Safe scheduling method and system for new energy equipment

Abstract

The invention discloses a security scheduling method and system for new energy equipment. The method comprises the following steps: receiving a first encrypted data packet sent by the new energy equipment; wherein the first encrypted data packet is generated by encrypting and signing according to the current state data of the new energy equipment; the state data comprises wind speed, rotating speed and power; decrypting the first encrypted data packet, then performing secondary encryption to generate a second encrypted data packet, and sending the second encrypted data packet to a dispatching center, so that the dispatching center decrypts the second encrypted data packet to obtain state data, generates a dispatching instruction according to the state data, and then encrypts and signs the dispatching instruction to obtain a first encrypted dispatching instruction; receiving the first encrypted scheduling instruction, decrypting the first encrypted scheduling instruction, and performing secondary encryption to generate a second encrypted scheduling instruction; and the second encrypted scheduling instruction is sent to the new energy equipment, so that the new energy equipment decrypts the second encrypted scheduling instruction to obtain a scheduling instruction, and scheduling is performed according to the scheduling instruction.

Description

Technical Field

[0001] The present invention relates to the field of new energy dispatching control, and in particular to a safe dispatching method and system for new energy equipment. Background Art

[0002] In the current field of wind turbine dispatching and power dispatching data transmission, there is a challenge of data transmission security. Although the traditional wired transmission method is stable, its application is limited by the complex wiring range and geographical environment, and it is difficult to adapt to the needs of widely distributed new energy equipment.

[0003] In contrast, wireless transmission has shown certain advantages in the transmission of new energy data due to its strong flexibility and convenient deployment. However, this transmission method is also accompanied by significant security risks. Since traditional wireless transmission technology often lacks effective encryption measures, data is easily subject to malicious tampering during transmission, which not only seriously threatens the confidentiality and integrity of the data, but also poses a potential threat to the stable operation of the power dispatching system. For example, if a fixed encryption algorithm is used directly between new energy equipment and the dispatching center, this seemingly safe encryption mechanism itself may also become a potential security vulnerability. Once the new energy equipment is illegally accessed or hacked due to insufficient security protection, the attacker may use this communication channel to reversely crack the encryption algorithm through reverse engineering and other means, and then obtain illegal access rights to the dispatching center data. Once this attack is successful, it may lead to the complete collapse of the data security system of the dispatching center, cause chaos in the power dispatching system, and may even cause immeasurable serious consequences such as large-scale power outages. Summary of the invention

[0004] The embodiments of the present invention provide a method and system for secure scheduling of new energy equipment, which ensure the confidentiality and integrity of status data and scheduling instructions during transmission, effectively prevent data leakage and tampering, and thus improve the security of communication between new energy equipment and a scheduling center.

[0005] An embodiment of the present invention provides a safe scheduling method for new energy equipment, which is applicable to a wireless security gateway in a safe scheduling system for new energy equipment; the safe scheduling method includes:

[0006] Receive a first encrypted data packet sent by the new energy device; wherein the first encrypted data packet is generated by encrypting and signing according to current status data of the new energy device; the status data includes: wind speed, rotation speed and power;

[0007] After decrypting the first encrypted data packet, perform secondary encryption to generate a second encrypted data packet;

[0008] Sending the second encrypted data packet to the dispatch center so that the dispatch center decrypts the second encrypted data packet to obtain the status data of the new energy equipment, and generates a dispatch instruction for the new energy equipment according to the status data of the new energy equipment, and then encrypts and signs the dispatch instruction to obtain the first encrypted dispatch instruction;

[0009] Receive the first encrypted dispatch instruction sent back by the dispatch center;

[0010] After decrypting the first encrypted scheduling instruction, perform secondary encryption to generate a second encrypted scheduling instruction;

[0011] The second encrypted scheduling instruction is sent to the new energy device, so that the new energy device decrypts the second encrypted scheduling instruction, obtains the scheduling instruction, and performs scheduling according to the scheduling instruction.

[0012] Furthermore, before receiving the first encrypted data packet sent by the new energy device, the method further includes:

[0013] Registration online detection steps: detect the registration online status of new energy equipment;

[0014] When the registration online status of the new energy device is registered online, a data confidentiality transmission channel is established between the new energy device and the wireless security gateway;

[0015] When the registration online status of the new energy equipment is not registered online, a registration online request is sent to the dispatch center, and the process jumps to the registration online detection step again; wherein, after receiving the registration online request, the dispatch center authenticates the identity of the new energy equipment, and after the identity authentication is passed, updates the registration status of the new energy equipment to registered online, otherwise, an equipment abnormality signal is issued.

[0016] Furthermore, when the registration online status of the new energy equipment is registered online, it also includes:

[0017] Online timing detection step: Generate a timing detection package according to the preset detection time node;

[0018] Sending a timing detection packet to the new energy device, so that the new energy device in an online state generates a reply signal according to the timing detection packet, and sends the reply signal back to the wireless security gateway;

[0019] Reply signal detection step: detect whether a reply signal is received at the current time;

[0020] If no reply signal is received at the current time, the waiting reply time is calculated based on the sending time of the timing detection packet and the current time;

[0021] Compare the waiting reply time with the preset detection reply time. If the waiting reply time does not exceed the preset detection reply time, jump back to the reply signal detection step. If the waiting reply time exceeds the preset detection reply time, it is determined that the new energy device has not responded, and the number of non-responses is accumulated. If the number of non-responses exceeds the preset number, it is determined that the registered online state of the new energy device is registered offline. If the number of non-responses does not exceed the preset number, jump back to the online timing detection step.

[0022] If a reply signal is received at the current time, the process will jump back to the online timing detection step and clear the number of unresponsive times.

