A data interaction system and method based on source network interconnection and network security protection

Abstract

The present application relates to the technical field of power grid data interaction, and particularly relates to a data interaction system and method based on source grid interconnection and network security protection. The system configures a server cluster at the control end through a component configuration module, and sets an operation service bus at the power grid end, which subscribes to the message queue of the server cluster in real time. Meanwhile, the structured data at the control end is converted into standard data through a data transmission module, and after the standard data is signed, it is pushed to the operation service bus for analysis and processing. At the same time, the confirmation message of the power grid end is fed back to the server cluster of the control end, realizing the bidirectional data asynchronous interaction between the power grid end and the control end. The system also controls the device access of the control end through a firewall intrusion detection module, collects the power grid operation data for network intrusion detection, and intercepts network intrusion behavior. The present application realizes the real-time interconnection and transmission of bidirectional data between the power grid and the power generation system under the condition of meeting the network security protection requirements of the power grid and the power generation system.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of power grid data interaction, and in particular to a data interaction system and method based on source-grid interconnection and network security protection. BACKGROUND

[0002] After the generation side and the power grid end realize "separation of power plant and power grid", the power generation group needs to report maintenance, grid connection and other data to the power grid dispatching organization, but the networks of the two parties are physically isolated. Therefore, the power grid deploys a workstation in the three-zone network security of the power generation group, and the power generation personnel need to copy data from the internal network to this area through a U disk for data reporting. The data interaction process is cumbersome, the U disk needs to be disinfected, and the data interaction stability is not high. Moreover, with the rapid increase of new energy power stations, the total installed capacity has approached that of traditional power sources, but the scale of individual power stations is small and the number is large, resulting in a sharp increase in information reporting. If manual cross-zone switching for reporting is still relied on, the efficiency is low and errors are easy to occur, affecting the cooperation between power plant and power grid, and at the same time, the security protection levels of various new energy power stations are uneven, and power stations with poor protection are vulnerable to network attacks from the outside world, threatening the safety and stability of the power grid. SUMMARY

[0003] To solve the above technical problems, the present application provides a data interaction system and method based on source-grid interconnection and network security protection to improve the security of power grid data transmission and interaction and the security protection level of the power grid and power generation network, and at the same time, reduce the dependence on manual data interaction.

[0004] In a first aspect, the present application provides a data interaction system based on source-grid interconnection and network security protection, comprising:

[0005] A component configuration module is configured to configure a server cluster at the centralized control end, access one or more power generation devices through the server cluster, set up a running service bus at the power grid end, and subscribe to the message queue of the server cluster in real time through the running service bus, so as to realize bidirectional data asynchronous interaction between the power grid end and the centralized control end.

[0006] A data transmission module is configured to convert the structured data of the power generation device at the centralized control end into standard data, sign the standard data with an SM2 private key to obtain an atomized message, push the atomized message to the running service bus of the power grid end through the message queue, and feed back the confirmation message of the power grid end to the server cluster of the centralized control end.

[0007] The firewall intrusion detection module is configured to build a zero-trust power grid boundary firewall between the control terminal and the power grid terminal, dynamically verify the identity of the power generation equipment of the control terminal through the power grid boundary firewall, allow the power generation equipment that has passed the dynamic verification to push the atomized message to the power grid terminal through the message queue, collect the power grid operation data of the control terminal and the power grid terminal by using the power grid boundary firewall, detect network intrusion on the power grid operation data by using the principal component analysis method, trigger an alarm when network intrusion is detected, and intercept network intrusion in combination with the power grid boundary firewall.

[0008] Further, the component configuration module comprises:

[0009] The server deployment unit is configured to deploy a server cluster at the control terminal, wherein the server cluster comprises a protocol analysis server for analyzing the communication protocol of the power generation equipment in real time and a task processing server for processing batch tasks;

[0010] The data security configuration unit is configured to configure an industrial switch and a malicious code prevention device at the control terminal, wherein the industrial switch is connected with the protocol analysis server, the task processing server and the malicious code prevention device respectively;

[0011] The power grid configuration unit is configured to set an operation service bus at the power grid terminal, build a message subscription / publishing mechanism between the operation service bus and the server cluster based on a Kafka message queue, and realize bidirectional data asynchronous interaction between the operation service bus and the server cluster; wherein the power grid terminal is divided into a power grid III area and a power grid DMZ area, the power grid III area is used for the production control area of the power monitoring system, and is used for power dispatching, automatic control and real-time data interaction; the power grid DMZ area is a buffer area between the power grid III area and the control terminal, and is used for data transfer and security isolation;

[0012] The forward isolation unit is configured to perform antivirus detection on the data obtained by the operation service bus, and only allow the data passing the antivirus detection to be unidirectionally transmitted into the power grid DMZ area;

[0013] The reverse isolation unit is configured to encrypt the control instruction generated by the power grid III area, and reversely transmit the encrypted control instruction to the control terminal according to an instruction white list.

[0014] Further, the data transmission module comprises:

[0015] The data encapsulation unit is configured to convert the structured data of the power generation equipment of the control terminal into a JSON message, perform standardized preprocessing on the JSON message, and encapsulate the standardized preprocessed JSON message into standard data; the standardized preprocessing operation comprises one or more of field sorting, Unicode escaping and space elimination;

[0016] a data signature unit configured to generate a digital signature by signing the standard data with an SM2 private key using SM3 as a hash base;

[0017] a data pushing unit configured to combine the digital signature and the standard data into an atomized message, and push the atomized message to a running service bus at the grid end through a Kafka message queue;

[0018] a signature verification unit configured to extract the digital signature from the atomized message at the grid end, and verify the digital signature with an SM2 public key, wherein if the verification is passed, an acknowledgement response is returned to the control center through the Kafka message queue, and if the verification is not passed, the atomized message is discarded, and the control center is notified through a special error feedback Topic to trigger a data tracing and key rotation process;

[0019] a timeout retransmission unit configured to start a response timer after pushing the atomized message, and if the response timer is timed out and no acknowledgement response is received from the grid end, the atomized message is re-pushed according to a hierarchical retransmission strategy; when the number of retransmissions of the atomized message reaches a preset threshold, the retransmission of the atomized message is stopped and an alarm is generated.

[0020] Further, the firewall intrusion detection module comprises:

[0021] a firewall construction unit configured to construct a zero-trust grid boundary firewall between the control center and the grid end using a zero-trust architecture;

[0022] an access control unit configured to dynamically verify the identity of the power generation equipment at the control center through the grid boundary firewall based on an access control list, and allow the power generation equipment that has passed the dynamic verification to push the atomized message to the grid end through the message queue;

[0023] an intrusion detection unit configured to collect grid operation data of the control center and the grid end using the grid boundary firewall, perform network intrusion detection on the grid operation data using a principal component analysis method, trigger an alarm when network intrusion is detected, and start a security protection mechanism to isolate the network or equipment based on the grid boundary firewall; wherein the grid operation data includes traffic of a grid communication network, operation status of devices in the grid, operation logs of monitoring and operation personnel or users, and system configuration.

