Transformer substation real-time communication encryption method and system

Abstract

The invention discloses a transformer substation real-time communication encryption method. The method comprises the following steps: constructing an encryption system for encrypting transformer substation real-time communication; an edge computing scheme is adopted to ensure the real-time performance of password management; safety gain and delay in the real-time communication process of the transformer substation are quantified; and according to a quantification result, carrying out optimization calculation based on an SORTS algorithm to realize final real-time communication encryption of the transformer substation. The invention also discloses a system for realizing the real-time communication encryption method of the transformer substation. According to the transformer substation real-time communication encryption method and system provided by the invention, through setting of communication indexes and introduction of edge calculation, dynamic adaptive encryption of transformer substation real-time communication is realized, the reliability is higher, and the security is better.

Description

Technical Field

[0001] The invention belongs to the field of electrical automation, and in particular relates to a substation real-time communication encryption method and system. Background Art

[0002] With the development of economy and technology and the improvement of people's living standards, electricity has become an indispensable secondary energy source in people's production and life, bringing endless convenience to people's production and life. Therefore, ensuring the stable and reliable supply of electricity has become one of the most important tasks of the power system.

[0003] At present, power system substations have gradually developed into digital substations. In digital substations, the security of substation networks is particularly important. At present, substation networks are real-time and heterogeneous, and there are obvious differences and incompatibilities between them and traditional encryption architectures represented by Secure Sockets Layer / Transport Layer Security (SSL / TLS) and Public Key Infrastructure (PKI). Therefore, there are mainly the following problems for the encryption of substation networks: due to the limitations of computing and storage resources, few industrial devices in digital substations support encryption or authentication; then, when certificate verification needs to interact with the remote control center through RTU, the strict real-time requirements of some communication services are incompatible with the cumbersome handshake stage in Secure Sockets Layer / Transport Layer Security (SSL / TLS) and the complex certificate management process in traditional Public Key Infrastructure (PKI); finally, heterogeneous networks and various services with different security and latency requirements put forward more stringent requirements for the encryption process. Summary of the invention

[0004] One of the purposes of the present invention is to provide a substation real-time communication encryption method with high reliability and good security.

[0005] A second object of the present invention is to provide a system for implementing the substation real-time communication encryption method.

[0006] The substation real-time communication encryption method provided by the present invention comprises the following steps:

[0007] S1. Construct an encryption system for encrypting real-time communication in substations;

[0008] S2. Use edge computing solutions to ensure real-time password management;

[0009] S3. Quantify the security gains and delays in the real-time communication process of the substation;

[0010] S4. According to the quantization result obtained in step S3, an optimization calculation is performed based on the SORTS algorithm to achieve the final substation real-time communication encryption.

[0011] The construction of an encryption system for encrypting substation real-time communication described in step S1 specifically includes the following steps:

[0012] An encryption system built to encrypt real-time communications in substations, including cloud, edge and endpoint layers;

[0013] The cloud layer includes the certificates and management server of the remote control center; the cloud layer is used to remotely monitor and control the encryption manager, global management authorization and certificates in the substation, and provide a management interface;

[0014] The functions of the cloud layer include: management services: including the addition and deletion of endpoints and encryption devices, the selection of cipher suites, and the start and stop of encryption services; certificate services: including the generation, storage, issuance, revocation and association of certificates with devices; monitoring services, including the display of the operating status of encryption providers, the reporting of connection status, and the statistics of abnormal events;

[0015] The edge layer includes several parallel encryption managers embedded in the substation RTU; each edge node saves and manages the encryption configuration and keys in the main RTU domain; the edge node collects traffic information from the encryption providers in the domain, and then calculates and executes the best encryption strategy for the current domain;

[0016] The endpoint layer includes cryptographic providers to provide encryption and signing services for resource-constrained endpoint devices that lack cryptographic capabilities.

[0017] The edge computing solution described in step S2 is used to ensure the real-time nature of password management, and specifically includes the following steps:

[0018] According to the encryption system constructed in step S1, the encryption management service is integrated into the RTU and the remote control center, and the edge computing solution is adopted to ensure the real-time nature of password management.

