A power monitoring security protection control system and method

Abstract

The application relates to the technical field of power system safety monitoring, and discloses a power monitoring safety protection control system and method, which comprises a master station safety controller, a terminal safety verification unit and a safety verification channel; the master station safety controller responds to a control instruction of a monitoring master station, performs foresight simulation on the instruction, and generates a verification data packet containing a physical state expected vector; the terminal safety verification unit receives an original control instruction and the verification data packet, and performs cooperative arbitration; the cooperative arbitration process comprises: the terminal safety verification unit performs localized consequence simulation based on a built-in local physical micro model, generates a local predicted state vector, and compares the vector with the physical state expected vector issued by the master station; according to the comparison result, the terminal safety verification unit generates and executes a permission or blocking decision on the control instruction. Through the physical layer cooperative verification of the master station and the terminal, the application effectively protects malicious control instructions which have physical hazards on the power system.

Description

Technical Field

[0001] This invention relates to the field of power system security monitoring technology, specifically to a power monitoring security protection control system and method. Background Technology

[0002] As modern power systems evolve towards intelligence and interconnectivity, monitoring systems based on information and communication technologies play an increasingly important role in ensuring the stable operation of the power grid. However, as a critical infrastructure, the power system faces severe threats from cyberspace. Traditional power monitoring system information security protection mainly focuses on network boundary isolation, identity authentication, access control, data encryption, and intrusion detection, aiming to prevent unauthorized access and data leakage. While these measures have achieved significant results in the field of information security, they still fall short in terms of the physical security of power control commands.

[0003] Current technologies lack effective physical-level protection against control commands that have passed information security certification but have been tampered with during transmission or originate from internal malicious behavior. Once a malicious control command passes through information security defenses and is sent to power equipment, its apparent legitimacy makes it difficult for traditional protection methods to detect and block it in a timely manner. For example, a seemingly legitimate circuit breaker tripping command, if executed, could trigger a cascading failure or a large-scale power outage; existing systems typically cannot predict and prevent this before the command is executed. Furthermore, for complex equipment operation sequences, traditional methods struggle to effectively verify their execution order, time intervals, and other physical and logical constraints, providing attackers with the opportunity to manipulate operational steps or timing to create security vulnerabilities. Therefore, power monitoring systems urgently need a protection mechanism that can deeply verify the physical consequences and operational logic of control commands before their final execution, to compensate for the limitations of information security protection in understanding the physical world. Summary of the Invention

[0004] The technical problem to be solved by this invention is that existing protection systems are unable to defend against certified but tampered or logically malicious control commands, which may cause physical damage to the power grid.

[0005] To solve the above-mentioned technical problems, the present invention provides the following technical solution: The first aspect of the present invention provides a power monitoring security protection control system, which includes a master station security controller deployed on the master station side, at least one terminal security verification unit deployed on the terminal equipment side, and a security verification channel for data exchange between the two.

[0006] In this system, the master station safety controller performs forward-looking analysis and consequence prediction on control commands issued by the monitoring master station. The master station safety controller incorporates a global power system model and, based on real-time power grid state estimation results, simulates the new steady-state of the power grid after each control command is executed. Through this simulation, the expected changes in physical quantities at the point of action and adjacent key nodes after the command's execution can be obtained in advance. These expected changes are constructed into a structured physical state prediction vector. This vector, along with the command's identity information, is encapsulated into a verification data packet.

[0007] The terminal security verification unit is physically or logically connected in series in the execution path of the control command, acting as a verification checkpoint before the command ultimately acts on the primary equipment. This unit receives verification data packets from the master station and also receives raw control commands issued through existing control channels. Its function is to perform a cooperative arbitration based on local information. The terminal security verification unit incorporates a local physical micro-model, which is a reduced-order equivalent model of its local power grid. Using this micro-model and real-time acquired local electrical quantities, the unit independently performs localized consequence simulation of the received control commands, generating a local predicted state vector. Subsequently, the unit quantitatively compares this local prediction result with the expected physical state vector issued by the master station.

[0008] If the deviation between the two is within the preset execution safety threshold, it indicates that the physical consequences of the instruction are consistent with the master station's expectations, and the instruction is considered safe. Conversely, if the deviation exceeds the limit, the instruction may have been tampered with or is not applicable to the current operating conditions and should be considered a dangerous instruction. Based on this comparison result, the terminal security verification unit generates a decision to allow or block the instruction and physically controls whether the instruction can be executed by the backend device.

[0009] As a preferred technical solution, to ensure the integrity of control commands during transmission, the master station security controller also encapsulates the hash value of the original control command when generating the verification data packet. Upon receiving the command and verification data packet, the terminal security verification unit first performs a correlation check on the two, that is, independently calculates the hash value of the received command and compares it with the hash value in the verification data packet. Only when the hash values ​​match will subsequent physical state compliance verification be initiated, thereby defending against man-in-the-middle attacks.

[0010] As a preferred technical solution, to handle operation sequences involving multiple steps, this system extends the security verification mechanism from single-point instructions to a temporal process. The master station security controller can identify the instruction sequence and generate a verification data sequence containing the expected physical state of each step and the time window constraints between steps through iterative simulation. The terminal security verification unit integrates a temporal logic verification function based on a finite state machine. After verifying the physical state compliance of each instruction in the sequence, this unit also checks whether its execution order and time interval conform to the preset logical procedure. An instruction must pass both physical consequence verification and temporal logic verification simultaneously before it can be permitted to execute.