[0024] Further, the network intrusion detection on the grid operation data using the principal component analysis method comprises:

[0025] data cleaning is performed on the grid operation data, and L1 regularization is used to denoise the cleaned grid operation data, and a covariance matrix is constructed based on the denoised grid operation data;

[0026] The principal components of the power grid operation data are extracted by eigenvalue decomposition of the covariance matrix;

[0027] The extracted principal components are sorted, and the first k principal components are selected as the eigenvectors with the largest eigenvalues;

[0028] The original power grid operation data is projected into the principal component space, and the original power grid operation data is reconstructed by the first k principal components;

[0029] The reconstruction error of each data point is calculated according to the reconstructed original power grid operation data, and the corresponding anomaly score is generated based on the reconstruction error of each data point ;

[0030] If the anomaly score of the data point exceeds the preset threshold T, the corresponding data point is determined to have network abnormal behavior.

[0031] In a second aspect, the present application provides a data interaction method based on source network interconnection and network security protection, comprising:

[0032] A server cluster is configured at the centralized control end, one or more power generation devices are accessed through the server cluster, and an operation service bus is set at the power grid end, and the message queue of the server cluster is subscribed in real time through the operation service bus, so that bidirectional data asynchronous interaction is carried out between the power grid end and the centralized control end;

[0033] The structured data of the power generation device at the centralized control end is converted into standard data, and the standard data is signed by using an SM2 private key to obtain an atomized message, which is pushed to the operation service bus at the power grid end through the message queue, and the confirmation message of the atomized message at the power grid end is fed back to the server cluster at the centralized control end;

[0034] A zero-trust power grid boundary firewall is constructed between the centralized control end and the power grid end, and the identity of the power generation device at the centralized control end is dynamically verified through the power grid boundary firewall, allowing the power generation device that has passed the dynamic verification to push the atomized message to the power grid end through the message queue, and using the power grid boundary firewall to collect the power grid operation data of the centralized control end and the power grid end, using a principal component analysis method to detect network intrusion on the power grid operation data, triggering an alarm when network intrusion is detected, and combining the power grid boundary firewall to intercept network intrusion.

[0035] Further, the server cluster is configured at the centralized control end, one or more power generation devices are accessed through the server cluster, and an operation service bus is set at the power grid end, and the message queue of the server cluster is subscribed in real time through the operation service bus, so that bidirectional data asynchronous interaction is carried out between the power grid end and the centralized control end, comprising:

[0036] A server cluster is deployed at the centralized control end, which includes a protocol analysis server for real-time analysis of power generation equipment communication protocols and a task processing server for processing batch tasks;

[0037] An industrial switch and a malicious code prevention device are configured at the centralized control end, and the industrial switch is connected with the protocol analysis server, the task processing server and the malicious code prevention device respectively;

[0038] An operation service bus is set at the power grid end, and a message subscription / publishing mechanism is built between the operation service bus and the server cluster based on a Kafka message queue, so as to realize bidirectional data asynchronous interaction between the operation service bus and the server cluster; wherein, the power grid end is divided into a power grid III area and a power grid DMZ area, the power grid III area is used for a production control area of a power monitoring system, and is used for power grid dispatching, automatic control and real-time data interaction; the power grid DMZ area is a buffer area between the power grid III area and the centralized control end, and is used for data transfer and security isolation;

[0039] The data obtained by the operation service bus is subjected to antivirus detection, and only the data passing the antivirus detection is allowed to be unidirectionally transmitted into the power grid DMZ area;

[0040] The control instructions generated by the power grid III area are encrypted, and the encrypted control instructions are reversely transmitted to the centralized control end according to an instruction whitelist.

[0041] Further, the structured data of the power generation equipment at the centralized control end is converted into standard data, and the standard data is signed by using an SM2 private key to obtain an atomized message, the atomized message is pushed to the operation service bus at the power grid end through a message queue, and the confirmation message of the atomized message from the power grid end is fed back to the server cluster at the centralized control end, including:

[0042] The structured data of the power generation equipment at the centralized control end is converted into a JSON message, and the JSON message is subjected to standardization preprocessing, and the JSON message after the standardization preprocessing is encapsulated as standard data; the standardization preprocessing operation includes one or more of field sorting, Unicode escaping and space elimination;

[0043] SM3 is used as a hash base, and the standard data is signed by using the SM2 private key to generate a digital signature;

[0044] The digital signature and the standard data are combined as an atomized message, and the atomized message is pushed to the operation service bus at the power grid end through a Kafka message queue;

[0045] Extract the digital signature from the atomized message, and use the SM2 public key to verify the digital signature, if the verification is passed, return the confirmation response to the control end through the Kafka message queue, if the verification is not passed, discard the atomized message, and notify the control end through the special error feedback Topic, trigger the data traceability and key rotation process;

[0046] Start the response timer after pushing the atomized message, if the response timer times out and no confirmation response is received from the power grid end, re-push the atomized message according to the hierarchical retransmission strategy; when the retransmission number of the atomized message reaches the preset threshold, stop the atomized message retransmission and generate an alarm.

[0047] Further, the zero-trust grid boundary firewall is constructed between the control end and the power grid end, and the identity of the power generation equipment of the control end is dynamically verified through the grid boundary firewall, allowing the power generation equipment that has passed the dynamic verification to push the atomized message to the power grid end through the message queue, and collecting the grid operation data of the control end and the power grid end through the grid boundary firewall, using the principal component analysis method to detect network intrusion on the grid operation data, triggering an alarm when network intrusion is detected, and intercepting network intrusion in combination with the grid boundary firewall, including:

[0048] A zero-trust grid boundary firewall is constructed between the control end and the power grid end using a zero-trust architecture;

[0049] Based on the access control list, the identity of the power generation equipment of the control end is dynamically verified through the grid boundary firewall, allowing the power generation equipment that has passed the dynamic verification to push the atomized message to the power grid end through the message queue;

[0050] The grid operation data of the control end and the power grid end is collected through the grid boundary firewall, and the principal component analysis method is used to detect network intrusion on the grid operation data, triggering an alarm when network intrusion is detected, and starting a security protection mechanism, isolating the network or equipment based on the combination of the grid boundary firewall; wherein the grid operation data includes the traffic of the grid communication network, the running state of the equipment in the grid, the operation log of the monitoring and operation personnel or users, and the system configuration.

[0051] Further, the principal component analysis method is used to detect network intrusion on the grid operation data, including:

[0052] The grid operation data is cleaned, and the cleaned grid operation data is denoised using L1 regularization, and a covariance matrix is constructed based on the denoised grid operation data;

[0053] The principal components of the grid operation data are extracted by eigenvalue decomposition of the covariance matrix;

[0054] The extracted principal components are sorted, and the first k principal components are selected as the characteristic vectors with the largest eigenvalues;

[0055] The original power grid operation data is projected into the principal component space, and the original power grid operation data is reconstructed through the first k principal components;

[0056] The reconstruction error of each data point is calculated according to the reconstructed original power grid operation data, and the corresponding anomaly score is generated based on the reconstruction error of each data point ;

[0057] If the anomaly score of the data point exceeds the preset threshold T, the corresponding data point is determined to exist network abnormal behavior.

