control terminal and a management master station, wherein the load control terminal is connected to the management master station;

[0030] The load control terminal is used to encrypt the data to be transmitted using the encryption algorithm of the VPN channel to obtain an encrypted data packet; the VPN channel is a dedicated channel between the load control terminal and the management main station; the encrypted data packet is sent to the management main station through the VPN channel;

[0031] The management master station is used to authenticate the load control terminal connected to the VPN channel according to the authentication method of the VPN channel; if the identity authentication is successful, receive the encrypted data packet sent by the load control terminal; perform integrity verification on the encrypted data packet; if the integrity verification is successful, decrypt and analyze the encrypted data packet; if the integrity verification fails, detect the communication data based on the behavior-based detection method; when data intrusion and network threats are detected, initiate an emergency plan, which includes switching the backup power supply, adjusting the load distribution and initiating emergency maintenance.

[0032] A computer device includes a memory and a processor, wherein the memory stores a computer program, and is characterized in that when the processor executes the computer program, the steps of a safety control method between a load control terminal and a management master station are implemented.

[0033] A computer-readable storage medium stores a computer program, wherein the computer program, when executed by a processor, implements the steps of a safety control method between a load control terminal and a management master station.

[0034] Beneficial effects of the present invention: The present invention ensures the confidentiality and integrity of sensitive information during transmission by encrypting the data transmission between the load control terminal and the management master station and using a dedicated VPN channel, thereby preventing the risk of data being illegally stolen or tampered with. At the same time, a strict access authentication mechanism ensures that only legitimate load control terminals can communicate with the management master station, avoiding the security risks caused by unauthorized device access. In addition, through integrity verification of communication data and detection of abnormal behavior, potential data intrusions and other network threats can be discovered and responded to in the first place, and emergency plans can be initiated in a timely manner, minimizing the impact of service interruptions or data leaks caused by network attacks on the normal operation of the power grid, thereby maintaining the efficient operation of the power system and the stability of social life, not only strengthening the security defense system of the power grid, but also providing solid technical support for the future development of smart grids. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0036] Figure 1 This is a diagram of the application environment of a safety control method between a load control terminal and a management master station provided in one embodiment of the present invention.

[0037] Figure 2 A schematic flow chart of a safety control method between a load control terminal and a management master station provided in accordance with an embodiment of the present invention.

[0038] Figure 3 A schematic diagram of the structure of a safety control system between a load control terminal and a management master station provided in one embodiment of the present invention.

[0039] Figure 4 A structural block diagram of a safety control system between a load control terminal and a management master station provided in one embodiment of the present invention.

[0040] Figure 5 An internal structural diagram of a computer device for security control between a load control terminal and a management master station provided in one embodiment of the present invention.

[0041] Figure 6 FIG. 4 is a diagram showing the internal structure of a computer device in another embodiment. DETAILED DESCRIPTION

[0042] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0043] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0044] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The term "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive with other embodiments.

[0045] The present invention is described in detail with reference to schematic diagrams. When describing the embodiments of the present invention, for the sake of convenience, the cross-sectional diagrams showing the device structure will not be partially enlarged according to the general scale, and the schematic diagrams are only examples, which should not limit the scope of protection of the present invention. In addition, in actual production, the three-dimensional dimensions of length, width and depth should be included.

[0046] At the same time, in the description of the present invention, it should be noted that the directions or positional relationships indicated by the terms "upper, lower, inner and outer" are based on the directions or positional relationships shown in the drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific direction, be constructed and operated in a specific direction, and therefore cannot be understood as limiting the present invention. In addition, the terms "first, second or third" are only used for descriptive purposes and cannot be understood as indicating or implying relative importance.

[0047] In the present invention, unless otherwise clearly specified and limited, the terms "install, connect, connect" should be understood in a broad sense, for example: it can be a fixed connection, a detachable connection or an integral connection; it can also be a mechanical connection, an electrical connection or a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0048] Example 1, reference Figure 1-Figure 4 , which is the first embodiment of the present invention, provides a safety control method between a load control terminal and a management master station, including:

