Substation real-time communication encryption method and system

Abstract

The present invention discloses a method for encrypting substation real-time communications, including constructing an encryption system for encrypting substation real-time communications; adopting an edge computing solution to ensure the real-time nature of password management; quantifying the security gain and delay in the substation real-time communication process; and performing optimization calculations based on the SORTS algorithm according to the quantification results to achieve final substation real-time communication encryption. The present invention also discloses a system for implementing the substation real-time communication encryption method. The substation real-time communication encryption method and system provided by the present invention, through the setting of communication indicators and the introduction of edge computing, not only achieve dynamic adaptive encryption of substation real-time communications, but also have higher reliability and better security.

Description

Technical Field

[0001] The present invention belongs to the field of electrical automation, and in particular relates to a substation real-time communication encryption method and system. Background Art

[0002] With the development of economy and technology and the improvement of people's living standards, electricity has become an indispensable secondary energy source in people's production and life, bringing endless convenience to people's production and life. Therefore, ensuring a stable and reliable supply of electricity has become one of the most important tasks of the power system.

[0003] Currently, power system substations are gradually evolving into digital substations. Within digital substations, substation network security is particularly crucial. Currently, substation networks are real-time and heterogeneous, presenting significant differences and incompatibilities with traditional encryption architectures, such as Secure Sockets Layer / Transport Layer Security (SSL / TLS) and Public Key Infrastructure (PKI). Consequently, encryption in substation networks presents the following challenges: Due to limited computing and storage resources, few industrial devices within digital substations support encryption or authentication. Furthermore, when certificate verification requires interaction with remote control centers via RTUs, the strict real-time requirements of certain communication services are incompatible with the cumbersome handshake phase in Secure Sockets Layer / Transport Layer Security (SSL / TLS) and the complex certificate management process in traditional Public Key Infrastructure (PKI). Finally, heterogeneous networks and diverse services with varying security and latency requirements place even more stringent demands on encryption. Summary of the Invention

[0004] One of the purposes of the present invention is to provide a substation real-time communication encryption method with high reliability and good security.

[0005] A second object of the present invention is to provide a system for implementing the substation real-time communication encryption method.

[0006] The substation real-time communication encryption method provided by the present invention comprises the following steps:

[0007] S1. Build an encryption system for encrypting real-time communications in substations;

[0008] S2. Use edge computing solutions to ensure real-time password management;

[0009] S3. Quantify the security gains and delays during real-time communication in substations;

[0010] S4. Based on the quantization result obtained in step S3, an optimization calculation is performed based on the SORTS algorithm to achieve the final substation real-time communication encryption.

[0011] The construction of an encryption system for encrypting substation real-time communication in step S1 specifically includes the following steps:

[0012] An encryption system built to encrypt real-time communications in substations, including cloud, edge, and endpoint layers;

[0013] The cloud layer includes the certificate and management server of the remote control center; the cloud layer is used to remotely monitor and control the encryption manager in the substation, globally manage authorization and certificates, and provide a management interface;

[0014] The functions of the cloud layer include: management services: including adding and removing endpoints and encryption devices, selecting cipher suites, and starting and stopping encryption services; certificate services: including certificate generation, storage, issuance, revocation, and association with devices; monitoring services, including displaying the operating status of encryption providers, reporting on connection status, and statistics on abnormal events;

[0015] The edge layer consists of several parallel encryption managers embedded in the substation RTUs. Each edge node stores and manages the encryption configuration and keys in the main RTU domain. The edge node collects traffic information from encryption providers in the domain and then calculates and executes the optimal encryption strategy for the current domain.

[0016] The endpoint layer includes cryptographic providers that provide encryption and signing services for resource-constrained endpoint devices that lack cryptographic capabilities.

[0017] The edge computing solution described in step S2 is used to ensure the real-time performance of password management, and specifically includes the following steps:

[0018] According to the encryption system constructed in step S1, the encryption management service is integrated into the RTU and remote control center, and the edge computing solution is adopted to ensure the real-time performance of password management.