[0058] The beneficial effects of the present application are that by configuring and deploying high-performance server clusters and operation service buses between the power grid end and the centralized control end, the power grid end and the centralized control end can efficiently and stably realize source-grid direct connection, and at the same time, a joint control mechanism is constructed between the power grid end and the centralized control end for standardized asynchronous communication, realizing a closed loop of bidirectional data interaction while improving the processing efficiency of messages. At the same time, the present application also performs SM2 signature encryption and verification on the interactive data and transmitted files, improving the reliability and data integrity of data interaction. In addition, a zero-trust power grid operation firewall is constructed between the power grid end and the centralized control end to control the device access of the centralized control end, to improve the security of data transmission, and at the same time, a principal component analysis method is used to detect network intrusion attacks in the power grid, to realize real-time interconnection and safe and stable transmission of bidirectional data between the power grid and the power generation system while meeting the network security protection requirements of the power grid and power generation. BRIEF DESCRIPTION OF DRAWINGS

[0059] Figure 1 A module block diagram of the data interaction system based on source-grid interconnection and network security protection provided by the present application;

[0060] Figure 2 A schematic diagram of the component deployment provided by the present application;

[0061] Figure 3 A network architecture schematic diagram of the centralized control end and the power grid end provided by the present application;

[0062] Figure 4 A data interaction schematic diagram of the centralized control end and the power grid end provided by the present application;

[0063] Figure 5 A flowchart of the data interaction method based on source-grid interconnection and network security protection provided by the present application. DETAILED DESCRIPTION

[0064] With reference to the accompanying drawings, the technical solutions in the embodiments of the present application will be clearly and completely described below. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative efforts belong to the scope of the present application.

[0065] In the process of power grid data transmission, the inconsistency of communication protocols and interface standards is a long-standing technical problem. Due to the involvement of multiple levels and various devices in the power system, the communication protocols used by different manufacturers and systems differ greatly. Smart substations widely use IEC 61850, while traditional dispatching automation systems use IEC 60870-5-104 or DNP3, and some old devices even rely on private protocols. This fragmented protocol environment leads to complex protocol conversion when data is exchanged, and the current conversion method mainly relies on manual configuration of mapping tables or customized development of interface adapters, which is not only inefficient but also prone to errors and cannot meet the real-time requirements.

[0066] At the same time, a large number of format conversions and quality checks are involved in the transmission process of power grid data, but the current technical means are still relatively backward and rely heavily on manual intervention. In actual processing, in order to maintain the consistency and accuracy of data, operation and maintenance personnel need to manually maintain complex mapping relationship tables, which not only consumes time and effort, but also easily leads to data errors due to human negligence. In addition, when cross-system data is exchanged, the problem of asynchronous timing will lead to errors in state estimation.

[0067] In addition, as a critical information infrastructure, the power grid is facing increasingly severe network security threats, but the existing protection technology still has significant shortcomings. With the large-scale access of new energy stations, their security protection levels are uneven, and some wind turbine controllers and energy storage management systems even lack basic identity authentication mechanisms. Based on this, the present application designs a data interaction system and method based on source-grid interconnection and network security protection to solve the above problems.

[0068] Embodiment 1:

[0069] Referring to Figure 1 The present application provides a data interaction system based on source-grid interconnection and network security protection, which comprises:

[0070] A component configuration module is configured to configure a server cluster at the control end (also referred to as the control side in the present application), access one or more power generation devices through the server cluster, and set up a running service bus at the power grid end (also referred to as the control side in the present application), and subscribe to the message queue of the server cluster in real time through the running service bus, so as to realize bidirectional data asynchronous interaction between the power grid end and the control end.

[0071] The data transmission module is configured to convert the structured data of the power generation equipment of the centralized control end into standard data, sign the standard data by using an SM2 private key, obtain an atomized message, push the atomized message to an operation service bus of the power grid end through a message queue, and feed back a confirmation message of the power grid end to a server cluster of the centralized control end.

[0072] The firewall intrusion detection module is configured to build a zero-trust power grid boundary firewall between the centralized control end and the power grid end, dynamically verify the identity of the power generation equipment of the centralized control end through the power grid boundary firewall, allow the power generation equipment that has passed the dynamic verification to push the atomized message to the power grid end through the message queue, collect power grid operation data of the centralized control end and the power grid end by using the power grid boundary firewall, perform network intrusion detection on the power grid operation data by using a principal component analysis method, trigger an alarm when network intrusion is detected, and intercept the network intrusion in combination with the power grid boundary firewall.

[0073] Further, the component configuration module of the embodiment of the present application comprises:

[0074] The server deployment unit is configured to deploy a server cluster at the centralized control end, and the server cluster comprises a protocol analysis server that analyzes the communication protocol of the power generation equipment in real time and a task processing server that processes batch tasks.

[0075] The data security configuration unit is configured to configure an industrial switch and a malicious code prevention device at the centralized control end, and the industrial switch is connected with the protocol analysis server, the task processing server and the malicious code prevention device respectively.

[0076] As shown in the figure, Figure 2 As shown in the figure, the present application deploys a high-performance server cluster at the centralized control end, also known as the centralized control III area (i.e. the grid side) of the power generation group. Among them, server 1 represents a protocol analysis server, which is responsible for real-time protocol analysis. Through the protocol analysis server, a protocol adaptive engine can be built to convert the multi-source data of the new energy station in the centralized control end into a standardized JSON format, thereby solving the problem of inconsistent protocols between multiple devices. Server 2 represents a task processing server, which undertakes batch task processing. At the same time, the embodiment of the present application also provides an industrial-grade switch and a malicious code prevention device. The industrial-grade switch ensures high-speed data transmission between the centralized control end and the power grid end, and the malicious code prevention device can detect viruses for the power generation equipment connected to the server cluster, effectively preventing malicious code threats. Subsequently, through a multi-level data processing flow (i.e. the data processing process of the data transmission module), the standardization of the power generation side data can be realized. By setting the protocol analysis server, the task processing server, the industrial-grade switch and the malicious code prevention device at the centralized control end, a source-grid interaction security smart connection platform can be formed at the centralized control end.

[0077] The power grid configuration unit is used for setting an operation service bus at the power grid end, and constructing a message subscription / publishing mechanism between the operation service bus and the server cluster based on a Kafka message queue, so as to realize bidirectional data asynchronous interaction between the operation service bus and the server cluster; wherein the power grid end is divided into a power grid III area and a power grid DMZ area, the power grid III area is used for a production control area of the power monitoring system, and is used for power grid dispatching, automatic control and real-time data interaction; the power grid DMZ area is a buffer area between the power grid III area and the centralized control end, and is used for data transfer and security isolation.

[0078] The forward isolation unit is used for performing antivirus detection on the data obtained by the operation service bus, and only allowing the data passing the antivirus detection to be unidirectionally transmitted into the power grid DMZ area.

[0079] The reverse isolation unit is used for encrypting the control instruction generated by the power grid III area, and reversely transmitting the encrypted control instruction to the centralized control end according to an instruction whitelist.

[0080] Specifically, in the embodiment of the present application, as shown in Figure 2 and Figure 3 , the power grid end (i.e. the power grid side) can be specifically divided into a power grid III area and a power grid DMZ area, the power grid III area belongs to a production control area of the power monitoring system, and is directly related to power grid dispatching, automatic control and real-time data interaction. The power grid DMZ area is a buffer area between the power grid III area and an external network, is used for data transfer and security isolation, and avoids direct invasion of external threats into the production control area. The power grid side and the centralized control side (i.e. the centralized control end) are only allowed by the power grid boundary firewall to report data from the centralized control III area to the DQZ area, and are prohibited from being actively accessed in reverse.