[0023] Further, sending the second encrypted scheduling instruction to the new energy equipment includes:

[0024] The second encrypted scheduling instruction is sent to the new energy equipment through the data security transmission channel.

[0025] Further, sending the second encrypted data packet to the dispatch center includes:

[0026] The second encrypted data packet is sent to the dispatch center through a preset VPN channel.

[0027] Furthermore, after receiving the first encrypted data packet sent by the new energy device, the method further includes:

[0028] generating a first confirmation signal;

[0029] Encrypting and signing the first confirmation signal to obtain a first confirmation encrypted signal;

[0030] The first confirmation encrypted signal is sent back to the new energy device, so that when the new energy device receives the first confirmation encrypted signal, it decrypts the first confirmation encrypted signal to obtain the first confirmation signal; when the first confirmation encrypted signal is not received, the transmission delay is obtained according to the sending time of the first encrypted data packet and the current time; when the transmission delay exceeds the preset delay, the first encrypted data packet is resent to the wireless security gateway; when the transmission delay does not exceed the preset delay, the first confirmation signal continues to be received.

[0031] Further, decrypting the first encrypted data packet includes:

[0032] Decrypting the first encrypted data packet to obtain decrypted data and a first verification hash value;

[0033] Calculate the decrypted data using a hash algorithm to obtain a first calculated hash value;

[0034] Determine whether the first calculated hash value is consistent with the first verified hash value. If so, continue the security scheduling. If not, terminate the security scheduling and send a signal to the new energy device requesting to resend data.

[0035] Based on the above method embodiment, the present invention provides a corresponding system embodiment, including: new energy equipment, a wireless security gateway and a dispatching center;

[0036] The new energy device is used to send a first encrypted data packet to the wireless security gateway; wherein the first encrypted data packet is generated by encrypting and signing according to the current state data of the new energy device; the state data includes: wind speed, rotation speed and power;

[0037] A wireless security gateway is used to receive a first encrypted data packet sent by a new energy device; wherein the first encrypted data packet is generated by encrypting and signing according to the current status data of the new energy device; the status data includes: wind speed, rotation speed and power; after decrypting the first encrypted data packet, it is encrypted twice to generate a second encrypted data packet; the second encrypted data packet is sent to a dispatch center, so that the dispatch center decrypts the second encrypted data packet to obtain the status data of the new energy device, and generates a dispatch instruction for the new energy device according to the status data of the new energy device, and then encrypts and signs the dispatch instruction to obtain a first encrypted dispatch instruction; receives the first encrypted dispatch instruction returned by the dispatch center; after decrypting the first encrypted dispatch instruction, it is encrypted twice to generate a second encrypted dispatch instruction; the second encrypted dispatch instruction is sent to the new energy device, so that the new energy device decrypts the second encrypted dispatch instruction to obtain the dispatch instruction, and dispatches according to the dispatch instruction;

[0038] The dispatching center is used to receive the second encrypted data packet sent by the wireless security gateway; decrypt the second encrypted data packet to obtain the status data of the new energy equipment; generate the dispatching instruction of the new energy equipment according to the status data of the new energy equipment; encrypt and sign the dispatching instruction to obtain the first encrypted dispatching instruction; and send the first encrypted dispatching instruction back to the wireless security gateway.

[0039] Furthermore, before receiving the first encrypted data packet sent by the new energy device, the method further includes:

[0040] Registration online detection steps: detect the registration online status of new energy equipment;

[0041] When the registration online status of the new energy device is registered online, a data confidentiality transmission channel is established between the new energy device and the wireless security gateway;

[0042] When the registration online status of the new energy equipment is not registered online, a registration online request is sent to the dispatch center, and the process jumps to the registration online detection step again; wherein, after receiving the registration online request, the dispatch center authenticates the identity of the new energy equipment, and after the identity authentication is passed, updates the registration status of the new energy equipment to registered online, otherwise, an equipment abnormality signal is issued.

[0043] Furthermore, when the registration online status of the new energy equipment is registered online, it also includes:

[0044] Online timing detection step: Generate a timing detection package according to the preset detection time node;

[0045] Sending a timing detection packet to the new energy device, so that the new energy device in an online state generates a reply signal according to the timing detection packet, and sends the reply signal back to the wireless security gateway;

[0046] Reply signal detection step: detect whether a reply signal is received at the current time;

[0047] If no reply signal is received at the current time, the waiting reply time is calculated based on the sending time of the timing detection packet and the current time;

[0048] Compare the waiting reply time with the preset detection reply time. If the waiting reply time does not exceed the preset detection reply time, jump back to the reply signal detection step. If the waiting reply time exceeds the preset detection reply time, it is determined that the new energy device has not responded, and the number of non-responses is accumulated. If the number of non-responses exceeds the preset number, it is determined that the registered online state of the new energy device is registered offline. If the number of non-responses does not exceed the preset number, jump back to the online timing detection step.

[0049] If a reply signal is received at the current time, the process will jump back to the online timing detection step and clear the number of unresponsive times.