[0011] As a preferred technical solution, to ensure the long-term accuracy of the model used for decision-making, the system also includes a closed-loop model integrity verification mechanism. During steady-state operation of the system, each terminal security verification unit periodically uploads its locally measured and digitally signed state feature vectors to the main station. The main station security controller compares these real physical data with the theoretical calculation values ​​of the global model. If the deviation continues to exceed the model's tolerance threshold, a model inconsistency alarm is triggered, prompting maintenance personnel to perform model calibration or parameter correction, thereby defending against slow data corruption attacks targeting the model.

[0012] As a preferred technical solution, the decision-arbitration and execution functions of the terminal security verification unit control the instructions through physical or logical means. It can output control signals to drive relay contacts, physically opening or closing the instruction path; it can also output digital level signals to control the enable pins of backend devices; or it can logically authorize or prohibit instruction execution by sending gating communication messages.

[0013] As a preferred technical solution, the system possesses comprehensive auditing and traceability capabilities. The endpoint security verification unit generates structured logs for all verification processes and decision results, and reports them in real-time or in batches through the security verification channel according to the event level. The main station security controller centrally receives, stores, and performs correlation analysis on all logs, enabling it to detect abnormal attack patterns and provide data support for post-incident fault tracing and security auditing.

[0014] The second aspect of the present invention provides a power monitoring security protection control method, which is achieved through the collaborative work of the master station side and the terminal side.

[0015] The method includes: the master station security controller responding to control commands by performing a forward-looking simulation to generate a verification data packet containing a predicted physical state vector, and sending this data packet to the terminal security verification unit through a security verification channel. Subsequently, the terminal security verification unit receives the verification data packet and the original control commands transmitted through the existing control channel. Next, the terminal security verification unit performs cooperative arbitration, the core of which involves performing a localized consequence simulation to generate a locally predicted state vector, and quantitatively comparing it with the predicted physical state vector issued by the master station. Finally, based on the comparison result, the terminal security verification unit generates and executes a decision to permit or block the control commands.

[0016] This invention provides a power monitoring and security protection control system and method. It has the following beneficial effects: 1. This invention extends security protection from the information layer to the physical layer by establishing a collaborative arbitration mechanism that combines forward-looking simulation on the master station side with localized consequence simulation on the terminal side. The system not only verifies the source and integrity of instructions but also checks the physical consequences of instruction execution by comparing the expected physical state vector with the locally predicted state vector. This enables the invention to identify and block malicious instructions that have passed traditional authentication but may cause physical damage to the power system.

[0017] 2. This invention improves the overall reliability of the system by establishing an independent verification closed loop between the master station and the terminal. The terminal security verification unit performs independent simulation based on local models and real-time measurements, without completely relying on the verification data issued by the master station, thus possessing the ability to identify deviations or potential anomalies in the master station's model. Furthermore, the separation of the security verification channel from the existing control channel reduces the risk of coordinated tampering of control commands and verification data.

[0018] 3. This invention enables security verification of instruction sequences containing multiple steps at the temporal logic level. By introducing a temporal logic verification module based on a finite state machine, the system not only verifies the physical rationality of individual instructions in the sequence but also constrains the compliance of their execution order and time intervals. This mechanism effectively prevents logical errors caused by out-of-order, missing, or timed-out execution of instructions, ensuring the security of complex operation processes. Attached Figure Description

[0019] Figure 1 This is an architecture diagram of a power monitoring and security protection control system according to an embodiment of the present invention; Figure 2 This is a flowchart illustrating the security protection method according to an embodiment of the present invention. Figure 3 This is a schematic diagram illustrating the physical state conformity verification of an embodiment of the present invention; Figure 4This is a schematic diagram of a finite state machine model for instruction sequence timing logic verification according to an embodiment of the present invention.

[0020] The module comprises: 100, Main Station Security Controller; 110, Global Model Management Module; 120, State Estimation Module; 130, Instruction Sequence Parsing Module; 140, Verification Vector Generation Module; 150, Model Integrity Verification Module; 160, Security Audit Module; 200, Terminal Security Verification Unit; 210, Instruction Reception and Association Module; 220, Local Model Prediction Module; 230, Physical State Compliance Verification Module; 240, Temporal Logic Verification Module; 250, Decision Arbitration and Execution Module; 260, Log and Feedback Module; and 300, Security Verification Channel. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings.

[0022] See attached document Figure 1 , Figure 1 This is an architecture diagram of a power monitoring and security protection control system according to an embodiment of the present invention. The present invention provides a power monitoring and security protection control system, which is physically deployed on the master station side and the terminal equipment side of the power monitoring system.

[0023] The system includes: a master station security controller 100 deployed on the master station side; at least one terminal security verification unit 200 deployed on the terminal equipment side; and a security verification channel 300 for data exchange between the master station security controller 100 and the terminal security verification unit 200. The security verification channel 300 is a dedicated communication link independent of the existing control channels of the power system.

[0024] The master station security controller 100, deployed at the monitoring master station or dispatch center, is used to perform forward analysis on the issued control commands and generate verification data. Logically, the master station security controller 100 includes: a global model management module 110, a state estimation module 120, a command sequence parsing module 130, a verification vector generation module 140, a model integrity verification module 150, and a security audit module 160.