[0019] The quantification of the security gain and delay in the substation real-time communication process described in step S3 specifically includes the following steps:

[0020] Convert the substation communication network into a graph: Set the substation communication network as a graph consisting of devices and flows between devices; set device risk level and flow risk level to measure the risk level of the device; set security gain to measure the security enhancement of different encryption schemes; use flow quota as the weight of security gain and delay; set a security configuration M for a set of flows F, denoted as m = M(f), where m is the encryption scheme applied to each flow in flow F, m∈C, and C is the set of all available methods;

[0021] The quantitative model is expressed as

[0022] DRL(d)=N(d)*M(d)

[0023] FRL(f)=P(f)*W(f)*DRL(S(f)) / DRL(D(f))

[0024]

[0025]

[0026] where DRL(d) is the risk level of device d in the substation network; N(d) is the number of unsafe links; M(d) is the number of maintenance visits per year; FRL(f) is the traffic risk level of subflow f; P(f) is the traffic quota of subflow f; W(f) is the service weight of subflow f; S(f) is the source device of subflow f; D(f) is the destination device of subflow f; SG(M) is the security gain; G(M(f)) is the empirical security gain; OD(M) is the total delay of security configuration M; and D(M(f)) is the delay introduced by security configuration M.

[0027] Step S4, based on the quantization result obtained in step S3, performs optimization calculation based on the SORTS algorithm to achieve the final substation real-time communication encryption, which specifically includes the following steps:

[0028] According to the quantization result obtained in step S3, based on the SORTS algorithm, a safe configuration M is solved so that SG(M) is maximized and OD(M) < η; where η is the set upper bound of the delay increment;

[0029] The computing process is implemented by edge nodes in the edge layer.

[0030] The step S4 further includes the following steps:

[0031] In the process of optimization calculation based on the SORTS algorithm, the following constraints are added to prevent the flow rate from exceeding the set value:

[0032]

[0033] Where D(f) is the delay introduced by sub-flow f.

[0034] The present invention also provides a system for implementing the substation real-time communication encryption method, including a system construction module, an edge computing module, an index quantification module and a communication encryption module; the system construction module, the edge computing module, the index quantification module and the communication encryption module are connected in series in sequence; the system construction module is used to construct an encryption system for encrypting substation real-time communication, and upload the data information to the edge computing module; the edge computing module is used to adopt an edge computing solution based on the received data information to ensure the real-time nature of password management, and upload the data information to the index quantification module; the index quantification module is used to quantify the security gain and delay in the substation real-time communication process based on the received data information, and upload the data information to the communication encryption module; the communication encryption module is used to perform optimization calculation based on the SORTS algorithm according to the received data information and the obtained quantification results to achieve the final substation real-time communication encryption.

[0035] The substation real-time communication encryption method and system provided by the present invention, through the setting of communication indicators and the introduction of edge computing, not only realize the dynamic adaptive encryption of substation real-time communication, but also have higher reliability and better security. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 Schematic diagram of the process of the present invention.

[0037] Figure 2 Schematic diagram of the functional modules of the system of the present invention. DETAILED DESCRIPTION

[0038] like Figure 1 The figure shows a flow chart of the method of the present invention: The substation real-time communication encryption method disclosed in the present invention comprises the following steps:

[0039] S1. Build an encryption system for encrypting real-time substation communications; specifically, the following steps:

[0040] An encryption system built to encrypt real-time communications in substations, including cloud, edge, and endpoint layers;

[0041] The cloud layer includes the certificate and management server of the remote control center; the cloud layer is used to remotely monitor and control the encryption manager in the substation, globally manage authorization and certificates, and provide a management interface;

[0042] The functions of the cloud layer include: management services: including adding and removing endpoints and encryption devices, selecting cipher suites, starting and stopping encryption services, etc.; certificate services: including certificate generation, storage, issuance, revocation, and association with devices; monitoring services, including displaying the operating status of encryption providers, reporting on connection status, and statistics on abnormal events;

[0043] The edge layer includes several parallel encryption managers embedded in the substation RTUs. Each edge node stores and manages the encryption configuration and keys for the main RTU domain. The edge node collects traffic information from encryption providers in the domain and then calculates and executes the optimal encryption strategy for the current domain. The edge node performs calculations based on the SORTS algorithm, which balances the security and availability of network traffic while also being able to resist certain types of denial of service (DoS) attacks. The algorithm makes real-time decisions based on an understanding of local network traffic. Under the premise of a trusted remote control center, the encryption manager's uplink is secure, and the security of the downlink is guaranteed by isolation and encryption technologies.