[0050] Compared with the prior art, the beneficial effects of the embodiment of this solution are:

[0051] The present invention receives the first encrypted data packet sent by the new energy device through the wireless security gateway in the security dispatching system of the new energy device, wherein the first encrypted data packet is generated by encrypting and signing according to the current state data of the new energy device; the state data includes: wind speed, rotation speed and power, and then, the wireless security gateway, as a transfer station for data transmission and a "hub" for encryption and decryption, decrypts the first encrypted data packet, performs secondary encryption, generates a second encrypted data packet, provides the first layer of security protection for the data, and ensures the confidentiality and integrity of the data transmitted between the new energy device and the wireless security gateway. Then, the wireless security gateway sends the second encrypted data packet to the dispatching center so that the dispatching center decrypts the second encrypted data packet, thereby restoring the original state data of the new energy device, providing the second layer of security protection for the data, and ensuring the confidentiality and integrity of the data transmitted between the wireless security gateway and the dispatching center, so that even if the security protection of the new energy device is breached, the attacker can only obtain the data packet encrypted for the first time, and cannot directly obtain the sensitive information of the dispatching center, thereby ensuring the confidentiality and integrity of the state data in the entire transmission process. Afterwards, the dispatching center generates a dispatching instruction for the new energy device according to the state data of the new energy device, and then encrypts and signs the dispatching instruction to obtain the first encrypted dispatching instruction. Next, the wireless security gateway receives the first encrypted dispatch instruction sent back by the dispatch center, decrypts the first encrypted dispatch instruction, performs secondary encryption, generates a second encrypted dispatch instruction, and sends the second encrypted dispatch instruction to the new energy device, so that the new energy device decrypts the second encrypted dispatch instruction and obtains the dispatch instruction, thereby ensuring the confidentiality and integrity of the dispatch instruction during the entire transmission process. Finally, the new energy device is dispatched according to the dispatch instruction, realizing the safe dispatch of the new energy device.

[0052] To summarize, the present invention introduces a wireless security gateway to achieve separated encryption and decryption processing between new energy equipment and the wireless security gateway, and between the wireless security gateway and the dispatch center, thereby ensuring the confidentiality and integrity of status data and dispatch instructions during transmission, effectively preventing data leakage and tampering, and thus improving the security of communication between new energy equipment and the dispatch center. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 It is a flow chart of a safe dispatching method for new energy equipment provided by an embodiment of the present invention;

[0054] Figure 2 It is a structural diagram of a safe dispatching system for new energy equipment provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0055] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0056] In the description of the present invention, it should be understood that the terms "first" and "second" are only used for descriptive purposes and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features.

[0057] like Figure 1 As shown, an embodiment of the present invention provides a method for secure scheduling of new energy equipment, which is applicable to a wireless security gateway in a secure scheduling system of new energy equipment. The method includes at least the following steps:

[0058] Step S1: receiving a first encrypted data packet sent by the new energy device; wherein the first encrypted data packet is generated by encrypting and signing according to the current status data of the new energy device; the status data includes: wind speed, rotation speed and power;

[0059] In a preferred embodiment, before receiving the first encrypted data packet sent by the new energy device, the method further includes:

[0060] Registration online detection steps: detect the registration online status of new energy equipment;

[0061] When the registration online status of the new energy device is registered online, a data confidentiality transmission channel is established between the new energy device and the wireless security gateway;

[0062] When the registration online status of the new energy equipment is not registered online, a registration online request is sent to the dispatch center, and the process jumps to the registration online detection step again; wherein, after receiving the registration online request, the dispatch center authenticates the identity of the new energy equipment, and after the identity authentication is passed, updates the registration status of the new energy equipment to registered online, otherwise, an equipment abnormality signal is issued.

[0063] For step S1, it should be noted that the safe dispatching method for new energy equipment of the present invention is applicable to the wireless security gateway in the safe dispatching system of new energy equipment, wherein the safe dispatching system of new energy equipment includes new energy equipment, a wireless security gateway and a dispatching center.

[0064] First, before the wireless security gateway receives the first encrypted data packet sent by the new energy device, it is necessary to detect the status of the new energy device to verify whether the new energy device has completed the necessary registration process and its identity has been recognized by the dispatch center. Specifically, the wireless security gateway will check the registration status of each new energy device that attempts to establish a connection. In this embodiment, the database or registry containing all registered device information is queried. If the registration status of the new energy device is "registered online", it means that the new energy device has passed the identity authentication and its information has been recorded by the dispatch center. At this time, the wireless security gateway will establish a secure data confidentiality transmission channel with the new energy device through VPN technology. This channel will be used for subsequent data transmission to ensure the confidentiality and integrity of the data during the transmission process. If the registration status of the new energy device is "unregistered online", it means that the device has not completed the registration process or its identity information has not been recorded by the dispatch center. In this case, the wireless security gateway will not immediately establish communication with the device. It will send a registration online request to the dispatch center, which contains the necessary identity information of the device, such as device ID, manufacturer information, etc. After receiving the online registration request, the dispatch center will perform a series of identity authentication operations, including checking whether the device's identity information matches the known device information, or requiring the device to provide additional verification information, such as passwords, keys, etc. If the identity authentication is successful, the dispatch center will update the registration status of the new energy device to "registered online" and notify the wireless security gateway that a data confidentiality transmission channel can be established. However, if the identity authentication fails, the dispatch center will send a device abnormality signal, indicating that the device may have security risks or identity forgery problems. At this time, the wireless security gateway will refuse to establish communication with the device and may take further security measures, such as recording abnormal logs, sending alarms, etc.

[0065] After the new energy equipment has confirmed the legitimacy and identity of the new energy equipment through the registration online detection step, it will collect the current status data in real time. The status data includes key parameters such as wind speed, rotation speed and power, which reflect the working efficiency and status of the equipment. Then, in order to ensure the security of the data, the new energy equipment will encrypt the status data through an encryption algorithm before sending it. The purpose of encryption is to protect the confidentiality of the data and prevent it from being intercepted or tampered with by unauthorized personnel during the transmission process. At the same time, the data packet will also be accompanied by a digital signature, which is generated by the device using a private key to verify the source and integrity of the data packet, thereby reducing the possibility of a third party forging false power dispatching information to disrupt the normal operation of the power system and improving the overall security of the system. Finally, after the data packet is encrypted and signed, the first encrypted data packet is generated, and the new energy device will send it to the wireless security gateway through the previously established data confidentiality transmission channel.