[0025] The terminal security verification unit 200 is an embedded hardware device whose physical interface is connected serially or indirectly between the monitoring host and the remote control device or intelligent electronic device (IED). The terminal security verification unit 200 is used to perform collaborative arbitration based on local information and verification data issued by the master station before the final execution of the instruction. Logically, the terminal security verification unit 200 includes: an instruction receiving and association module 210, a local model prediction module 220, a physical state compliance verification module 230, a timing logic verification module 240, a decision arbitration and execution module 250, and a log and feedback module 260.

[0026] See attached document Figure 2 , Figure 2 This is a flowchart illustrating the operation of a security protection method according to an embodiment of the present invention. The present invention provides a power monitoring security protection method, comprising the following steps: S101, the system initializes and enters steady-state operation. During steady-state operation, each terminal security verification unit 200 periodically generates and uploads local state feature vectors, which are received and compared by the model integrity verification module 150 of the main station security controller 100 to achieve continuous integrity verification of the global model.

[0027] S102, when the monitoring master station issues a control command, the command sequence parsing module 130 of the master station safety controller 100 captures and parses the command; the verification vector generation module 140 performs forward simulation of the command based on the real-time power grid status provided by the state estimation module 120, and generates a verification data packet containing physical state expectations or timing constraints.

[0028] S103, the master station security controller 100 sends the verification data packet to the target terminal security verification unit 200 through the security verification channel 300. At the same time, the original control command is sent to the target terminal device through the existing control channel.

[0029] S104, the instruction receiving and association module 210 of the terminal security verification unit 200 receives the instruction and verification data packet, and performs preliminary verification on their source, data integrity and pairing relationship.

[0030] S105, after the initial verification is passed, the terminal security verification unit 200 performs collaborative arbitration: the local model prediction module 220 performs local instruction simulation; the physical state compliance verification module 230 compares the local simulation results with the physical expectations in the verification data packet; for instruction sequences, the timing logic verification module 240 further verifies the legality of the process.

[0031] S106, the decision arbitration and execution module 250 generates a final decision based on the result of the collaborative arbitration. If all verification items pass, an execution permission signal is output; if any verification item fails, a blocking operation is performed to prevent the instruction from being executed by the backend device.

[0032] S107, the log and feedback module 260 records the decision results and key verification data, and reports the record to the security audit module 160 of the main station security controller 100 through the security verification channel 300 for archiving and analysis.

[0033] The following provides a detailed description of each module of the safety protection and control system of the present invention.

[0034] The main station security controller 100 establishes the data and model foundation for subsequent security decisions. Its internal basic model and state management functions are jointly implemented by the global model management module 110 and the state estimation module 120.

[0035] The global model management module 110 is used to store, load, and maintain the global model of the power system. This global model is a structured data representation of the power system, and its content includes at least: Firstly, power grid topology data, such as the connection relationships of primary equipment components like buses, transmission lines, transformers, generators, and loads; Secondly, equipment parameter data, such as the impedance, rated capacity, and turns ratio of lines and transformers; Third, operational constraint data, such as the safe range of bus voltage, the stability limit and thermal stability limit of the line, etc.

[0036] The model is stored in a database or a standardized file format (such as CIM / XML) and supports version control and online updates to reflect actual changes in the power grid.

[0037] The state estimation module 120 calculates the current operating state of the power system based on a global model and real-time measurement data. This module acquires real-time telemetry data from the power system's SCADA system or Wide Area Measurement System (WAMS), which forms the measurement vector. .

[0038] The state estimation module 120 solves a state vector... For the optimization problem of variables, the goal is to obtain the best estimate of the current state of the system. State vector. This typically includes the voltage magnitude and phase angle of all buses in the power grid.

[0039] One specific implementation is to use the weighted least squares (WLS) state estimation method, the goal of which is to find a state vector. This minimizes the weighted sum of squares of the measurement residuals. Its objective function is... The definition is as follows: ; in: It is the system state vector to be determined. .

[0040] It is an actual measurement vector collected by systems such as SCADA. Specifically, this vector includes a set of one or more sets of measurement values, such as active power injection and reactive power injection of some buses in the system, as well as active power flow and reactive power flow of some lines.

[0041] It is a nonlinear measurement function that converts the state vector The value is mapped to a theoretical measurement, and this function is determined by the power flow equations of the power network.

[0042] It is the covariance matrix of measurement error, and its diagonal elements reflect the accuracy of different measurement channels.

[0043] To solve the above objective function, those skilled in the art can use various iterative algorithms, such as the Newton-Raphson method or the fast decoupling method. Their specific implementations are well-known technologies in this field and will not be elaborated here.

[0044] The output of the state estimation module 120 is a power grid state profile. This profile includes the voltage magnitude and phase angle of all buses, representing a complete set of data reflecting the power grid's operating state at a specific moment. This power grid state profile will serve as the initial condition for the subsequent forward-looking simulation performed by the verification vector generation module 140.

[0045] One of the core functions of the master station security controller 100 is to convert issued control commands into verifiable data structures containing physical and temporal constraints. The command sequence parsing module 130 and the verification vector generation module 140 work together to achieve this function. The specific process is as follows: S301, the instruction sequence parsing module 130 receives control instructions from the monitoring master station. This module includes an operation sequence rule base, which can be implemented using a structured data format (such as XML or JSON) or a relational database table, defining the name of each operation sequence, the instruction steps it contains, the execution order, and logical dependencies.

[0046] When a control command is received, the module matches it against a rule base. If the command is part of a defined sequence, it is identified as a sequence command and associated with a unique sequence identifier. This identifier can be generated by a timestamp, random number, or counter to ensure the uniqueness of each sequence operation; if no sequence is matched, it is identified as a single independent instruction.