[0049] The security control method between the load control terminal and the management master station provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown. Among them, the load control terminal 102 can communicate with the management master station 104 and the power grid device 300 respectively through the network. The load control terminal 102 uses the encryption algorithm of the VPN channel to encrypt the data to be transmitted to obtain an encrypted data packet; the VPN channel is a dedicated channel between the load control terminal 102 and the management master station 104; the load control terminal 102 sends the encrypted data packet to the management master station 104 through the VPN channel; the management master station 104 authenticates the load control terminal 102 connected to the VPN channel according to the authentication method of the VPN channel; the management master station 104 receives the encrypted data packet sent by the load control terminal 102 when the identity authentication passes; the management master station 104 performs integrity verification on the encrypted data packet; the management master station 104 decrypts and analyzes the encrypted data packet when the integrity verification passes; the management master station 104 detects the communication data based on the behavior-based detection method when the integrity verification fails; the management master station 104 activates the emergency plan when data intrusion and network threats are detected, and the emergency plan includes switching the backup power supply, adjusting the load distribution and initiating emergency maintenance.

[0050] In an exemplary embodiment, Figure 2 As shown, a safety control method between a load control terminal and a management master station is provided, comprising the following steps S202 to S216. Among them:

[0051] S202, the load control terminal uses the encryption algorithm of the VPN channel to encrypt the data to be transmitted to obtain an encrypted data packet; the VPN channel is a dedicated channel between the load control terminal and the management master station;

[0052] S204, the load control terminal sends the encrypted data packet to the management master station through the VPN channel;

[0053] S206, the management master station authenticates the load control terminal connected to the VPN channel according to the VPN channel authentication method;

[0054] S208, the management master station receives the encrypted data packet sent by the load control terminal when the identity authentication is passed;

[0055] S210, the management master station performs integrity check on the encrypted data packet;

[0056] S212, the management master station decrypts and analyzes the encrypted data packet if the integrity check passes;

[0057] S214, when the integrity check fails, the management master station detects the communication data based on a behavior-based detection method;

[0058] S216, when the management master station detects data intrusion and network threats, it activates the emergency plan, which includes switching the backup power supply, adjusting the load distribution and initiating emergency maintenance.

[0059] Among them, the load control terminal refers to a device installed at the edge of the network for monitoring and controlling power loads. It can be a smart meter, distribution automation terminal or other form of data acquisition unit, which is responsible for collecting power consumption information and performing load control operations according to instructions. The management master station is part of the power grid operation center, responsible for receiving information from the load control terminal and making decisions based on this information, such as adjusting power supply or issuing control commands to optimize power grid operation. It can be a server or workstation integrated with SCADA (supervisory control and data acquisition system), EMS (energy management system) or other power grid management software. The data to be transmitted refers to the information collected by the load control terminal and prepared to be sent to the management master station. The data to be transmitted may include parameters such as real-time power consumption, voltage, current, and equipment status information. The encrypted data packet refers to the data packet generated by the load control terminal that can only be decrypted by the legitimate recipient in order to protect the security of the data during transmission. The authentication method of the VPN channel refers to a certain authentication mechanism used to verify the identity of the load control terminal in order to ensure that only authorized devices can access the management master station. The authentication method may include username / password, digital certificate, two-factor authentication, etc. Behavior detection methods refer to methods used to identify abnormal behavior patterns in network activities; for example, if a large number of data packets are detected to be suddenly sent from a terminal, this may be a sign of a malicious attack. Communication data refers to data that reflects the state of the network, which is used to help the management master station detect whether the network is in an abnormal state, whether there is data intrusion or network threat, for example, communication data can include but is not limited to indicators such as network traffic pattern, connection frequency, and packet size distribution. Data intrusion refers to the act of unauthorized access or modification of data on the network. For example, hackers may try to change the data reported by the load control terminal to conceal the actual power consumption. Network threats refer to other forms of network attacks besides data intrusion, such as denial of service attacks (DoS), man-in-the-middle attacks (MITM), etc., which may all lead to power grid service interruption or data leakage. Encryption algorithms include symmetric encryption algorithms, asymmetric encryption algorithms, hash algorithms, and stream ciphers and block ciphers.