[0081] As shown in Figure 2 and Figure 3 , compared with the traditional power grid DMZ area, the newly built component of the power grid end of the embodiment of the present application adds an operation service bus, as shown in Figure 2 , the newly added operation service bus further constructs a security channel with a forward isolation unit and a reverse isolation unit, wherein the forward isolation unit corresponds to a forward isolation device in Figure 3 , and the reverse isolation unit corresponds to a reverse isolation device in Figure 3 . The forward isolation device strictly follows the "unidirectional transmission" principle, and only allows the power generation data to enter the power grid DMZ area after antivirus detection, and the reverse isolation device adopts SM9 algorithm encryption and instruction whitelist mechanism to ensure that the AGC / AVC control instruction issued by the power grid is traceable and tamper-proof. In addition, the network layer of the centralized control end and the power grid end in the embodiment of the present application adopts MPLS-VPN and power special optical fiber double channel redundancy, and guarantees the transmission delay of key business data through TSN technology.

[0082] In addition, as shown in Figure 4As shown, in the communication layer of the joint control mechanism, the source-grid interaction security smart connection platform formed by the centralized control end adopts a standardized asynchronous communication mechanism based on the Kafka message queue between the business system operation service bus of the DMZ zone of the power grid, and builds a bidirectional data interaction closed loop.

[0083] In the data uploading link, when the power generation equipment state or power data of the centralized control end changes, the source-grid interaction security smart connection platform will immediately encapsulate the structured data into a standardized JSON message (i.e. JSON message), and push it to the Kafka message queue through the business system of the power plant itself. The pushed message contains time stamp, station ID and other key metadata, and also contains SM3 hash check value. The power grid side operation service bus subscribes to the message queue in real time, and after obtaining the message, it is processed through format verification and business logic, and the acknowledgement information is fed back to the message queue of the centralized control end, forming a strict interaction confirmation mechanism. In the instruction issuing link, the control instruction generated by the power grid dispatching system of the power grid end is transmitted in the reverse direction through the same message path to verify the digital signature of the instruction by the source-grid interaction security smart connection platform, and to check the rationality of the instruction. When the signature verification is passed and the instruction is reasonable, the corresponding control instruction is executed. Finally, the execution result is fed back to the power grid end through the message queue. In addition, the centralized control end is also configured with an SFTP file service, which can be called to interact with the operation service bus of the power grid end when transmitting files.

[0084] Further, in the embodiment of the present application, the data transmission module comprises:

[0085] A data encapsulation unit is configured to convert the structured data of the centralized control power generation equipment into a JSON message, and to standardize the JSON message. The standardized preprocessing operation includes one or more of field sorting, Unicode escaping and space removal.

[0086] A data signature unit is configured to use SM3 as a hash base and use an SM2 private key to sign the standard data to generate a digital signature.

[0087] A data pushing unit is configured to combine the digital signature and the standard data into an atomized message, and to push the atomized message to the operation service bus of the power grid end through the Kafka message queue.

[0088] A signature verification unit is configured to extract the digital signature from the atomized message by the power grid end, and to use the SM2 public key to verify the digital signature. If the signature verification is passed, an acknowledgement is returned to the centralized control end through the Kafka message queue. If the signature verification is not passed, the atomized message is discarded, and the centralized control end is notified through a special error feedback Topic, triggering the data tracing and key rotation process.

[0089] a timeout retransmission unit configured to start a response timer after pushing the atomized message, and re-push the atomized message according to a hierarchical retransmission strategy if the response timer times out and no acknowledgement response returned by the grid end is received; and stop the retransmission of the atomized message and generate an alarm when the number of retransmissions of the atomized message reaches a preset threshold.

[0090] Specifically, to solve the problems of low transmission reliability and insufficient data integrity, the SM2 signature verification and the timeout retransmission + threshold control method are used in the data transmission module to realize data encryption transmission and message retransmission.

[0091] In terms of reliability, the timeout retransmission unit of the data transmission module designs an intelligent retransmission mechanism based on timeout retransmission and threshold control. The source grid interaction security intelligent connection platform starts a response timer accurate to milliseconds after sending data, and if no acknowledgement response from the grid dispatching system is received within the timeout, a hierarchical retransmission strategy is automatically triggered. The hierarchical retransmission strategy is: the first retransmission interval is 1 second, and the subsequent intervals are exponentially longer. This strategy can both avoid network congestion and ensure data delivery.

[0092] When the number of retransmissions reaches the preset threshold, the retransmission is immediately stopped and a three-level alarm (i.e. platform pop-up + SMS notification + work order system linkage) is generated to prevent message queue backlog due to continuous retries.

[0093] In terms of data integrity, the signature verification unit deeply integrates the SM2 algorithm into the message processing pipeline for signature and verification. The process is as follows: the source grid interaction security intelligent connection platform at the centralized control end standardizes the JSON message of the power generation equipment when packaging data, including field sorting, Unicode escaping, and space removal. Then, the SM2 private key is used to generate a unique digital signature for the standardized data (SM3 is used as the hash base when signing), and the signature and the original data together form an atomized message. After the grid dispatching system at the grid end subscribes to the atomized message, it first extracts the digital signature for SM2 public key verification. If the signature is invalid, the corresponding data packet is discarded directly and the source grid interaction security intelligent connection platform is notified through a dedicated error feedback Topic to trigger the data tracing and key rotation process.

[0094] Embodiment 2:

[0095] Specifically, based on the above embodiment 1, the firewall intrusion detection module of the embodiment of the application specifically includes:

[0096] a firewall construction unit configured to construct a zero-trust grid boundary firewall between the centralized control end and the grid end using a zero-trust architecture;

[0097] An access control unit is configured to perform dynamic verification on the identity of the power generation device of the centralized control end through the power grid boundary firewall based on an access control list, and allow the power generation device that has passed the dynamic verification to push an atomized message to the power grid end through a message queue.

[0098] An intrusion detection unit is configured to collect power grid operation data of the centralized control end and the power grid end by using the power grid boundary firewall, perform network intrusion detection on the power grid operation data by using a principal component analysis method, trigger an alarm when network intrusion is detected, and start a security protection mechanism to isolate the network or the device based on the power grid boundary firewall.

[0099] Specifically, as shown in Figure 2 The power grid boundary firewall adopts a zero trust architecture (ZTA), in which any device, user, application program or service should not be trusted by default, and each access request must be strictly verified and authorized. The power grid boundary firewall is responsible for implementing traffic control between different regions of the power grid. The firewall can be configured to only allow specific services and data to report data from the centralized control III region to the DQZ region, and prohibit any other form of reverse access or unauthorized cross-region traffic.

[0100] The firewall restricts specific requests from the centralized control III region through an access control list. These requests are verified according to the identity and permission of the device or service, ensuring that only authorized centralized control devices can report data to the DQZ region. That is, the constraints are: 1. Source IP: only allow IP range of the centralized control III region; 2. Target IP: only allow device IP address of the DQZ region; 3. Service type: only allow specific protocols.

[0101] The power grid boundary firewall performs identity authentication on each request of the centralized control end device, verifying whether the centralized control end device is authorized to send data. In this scenario, the security policy of the power grid requires that the devices in the DQZ region should not actively initiate a request to connect to the centralized control III region, preventing the devices in the DQZ region from being hacked or maliciously manipulated, and ensuring the security of the business system running on the power grid end.