[0047] S302, based on the recognition result of the instruction sequence parsing module 130, the verification vector generation module 140 uses the current system state vector provided by the state estimation module 120 before the instruction is issued. Calculations are performed based on the initial conditions.

[0048] S303, for a single independent instruction The verification vector generation module 140 calculates its expected physical state vector by performing a prospective simulation. The details are as follows: The simulation first involves control commands. (For example, disconnecting a line) translates to modifying the parameters of the power system network model, specifically in terms of the network admittance matrix. The modification yields the new admittance matrix after instruction execution. .

[0049] Subsequently, with Given the initial state, in the new admittance matrix Under the network structure represented, a power flow calculation of the power system is performed to obtain the state vector when the system reaches a new steady state after the command is executed. Power flow calculations solve a set of nonlinear equations. The specific solution process is a well-known technique in this field and will not be elaborated here.

[0050] Finally, from the complete system state vector In the process, the physical quantities of key nodes related to the command operation position are extracted to form the physical state prediction vector. This extraction process can be performed using a selection matrix. accomplish: ; in: It is a selection matrix whose elements are either 0 or 1, used to select a predetermined subset of key variables from the complete state vector. One specific implementation is a selection matrix... The configuration is predetermined, and its selection range includes: the busbar where the equipment directly affected by the command (such as a circuit breaker) is located, the adjacent first-order buses directly connected to that busbar, and all branches connecting these buses. In this way, It can contain the key response characteristics of the local power grid after the command operation.

[0051] S304, for a being identified as containing The instruction sequence of each step The verification vector generation module 140 constructs a temporal physical state expected vector sequence through iterative simulation. .

[0052] The construction process is as follows: For the first instruction in the sequence , based on the initial state of the system Based on this, the expected physical state vector is calculated using the S303 method. and the system status after execution .

[0053] For the subsequent... Step instructions The system status after the above step is completed. As the initial state for this simulation, the method in S303 is repeated to calculate the expected physical state vector for this step. and the system state after execution .

[0054] Simultaneously, time window constraints between each operation step are extracted from the operation sequence rule base. This constraint defines the period from the first... Step operation completed to the 1st The maximum permissible time interval for step operation. This constraint can be preset based on power system safety operation regulations, equipment mechanical characteristics (such as the shortest settling time after circuit breaker closing), or safety requirements to prevent human error.

[0055] Finally, the physical expectations, time constraints, and sequence identifiers obtained from each step are combined to form an ordered list containing multiple tuples, i.e. : ; To ensure the accuracy of the global model used for security decisions and to defend against slow data corruption attacks targeting the model, the model integrity verification module 150 of the main station security controller 100 collaborates with the security verification units 200 of each terminal to periodically perform closed-loop verification under steady-state conditions where no control commands are executed. The specific process is as follows: S401, at the preset verification period , No. Each terminal security verification unit 200 collects the real-time electrical quantities of its connection points to form a local state feature vector. This vector is structured data, which includes: measurement data fields (e.g., the voltage amplitude at the nodes). Active power injection and reactive power injection ), and metadata fields (such as the current timestamp) The unique device identifier of this terminal ).

[0056] S402, the terminal security verification unit 200 uses its pre-configured private key to verify the local state feature vector. A digital signature is made, and then it is sent to the main station security controller 100 through the security verification channel 300.

[0057] S403, the model integrity verification module 150 of the master station security controller 100 receives signed feature vectors from one or more terminals. After verifying the validity of the signature using the corresponding public key, the module extracts... and its associated timestamps and equipment identification .

[0058] S404, Model Integrity Verification Module 150 and Theoretical state feature vectors are extracted from the system state estimation results at corresponding times and nodes obtained from the state estimation module 120. This theoretical vector Composition and Correspondingly, it includes the theoretical voltage amplitude calculated by the model. Theoretical active power injection and theoretical reactive power injection .

[0059] S405, Model Integrity Verification Module 150 calculates the actual uploaded feature vectors. Theoretical eigenvectors calculated by the model The deviation between the two vectors is δmodel,k. A specific method for quantifying this deviation is to calculate the Euclidean norm between the two vectors: ; S406, The model integrity verification module 150 will calculate the deviation. With a pre-set model tolerance threshold Compare. The threshold. It can be determined comprehensively based on factors such as statistical analysis of historical operating data, normal fluctuation range under typical operating conditions, and measurement confidence of different measuring points.

[0060] S407, if If the current global model's state is consistent with the actual state of the physical system, the model integrity check passes.

[0061] S408, if Especially when the threshold is exceeded for multiple consecutive verification cycles, the model integrity verification module 150 triggers a model inconsistency event and initiates a predefined response procedure. This procedure may include: automatically marking the data source that caused the deviation and reducing its weight in the state estimation; issuing an alarm to the operations and maintenance personnel, indicating that the model parameters may need to be calibrated; in extreme cases, if the deviations of multiple key nodes continue to exceed the limit, the security verification function based on the global model can be temporarily suspended to prevent misjudgments based on the faulty model.

[0062] After receiving the instructions and verification data from the master station, the terminal security verification unit 200 first performs synchronization and correlation verification by the instruction receiving and association module 210. This is a prerequisite for all subsequent security arbitrations. The specific process is as follows: S501, the command receiving and association module 210 is configured with two independent receiving interfaces, connected to the existing control channel and the security verification channel 300 of the power system, respectively. This module monitors these two channels in parallel to receive raw control commands. Verification data packets VDP are transmitted via an encryption mechanism through the secure verification channel 300.