[0066] It should be noted that, for the selection of encryption algorithms, the present invention can use symmetric key algorithms such as AES or SM4 for data encryption. AES is a widely used symmetric key algorithm with the characteristics of high security and high efficiency. SM4 is a symmetric key algorithm independently developed in China, which is more suitable for domestic information security needs. For the selection of key exchange protocols, the present invention can use key exchange protocols such as IKEv2 or IKEv1 for key exchange. IKEv2 is an improved version of IKEv1, which has the characteristics of higher security and higher efficiency. For the selection of transport layer protocols, the present invention can use transport layer protocols such as TCP or UDP for data transmission. TCP is a reliable transport layer protocol that provides connection-oriented, ordered, and reliable data transmission services. UDP is an unreliable transport layer protocol that provides connectionless, unordered, and efficient data transmission services. Select a suitable transport layer protocol according to actual needs. For example, for applications that need to ensure data reliability, the TCP protocol can be selected; for applications that need to improve transmission efficiency, the UDP protocol can be selected. For the selection of transmission mode, select a suitable transmission mode according to actual needs, such as stream mode or message mode. The stream mode treats data as a continuous stream of bytes without distinguishing data blocks; the message mode divides data into independent messages, each of which contains complete header and tail information. Select the appropriate transmission mode according to actual needs. For example, for applications that need to ensure data integrity, you can choose the message mode; for applications that need to improve transmission efficiency, you can choose the stream mode.

[0067] The wireless security gateway receives the first encrypted data packet sent by the new energy device, and after receiving the first encrypted data packet, continues to execute step S2 of security scheduling of the new energy device.

[0068] At the same time, after the wireless security gateway receives the first encrypted data packet sent by the new energy device, it needs to give feedback to the new energy device to indicate that the transmitted data has been successfully received.

[0069] Preferably, after receiving the first encrypted data packet sent by the new energy device, the method further includes:

[0070] generating a first confirmation signal;

[0071] Encrypting and signing the first confirmation signal to obtain a first confirmation encrypted signal;

[0072] The first confirmation encrypted signal is sent back to the new energy device, so that when the new energy device receives the first confirmation encrypted signal, it decrypts the first confirmation encrypted signal to obtain the first confirmation signal; when the first confirmation encrypted signal is not received, the transmission delay is obtained according to the sending time of the first encrypted data packet and the current time; when the transmission delay exceeds the preset delay, the first encrypted data packet is resent to the wireless security gateway; when the transmission delay does not exceed the preset delay, the first confirmation signal continues to be received.

[0073] Specifically, after successfully receiving and processing the first encrypted data packet, the wireless security gateway first generates a first confirmation signal, indicating that the data packet has been successfully received. Similarly, in order to ensure the security and authenticity of the confirmation signal, the wireless security gateway uses the encryption algorithm agreed with the new energy device to encrypt the first confirmation signal, and digitally signs the encrypted confirmation signal to ensure the integrity of the signal and the authenticity of the source. Then, the encrypted and signed confirmation signal, that is, the first confirmation encryption signal, is sent back to the new energy device through the data confidentiality transmission channel. After receiving the first confirmation encryption signal, the new energy device uses the same decryption algorithm and key to decrypt it to restore the first confirmation signal. If the new energy device does not receive the first confirmation encryption signal within a preset time, it will calculate the transmission delay based on the sending time of the first encrypted data packet and the current time. If the transmission delay exceeds the preset delay threshold, indicating that the data is lost, the new energy device will resend the first encrypted data packet to the wireless security gateway. If the transmission delay does not exceed the preset delay threshold, the new energy device will continue to wait and try to receive the first confirmation signal until it exceeds the preset delay threshold or receives the first confirmation signal within the preset delay threshold.

[0074] In addition, before executing the data interaction process between the new energy device and the wireless security gateway, the production and installation workflow of the device digital identity certificate is started. The specific implementation steps include the following: issuance and installation of the device digital identity certificate. The device digital identity certificate includes two types of certificates: new energy device and wireless security gateway. The issuance of the device digital identity certificate is uniformly issued by the internal private CA submodule in the wireless security gateway.

[0075] After executing the data interaction process between the new energy equipment and the wireless security gateway, in order to ensure the safe and stable operation of the new energy equipment, the new energy scheduling equipment timing detection process is started.

[0076] Preferably, when the registration online status of the new energy equipment is registered online, the method further includes:

[0077] Online timing detection step: Generate a timing detection package according to the preset detection time node;

[0078] Sending the timing detection packet to the new energy device, so that the new energy device in the online state generates a reply signal according to the timing detection packet, and sends the reply signal back to the wireless security gateway;

[0079] Reply signal detection step: detecting whether the reply signal is received at the current time;

[0080] If the reply signal is not received at the current time, the waiting reply time is calculated according to the sending time of the timing detection packet and the current time;

[0081] Compare the waiting reply time with the preset detection reply time; if the waiting reply time does not exceed the preset detection reply time, jump back to the reply signal detection step; if the waiting reply time exceeds the preset detection reply time, determine that the new energy device has not responded, and accumulate the number of non-responses; if the number of non-responses exceeds the preset number, determine that the registered online state of the new energy device is registered offline; if the number of non-responses does not exceed the preset number, jump back to the online timing detection step;

[0082] If the reply signal is received at the current time, the process jumps back to the online timing detection step and clears the number of unresponsive times.