[0102] Further, in the embodiment of the present application, the principal component analysis method is used to perform network intrusion detection on the power grid operation data, including the following processes:

[0103] Data preprocessing. The security threats in the network are accompanied by a large amount of noise, so the embodiment of the application adopts the denoising technology L1 regularization in processing to improve the robustness of anomaly detection. Therefore, the embodiment of the application first cleans the power grid operation data, and then denoises the cleaned power grid operation data by L1 regularization. Because PCA (i.e. principal component analysis method) depends on the covariance matrix to capture the characteristic relationship of the data, the embodiment of the application constructs the covariance matrix based on the denoised power grid operation data. The covariance matrix can be specifically represented as:

[0104]

[0105] wherein X is a standardized data matrix, is the transpose matrix of the data matrix X, and n-1 is a correction term of unbiased estimation, is the covariance matrix. Each element of the covariance matrix represents the correlation between feature i and feature j. For example, malicious traffic patterns have a high correlation with device failures, and they belong to the same security threat event.

[0106] By eigenvalue decomposition of the covariance matrix, the principal components of the power grid operation data are extracted, which are specifically shown in the following formula:

[0107]

[0108] wherein v is the eigenvector, representing the direction of the principal component; λ is the eigenvalue, representing the variance size of the principal component.

[0109] In the principal component analysis process, by sorting the extracted eigenvalues and eigenvectors, the direction that can best explain the data variation can be determined. Therefore, the embodiment of the application sorts the extracted principal components, and selects the first k principal components as the eigenvectors with the largest eigenvalues;

[0110] Then the original power grid operation data is projected into the principal component space, which is specifically shown in the following formula:

[0111]

[0112] wherein Z is the projection of the power grid operation data in the principal component space, is the selected first k principal components, representing the normal power grid traffic or the normal operation mode of the device.

[0113] In security threat detection, the original data is projected onto the principal component space, and the reconstruction error is calculated by reconstructing the data using the principal components. If the reconstruction error of a certain data point is large, it indicates that the data point deviates significantly from the normal operating mode, thus representing an anomaly. Therefore, this embodiment of the invention reconstructs the original power grid operation data using the first k principal components, as shown in the following formula:

[0114]

[0115] in, It is the reconstructed data matrix. It is the transpose of the first k principal components;

[0116] Then, the reconstruction error is calculated for each data point based on the reconstructed original power grid operation data, as shown in the following formula:

[0117]

[0118] in, It is the first Reconstruction error per data point It is the first in the original power grid operation data Data points.

[0119] Specifically, by calculating the reconstruction error, an anomaly score can be generated for each data point. In security threat detection, a large reconstruction error usually indicates abnormal behavior at that data point, a sign of a security threat. Therefore, this embodiment of the invention generates a corresponding anomaly score based on the reconstruction error of each data point. The anomaly score formula is as follows:

[0120]

[0121] in, It is the first Anomaly scores for each data point It is the standard deviation of the reconstruction error of all data points; if the outlier score of the data points If the data exceeds a preset threshold T, the corresponding data point is considered to have abnormal network behavior. Once an anomaly is detected, i.e., a network intrusion threat is detected, the firewall intrusion detection module can trigger an alarm or automatic response measures. First, an alarm notification is issued, then the security protection mechanism is activated, and based on the severity of the network intrusion threat, the network or device is automatically isolated to prevent the threat from spreading further.

[0122] In this embodiment of the invention, the actual workflow of the data interaction system based on source-network interconnection and network security protection is as follows:

[0123] Step1, the control III area converts the multi-source data of the new energy field station into a standardized JSON format through a protocol adaptive engine, solving the problem of inconsistent protocols;

[0124] Step2, the standardized data is encapsulated using SM2 signature and SM3 hash check value encryption to ensure transmission integrity and confidentiality, resist tampering and eavesdropping;

[0125] Step3, the zero-trust firewall dynamically verifies the identity of the control device (SM2 certificate + IP whitelist), and only allows authorized one-way data reporting to the DQZ area;

[0126] Step4, the encrypted data is transmitted through the Kafka message queue, and the timeout retransmission and dead letter queue mechanism guarantee the delivery, solving the transmission reliability problem;

[0127] Step5, after the power grid DQZ area business system processes the data, the signature feedback message is closed loop confirmed, and the automatic retransmission is triggered in case of exception;

[0128] Step6, the full-link intrusion detection system intercepts abnormal traffic in real time, and the firewall blocks the attack source.

[0129] The embodiment of the application is connected with the DMZ area of the power grid through the power grid boundary firewall, and interacts with the control III area (i.e. the control end) of the power generation group through the forward and reverse isolation function of the application, and signs and encrypts the data and the transmitted files, and checks the integrity, which meets the network security protection requirements of the power grid and the power generation, and realizes the real-time interconnection and efficient transmission of the bidirectional data of the power grid and the power generation system.

[0130] Embodiment 3

[0131] Referring to Figure 5 Based on the above embodiment 1 and embodiment 2, the embodiment of the application also provides a data interaction method based on source network interconnection and network security protection, comprising:

[0132] A server cluster is configured at the control end, one or more power generation devices are accessed through the server cluster, and a running service bus is set at the power grid end, and the message queue of the server cluster is subscribed in real time through the running service bus, so that the power grid end and the control end are bidirectional data asynchronous interaction;

[0133] The structured data of the power generation device at the control end is converted into standard data, and the standard data is signed by using an SM2 private key to obtain an atomized message, and the atomized message is pushed to the running service bus of the power grid end through the message queue, and the confirmation message of the atomized message of the power grid end is fed back to the server cluster of the control end;

[0134] A zero-trust power grid boundary firewall is constructed between the control terminal and the power grid terminal, and the identity of the power generation equipment of the control terminal is dynamically verified through the power grid boundary firewall, the power generation equipment that has passed the dynamic verification is allowed to push the atomized message to the power grid terminal through the message queue, the power grid operation data of the control terminal and the power grid terminal is collected by using the power grid boundary firewall, the principal component analysis method is used for network intrusion detection of the power grid operation data, and the alarm is triggered when the network intrusion is detected, and the network intrusion is intercepted in combination with the power grid boundary firewall.

[0135] Further, in the embodiment of the present application, a server cluster is configured at the control terminal, one or more power generation equipments are accessed through the server cluster, and a running service bus is set at the power grid terminal, and the message queue of the server cluster is subscribed in real time through the running service bus, so that the bidirectional data asynchronous interaction between the power grid terminal and the control terminal is realized, including:

[0136] A server cluster is deployed at the control terminal, and the server cluster includes a protocol analysis server for real-time analysis of power generation equipment communication protocols and a task processing server for processing batch tasks;

[0137] An industrial switch and a malicious code prevention device are configured at the control terminal, and the industrial switch is connected with the protocol analysis server, the task processing server and the malicious code prevention device respectively;

[0138] A running service bus is set at the power grid terminal, and a message subscription / publishing mechanism is constructed between the running service bus and the server cluster based on the Kafka message queue, so as to realize the bidirectional data asynchronous interaction between the running service bus and the server cluster; wherein the power grid terminal is divided into a power grid III area and a power grid DMZ area, the power grid III area is used for the production control area of the power monitoring system, and is used for power dispatching, automatic control and real-time data interaction; the power grid DMZ area is a buffer area between the power grid III area and the control terminal, and is used for data transfer and security isolation;

[0139] The data obtained by the running service bus is subjected to antivirus detection, and only the data passing the antivirus detection is allowed to be unidirectionally transmitted into the power grid DMZ area;

[0140] The control instructions generated by the power grid III area are encrypted, and the encrypted control instructions are reversely transmitted to the control terminal according to the instruction white list.