[0063] S502, to handle the potential arrival time difference between commands and VDPs transmitted across different network channels, the command receiving and association module 210 internally configures a synchronization buffer and an association timer. The synchronization buffer has a limited capacity and can be managed using a first-in, first-out (FIFO) or timestamp-based eviction mechanism. When any data (command or VDP) arrives, this module stores it in the buffer and starts the timer. The timer's duration... A preset synchronization wait window is set. If the other data paired with it fails to arrive within this window, the data in the buffer pool will be discarded and a synchronization timeout event will be recorded.

[0064] S503, when the instruction After both the VDP and the VDP arrive at the buffer pool, the instruction receiving and association module 210 first decrypts and verifies the VDP. Specifically, this process involves decrypting the VDP using the session key negotiated during channel establishment to restore its internal verification data structure. Subsequently, the digital signature generated by the master station security controller 100 is extracted from the VDP and verified using the preset public key of the master station security controller 100.

[0065] Signature verification ensures that the VDP's origin is trustworthy and that its content has not been tampered with during transmission. If signature verification fails, the VDP is considered illegitimate, the association process is immediately suspended, and an alarm is triggered.

[0066] S504, after the VDP signature verification is successful, the instruction receiving and association module 210 performs a core association verification. This module extracts the original instruction hash value encapsulated by the main station from the decrypted VDP. Simultaneously, this module processes the raw control commands received from the control channel. Applying the same hash algorithm (e.g., SHA-256 or SHA-3), a local hash value is calculated. Then, the two hash values ​​are compared bit by bit.

[0067] S505, if and If they are completely identical, it proves that the control command currently being received is... The instruction is paired with the valid VDP verification data packet. The instruction receiving and association module 210 receives the instruction and the physical state expectation vector parsed from the VDP. Or time-series physical expected vector sequence Together, they are passed to the subsequent local model prediction module 220, physical state compliance verification module 230 and temporal logic verification module 240 for deep arbitration.

[0068] S506, if and Inconsistency indicates that the control command may have been tampered with during transmission, or that the command does not match the verification data packet. In this case, the command receiving and association module 210 immediately blocks the command, prohibiting it from flowing to the backend device, and generates an alarm log for association verification failure. This log contains information such as the event type, timestamp, and involved command ID, and is reported through the security verification channel 300.

[0069] After the command and verification data are associated, the terminal security verification unit 200 initiates a localized collaborative arbitration mechanism. This mechanism is implemented collaboratively by the local model prediction module 220, the physical state compliance verification module 230, and the timing logic verification module 240. The specific process is as follows: S601, Local model prediction module 220 receives control instructions that have undergone correlation verification. The system performs localized consequence simulations based on its built-in Local Physical Micromodel (MPM). This MPM is a reduced-order equivalent model of the local power grid where the terminal equipment is located. The MPM is configured by the master station safety controller 100 based on the global model during system initialization and can be periodically updated according to changes in the power grid topology or parameters. The specific MPM implementation can be a Thevenin equivalent model or a linearized power flow model such as a DC power flow based on the Jacobian matrix of a specific operating point.

[0070] S602, the local model prediction module 220 uses the real-time measurements (such as node voltage and power injection) collected by its own sensors as the boundary conditions for the MPM, simulating commands. The execution process is as follows. For example, if the instruction is to trip the circuit breaker, the network topology parameters of the corresponding branch are modified in the MPM. After simulation calculation, the module outputs a local predicted state vector. The dimension and structure of this vector are the same as the expected physical state vector issued by the main station. Maintain consistency.

[0071] S603, Physical state compliance verification module 230 receives data from the master station. and from local forecasts This module calculates the deviation between two vectors. This quantifies the consistency between expected and locally predicted consequences. A specific method for calculating this discrepancy is the normalized Euclidean distance: ; in, The L2 norm of a vector is used to represent the vector's L2 norm.

[0072] S604, the physical state conformity verification module 230 will calculate the deviation With a preset execution security threshold Compare. The threshold. The setting comprehensively considers the inherent errors of the master station's global model and the terminal's local model, measurement accuracy, and acceptable system safety margin. This threshold can be a fixed value or dynamically adjusted based on system operating mode, equipment status, and other information. If the physical consequences of the instruction are as expected, the physical state conformity verification is passed.

[0073] S605: If the received instruction is a single, independent instruction, the physical state compliance verification result of S604 is the final arbitration result. If the received instruction is a sequence, after the physical state compliance verification passes, the timing logic verification module 240 must perform subsequent verification.

[0074] S606, the timing logic verification module 240 is implemented based on a finite state machine (FSM) model and is used to verify instruction sequences. The execution order and time interval are verified. This module provides a sequence identifier for each activity. Maintain an independent state instance. The components of this finite state machine are defined as follows: State set This includes {idle, waiting step i, sequence success (SEQ_SUCCESS), sequence failure (SEQ_FAILED)}.

[0075] enter : This is a control command that has passed the physical state compliance verification.

[0076] State transition function The next state is determined based on the current state and the input command.

[0077] S607, the timing logic verification module 240 operates according to the preset state transition function.

[0078] When the state machine is in the "idle" state, if the received instruction is the first step of the sequence (i.e., ... If the state transitions to "Waiting for step 2", then the state will change.