[0060] For example, in the context of power grid operation, after the load control terminal collects key parameters such as real-time power consumption, voltage, current, etc., it will not directly send out these raw data, but first encrypt the data using a preset encryption algorithm to form an encrypted data packet. Even if the data is intercepted during transmission, it cannot be easily interpreted. Subsequently, the encrypted data packet will be transmitted through a virtual private network (VPN) channel specially set up between the load control terminal and the management master station. Before the management master station receives the data, it will perform strict identity authentication on the load control terminal that attempts to access the VPN channel. This process involves a variety of authentication mechanisms, such as username / password combinations, digital certificates, or more complex security measures to ensure that only authorized devices can establish a connection with the master station. Once the identity of the load control terminal is confirmed, the management master station will begin to receive these encrypted data packets and immediately perform integrity checks on them to verify whether the data has not been tampered with during transmission. If the verification result shows that the data is intact, the management master station will use the corresponding decryption key to decrypt the data packet, and then conduct detailed analysis and processing of the decrypted information to draw important conclusions about the current state of the power grid and make corresponding decisions based on this, such as adjusting the power supply or issuing further control instructions to optimize the operation efficiency of the power grid. However, if any anomalies are found during the integrity verification process, indicating that the data may have been tampered with or there is a potential security risk, the management master station will not rush to decrypt the data packet, but will start a set of security detection programs based on behavioral analysis to identify unusual patterns in network activities, such as abnormally high traffic events in a short period of time, which may indicate an ongoing malicious attack. If data intrusion or other types of network threats are determined, the management master station will quickly initiate emergency plans and take a series of measures to mitigate the damage, such as switching to backup power supplies, redistributing grid loads, and even initiating emergency maintenance procedures when necessary to ensure that the safe and stable operation of the power grid is not affected.

[0061] The above-mentioned security control method between the load control terminal and the management master station ensures the confidentiality and integrity of sensitive information during transmission by encrypting the data transmission between the load control terminal and the management master station and using a dedicated VPN channel, thereby preventing the risk of data being illegally stolen or tampered with. At the same time, a strict access authentication mechanism ensures that only legitimate load control terminals can communicate with the management master station, avoiding the security risks caused by unauthorized device access. In addition, through integrity verification of communication data and abnormal behavior detection, potential data intrusions and other network threats can be discovered and responded to in the first place, and emergency plans can be initiated in a timely manner, minimizing the impact of service interruptions or data leaks caused by network attacks on the normal operation of the power grid, thereby maintaining the efficient operation of the power system and the stability of social life, not only strengthening the security defense system of the power grid, but also providing solid technical support for the future development of smart grids.

[0062] In an exemplary embodiment, the management main station performs integrity check on the encrypted data packet, including:

[0063] The management master station extracts the check code from the encrypted data packet, and uses the check algorithm to calculate the encrypted data packet to generate a verification check code, and compares the consistency of the check code and the verification check code;

[0064] When the check code is consistent with the verification code, the management master station determines that the integrity check of the encrypted data packet has passed;

[0065] When the check code is inconsistent with the verification check code, the management master station determines that the integrity check of the encrypted data packet fails.

[0066] Exemplarily, the check code refers to a numerical value or string calculated according to a certain algorithm when the load control terminal generates an encrypted data packet. The value can be a summary information calculated by adding a specific hash function (such as SHA-256) to the content of the data packet. As a unique identifier, the check code represents the content of the original data packet. If the data packet is modified during transmission, even a small change will cause the check code to change significantly. Therefore, the check code is embedded in the encrypted data packet and sent to the management master station along with the data. When the management master station receives the encrypted data packet, it will recalculate the summary information of the data packet according to the same algorithm (that is, the algorithm used to generate the check code). This newly generated summary information is the verification check code. The management master station compares the calculated verification check code with the check code in the received encrypted data packet. If the two match, it means that the data has not been tampered with during transmission, that is, the integrity check passes; if they do not match, it means that the data may have been tampered with or an error has occurred during transmission, and the integrity check fails at this time.

[0067] In this embodiment, by embedding a check code based on a hash algorithm when the load control terminal generates an encrypted data packet, and recalculating the verification check code for comparison after the management master station receives the data packet, it is possible to accurately determine whether the data has maintained its original state during the transmission process and has not been tampered with or damaged. This not only improves the reliability of data transmission and prevents potential security threats, but also provides solid data integrity protection for power grid operations, ensuring the accuracy and timeliness of power grid management and dispatching decisions, thereby maintaining the stable operation and service quality of the power system.

[0068] In an exemplary embodiment, the method further comprises:

[0069] When the management master station detects no data intrusion or network threat, it determines that the network is faulty.