[0044] The endpoint layer includes cryptographic providers, which are used to provide encryption and signing services to resource-constrained endpoint devices that lack encryption capabilities. Cryptographic providers are designed as lightweight, pluggable encryption supplementary agents for endpoint devices. Due to the memory and storage limitations of cryptographic providers, most certificate operations are delegated to the edge layer.

[0045] S2. Use edge computing solutions to ensure real-time password management. This includes the following steps:

[0046] Based on the encryption system constructed in step S1, the encryption management service is integrated into the RTU and remote control center, and an edge computing solution is adopted to ensure the real-time performance of password management, including verification and key distribution;

[0047] S3. Quantify the security gain and delay in the substation real-time communication process; specifically, the steps include:

[0048] The concept of node assurance value for determining node credibility and the concept of flow assurance value derived by multiplying node assurance values ​​are borrowed from converting an industrial network N into a graph consisting of subsystems / nodes (D) and links (L), and the concept of flow assurance value is derived by multiplying node assurance values, and maintenance, service weights and flow directions are taken into account in a substation-specific network security model; therefore, the substation communication network is converted into a graph: the substation communication network is set as a graph consisting of flows between devices; the device risk level and flow risk level are set to measure the risk level of the device; the security gain is set to measure the security enhancement of different encryption schemes; the flow quota is used as the weight of security gain and delay; a security configuration M of a set of flows F is set, denoted as m=M(f), where m is the encryption scheme applied to each flow in flow F, m∈C, and C is the set of all available methods;

[0049] The quantitative model is expressed as

[0050] DRL(d)=N(d)*M(d)

[0051] FRL(f)=P(f)*W(f)*DRL(S(f)) / DRL(D(f))

[0052]

[0053]

[0054] Where DRL(d) is the risk level of device d in the substation network; N(d) is the number of unsafe links; M(d) is the number of maintenance operations per year; FRL(f) is the traffic risk level of subflow f; P(f) is the traffic quota of subflow f; W(f) is the service weight of subflow f; S(f) is the source device of subflow f; D(f) is the destination device of subflow f; SG(M) is the security gain; G(M(f)) is the empirical security gain; OD(M) is the total delay of security configuration M; D(M(f)) is the delay introduced by security configuration M.

[0055] S4. Based on the quantization results obtained in step S3, an optimization calculation is performed based on the SORTS algorithm to achieve the final substation real-time communication encryption; specifically, the steps include:

[0056] According to the quantization result obtained in step S3, based on the SORTS algorithm, a safe configuration M is solved so that SG(M) is maximized and OD(M) < η; where η is the set upper bound of the delay increment;

[0057] The computation process is implemented by edge nodes in the edge layer;

[0058] At the same time, during the optimization calculation based on the SORTS algorithm, since the encryption group to be connected is a mapping from all network flows to encryption methods, the following constraints can be added to prevent the flow rate from exceeding the set value:

[0059]

[0060] Where D(f) is the delay introduced by sub-flow f.

[0061] like Figure 2The figure shows a schematic diagram of the functional modules of the system of the present invention: the system disclosed in the present invention for implementing the substation real-time communication encryption method includes a system construction module, an edge computing module, an index quantification module and a communication encryption module; the system construction module, the edge computing module, the index quantification module and the communication encryption module are connected in series in sequence; the system construction module is used to construct an encryption system for encrypting substation real-time communication, and upload the data information to the edge computing module; the edge computing module is used to adopt an edge computing solution based on the received data information to ensure the real-time nature of password management, and upload the data information to the index quantification module; the index quantification module is used to quantify the security gain and delay in the substation real-time communication process based on the received data information, and upload the data information to the communication encryption module; the communication encryption module is used to perform optimization calculation based on the SORTS algorithm according to the received data information and the obtained quantification results to achieve the final substation real-time communication encryption.