[0083] Specifically, the wireless security gateway automatically generates a timing detection package according to a preset detection time node, such as a fixed time period every hour or every day. These detection packages contain specific detection instructions or parameters, which are used to trigger the self-detection or status feedback of the new energy device. When the preset detection time node is reached, the wireless security gateway will send the generated timing detection package to the corresponding new energy device through the data confidentiality transmission channel. At the same time, the wireless security gateway will record the key information such as the sending time, device ID, and detection package content for subsequent auditing. After sending the timing detection package, when the new energy device in the registered online receives the timing detection package, it performs self-detection or status feedback operations according to the instructions therein, generates a reply signal, and sends the reply signal back to the wireless security gateway (if the new energy device is offline, it is impossible to perform status feedback, thereby generating a reply signal); after sending the timing detection package, the wireless security gateway will enter a waiting state to monitor the reply signal of the new energy device. The reply signal contains the current status information, detection results or confirmation information of the new energy device, specifically detecting whether the reply signal is received at the current time. If received, it indicates that the device is in a normal response state; if not received, further processing is required.

[0084] If no reply signal is received at the current time, the wireless security gateway will calculate the waiting reply time according to the sending time of the timing detection package and the current time. Subsequently, the wireless security gateway will compare this waiting reply time with the preset detection reply time. In this embodiment, the preset detection reply time is set based on the response time of the device, network delay and other factors. If the waiting reply time does not exceed the preset detection reply time, the wireless security gateway will maintain the monitoring state and jump back to the reply signal detection step to continue monitoring the reply signal and wait for the reply of the new energy device. If the waiting reply time exceeds the preset detection reply time, the wireless security gateway will determine that the new energy device has not responded and accumulate the number of unresponsive times. When the number of unresponsive times reaches or exceeds the preset number threshold, the gateway will update the registered online status of the new energy device to "registered offline", indicating that the device may be in a state of failure, offline or unable to communicate. In this embodiment, the number of unresponsive times is accumulated to 3 times, that is, any of the 3 consecutive online timing detections did not receive a reply from the detection device within the specified time, and the device status table in the wireless security gateway is updated to the device status offline, and the offline time is the current detection time.

[0085] It should be noted that when it is detected that a reply signal has been received at the current time, the current accumulated number of unresponsive times needs to be cleared and recounted to prepare for the next round of detection cycle.

[0086] After executing the data interaction process between the new energy device and the wireless security gateway, start the key refresh process in the data confidentiality transmission channel, which specifically includes the following implementation steps:

[0087] Read the refresh cycle of the data confidentiality transmission channel of the new energy device in the device registry. This cycle is pre-set and is used to determine when the key in the data confidentiality transmission channel needs to be updated. Start a refresh timer based on the refresh cycle read. When the refresh timer reaches the set time, it triggers the establishment process of the data confidentiality transmission channel, including re-establishing the secure communication link between the new energy device and the wireless security gateway, and negotiating a new key. During the link establishment process, the new energy device and the wireless security gateway will use the new key to communicate. These new keys will replace the old keys, thereby ensuring the security of the data confidentiality transmission channel.

[0088] Step S2: After decrypting the first encrypted data packet, perform secondary encryption to generate a second encrypted data packet;

[0089] Preferably, decrypting the first encrypted data packet includes:

[0090] Decrypting the first encrypted data packet to obtain decrypted data and a first verification hash value;

[0091] Calculate the decrypted data using a hash algorithm to obtain a first calculated hash value;

[0092] Determine whether the first calculated hash value is consistent with the first verified hash value. If so, continue the security scheduling. If not, terminate the security scheduling and send a signal to the new energy device requesting to resend data.

[0093] For step S2, the wireless security gateway receives the first encrypted data packet through step S1, which contains the encrypted data and additional information (such as check code, timestamp, etc.). Subsequently, the wireless security gateway selects the corresponding decryption algorithm according to the encryption algorithm agreed in advance with the new energy device. This encryption algorithm is shared by both parties and is used to ensure the security of the data during transmission. After decryption processing, the wireless security gateway obtains the decrypted data and the first verification hash value. This first verification hash value is obtained by the new energy device by performing a hash operation on the data content before sending the data, and is used to verify the integrity and authenticity of the data at the receiving end. Then, the decrypted data is hashed using the same hash algorithm to obtain the first calculated hash value, and the first calculated hash value is compared with the first verification hash value. If the two are equal, it means that the data has not been tampered with or damaged during the transmission process, and the data integrity is verified. At this time, the wireless security gateway continues to perform subsequent security scheduling operations. If the data verification fails, that is, the first calculated hash value is not equal to the first verification hash value, then the wireless security gateway sends a signal to the new energy device requesting the data to be resent, and records an error log.

[0094] After the wireless security gateway decrypts the first encrypted data packet to obtain the decrypted data, it uses another encryption algorithm to re-encrypt the data to generate a second encrypted data packet. The algorithm used for this encryption is agreed upon in advance with the dispatch center, ensuring that the security of this link is independent of the previous communication process with the new energy device. The core purpose of this practice is to enhance the confidentiality and integrity of the communication between the new energy device and the dispatch center. By introducing another layer of encryption, even if the attacker can successfully attack the new energy device and obtain the encrypted communication content between it and the wireless security gateway, they still cannot directly parse the communication encryption algorithm and key between the new energy device and the dispatch center, which greatly increases the difficulty of attacking the dispatch center. In addition, the secondary encryption also helps prevent data from being tampered with during transmission. Because any illegal modification of the encrypted data will be exposed during decryption, resulting in decryption failure or data inconsistency, thereby triggering a security alarm or error handling mechanism.

[0095] In addition, when it is detected that the first calculated hash value is not equal to the first verified hash value, that is, the data is damaged, an error correction code is used for error correction. For example, a Reed-Solomon error correction code or an LDPC error correction code can be used to correct the data.