[0141] Further, in the embodiment of the present application, the structured data of the power generation equipment of the control terminal is converted into standard data, and the standard data is signed by using an SM2 private key to obtain an atomized message, the atomized message is pushed to the running service bus of the power grid terminal through the message queue, and the confirmation message of the power grid terminal to the atomized message is fed back to the server cluster of the control terminal, including:

[0142] The structured data of the centralized control power generation and transmission equipment is converted into a JSON message, and the JSON message is standardized pretreated, and the standardized pretreated JSON message is packaged as standard data; the standardized pretreating operation includes one or more of field sorting, Unicode escaping and space removal;

[0143] The standard data is signed by using an SM2 private key based on an SM3 hash base, to generate a digital signature;

[0144] The digital signature and the standard data are combined into an atomized message, and the atomized message is pushed to a power grid end operation service bus through a Kafka message queue;

[0145] The digital signature is extracted from the atomized message, and the digital signature is verified by using an SM2 public key, if the verification is passed, an acknowledgement is returned to the centralized control end through the Kafka message queue, if the verification is not passed, the atomized message is discarded, and the centralized control end is notified through a special error feedback Topic, to trigger a data traceability and key rotation process;

[0146] A response timer is started after the atomized message is pushed, if the response timer is timed out and the acknowledgement returned by the power grid end is not received, the atomized message is re-pushed according to a hierarchical retransmission strategy, and when the retransmission number of the atomized message reaches a preset threshold, the atomized message retransmission is stopped and an alarm is generated.

[0147] In order to solve the problems of low transmission reliability and insufficient data integrity, the SM2 signature verification and the timeout retransmission and threshold control method are used in the data transmission module to realize data encryption transmission and message retransmission.

[0148] In terms of reliability, the timeout retransmission unit of the data transmission module designs an intelligent retransmission mechanism based on timeout retransmission and threshold control. The source grid interaction security intelligent connection platform starts a response timer accurate to milliseconds after sending data, if the acknowledgement of the power grid dispatching system is not received within the timeout, the hierarchical retransmission strategy is automatically triggered. The hierarchical retransmission strategy is: the first retransmission interval is 1 second, and the subsequent each interval is exponentially extended, which can avoid network congestion and ensure data delivery.

[0149] When the retransmission number reaches the preset threshold, the retransmission is immediately stopped and a three-level alarm (i.e. platform pop-up window + SMS notification + work order system linkage) is generated, to prevent message queue backlog caused by continuous retries.

[0150] In terms of data integrity, the signature verification unit of the embodiment of the application deeply integrates the national secret SM2 algorithm into the message processing pipeline for signature and verification, and the process is as follows: the source network interaction security intelligent connection platform of the centralized control end standardizes the JSON message of the power generation equipment when data is packaged, and the standardization preprocessing includes field sorting, Unicode escape and space removal. Then, the SM2 private key is used to generate a unique digital signature (SM3 is used as the hash base when signing) for the standardized data, and the signature and the original data together constitute an atomized message. After the grid dispatching system of the power grid end subscribes to the atomized message, the digital signature is extracted first for SM2 public key verification, and if the signature is invalid, the corresponding data packet is discarded directly and the source network interaction security intelligent connection platform is notified through a special error feedback Topic, triggering the data traceability and key rotation process.

[0151] Further, in the embodiment of the application, a zero-trust grid boundary firewall is constructed between the centralized control end and the power grid end, and the identity of the power generation equipment of the centralized control end is dynamically verified through the grid boundary firewall, allowing the power generation equipment that has passed the dynamic verification to push the atomized message to the power grid end through the message queue, and the grid operation data of the centralized control end and the power grid end is collected through the grid boundary firewall, the principal component analysis method is used for network intrusion detection of the grid operation data, and the alarm is triggered when network intrusion is detected, and the network intrusion is intercepted in combination with the grid boundary firewall, including:

[0152] A zero-trust grid boundary firewall is constructed between the centralized control end and the power grid end using a zero-trust architecture.

[0153] Based on the access control list, the identity of the power generation equipment of the centralized control end is dynamically verified through the grid boundary firewall, allowing the power generation equipment that has passed the dynamic verification to push the atomized message to the power grid end through the message queue.

[0154] The grid operation data of the centralized control end and the power grid end is collected through the grid boundary firewall, the principal component analysis method is used for network intrusion detection of the grid operation data, and the alarm is triggered when network intrusion is detected, and the security protection mechanism is started, and the network or equipment is isolated based on the combination of the grid boundary firewall; wherein the grid operation data includes the traffic of the power grid communication network, the running state of the equipment in the power grid, the operation log of the monitoring and operation personnel or user, and the system configuration.

[0155] In the embodiment of the present application, the power grid boundary firewall adopts a zero trust architecture (ZTA), in which any device, user, application or service should not be trusted by default, and each access request must be strictly verified and authorized. The power grid boundary firewall will be responsible for implementing traffic control between different areas of the power grid. The firewall can be configured to only allow specific services and data to report data from the control III area to the DQZ area, and prohibit any other form of reverse access or unauthorized cross-area traffic.

[0156] The firewall restricts specific requests from the control III area through an access control list. These requests are verified according to the identity and permissions of the device or service, ensuring that only authorized control devices can report data to the DQZ area. That is, the constraints are: 1. Source IP: only allow IP range of control III area; 2. Target IP: only allow device IP address of DQZ area; 3. Service type: only allow specific protocol.

[0157] The power grid boundary firewall performs identity authentication on each request from the control end device, verifying whether the control end device is authorized to send data. In this scenario, the security policy of the power grid requires that the devices in the DQZ area not initiate a connection request to the control III area, preventing the devices in the DQZ area from being hacked or maliciously manipulated, and ensuring the security of the business system running on the power grid side.

[0158] Further, in the embodiment of the present application, a principal component analysis method is used for network intrusion detection of power grid operation data, specifically including:

[0159] Data preprocessing. Security threats in the network are accompanied by a large amount of noise, so the L1 regularization denoising technology is used in the preprocessing to improve the robustness of anomaly detection. Therefore, the embodiment of the present application first cleans the power grid operation data, and then uses L1 regularization to denoise the cleaned power grid operation data. Since PCA (i.e. principal component analysis method) relies on a covariance matrix to capture the characteristic relationship of the data, the embodiment of the present application constructs a covariance matrix based on the denoised power grid operation data. The covariance matrix can be specifically represented as:

[0160]

[0161] where X is the standardized data matrix, is the transpose matrix of the data matrix X, and n-1 is the correction term of the unbiased estimate, is the covariance matrix. Each element of the covariance matrix represents the correlation between feature i and feature j. For example, malicious traffic patterns have a high correlation with device failures, and they belong to the same security threat event.

[0162] The principal components of the power grid operation data are extracted by eigenvalue decomposition of the covariance matrix, and are specifically as follows:

[0163]

[0164] Wherein, v is an eigenvector, representing the direction of the principal component; λ is an eigenvalue, representing the variance of the principal component.

[0165] In the principal component analysis process, the direction that can best explain the data variation can be determined by sorting the extracted eigenvalues and eigenvectors. Therefore, the principal components extracted by the embodiment of the application are sorted, and the first k principal components are selected as the eigenvectors with the largest eigenvalues.

[0166] Then, the original power grid operation data is projected into the principal component space, and is specifically as follows:

[0167]

[0168] Wherein, Z is the projection of the power grid operation data in the principal component space, are the first k principal components selected, representing the normal power grid flow or normal operation mode of the equipment.