[0070] For example, when the management master station determines that a network failure occurs without detecting data intrusion or network threats, it can rule out the possibility of security threats, thereby guiding technicians to quickly turn to checking problems at the physical layer or network layer, such as hardware failure, configuration error, or signal attenuation. This method of distinguishing security events from common network failures improves the efficiency and accuracy of troubleshooting, and ensures the rapid recovery and continued stable operation of the power grid communication system.

[0071] In an exemplary embodiment, the load control terminal uses the encryption algorithm of the VPN channel to encrypt the data to be transmitted to obtain the encrypted data packet, including:

[0072] The load control terminal uses the encryption algorithm of the VPN channel to encrypt the data to be transmitted, and encapsulates the encrypted data packet according to the format required by the protocol of the VPN channel to obtain an encrypted data packet.

[0073] For example, encryption processing ensures the confidentiality of data during transmission and prevents unauthorized access; and encapsulation that complies with the protocol ensures that the structure of the data packet complies with communication standards, facilitating correct parsing and processing by the management master station, thereby improving the reliability and efficiency of data transmission and ensuring the security and smoothness of information exchange in the power grid system.

[0074] In an exemplary embodiment, obtaining an encrypted data packet includes:

[0075] The load control terminal generates a check code according to the data in the preset algorithm data packet;

[0076] The load control terminal adds the check code to the target position of the data packet after the encapsulation process to obtain an encrypted data packet, wherein the target position includes the end of the data packet after the encapsulation process, the header and the dedicated field of the check code.

[0077] Exemplarily, the load control terminal first calculates the data in the data packet to be sent according to a preset algorithm (such as a hash algorithm) to generate a check code. Then, the load control terminal inserts the check code into a specified position in the data packet that has been encapsulated according to the VPN channel protocol requirements. This position can be the end of the data packet, the head, or a field specifically used to store the check code. In this way, the load control terminal creates an encrypted data packet containing a check code, ensuring that the data has the ability to verify integrity before transmission, thereby enhancing the security and reliability of data transmission.

[0078] In an exemplary embodiment, the load control terminal sends an encrypted data packet to the management main station through a VPN channel, including:

[0079] The load control terminal detects the communication status of the VPN channel, and when the communication status of the VPN channel is normal, sends the encrypted data packet to the management main station through the VPN channel.

[0080] For example, the load control terminal will actively detect the communication status of the VPN channel between the load control terminal and the management master station to confirm whether the channel is in normal working condition. If the detection result shows that the communication status of the VPN channel is normal, and no network interruption, high latency or other abnormal conditions that affect communication are detected, the load control terminal will send the previously encrypted and encapsulated data packets to the management master station through this secure VPN channel. This process ensures that data transmission is only carried out when the network connection is stable and secure, thereby improving the reliability and security of data transmission.

[0081] In an exemplary embodiment, the method further comprises:

[0082] The load control terminal compresses and encrypts the data to be transmitted to obtain the data to be backed up;

[0083] The load control terminal verifies the integrity and availability of the data to be backed up;

[0084] The load control terminal performs data recovery when the data to be backed up is incomplete or unavailable.

[0085] Exemplarily, the load control terminal compresses the data to be transmitted to reduce the storage space it occupies, and then uses an encryption algorithm to encrypt the compressed data to generate data to be backed up. Next, the load control terminal verifies the integrity and availability of the generated data to be backed up to ensure that the data is not damaged during the compression and encryption process. If the verification result shows that the data to be backed up is incomplete or unavailable, the load control terminal will automatically start the data recovery process to repair or regenerate the correct data to be backed up, thereby ensuring that the final stored backup data is complete and available so that it can be smoothly restored when needed. This process enhances the reliability of data backup and the security of data management.

[0086] In an exemplary embodiment, the method further includes the following steps performed by the load control terminal and the management master station:

[0087] Collect log data;

[0088] Normalize log data;

[0089] Parse the normalized log data, save the log data with a priority higher than the priority threshold, and clear the log data with a priority lower than the priority threshold;

[0090] When security events or abnormal behaviors are detected in the log data, alarm information is output.

[0091] For example, the load control terminal and the management master station first collect log data related to system operation; then, the collected log data is normalized to unify the format and standard for subsequent processing; then, the normalized log data is parsed and classified according to the set priority threshold, and the log data with a priority higher than the threshold is retained for subsequent analysis, while the log data with a priority lower than the threshold is cleared to save storage resources; finally, the system will regularly check these log data, and once a possible security incident or abnormal behavior is detected, an alarm message will be immediately output so that timely countermeasures can be taken. This process ensures that important information is retained and used to monitor the health of the system, while avoiding irrelevant data from occupying valuable storage space.