[0096] Step S3: sending the second encrypted data packet to the dispatch center, so that the dispatch center decrypts the second encrypted data packet to obtain the status data of the new energy equipment, and generates a dispatch instruction of the new energy equipment according to the status data of the new energy equipment, and then encrypts and signs the dispatch instruction to obtain a first encrypted dispatch instruction;

[0097] In a preferred embodiment, sending the second encrypted data packet to the dispatch center includes:

[0098] The second encrypted data packet is sent to the dispatch center through a preset VPN channel.

[0099] For step S3, the second encrypted data packet obtained after the second encryption of step S2 is sent to the dispatch center through the preset VPN channel. After receiving the second encrypted data packet, the dispatch center uses the decryption algorithm and key agreed with the wireless security gateway to decrypt it. After decryption, the dispatch center can obtain the status data of the new energy equipment. According to the status data of the new energy equipment, the dispatch center will analyze and make decisions, and generate corresponding dispatch instructions to guide the new energy equipment on how to adjust its working state to meet the power grid demand or improve energy utilization efficiency. In this embodiment, the dispatch center will adjust the operation mode of the power grid according to the actual situation, such as changing the output power of the generator set, adjusting the power flow distribution of the transmission line, etc., to maintain the stability of the system. If the abnormal situation of the new energy equipment may cause power supply interruption or other major impacts, immediately start the corresponding emergency plan, such as load transfer, backup power supply input, etc., to minimize the impact. For example, if the number of wind turbines in operation in the current area is x, each turbine needs to generate y electricity per unit time to meet the required wind power xy in the area. However, the system detects that the current total wind power generation is less than xy, and a wind turbine fails, causing its power generation to be abnormal. At this time, the dispatch center promptly activates the emergency plan, isolates the faulty generator, and starts the non-operating generator to replace the faulty generator, and connects it to the power grid with a unit power generation of y to keep the total power generation of the system unchanged. At the same time, the relevant maintenance personnel are notified in time to carry out maintenance.

[0100] Next, the dispatch center encrypts the corresponding dispatch instruction and digitally signs it to verify the authenticity and integrity of the instruction. After completing the encryption and signing, the dispatch center will send the first encrypted dispatch instruction back to the wireless security gateway corresponding to the new energy device through the same VPN channel.

[0101] It should be noted that the encryption and signing process is similar to the data processing of the wireless security gateway in step S2, but the algorithms and keys used are different, because the communication between the dispatch center and the new energy equipment needs to maintain independent security to avoid potential key leakage or algorithm cracking that may threaten the entire communication system and the dispatch center.

[0102] Step S4: receiving the first encrypted dispatch instruction sent back by the dispatch center;

[0103] In step S4, the wireless security gateway receives the first encrypted scheduling instruction sent back by the scheduling center.

[0104] As needed, the wireless security gateway waits for and receives the first encrypted scheduling instruction from the scheduling center, and after receiving the first encrypted scheduling instruction, generates a second confirmation message and returns it to the scheduling center to confirm to the scheduling center that the first encrypted scheduling instruction has been successfully received.

[0105] Step S5: After decrypting the first encrypted scheduling instruction, perform secondary encryption to generate a second encrypted scheduling instruction;

[0106] For step S5, after receiving the first encrypted scheduling instruction sent back by the scheduling center, the wireless security gateway uses the decryption algorithm and key agreed with the scheduling center to decrypt the first encrypted scheduling instruction to restore the original scheduling instruction content. After the decryption is successful, the wireless security gateway applies another set of encryption algorithms and keys agreed with the new energy device for secondary encryption to generate a second encrypted scheduling instruction to ensure the independence and security of the communication between the new energy device and the wireless security gateway.

[0107] Step S6: Send the second encrypted scheduling instruction to the new energy device, so that the new energy device decrypts the second encrypted scheduling instruction, obtains the scheduling instruction, and performs scheduling according to the scheduling instruction.

[0108] In a preferred embodiment, sending the second encrypted scheduling instruction to the new energy device includes:

[0109] The second encrypted scheduling instruction is sent to the new energy equipment through the data security transmission channel.

[0110] For step S6, after completing the secondary encryption in step S5 to obtain the second encrypted scheduling instruction, the wireless security gateway sends the second encrypted scheduling instruction to the new energy device that needs to be scheduled through the data security transmission channel. The new energy device continues to receive the second encrypted scheduling instruction. After receiving the second encrypted scheduling instruction, it uses the decryption algorithm and key agreed with the wireless security gateway to decrypt it and restore the original scheduling instruction content so that the new energy device can understand and execute it.

[0111] In the present invention, a wireless security gateway is used for data transmission to realize vertical isolation between the power intranet and the management information area, which not only improves the efficiency and reliability of data transmission, but also reduces the risk of data leakage and malicious attacks.

[0112] like Figure 2 As shown, based on the above method embodiment, a corresponding system embodiment is provided;

[0113] An embodiment of the present invention provides a security dispatching system for new energy equipment, including: new energy equipment, a wireless security gateway and a dispatching center;

[0114] The new energy device is used to send a first encrypted data packet to the wireless security gateway; wherein the first encrypted data packet is generated by encrypting and signing according to the current state data of the new energy device; the state data includes: wind speed, rotation speed and power;