[0079] When the state machine is in the "waiting for step i" state, if it receives the instruction for the i-th step of the sequence... Once step i-1 passes verification and is executed, the module records its completion timestamp and uses this as a benchmark to check whether the time interval between the current time and that timestamp is within the specified range. Prescribed time window Within this time constraint, if the time constraint is met, the state transitions to "waiting for step i+1"; if the timeout occurs or the received instruction is not the expected step i, the state transitions to "sequence failure".

[0080] When the last instruction in the sequence If the sequence is successfully received under all constraints, the state transitions to "sequence successful". Upon transitioning to either "sequence successful" or "sequence failed", the state machine instance corresponding to that sequence identifier will be terminated and destroyed.

[0081] Therefore, for each instruction in the instruction sequence, the final arbitration result is "pass" if both the physical state compliance verification and the timing logic verification pass. If either verification fails, the arbitration result is "fail".

[0082] The decision arbitration and execution module 250 integrates the arbitration results of all front-end verification modules, generates a final decision, and translates it into specific execution control over the back-end intelligent electronic device (IED). The specific process is as follows: S701, the decision arbitration and execution module 250 receives arbitration results from the physical state compliance verification module 230 and (if applicable) the timing logic verification module 240. These results can be transmitted in the form of internal software flags, function call return values, or message queues, explicitly indicating "pass" or "fail".

[0083] S702, this module generates a final decision based on a deterministic decision rule. This rule states that the final decision is a logical AND operation of all applicable prior verification arbitration results. For a single, independent instruction, if the physical state compliance verification result is "pass," the final decision is "allow." For any instruction in a sequence of instructions, if both the physical state compliance verification result and the timing logic verification result are "pass," the final decision is "allow." In all other cases, the final decision is "block."

[0084] S703, based on the generated final decision, the decision arbitration and execution module 250 outputs a physical execution control signal. This signal is used to control whether the original control command can be received and executed by the execution unit of the backend IED. The specific implementation of this execution control signal can be as follows: Method 1: Relay contact control. The module outputs a drive signal to control the coil of a normally open dry contact relay. When the decision is "allow," the coil is energized, the contact closes, and the instruction input circuit of the downstream IED is activated. When the decision is "block," the coil is de-energized, and the contact opens.

[0085] Method 2: Digital Level Signal. The module outputs a high / low level signal through a digital I / O port. For example, a high level is conventionally agreed to represent "allow" and a low level to represent "block". This level signal is connected to an enable input pin of the backend IED.

[0086] Method 3: Gated Communication Messages. In network-based control systems, the module can control whether to send an authorized execution communication message (e.g., a specific IEC 61850 GOOSE message) to the backend IED. The IED is configured to execute control commands from the master station only after receiving this authorized message.

[0087] In this manner, the terminal security verification unit 200 is physically or logically connected in series in the control path from the monitoring master station to the backend IED, thus controlling the execution permission of the original control command. When the decision arbitration and execution module 250 outputs a "permit" signal, the control path is opened or enabled, allowing the original control command to pass to the final execution logic of the backend IED. When an "block" signal is output, the control path is disconnected or remains disabled, effectively intercepting the command. Method one constitutes a physical connection; methods two and three constitute a logical connection.

[0088] To achieve complete event tracing, the log and feedback module 260 of the terminal security verification unit 200 and the security audit module 160 of the main station security controller 100 work together to record all key events and decisions, and perform centralized analysis and auditing. The specific process is as follows: S801, the logging and feedback module 260 is configured to generate logs at specific event trigger points. These trigger points include at least: after the instruction receiving and association module 210 completes instruction association verification (regardless of success, failure, or timeout); after the physical state compliance verification module 230 completes deviation calculation and comparison; after the timing logic verification module 240 completes state transition; and after the decision arbitration and execution module 250 generates the final "permit" or "block" decision.

[0089] S802, each time an event is triggered, the log and feedback module 260 generates a structured log entry. This entry is a data record containing multiple fields, and its specific structure may include: Event timestamp: Records the precise time when an event occurred.

[0090] Device Identifier: Records the unique ID of the terminal security verification unit 200 that generated this log.

[0091] Event type: A predefined code (e.g., using enumeration code 0x01 to indicate successful association, and 0x11 to indicate failed physical compliance verification) to identify the nature of the event.

[0092] Associated instruction hash value: uniquely associates the recorded event with a specific control instruction.

[0093] Arbitration Results and Key Data: Records the arbitration results corresponding to this event, and may include snapshots of key data, such as deviation calculations in physical condition conformity verification events. .

[0094] S803, the generated log entries are stored locally on the terminal in a non-volatile storage medium (such as Flash memory). To prevent local tampering of the logs, log rolling hashing or generating a digital signature for the entire log file can be used to ensure the integrity of its storage. For log rolling hashing, each new log entry is associated with the hash value of its previous entry to form a hash chain.

[0095] S804, the log and feedback module 260 reports logs to the main station security controller 100 using different strategies based on the severity of the event. Specifically, any event that causes an instruction to be "blocked" is defined as a high-level security event, triggering a real-time reporting mechanism; while regular operation records where the corresponding instruction is successfully "permitted" can be reported periodically in batches to reduce communication overhead. All reported data is transmitted through the security verification channel 300.

[0096] S805, the security audit module 160 receives and parses log data from all terminal security verification units at the main station security controller 100.

[0097] The S806 security audit module 160 performs automated correlation analysis and anomaly detection on the aggregated log streams. This module has a configurable rule engine to identify potential security threat patterns, such as: multiple endpoints frequently reporting "blocking" events against the same type of command within a short period, which may indicate a coordinated attack; or, an endpoint's physical state prediction deviation consistently hovering near a threshold, which may indicate model mismatch or a slow attack.