[0169] In the security threat detection, the original data is projected into the principal component space, and the reconstruction error is calculated by reconstructing the data through the principal components. If the reconstruction error of a data point is large, it indicates that the data point deviates greatly from the normal operation mode, thereby representing an abnormal situation. Therefore, the first k principal components are used to reconstruct the original power grid operation data in the embodiment of the application, and are specifically as follows:

[0170]

[0171] Wherein, is the reconstructed data matrix, is the transpose matrix of the first k principal components;

[0172] Then, the reconstruction error of each data point is calculated according to the reconstructed original power grid operation data, and is specifically as follows:

[0173]

[0174] Wherein, is the reconstruction error of the i th data point, is the i th data point in the original power grid operation data.

[0175] ​​Specifically, by calculating the reconstruction error, an anomaly score can be generated for each data point. In security threat detection, a large reconstruction error usually indicates abnormal behavior at that data point, a sign of a security threat. Therefore, this embodiment of the invention generates a corresponding anomaly score based on the reconstruction error of each data point. The anomaly score formula is as follows:

[0176]

[0177] in, It is the first Anomaly scores for each data point It is the standard deviation of the reconstruction error of all data points; if the outlier score of the data points If the data exceeds a preset threshold T, the corresponding data point is considered to have abnormal network behavior. Once an anomaly is detected, i.e., a network intrusion threat is detected, the firewall intrusion detection module can trigger an alarm or automatic response measures. First, an alarm notification is issued, then the security protection mechanism is activated, and based on the severity of the network intrusion threat, the network or device is automatically isolated to prevent the threat from spreading further.

[0178] In this embodiment of the invention, a high-performance server cluster and a service bus are configured and deployed between the power grid and the centralized control unit, enabling efficient and stable direct connection between the power grid and the centralized control unit. Simultaneously, a joint control mechanism is established between the power grid and the centralized control unit for standardized asynchronous communication, achieving a closed-loop two-way data interaction while improving message processing efficiency. Furthermore, this invention uses SM2 signature encryption and verification for the interacted data and transmitted files, enhancing the reliability and integrity of data interaction. In addition, a zero-trust power grid operation firewall is constructed between the power grid and the centralized control unit to control device access at the centralized control unit, improving data transmission security. Principal component analysis is used to detect network intrusion attacks in the power grid. While meeting the network security protection requirements of both the power grid and power generation systems, this invention achieves real-time two-way data interconnection and secure and stable transmission between the power grid and the power generation system.

[0179] In the description of embodiments of the present invention, the term "and / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Additionally, the character " / " in this document generally indicates that the preceding and following related objects have an "or" relationship.

[0180] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A data interaction system based on source network interconnection and network security protection, characterized in that, include: The component configuration module is used to configure a server cluster at the central control terminal, connect one or more power generation devices through the server cluster, and set up an operation service bus at the grid terminal. The operation service bus is used to subscribe to the message queue of the server cluster in real time, so as to enable bidirectional asynchronous data interaction between the grid terminal and the central control terminal. The data transmission module is used to convert the structured data of the power generation equipment at the centralized control end into standard data, and to sign the standard data using the SM2 private key to obtain atomic messages. The atomic messages are then pushed to the operation service bus at the power grid end through a message queue, and the confirmation messages of the atomic messages from the power grid end are fed back to the server cluster at the centralized control end. The firewall intrusion detection module is used to build a zero-trust power grid boundary firewall between the central control terminal and the power grid terminal. The power grid boundary firewall is used to dynamically verify the identity of the power generation equipment at the central control terminal, allowing the power generation equipment that has passed the dynamic verification to push atomic messages to the power grid terminal through a message queue. At the same time, the power grid boundary firewall is used to collect power grid operation data from the central control terminal and the power grid terminal, and principal component analysis is used to perform network intrusion detection on the power grid operation data. When a network intrusion is detected, an alarm is triggered, and the network intrusion is intercepted in conjunction with the power grid boundary firewall. 2.The data interaction system based on source network interconnection and network security protection of claim 1, wherein, The component configuration module includes: The server deployment unit is used to deploy a server cluster at the central control terminal. The server cluster includes a protocol parsing server for real-time parsing of the communication protocol of the power generation equipment and a task processing server for processing batch tasks. The data security configuration unit is used to configure industrial switches and anti-malicious code devices at the centralized control terminal. The industrial switches are connected to the protocol parsing server, the task processing server, and the anti-malicious code device, respectively. The power grid configuration unit is used to set up an operation service bus at the power grid end and build a message subscription / publishing mechanism between the operation service bus and the server cluster based on the Kafka message queue, so as to realize bidirectional asynchronous data interaction between the operation service bus and the server cluster. The power grid end is divided into a power grid zone III and a power grid DMZ zone. The power grid zone III is used for the production control area of ​​the power monitoring system, for power grid dispatching, automation control, and real-time data interaction. The power grid DMZ zone is a buffer area between the power grid zone III and the centralized control terminal, used for data transfer and security isolation. The forward isolation unit is used to perform anti-virus detection on the data acquired by the running service bus and only allows data that passes the anti-virus detection to be transmitted unidirectionally to the power grid DMZ area; The reverse isolation unit is used to encrypt the control commands generated in Zone III of the power grid, and transmit the encrypted control commands back to the central control terminal according to the command whitelist. 3.The data interaction system based on source network interconnection and network security protection of claim 1, wherein, The data transmission module includes: The data encapsulation unit is used to convert the structured data of the power generation equipment at the centralized control terminal into JSON messages, perform standardized preprocessing on the JSON messages, and encapsulate the standardized preprocessed JSON messages into standard data; the standardized preprocessing operations include one or more of field sorting, Unicode escaping, and whitespace removal; A data signature unit is configured to generate a digital signature by signing the standard data with an SM2 private key based on an SM3 hash base; A data pushing unit is configured to combine the digital signature and the standard data into an atomized message, and push the atomized message to an operation service bus at the grid end through a Kafka message queue; A signature verification unit is configured to extract the digital signature from the atomized message at the grid end, and verify the digital signature with an SM2 public key. If the verification is passed, an acknowledgement is returned to the control center through the Kafka message queue. If the verification is not passed, the atomized message is discarded, and a special error feedback Topic is used to notify the control center to trigger a data traceability and key rotation process; A timeout retransmission unit is configured to start a response timer after pushing the atomized message. If the response timer times out and no acknowledgement is received from the grid end, the atomized message is re-pushed according to a hierarchical retransmission strategy. When the number of retransmissions of the atomized message reaches a preset threshold, the retransmission of the atomized message is stopped, and an alarm is generated. 4.The data interaction system based on source network interconnection and network security protection of claim 1, wherein, The firewall intrusion detection module comprises: A firewall construction unit is configured to construct a zero-trust grid boundary firewall between the control center and the grid end based on a zero-trust architecture; An access control unit is configured to dynamically verify the identity of the power generation equipment at the control center through the grid boundary firewall based on an access control list, and allow the power generation equipment that has passed the dynamic verification to push the atomized message to the grid end through the message queue; An intrusion detection unit is configured to collect grid operation data of the control center and the grid end by using the grid boundary firewall, perform network intrusion detection on the grid operation data by using a principal component analysis method, trigger an alarm when network intrusion is detected, and start a security protection mechanism to isolate the network or equipment based on the grid boundary firewall. The grid operation data includes traffic of a grid communication network, operation status of devices in the grid, operation logs of monitoring and operation personnel or users, and system configuration.