[0115] A wireless security gateway is used to receive a first encrypted data packet sent by a new energy device; wherein the first encrypted data packet is generated by encrypting and signing according to the current status data of the new energy device; the status data includes: wind speed, rotation speed and power; after decrypting the first encrypted data packet, it is encrypted twice to generate a second encrypted data packet; the second encrypted data packet is sent to a dispatch center, so that the dispatch center decrypts the second encrypted data packet to obtain the status data of the new energy device, and generates a dispatch instruction for the new energy device according to the status data of the new energy device, and then encrypts and signs the dispatch instruction to obtain a first encrypted dispatch instruction; receives the first encrypted dispatch instruction returned by the dispatch center; after decrypting the first encrypted dispatch instruction, it is encrypted twice to generate a second encrypted dispatch instruction; the second encrypted dispatch instruction is sent to the new energy device, so that the new energy device decrypts the second encrypted dispatch instruction to obtain the dispatch instruction, and dispatches according to the dispatch instruction;

[0116] The dispatching center is used to receive the second encrypted data packet sent by the wireless security gateway; decrypt the second encrypted data packet to obtain the status data of the new energy equipment; generate the dispatching instruction of the new energy equipment according to the status data of the new energy equipment; encrypt and sign the dispatching instruction to obtain the first encrypted dispatching instruction; and send the first encrypted dispatching instruction back to the wireless security gateway.

[0117] In a preferred embodiment, before receiving the first encrypted data packet sent by the new energy device, the method further includes:

[0118] Registration online detection steps: detect the registration online status of new energy equipment;

[0119] When the registration online status of the new energy device is registered online, a data confidentiality transmission channel is established between the new energy device and the wireless security gateway;

[0120] When the registration online status of the new energy equipment is not registered online, a registration online request is sent to the dispatch center, and the process jumps to the registration online detection step again; wherein, after receiving the registration online request, the dispatch center authenticates the identity of the new energy equipment, and after the identity authentication is passed, updates the registration status of the new energy equipment to registered online, otherwise, an equipment abnormality signal is issued.

[0121] In a preferred embodiment, when the online registration state of the new energy device is already registered online, the method further includes:

[0122] Online timing detection step: Generate a timing detection package according to the preset detection time node;

[0123] Sending a timing detection packet to the new energy device, so that the new energy device in an online state generates a reply signal according to the timing detection packet, and sends the reply signal back to the wireless security gateway;

[0124] Reply signal detection step: detect whether a reply signal is received at the current time;

[0125] If no reply signal is received at the current time, the waiting reply time is calculated based on the sending time of the timing detection packet and the current time;

[0126] Compare the waiting reply time with the preset detection reply time. If the waiting reply time does not exceed the preset detection reply time, jump back to the reply signal detection step. If the waiting reply time exceeds the preset detection reply time, it is determined that the new energy device has not responded, and the number of non-responses is accumulated. If the number of non-responses exceeds the preset number, it is determined that the registered online state of the new energy device is registered offline. If the number of non-responses does not exceed the preset number, jump back to the online timing detection step.

[0127] If a reply signal is received at the current time, the process will jump back to the online timing detection step and clear the number of unresponsive times.

[0128] It can be understood that the above-mentioned system item embodiments correspond to the method item embodiments of the present invention, which can implement the safe scheduling method of new energy equipment provided by any of the above-mentioned method item embodiments of the present invention.

[0129] It should be noted that the system embodiments described above are merely illustrative, and some or all of the modules may be selected according to actual needs to achieve the purpose of the present embodiment. In addition, in the drawings of the system embodiments provided by the present invention, the connection relationship between the modules indicates that there is a communication connection between them, which may be specifically implemented as one or more communication buses or signal lines. Those of ordinary skill in the art may understand and implement the present invention without creative work.

[0130] The above is a preferred embodiment of the present invention. It should be pointed out that a person skilled in the art can make several improvements and modifications without departing from the principle of the present invention. These improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A safe dispatching method for new energy equipment, characterized in that: Wireless security gateway suitable for the security dispatching system of new energy equipment; The safe dispatching method comprises: Receive a first encrypted data packet sent by the new energy device; wherein the first encrypted data packet is generated by encrypting and signing according to current status data of the new energy device; the status data includes: wind speed, rotation speed and power; After decrypting the first encrypted data packet, perform secondary encryption to generate a second encrypted data packet; Sending the second encrypted data packet to the dispatch center so that the dispatch center decrypts the second encrypted data packet to obtain the status data of the new energy equipment, and generates a dispatch instruction for the new energy equipment according to the status data of the new energy equipment, and then encrypts and signs the dispatch instruction to obtain a first encrypted dispatch instruction; Receive the first encrypted dispatch instruction sent back by the dispatch center; After decrypting the first encrypted scheduling instruction, perform secondary encryption to generate a second encrypted scheduling instruction; The second encrypted scheduling instruction is sent to the new energy device, so that the new energy device decrypts the second encrypted scheduling instruction, obtains the scheduling instruction, and performs scheduling according to the scheduling instruction.

2. The safe dispatching method of new energy equipment according to claim 1, characterized in that: Before receiving the first encrypted data packet sent by the new energy device, the method further includes: Registration online detection steps: detect the registration online status of new energy equipment; When the registration online status of the new energy device is registered online, a data confidentiality transmission channel is established between the new energy device and the wireless security gateway; When the registration online status of the new energy equipment is not registered online, a registration online request is sent to the dispatch center, and the process jumps to the registration online detection step again; wherein, after receiving the registration online request, the dispatch center authenticates the identity of the new energy equipment, and after the identity authentication is passed, updates the registration status of the new energy equipment to registered online, otherwise, an equipment abnormality signal is issued.