[0098] In S807, all raw logs and alerts generated by the security audit module 160 are stored on a dedicated log server, forming an undeniable data foundation for post-incident security auditing, fault tracing, and attack behavior analysis. Operations personnel can query and analyze these audit records to reconstruct the complete process of a command from issuance and verification to final execution or blocking.

[0099] Example: This embodiment describes the application of the present invention in a typical 500kV substation automation system, specifically a planned "line load switching to busbar" operation, and demonstrates how the system defends against an instruction tampering attack targeting this operation sequence.

[0100] 1. Scene setting Physical Environment: A 500kV substation uses a double busbar configuration, consisting of busbar I and busbar II. One outgoing line, L1, is currently powered by busbar I and connected via circuit breaker QF11. This line is also connected to busbar II via circuit breaker QF2. Busbars I and II are connected via bus tie circuit breaker QF12.

[0101] Control equipment: Circuit breakers QF11, QF2, and QF12 are each controlled by an intelligent electronic device (IED) within their respective bay units. Each IED is equipped with a Terminal Security Verification Unit (TSVU) 200 of this invention at its front end. The master station monitoring system issues commands through the master station security controller (MSC) 100.

[0102] Operational task: Execute an operation sequence to smoothly switch the load of line L1 from bus I to bus II. The standard operation ticket procedure includes three steps: C1: Close the bus tie circuit breaker QF12 (so that bus I and bus II can operate in parallel).

[0103] C2: Close the circuit breaker QF2 on the II busbar side (so that line L1 is powered by both busbars).

[0104] C3: Disconnect the circuit breaker QF11 on the I bus side (to complete the load switching).

[0105] 2. Implementation process (1) The main site generates verification data The operator issues the above switching operation sequence at the monitoring master station. This instruction is first intercepted by the master station safety controller 100.

[0106] The instruction sequence parsing module 130 recognizes that this is an instruction sequence containing three steps and assigns it a unique sequence identifier ID_seq=OP_SEQ_123.

[0107] The verification vector generation module 140 starts iterative simulation. Based on the current system state... Using initial values, simulate the system transient and new steady state after C1, C2, and C3 are executed sequentially. Calculate the expected vectors of key physical quantities such as voltage and power at relevant nodes (e.g., L1 line start-up, I bus, II bus) after each operation. , , At the same time, time window constraints are extracted from the rule base, for example... =30s (C2 should be executed within 30 seconds after C1 is closed). =30s (C3 should be executed within 30 seconds after C2 is closed).

[0108] Ultimately, MSC generates a sequence of time-series physical state prediction vectors. The MSC packages the verification data for each step into an encrypted verification data packet (VDP) and sends it to the corresponding TSVU through the secure verification channel 300. Simultaneously, the original control commands C1, C2, and C3 are sent sequentially through the existing control channels.

[0109] (2) Terminal verification and attack scenarios The TSVUs deployed at QF12, QF2, and QF11 respectively received the corresponding instructions and VDP.

[0110] Step 1 (execute C1) and Step 2 (execute C2): The TSVUs controlling QF12 and QF2 receive the instruction and VDP respectively, and confirm that the instruction matches the VDP by comparing the hash values.

[0111] The local model prediction module 220 performs simulations based on local measurements and MPM to obtain the local predicted state vector. .

[0112] Physical state compliance verification module 230 calculation With the main site Deviation between Calculations show the deviation is less than the threshold. Physical conformity verification passed. (See attached document.) Figure 3 The figure illustrates this verification process using the change in the voltage of bus II in step 2 as an example. In the figure, the state curve predicted by the terminal's local model (V_LPS) closely matches the state curve expected by the master station (V_PEV), and remains within the execution safety threshold throughout the process. Within the defined tolerance range, it indicates that the physical consequences of the instruction are as expected.

[0113] The FSM state machine of the timing logic verification module 240 transitions from "idle" to "waiting for step 2", and then to "waiting for step 3", thus passing the timing verification.

[0114] The final decision was "permit," and instructions C1 and C2 were successfully executed.

[0115] Step 3 (Attack Occurs): During the process of the main station issuing command C3 (disconnect QF11), the attacker tampered with the command and changed it into a malicious command C'3 (disconnect bus tie circuit breaker QF12), and sent the malicious command to the TSVU that was originally intended to receive C3 and control QF11.

[0116] The TSVU controlling QF11 receives instruction C'3 and VDP for the original instruction C3.

[0117] In step S504, the instruction receiving and association module 210 calculates the hash value H_recv=Hash("Disconnect QF12") of the received instruction, and extracts the hash value H_sent=Hash("Disconnect QF11") sent by the master station from the VDP.

[0118] The module comparison revealed that Hrecv ≠ H_sent, and the correlation check failed.

[0119] Due to the association failure, the state machine of the timing logic verification module 240 will also undergo an abnormal transition. (See attached...) Figure 4 The diagram illustrates the finite state machine model used to verify the operation sequence. Under normal circumstances, the state machine smoothly transitions from "Waiting for step 3" to the "Sequence Successful" state. However, in this attack scenario, due to instruction association failure, the state machine jumps directly to the "Sequence Failed" state while "Waiting for step 3." This abnormal state transition is marked by a highlighted path in the diagram, thus interrupting the entire sequence.