[0019] The quantification of the security gain and delay in the real-time communication process of the substation described in step S3 specifically includes the following steps:

[0020] Convert the substation communication network into a graph: Set the substation communication network as a graph consisting of devices and flows between devices; Set the device risk level and flow risk level to measure the risk level of the device; Set the security gain to measure the security enhancement of different encryption schemes; Use the flow quota as the weight of security gain and delay; Set a security configuration M of a set of flows F, expressed as m = M(f), where m is the encryption scheme applied to each flow in flow F, m∈C, and C is the set of all available methods;

[0021] The quantitative model is expressed as

[0022] DRL(d)=N(d)*M(d)

[0023] FRL(f)=P(f)*W(f)*DRL(S(f)) / DRL(D(f))

[0024]

[0025]

[0026] where DRL(d) is the risk level of device d in the substation network; N(d) is the number of unsafe links; M(d) is the number of maintenance times per year; FRL(f) is the traffic risk level of subflow f; P(f) is the traffic quota of subflow f; W(f) is the service weight of subflow f; S(f) is the source device of subflow f; D(f) is the destination device of subflow f; SG(M) is the safety gain; G(M(f)) is the empirical safety gain; OD(M) is the total delay of the safety configuration M; and D(M(f)) is the delay introduced by the safety configuration M.

[0027] According to the quantization result obtained in step S3, the optimization calculation is performed based on the SORTS algorithm to achieve the final substation real-time communication encryption, which specifically includes the following steps:

[0028] According to the quantization result obtained in step S3, based on the SORTS algorithm, solve the safety configuration M that makes SG(M) maximum and OD(M)<η; wherein η is the set upper limit of the delay increment;

[0029] The computing process is implemented by edge nodes in the edge layer.

[0030] The step S4 further comprises the following steps:

[0031] In the process of optimization calculation based on the SORTS algorithm, the following constraints are added to prevent the flow rate from being greater than the set value:

[0032]

[0033] Where D(f) is the delay introduced by sub-stream f.

[0034] The present invention also provides a system for implementing the substation real-time communication encryption method, including a system construction module, an edge computing module, an index quantification module and a communication encryption module; the system construction module, the edge computing module, the index quantification module and the communication encryption module are connected in series in sequence; the system construction module is used to construct an encryption system for encrypting the substation real-time communication, and upload the data information to the edge computing module; the edge computing module is used to adopt an edge computing solution according to the received data information to ensure the real-time nature of password management, and upload the data information to the index quantification module; the index quantification module is used to quantify the security gain and delay in the substation real-time communication process according to the received data information, and upload the data information to the communication encryption module; the communication encryption module is used to perform optimization calculations based on the received data information and the obtained quantification results based on the SORTS algorithm to achieve the final substation real-time communication encryption.

[0035] The substation real-time communication encryption method and system provided by the present invention, through the setting of communication indicators and the introduction of edge computing, not only realize the dynamic adaptive encryption of substation real-time communication, but also have higher reliability and better security. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 The figure is a schematic diagram of the method flow of the present invention.

[0037] Figure 2 Schematic diagram of the functional modules of the system of the present invention. DETAILED DESCRIPTION

[0038] like Figure 1 The method flow chart of the method of the present invention is shown as follows: The substation real-time communication encryption method disclosed in the present invention comprises the following steps:

[0039] S1. Construct an encryption system for encrypting real-time communication in the substation; specifically, the steps include:

[0040] An encryption system built to encrypt real-time communications in substations, including cloud, edge and endpoint layers;

[0041] The cloud layer includes the certificates and management server of the remote control center; the cloud layer is used to remotely monitor and control the encryption manager, global management authorization and certificates in the substation, and provide a management interface;

[0042] The functions of the cloud layer include: management services: including the addition and deletion of endpoints and encryption devices, the selection of cipher suites, the start and stop of encryption services, etc.; certificate services: including the generation, storage, issuance, revocation and association of certificates with devices; monitoring services, including the display of the operation status of encryption providers, the report of connection status and the statistics of abnormal events;

[0043] The edge layer includes several parallel encryption managers embedded in the substation RTU; each edge node saves and manages the encryption configuration and keys in the main RTU domain; the edge node collects traffic information from the encryption provider in the domain, and then calculates and executes the best encryption strategy for the current domain; when calculating, the edge node calculates based on the SORTS algorithm, which balances the security and availability of network traffic and also has the ability to resist certain types of denial of service (DoS) attacks; the algorithm makes real-time decisions based on the understanding of local network traffic. Under the premise of a trusted remote control center, the encryption manager uplink is secure, and the security of the downlink is guaranteed by isolation and encryption technology;

[0044] The endpoint layer includes cryptographic providers, which are used to provide encryption and signing services for resource-constrained endpoint devices that lack encryption capabilities. Cryptographic providers are designed as lightweight, pluggable cryptographic supplementary agents for endpoint devices. Due to the memory and storage constraints of cryptographic providers, most certificate operations are delegated to the edge layer.