Claims

1. A substation real-time communication encryption method, comprising the following steps: S1. Build an encryption system for encrypting real-time substation communications; specifically, the following steps: An encryption system built to encrypt real-time communications in substations, including cloud, edge, and endpoint layers; The cloud layer includes certificates and management servers for the remote control center; The cloud layer is used to remotely monitor and control the encryption manager in the substation, globally manage authorization and certificates, and provide a management interface; The functions of the cloud layer include: management services: including adding and removing endpoints and encryption devices, selecting cipher suites, and starting and stopping encryption services; certificate services: including certificate generation, storage, issuance, revocation, and association with devices; monitoring services, including displaying the operating status of encryption providers, reporting on connection status, and statistics on abnormal events; The edge layer consists of several parallel encryption managers embedded in the substation RTUs. Each edge node stores and manages the encryption configuration and keys in the main RTU domain. The edge node collects traffic information from encryption providers in the domain and then calculates and executes the optimal encryption strategy for the current domain. The endpoint layer includes cryptographic providers that provide encryption and signing services to resource-constrained endpoint devices that lack cryptographic capabilities; S2. Use edge computing solutions to ensure real-time password management. This includes the following steps: Based on the encryption system constructed in step S1, the encryption management service is integrated into the RTU and remote control center, and an edge computing solution is adopted to ensure the real-time performance of password management. S3. Quantify the security gain and delay in the substation real-time communication process; specifically, the steps include: Convert the substation communication network into a graph: Set the substation communication network as a graph consisting of devices and flows between devices; set device risk level and flow risk level to measure the risk level of the device; set security gain to measure the security enhancement of different encryption schemes; use flow quota as the weight of security gain and delay; set a security configuration M for a set of flows F, denoted as m = M(f), where m is the encryption scheme applied to each flow in flow F, m∈C, and C is the set of all available methods; The quantitative model is expressed as DRL(d)=N(d)*M(d) FRL(f)=P(f)*W(f)*DRL(S(f)) / DRL(D(f)) Where DRL(d) is the risk level of device d in the substation network; N(d) is the number of unsafe links; M(d) is the number of maintenance operations per year; FRL(f) is the traffic risk level of subflow f; P(f) is the traffic quota of subflow f; W(f) is the service weight of subflow f; S(f) is the source device of subflow f; D(f) is the destination device of subflow f; SG(M) is the security gain; G(M(f)) is the empirical security gain; OD(M) is the total delay of security configuration M; D(M(f)) is the delay introduced by security configuration M. S4. Based on the quantization results obtained in step S3, an optimization calculation is performed based on the SORTS algorithm to achieve the final substation real-time communication encryption; specifically, the steps include: According to the quantization result obtained in step S3, based on the SORTS algorithm, a safe configuration M is solved so that SG(M) is maximized and OD(M) < η; where η is the set upper bound of the delay increment; The computation process is implemented by edge nodes in the edge layer; In the process of optimization calculation based on the SORTS algorithm, the following constraints are added to prevent the flow rate from exceeding the set value: Where D(f) is the delay introduced by sub-flow f.

2. A system for implementing the substation real-time communication encryption method according to claim 1, characterized in that It includes a system construction module, an edge computing module, an indicator quantification module, and a communication encryption module; the system construction module, the edge computing module, the indicator quantification module, and the communication encryption module are connected in series in sequence; the system construction module is used to build an encryption system for encrypting real-time communication in the substation and upload data information to the edge computing module; the edge computing module is used to adopt an edge computing solution based on the received data information to ensure the real-time performance of password management and upload the data information to the indicator quantification module; The indicator quantification module is used to quantify the security gain and delay in the substation's real-time communication process based on the received data information, and upload the data information to the communication encryption module; The communication encryption module is used to perform optimization calculations based on the received data information and the obtained quantization results based on the SORTS algorithm to achieve the final substation real-time communication encryption.

Images