5. The data interaction system based on source network interconnection and network security protection according to claim 4, characterized in that, The network intrusion detection on the grid operation data by using the principal component analysis method comprises: Data cleaning is performed on the grid operation data, and L1 regularization is used to denoise the cleaned grid operation data. A covariance matrix is constructed based on the denoised grid operation data; The principal components of the grid operation data are extracted by eigenvalue decomposition of the covariance matrix; The extracted principal components are sorted, and the first k principal components are selected as characteristic vectors with the largest eigenvalues; The original grid operation data is projected into the principal component space, and the original grid operation data is reconstructed by the first k principal components. reconstruction error is calculated for each data point according to the reconstructed original grid operation data, and a corresponding anomaly score is generated based on the reconstruction error of each data point ; If the data points are abnormally scored If the data exceeds a preset threshold T, the corresponding data point is determined to have abnormal network behavior.

6. A data interaction method based on source network interconnection and network security protection, characterized in that, The method comprises: A server cluster is configured at the control center to access one or more power generation equipment, and an operation service bus is set at the grid end to subscribe to the message queue of the server cluster in real time, so that bidirectional data asynchronous interaction is performed between the grid end and the control center; The structured data of the power generation equipment of the control terminal is converted into standard data, and the standard data is signed by using an SM2 private key to obtain an atomized message, the atomized message is pushed to a running service bus of the power grid terminal through a message queue, and a confirmation message of the atomized message of the power grid terminal is fed back to a server cluster of the control terminal; A zero-trust power grid boundary firewall is constructed between the control terminal and the power grid terminal, and the power generation equipment identity of the control terminal is dynamically verified through the power grid boundary firewall, the power generation equipment that has passed the dynamic verification is allowed to push the atomized message to the power grid terminal through the message queue, and the power grid boundary firewall is used to collect power grid operation data of the control terminal and the power grid terminal, a principal component analysis method is used for network intrusion detection of the power grid operation data, an alarm is triggered when network intrusion is detected, and the power grid boundary firewall is combined to intercept network intrusion. 7.The data interaction method based on source network interconnection and network security protection according to claim 6, characterized in that, The server cluster is configured at the control terminal, one or more power generation equipments are accessed through the server cluster, a running service bus is arranged at the power grid terminal, and the message queue of the server cluster is subscribed in real time through the running service bus, so that bidirectional data asynchronous interaction is realized between the power grid terminal and the control terminal, including: The server cluster is deployed at the control terminal, and the server cluster includes a protocol analysis server for analyzing the communication protocol of the power generation equipment in real time and a task processing server for processing batch tasks; The industrial switch and the anti-malicious code device are configured at the control terminal, and the industrial switch is connected with the protocol analysis server, the task processing server and the anti-malicious code device respectively; The running service bus is arranged at the power grid terminal, and a message subscription / publishing mechanism is constructed between the running service bus and the server cluster based on the Kafka message queue, so as to realize bidirectional data asynchronous interaction between the running service bus and the server cluster; wherein the power grid terminal is divided into a power grid III area and a power grid DMZ area, the power grid III area is used for the production control area of the power monitoring system, and is used for power grid dispatching, automatic control and real-time data interaction; the power grid DMZ area is a buffer area between the power grid III area and the control terminal, and is used for data transfer and security isolation; The data obtained by the running service bus is subjected to antivirus detection, and only the data passing the antivirus detection is allowed to be unidirectionally transmitted into the power grid DMZ area; The control instruction generated by the power grid III area is encrypted, and the encrypted control instruction is reversely transmitted to the control terminal according to an instruction whitelist. 8.The data interaction method based on source network interconnection and network security protection of claim 6, wherein, The structured data of the power generation equipment of the control terminal is converted into standard data, and the standard data is signed by using an SM2 private key to obtain an atomized message, the atomized message is pushed to a running service bus of the power grid terminal through a message queue, and a confirmation message of the atomized message of the power grid terminal is fed back to a server cluster of the control terminal; The structured data of the power generation equipment of the control terminal is converted into a JSON message, and the JSON message is subjected to standardization preprocessing, and the JSON message after the standardization preprocessing is encapsulated as standard data; the standardization preprocessing operation includes one or more of field sorting, Unicode escaping and space removal; Taking SM3 as a hash base, the standard data is signed by using an SM2 private key to generate a digital signature; The digital signature and the standard data are combined into an atomized message, and the atomized message is pushed to the operation service bus of the power grid end through a Kafka message queue; The digital signature is extracted from the atomized message, and the digital signature is verified by using an SM2 public key, if the verification is passed, an acknowledgement is returned to the control end through the Kafka message queue, if the verification is not passed, the atomized message is discarded, and the control end is notified through a special error feedback Topic, triggering the data traceability and key rotation process; After pushing the atomized message, a response timer is started, if the response timer is timed out and no acknowledgement is received from the power grid end, the atomized message is re-pushed according to a hierarchical retransmission strategy; when the retransmission number of the atomized message reaches a preset threshold, the atomized message retransmission is stopped and an alarm is generated. 9.The data interaction method based on source network interconnection and network security protection of claim 6, wherein, The power grid boundary firewall is constructed between the control end and the power grid end in a zero-trust manner, and the power generation equipment identity of the control end is dynamically verified through the power grid boundary firewall, allowing the power generation equipment that has passed the dynamic verification to push the atomized message to the power grid end through the message queue, and collecting the power grid operation data of the control end and the power grid end by using the power grid boundary firewall, and using the principal component analysis method to detect network intrusion of the power grid operation data, and triggering an alarm when network intrusion is detected, and intercepting network intrusion in combination with the power grid boundary firewall, including: A zero-trust power grid boundary firewall is constructed between the control end and the power grid end in a zero-trust manner; Based on an access control list, the power generation equipment identity of the control end is dynamically verified through the power grid boundary firewall, allowing the power generation equipment that has passed the dynamic verification to push the atomized message to the power grid end through the message queue; The power grid operation data of the control end and the power grid end is collected by using the power grid boundary firewall, and the principal component analysis method is used to detect network intrusion of the power grid operation data, and an alarm is triggered when network intrusion is detected, and a security protection mechanism is started, and the network or equipment is isolated based on the combination of the power grid boundary firewall; wherein the power grid operation data includes traffic of the power grid communication network, running state of the equipment in the power grid, operation log of the monitoring and operation personnel or user, and system configuration. 10.The data interaction method based on source network interconnection and network security protection according to claim 9, characterized in that, The principal component analysis method is used to detect network intrusion of the power grid operation data, including: The power grid operation data is cleaned, and the cleaned power grid operation data is denoised by using L1 regularization, and a covariance matrix is constructed based on the denoised power grid operation data; The principal components of the power grid operation data are extracted by eigenvalue decomposition of the covariance matrix; The extracted principal components are sorted, and the first k principal components are selected as the characteristic vectors with the largest eigenvalues; The original power grid operation data is projected into the principal component space, and the first k principal components are used to reconstruct the original power grid operation data. The reconstruction error is calculated for each data point based on the reconstructed original power grid operation data, and a corresponding anomaly score is generated based on the reconstruction error of each data point. If the data points are out of order... If the data exceeds a preset threshold T, the corresponding data point is determined to have abnormal network behavior.

Images