[0092] In an exemplary embodiment, Figure 3 As shown, the present application also provides a safety control system between a load control terminal and a management master station, the system comprising: a load control terminal and a management master station, the load control terminal being connected to the management master station;

[0093] The load control terminal is used to encrypt the data to be transmitted using the encryption algorithm of the VPN channel to obtain an encrypted data packet; the VPN channel is a dedicated channel between the load control terminal and the management master station; the encrypted data packet is sent to the management master station through the VPN channel;

[0094] The management master station is used to authenticate the load control terminal connected to the VPN channel according to the authentication method of the VPN channel; if the identity authentication is successful, receive the encrypted data packet sent by the load control terminal; perform integrity verification on the encrypted data packet; if the integrity verification is successful, decrypt and analyze the encrypted data packet; if the integrity verification fails, detect the communication data based on the behavior-based detection method; when data intrusion and network threats are detected, activate the emergency plan, which includes switching the backup power supply, adjusting the load distribution and initiating emergency maintenance.

[0095] The specific implementation process and beneficial effects of the security control system between the above-mentioned load control terminal and the management main station correspond to the security control method between the above-mentioned load control terminal and the management main station. The specific details can be referred to the description in the above-mentioned embodiment, and will not be repeated here. Among them, the load terminal and the management main station both include an encryption communication module, an identity authentication and authorization module, a data integrity verification module, a data protection module, an audit and log management module, and an emergency processing module, wherein the encryption communication module can execute the encryption processing steps with transmission data as in the above-mentioned embodiment, the identity authentication and authorization module can execute the identity authentication steps as in the above-mentioned embodiment, the data integrity verification module can execute the integrity verification steps of the encrypted data packet as in the above-mentioned embodiment, the data protection module can execute the steps of initiating the emergency plan when data intrusion and network threats are detected as in the above-mentioned embodiment, the audit and log management module can execute the log data management steps as in the above-mentioned embodiment, and the emergency processing module can be used to respond quickly when a security incident occurs, take necessary measures to curb the development of the situation, and restore the normal operation of the system.

[0096] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0097] Based on the same inventive concept, the embodiment of the present application also provides a safety control device between a load control terminal and a management master station for implementing the safety control method between the load control terminal and the management master station involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in the embodiments of the safety control device between one or more load control terminals and the management master station provided below can be referred to the limitations of the safety control method between the load control terminal and the management master station above, and will not be repeated here.

[0098] In an exemplary embodiment, Figure 4 As shown, a safety control device between a load control terminal and a management master station is provided, comprising:

[0099] Encryption module 402, used to encrypt the data to be transmitted using the encryption algorithm of the VPN channel to obtain an encrypted data packet; the VPN channel is a dedicated channel between the load control terminal and the management master station;

[0100] The data transmission module 404 is used to transmit the encrypted data packet to the management main station through the VPN channel;

[0101] The identity verification module 406 is used to verify the identity of the load control terminal connected to the VPN channel according to the VPN channel authentication method;

[0102] Authorization module 408, used to receive the encrypted data packet sent by the load control terminal when the identity authentication is passed;

[0103] The data integrity verification module 410 is used to perform integrity verification on the encrypted data packet;

[0104] Decryption module 412, used to decrypt and analyze the encrypted data packet if the integrity check passes;

[0105] The communication data detection module 414 is used to detect the communication data based on the behavior detection method when the integrity check fails;

[0106] The data protection module 416 is used to activate the emergency plan when data intrusion and network threats are detected. The emergency plan includes switching the backup power supply, adjusting the load distribution and initiating emergency maintenance.

[0107] Each module in the safety control device between the load control terminal and the management master station can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module.

[0108] In an exemplary embodiment, a computer device is provided. When the execution subject of the safety control method between the load control terminal and the management master station is the management master station, the computer device may be a server, and its internal structure diagram may be as shown in FIG. Figure 5 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store power grid data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a safety control method between a load control terminal and a management master station is implemented.

[0109] In an exemplary embodiment, a computer device is provided. When the execution subject of the safety control method between the load control terminal and the management master station is the load control terminal, the computer device may be a terminal, and its internal structure diagram may be as shown in FIG. Figure 6As shown. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface, the display unit and the input device are connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and the external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be implemented through WIFI, a mobile cellular network, near field communication (Near Field Communication, NFC) or other technologies. When the computer program is executed by the processor, a safety control method X between a load control terminal and a management master station is implemented. The display unit of the computer device is used to form a visually visible picture, which can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.