[0045] S2. Use edge computing solutions to ensure the real-time nature of password management; specifically, the following steps are included:

[0046] According to the encryption system constructed in step S1, the encryption management service is integrated into the RTU and the remote control center, and the edge computing solution is adopted to ensure the real-time nature of password management, including verification and key distribution;

[0047] S3. Quantify the security gain and delay in the real-time communication process of the substation; specifically, the steps include:

[0048] The node assurance value concept of node credibility and the flow assurance value concept derived by multiplying the node assurance values ​​are borrowed from converting the industrial network N into a graph composed of subsystems / nodes (D) and links (L), and the maintenance, service weights and flow directions are taken into account in the substation-specific network security model; therefore, the substation communication network is converted into a graph: the substation communication network is set as a graph composed of flows between devices; the device risk level and flow risk level are set to measure the risk level of the device; the security gain is set to measure the security enhancement of different encryption schemes; the flow quota is used as the weight of security gain and delay; a security configuration M of a set of flows F is set, expressed as m=M(f), where m is the encryption scheme applied to each flow in flow F, m∈C, and C is the set of all available methods;

[0049] The quantitative model is expressed as

[0050] DRL(d)=N(d)*M(d)

[0051] FRL(f)=P(f)*W(f)*DRL(S(f)) / DRL(D(f))

[0052]

[0053]

[0054] Where DRL(d) is the risk level of device d in the substation network; N(d) is the number of unsafe links; M(d) is the number of maintenance times per year; FRL(f) is the traffic risk level of subflow f; P(f) is the traffic quota of subflow f; W(f) is the service weight of subflow f; S(f) is the source device of subflow f; D(f) is the destination device of subflow f; SG(M) is the safety gain; G(M(f)) is the empirical safety gain; OD(M) is the total delay of the safety configuration M; D(M(f)) is the delay introduced by the safety configuration M;

[0055] S4. According to the quantification result obtained in step S3, an optimization calculation is performed based on the SORTS algorithm to achieve the final substation real-time communication encryption; specifically, the steps include:

[0056] According to the quantization result obtained in step S3, based on the SORTS algorithm, solve the safety configuration M that makes SG(M) maximum and OD(M)<η; wherein η is the set upper limit of the delay increment;

[0057] The computation process is implemented by edge nodes in the edge layer;

[0058] At the same time, in the process of optimizing calculation based on the SORTS algorithm, since the encryption group to be connected is a mapping from all network flows to encryption methods, the following constraints can be added to prevent the flow from being greater than the set value:

[0059]

[0060] Where D(f) is the delay introduced by sub-stream f.

[0061] like Figure 2The figure shows a schematic diagram of the functional modules of the system of the present invention: the system disclosed in the present invention for implementing the substation real-time communication encryption method comprises a system construction module, an edge computing module, an index quantification module and a communication encryption module; the system construction module, the edge computing module, the index quantification module and the communication encryption module are connected in series in sequence; the system construction module is used to construct an encryption system for encrypting the substation real-time communication, and upload the data information to the edge computing module; the edge computing module is used to adopt an edge computing solution according to the received data information to ensure the real-time nature of password management, and upload the data information to the index quantification module; the index quantification module is used to quantify the security gain and delay in the substation real-time communication process according to the received data information, and upload the data information to the communication encryption module; the communication encryption module is used to perform optimization calculations based on the received data information and the obtained quantification results based on the SORTS algorithm to achieve the final substation real-time communication encryption.

Claims

1. A substation real-time communication encryption method, comprising the following steps: S1. Construct an encryption system for encrypting real-time communication in substations; S2. Use edge computing solutions to ensure real-time password management; S3. Quantify the security gains and delays in the real-time communication process of the substation; S4. According to the quantization result obtained in step S3, an optimization calculation is performed based on the SORTS algorithm to achieve the final substation real-time communication encryption.