3. The safe dispatching method of new energy equipment according to claim 2, characterized in that: When the online registration status of the new energy equipment is registered online, it also includes: Online timing detection step: Generate a timing detection package according to the preset detection time node; Sending the timing detection packet to the new energy device, so that the new energy device in the online state generates a reply signal according to the timing detection packet, and sends the reply signal back to the wireless security gateway; Reply signal detection step: detecting whether the reply signal is received at the current time; If the reply signal is not received at the current time, the waiting reply time is calculated according to the sending time of the timing detection packet and the current time; Compare the waiting reply time with the preset detection reply time; if the waiting reply time does not exceed the preset detection reply time, jump back to the reply signal detection step; if the waiting reply time exceeds the preset detection reply time, determine that the new energy device has not responded, and accumulate the number of non-responses; if the number of non-responses exceeds the preset number, determine that the registered online state of the new energy device is registered offline; if the number of non-responses does not exceed the preset number, jump back to the online timing detection step; If the reply signal is received at the current time, the process jumps back to the online timing detection step and clears the number of unresponsive times.

4. The safe dispatching method of new energy equipment according to claim 2, characterized in that: Sending the second encrypted scheduling instruction to the new energy equipment includes: The second encrypted scheduling instruction is sent to the new energy equipment through the data security transmission channel.

5. The safe dispatching method of new energy equipment according to claim 4, characterized in that: Sending the second encrypted data packet to the dispatch center includes: The second encrypted data packet is sent to the dispatch center through a preset VPN channel.

6. The safe dispatching method of new energy equipment according to claim 1, characterized in that: After receiving the first encrypted data packet sent by the new energy device, the method further includes: generating a first confirmation signal; Encrypting and signing the first confirmation signal to obtain a first confirmation encrypted signal; The first confirmation encrypted signal is sent back to the new energy device, so that when the new energy device receives the first confirmation encrypted signal, it decrypts the first confirmation encrypted signal to obtain the first confirmation signal; when the first confirmation encrypted signal is not received, the transmission delay is obtained according to the sending time of the first encrypted data packet and the current time; when the transmission delay exceeds the preset delay, the first encrypted data packet is resent to the wireless security gateway; when the transmission delay does not exceed the preset delay, the first confirmation signal continues to be received.

7. The safe dispatching method of new energy equipment according to claim 1, characterized in that: Decrypting the first encrypted data packet includes: Decrypting the first encrypted data packet to obtain decrypted data and a first verification hash value; Calculate the decrypted data using a hash algorithm to obtain a first calculated hash value; Determine whether the first calculated hash value is consistent with the first verified hash value. If so, continue the security scheduling. If not, terminate the security scheduling and send a signal to the new energy device requesting resending of data.

8. A safe dispatching system for new energy equipment, characterized in that: include: New energy equipment, wireless security gateway and dispatch center; The new energy device is used to send a first encrypted data packet to the wireless security gateway; wherein the first encrypted data packet is generated by encrypting and signing according to the current status data of the new energy device; the status data includes: wind speed, rotation speed and power; The wireless security gateway is used to receive a first encrypted data packet sent by the new energy device; wherein the first encrypted data packet is generated by encrypting and signing according to the current status data of the new energy device; the status data includes: wind speed, rotation speed and power; after decrypting the first encrypted data packet, perform secondary encryption to generate a second encrypted data packet; send the second encrypted data packet to the dispatch center, so that the dispatch center decrypts the second encrypted data packet to obtain the status data of the new energy device, and generates a dispatch instruction for the new energy device according to the status data of the new energy device, and then encrypts and signs the dispatch instruction to obtain a first encrypted dispatch instruction; receive the first encrypted dispatch instruction returned by the dispatch center; after decrypting the first encrypted dispatch instruction, perform secondary encryption to generate a second encrypted dispatch instruction; send the second encrypted dispatch instruction to the new energy device, so that the new energy device decrypts the second encrypted dispatch instruction to obtain the dispatch instruction, and dispatches according to the dispatch instruction; The dispatch center is used to receive a second encrypted data packet sent by the wireless security gateway; decrypt the second encrypted data packet to obtain status data of the new energy equipment; generate a dispatch instruction for the new energy equipment based on the status data of the new energy equipment; encrypt and sign the dispatch instruction to obtain a first encrypted dispatch instruction; and send the first encrypted dispatch instruction back to the wireless security gateway.

9. The safe dispatching system for new energy equipment according to claim 8, characterized in that: Before receiving the first encrypted data packet sent by the new energy device, the method further includes: Registration online detection steps: detect the registration online status of new energy equipment; When the registration online status of the new energy device is registered online, a data confidentiality transmission channel is established between the new energy device and the wireless security gateway; When the registration online status of the new energy equipment is not registered online, a registration online request is sent to the dispatch center, and the process jumps to the registration online detection step again; wherein, after receiving the registration online request, the dispatch center authenticates the identity of the new energy equipment, and after the identity authentication is passed, updates the registration status of the new energy equipment to registered online, otherwise, an equipment abnormality signal is issued.

10. The safety dispatching system for new energy equipment according to claim 9, characterized in that: When the online registration status of the new energy equipment is registered online, it also includes: Online timing detection step: Generate a timing detection package according to the preset detection time node; Sending the timing detection packet to the new energy device, so that the new energy device in the online state generates a reply signal according to the timing detection packet, and sends the reply signal back to the wireless security gateway; Reply signal detection step: detecting whether the reply signal is received at the current time; If the reply signal is not received at the current time, the waiting reply time is calculated according to the sending time of the timing detection packet and the current time; Compare the waiting reply time with the preset detection reply time; if the waiting reply time does not exceed the preset detection reply time, jump back to the reply signal detection step; if the waiting reply time exceeds the preset detection reply time, determine that the new energy device has not responded, and accumulate the number of non-responses; if the number of non-responses exceeds the preset number, determine that the registered online state of the new energy device is registered offline; if the number of non-responses does not exceed the preset number, jump back to the online timing detection step; If the reply signal is received at the current time, the process jumps back to the online timing detection step and clears the number of unresponsive times.

Images