[0110] Those skilled in the art will understand that Figure 5 and Figure 6 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0111] Example 2

[0112] Reference Figure 5 , Figure 6 , which is the second embodiment of the present invention, and which is different from the previous embodiment in that:

[0113] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc., which can store program codes.

[0114] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0115] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0116] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0117] Although the preferred embodiments of the present application have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0118] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A safety control method between a load control terminal and a management master station, characterized in that: include, The load control terminal uses the encryption algorithm of the VPN channel to encrypt the data to be transmitted to obtain an encrypted data packet; the VPN channel is a dedicated channel between the load control terminal and the management master station; The load control terminal sends the encrypted data packet to the management main station through the VPN channel; The management main station authenticates the load control terminal connected to the VPN channel according to the authentication method of the VPN channel; The management master station receives the encrypted data packet sent by the load control terminal when the identity authentication is passed; The management main station performs integrity check on the encrypted data packet; The management main station decrypts and analyzes the encrypted data packet if the integrity check passes; When the integrity check fails, the management master station detects the communication data based on a behavior-based detection method; When the management master station detects data intrusion and network threats, it activates an emergency plan, which includes switching backup power supplies, adjusting load distribution, and initiating emergency maintenance.

2. The safety control method between the load control terminal and the management master station according to claim 1, characterized in that: The management main station performs integrity check on the encrypted data packet, including: The management main station extracts the check code in the encrypted data packet, and uses a check algorithm to calculate the encrypted data packet to generate a verification check code, and compares the consistency of the check code with the verification check code; The management host station determines that the integrity check of the encrypted data packet passes when the check code is consistent with the verification check code; When the check code is inconsistent with the verification check code, the management host station determines that the integrity check of the encrypted data packet fails.

3. The safety control method between the load control terminal and the management master station according to claim 2, characterized in that: When the management main station detects no data intrusion and no network threat, it determines that there is a network failure.

4. The safety control method between the load control terminal and the management master station according to claim 3, characterized in that: The load control terminal uses the encryption algorithm of the VPN channel to encrypt the data to be transmitted to obtain the encrypted data packet, including: The load control terminal uses the encryption algorithm of the VPN channel to encrypt the data to be transmitted, and encapsulates the encrypted data packet according to the format required by the protocol of the VPN channel to obtain the encrypted data packet.

5. The safety control method between the load control terminal and the management master station according to claim 4, characterized in that: The load control terminal generates a check code according to the data in the preset algorithm data packet; The load control terminal adds the check code to the target position of the encapsulated data packet to obtain the encrypted data packet, wherein the target position includes the end, the head and the dedicated field of the check code of the encapsulated data packet.

6. The safety control method between the load control terminal and the management master station according to claim 5, characterized in that: The load control terminal detects the communication status of the VPN channel, and when the communication status of the VPN channel is normal, sends the encrypted data packet to the management main station through the VPN channel.

7. The safety control method between the load control terminal and the management master station according to claim 6, characterized in that: The load control terminal compresses and encrypts the data to be transmitted to obtain data to be backed up; The load control terminal verifies the integrity and availability of the data to be backed up; The load control terminal performs data recovery when the data to be backed up is incomplete or unavailable.

8. A system using the safety control method between a load control terminal and a management master station as claimed in any one of claims 1 to 7, characterized in that: It includes a load control terminal and a management master station, wherein the load control terminal is connected to the management master station; The load control terminal is used to encrypt the data to be transmitted using the encryption algorithm of the VPN channel to obtain an encrypted data packet; the VPN channel is a dedicated channel between the load control terminal and the management main station; the encrypted data packet is sent to the management main station through the VPN channel; The management master station is used to authenticate the load control terminal connected to the VPN channel according to the authentication method of the VPN channel; if the identity authentication is successful, receive the encrypted data packet sent by the load control terminal; perform integrity verification on the encrypted data packet; if the integrity verification is successful, decrypt and analyze the encrypted data packet; if the integrity verification fails, detect the communication data based on the behavior-based detection method; when data intrusion and network threats are detected, initiate an emergency plan, which includes switching the backup power supply, adjusting the load distribution and initiating emergency maintenance.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images