2. The substation real-time communication encryption method according to claim 1 is characterized in that The construction of an encryption system for encrypting substation real-time communication described in step S1 specifically includes the following steps: An encryption system built to encrypt real-time communications in substations, including cloud, edge and endpoint layers; The cloud layer includes the remote control center's certificates and management servers; The cloud layer is used to remotely monitor and control the encryption manager in the substation, globally manage authorization and certificates, and provide a management interface; The functions of the cloud layer include: management services: including the addition and deletion of endpoints and encryption devices, the selection of cipher suites, and the start and stop of encryption services; certificate services: including the generation, storage, issuance, revocation and association of certificates with devices; monitoring services, including the display of the operating status of encryption providers, the reporting of connection status, and the statistics of abnormal events; The edge layer includes several parallel encryption managers embedded in the substation RTU; each edge node saves and manages the encryption configuration and keys in the main RTU domain; the edge node collects traffic information from the encryption providers in the domain, and then calculates and executes the best encryption strategy for the current domain; The endpoint layer includes cryptographic providers to provide encryption and signing services for resource-constrained endpoint devices that lack cryptographic capabilities.

3. The substation real-time communication encryption method according to claim 1 is characterized in that The edge computing solution described in step S2 is used to ensure the real-time nature of password management, and specifically includes the following steps: According to the encryption system constructed in step S1, the encryption management service is integrated into the RTU and the remote control center, and an edge computing solution is adopted to ensure the real-time nature of password management.

4. The substation real-time communication encryption method according to claim 3 is characterized in that The quantification of the security gain and delay in the real-time communication process of the substation described in step S3 specifically includes the following steps: Convert the substation communication network into a graph: Set the substation communication network as a graph consisting of devices and flows between devices; set the device risk level and flow risk level to measure the risk level of the device; Set security gains to measure the security enhancements of different encryption schemes; The traffic quota is used as the weight of security gain and delay; a security configuration M of a set of flows F is set, denoted as m=M(f), where m is the encryption scheme applied to each flow in flow F, m∈C, and C is the set of all available methods; The quantitative model is expressed as DRL(d)=N(d)*M(d) FRL(f)=P(f)*W(f)*DRL(S(f)) / DRL(D(f)) Where DRL(d) is the risk level of device d in the substation network; N(d) is the number of unsafe links; M(d) is the number of maintenance times per year; FRL(f) is the traffic risk level of subflow f; P(f) is the traffic quota of subflow f; W(f) is the service weight of subflow f; S(f) is the source device of subflow f; D(f) is the destination device of subflow f; SG(M) is the security gain; G(M(f)) is the empirical security gain; OD(M) is the total delay of security configuration M; D(M(f)) is the delay introduced by security configuration M.

5. The substation real-time communication encryption method according to claim 4 is characterized in that According to the quantization result obtained in step S3, the optimization calculation is performed based on the SORTS algorithm to achieve the final substation real-time communication encryption, which specifically includes the following steps: According to the quantization result obtained in step S3, based on the SORTS algorithm, solve the safety configuration M that makes SG(M) maximum and OD(M)<η; wherein η is the set upper limit of the delay increment; The computing process is implemented by edge nodes in the edge layer.

6. The substation real-time communication encryption method according to claim 5 is characterized in that The step S4 further comprises the following steps: In the process of optimization calculation based on the SORTS algorithm, the following constraints are added to prevent the flow rate from being greater than the set value: Where D(f) is the delay introduced by sub-stream f.

7. A system for implementing the substation real-time communication encryption method according to any one of claims 1 to 6, characterized in that It includes a system construction module, an edge computing module, an indicator quantification module and a communication encryption module; the system construction module, the edge computing module, the indicator quantification module and the communication encryption module are connected in series in sequence; the system construction module is used to build an encryption system for encrypting real-time communication of the substation, and upload data information to the edge computing module; the edge computing module is used to adopt an edge computing solution according to the received data information to ensure the real-time nature of password management, and upload data information to the indicator quantification module; The indicator quantification module is used to quantify the security gain and delay in the real-time communication process of the substation according to the received data information, and upload the data information to the communication encryption module; The communication encryption module is used to perform optimization calculations based on the received data information and the obtained quantization results based on the SORTS algorithm to achieve the final substation real-time communication encryption.

Images