[0120] The decision arbitration and execution module 250 immediately generates a "block" decision, and its output control signal enables the relay to disconnect, effectively intercepting the malicious instruction C'3 and preventing it from being sent to the backend IED.

[0121] (3) System response and auditing Because the malicious command was successfully blocked, no malfunctions occurred in the substation's primary equipment, thus avoiding a potential power grid disturbance caused by an error in the operating procedure.

[0122] The TSVU logging and reporting module 260 controlling QF11 immediately generates a high-level security event log with the event type "Instruction association verification failed" and includes snapshots of H_recv and H_sent. This log is reported in real time through the security verification channel 300.

[0123] The security audit module 160 of the main station security controller 100 received the alarm log. The module automatically performed correlation analysis and found that the sequence ID_seq=OP_SEQ_123 was currently being executed, and its third step had failed. The system immediately issued an alarm to the operation and maintenance personnel, indicating that "the switching operation sequence was interrupted, suspected of being an instruction tampering attack".

[0124] All relevant logs were archived, providing evidence for tracing the source of the attack in retrospect.

[0125] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A power monitoring security shield control system, characterized by, include: A master station security controller, deployed on the master station side, is used to respond to control commands issued by the monitoring master station, and to perform forward simulation on the control commands to generate a verification data packet containing a physical state expectation vector; At least one terminal security verification unit is deployed on the terminal device side to receive the control command and the verification data packet, and to perform collaborative arbitration; A security verification channel is used to transmit the verification data packet between the main station security controller and the terminal security verification unit; The terminal security verification unit is configured as follows: Based on the control commands, perform localized consequence simulation to generate a local predicted state vector; Compare the local predicted state vector with the expected physical state vector in the verification data packet; Based on the comparison results, a decision is generated to grant or deny the control command; The main station security controller includes: The state estimation module is used to calculate the current state vector of the system based on real-time power grid measurement data. The verification vector generation module is used to obtain the new steady state after the command execution by performing a power flow calculation on the control command, using the current state vector of the system as the initial condition, and extracting the physical quantities of key nodes from the new steady state to form the expected physical state vector. The terminal security verification unit includes: The local model prediction module is used to simulate the localized consequences of the control command based on its built-in local physical micro-model and with real-time acquired local measurement values ​​as boundary conditions, so as to generate the local predicted state vector. The physical state compliance verification module is used to calculate the deviation between the local predicted state vector and the expected physical state vector, and compare the deviation with a preset execution security threshold to complete the collaborative arbitration; The security verification channel is a dedicated communication link independent of the existing control channels of the power system; The control commands are transmitted through the existing control channel, and the verification data packets are transmitted through the security verification channel.

2. The power monitoring safety shield control system of claim 1, wherein, The main station security controller is also used to encapsulate the hash value of the control instruction within the verification data packet when generating the verification data packet; The terminal security verification unit includes an instruction receiving and association module, which is configured as follows: The control command and the verification data packet are received from the existing control channel and the security verification channel, respectively. Calculate the local hash value of the received control command; The local hash value is then compared with the hash value extracted from the verification data packet, and the control command is submitted for the collaborative arbitration only if the two match.

3. The power monitoring and security protection control system according to claim 1, characterized in that, When the control command is a sequence of commands, the verification data packet generated by the master station security controller also includes time window constraints between each step in the sequence; The terminal security verification unit also includes a timing logic verification module. The timing logic verification module is based on a finite state machine model and is used to further verify whether the execution order and time interval of the current instruction meet the time window constraint after the physical state compliance verification is passed, and to use the verification result as part of the collaborative arbitration.

4. The power monitoring and security protection control system according to claim 1, characterized in that, It also includes a model integrity verification mechanism that operates in steady state; The model integrity verification mechanism is configured as follows: The terminal security verification unit periodically collects and uploads digitally signed local state feature vectors; The model integrity verification module within the main station security controller compares the local state feature vector with the theoretical state feature vector calculated based on the global model, and determines the accuracy of the global model based on whether the comparison deviation exceeds the model tolerance threshold.

5. The power monitoring and security protection control system according to claim 1, characterized in that, The terminal security verification unit further includes a decision arbitration and execution module, which is configured as follows: The permission or blocking decision is generated based on the result of the collaborative arbitration, and the control command can be physically or logically controlled to be executed by the backend intelligent electronic device by controlling relay contacts, digital level signals or gating communication messages.

6. The power monitoring and security protection control system according to claim 1, characterized in that, The terminal security verification unit also includes a log and feedback module, which is used to record key events and final decisions of the collaborative arbitration in a structured manner, and to report the logs to the main station security controller in real time or periodically in batches, depending on the severity of the event. The main station security controller also includes a security audit module, which receives and performs automated correlation analysis and anomaly detection on the collected logs.

7. A power monitoring security protection control method, implemented by the power monitoring security protection control system as described in any one of claims 1-6, characterized in that, Includes the following steps: The main station security controller responds to the control commands issued by the monitoring main station, performs forward simulation on the control commands to generate a verification data packet containing the expected vector of physical state, and sends it to the terminal security verification unit through the security verification channel; The terminal security verification unit receives the control command and the verification data packet; The terminal security verification unit performs collaborative arbitration, which includes: performing localized consequence simulation based on the control command to generate a local predicted state vector; and comparing the local predicted state vector with the expected physical state vector in the verification data packet. Based on the comparison results of the collaborative arbitration, the terminal security verification unit generates and executes a decision to grant or block the control command.

Images