Method for monitoring WAPI network access state of substation terminal equipment

Abstract

The invention provides a substation terminal equipment WAPI network access state monitoring method, which comprises the following steps of: acquiring key negotiation turns and encrypted handshake duration of chips of different manufacturers from substation terminal equipment, synchronously acquiring calling times of a hardware acceleration unit, and forming an access performance record containing the negotiation turns, the handshake duration and the calling times of acceleration; aiming at the access performance record of the high-difference group chip, extracting the association performance of the key negotiation round and the encryption speed, identifying the inflection point position of the speed reduction caused by the increase of the negotiation round, and determining the inflection point position as an efficiency balance critical point; and analyzing the access stability performance of each chip in the mixed manufacturer environment through the optimized compatibility detection rule base, and dynamically adjusting compatibility strategy configuration when the access stability performance shows fluctuation imbalance to form adjusted strategy configuration content.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of information technology, and in particular to a substation terminal device WAPI network access state monitoring method. BACKGROUND

[0002] In the safe operation of the power system, the network access state monitoring of substation terminal devices is a crucial field, which is directly related to the stability of the power grid and the security of data transmission. Especially in the environment of wireless network access, ensuring the security and stability of communication between devices is an indispensable part of guaranteeing the normal operation of the power system. However, there are some limitations in the current monitoring methods in this field that cannot be ignored. Many schemes often ignore the differences in technical implementation of different manufacturers' devices, and fail to fully consider the mutual influence between device hardware characteristics and protocol execution details. This neglect leads to the fact that the monitoring strategy is difficult to adapt to the actual performance of different devices when facing complex environments, thereby affecting the reliability of the overall network access. The deeper technical difficulty lies in the fact that the number of key negotiation rounds, a core factor, forms a contradiction between security and efficiency that is difficult to reconcile. The number of key negotiation rounds refers to the number of times of key exchange when a device establishes a secure connection. The more rounds usually mean higher security, because it can more fully verify the identity and encryption parameters of both parties. However, in actual application, the increase in rounds may lead to a significant decrease in encryption processing speed due to the inability of some devices to fully utilize the built-in fast encryption function of the hardware. This contradiction makes it impossible to simultaneously consider security and efficiency, especially in the case of large differences in hardware performance and protocol implementation. Specifically, in the network access process of the substation, terminal devices of different manufacturers may tend to increase the number of negotiation rounds to improve security due to differences in protocol design, or simplify the process to pursue speed. For example, a device may ensure the absolute security of data transmission through multiple negotiations, but the time-consuming is too long, resulting in the inability to respond to control instructions in time during peak periods. Another device, although with fewer negotiation rounds and faster speed, may have hidden dangers due to insufficient security. This imbalance between security and efficiency caused by differences in negotiation rounds directly affects the stability of device access and the overall network operation effect. Therefore, how to balance the impact of the number of key negotiation rounds on security and efficiency in an environment where devices of different manufacturers are mixed, and find a reasonable strategy that can guarantee communication security and maintain processing speed, has become a key problem in the network access state monitoring of substation terminal devices. SUMMARY

[0003] The present application provides a substation terminal device WAPI network access state monitoring method, mainly including: Obtaining access performance related data from the substation terminal device to form an access performance record containing negotiation rounds and handshake duration; According to the access performance record, the implementation deviation degree of the chips of each manufacturer in the negotiation round ratio handshake duration is analyzed, and grouping is performed according to the difference in the implementation deviation degree, and the grouped chip access performance record is generated; For the grouped chip access performance record, performance correlation performance is extracted, and an efficiency balance critical point is determined; Through the efficiency balance critical point and the performance data comparison result, the compatibility detection rule library is optimized, the access stability performance is analyzed, and the strategy configuration content is dynamically adjusted; According to the strategy configuration content, a real-time monitoring mechanism is deployed, an access stability risk is identified, and a final access state monitoring result is output.

[0004] Further, the access performance related data is obtained from the substation terminal device, and the access performance record containing the negotiation round and the handshake duration is formed, which includes: The protocol data packet of the substation terminal device is obtained, the manufacturer identifier and the chip model information are extracted from the data packet header, the round count field in the key negotiation message is parsed, the difference between the start timestamp and the end timestamp of each negotiation round is calculated to obtain the single round negotiation time consumption, the total time consumption of each round is accumulated to obtain the handshake duration, and the protocol analysis data is formed; The call count register of the hardware acceleration unit is read at the same time, the difference between the initial count value and the termination count value is calculated to determine the number of hardware calls and the number of software processing rounds, and the performance collection data is formed; According to the timestamp ascending order, the protocol analysis data and the performance collection data are arranged and aggregated, and the structured access performance record is generated.

[0005] Further, the implementation deviation degree of the chips of each manufacturer in the negotiation round ratio handshake duration is analyzed according to the access performance record, and grouping is performed according to the difference in the implementation deviation degree, which includes: The negotiation round and the handshake duration data are extracted from the access performance record, and the single round average time consumption is calculated; The standard single round time consumption reference value in the industry specification is obtained, the difference between the single round average time consumption and the standard single round time consumption reference value is calculated, and the implementation deviation degree is obtained; According to the comparison between the implementation deviation degree and the preset deviation threshold range, if it is out of range, it is marked as a high difference group, and if it is within the range, it is marked as a low difference group, and an intermediate record is formed; The difference grouping identifier in the intermediate record is used to reorganize the data, the data sets of the high difference group and the low difference group are established, and the grouped chip access performance record is generated.

[0006] Further, the performance correlation performance is extracted for the grouped chip access performance record, and the efficiency balance critical point is determined, which includes: Read historical access data from the chip access performance record of the high difference group, sort by negotiation round, calculate the average handshake duration corresponding to each round, and form a round duration mapping table; According to the round duration mapping table, calculate the duration growth rate between adjacent rounds to obtain the duration change slope. When the slope changes from zero or negative to positive, it is marked as a performance turning point; Verify the change amplitude of handshake duration before and after the performance turning point. If the difference exceeds the preset proportion threshold, confirm the speed decline inflection point; Determine the efficiency balance critical point through the negotiation round corresponding to the inflection point and the efficiency decay coefficient.

[0007] Further, the compatibility detection rule library is optimized by comparing the efficiency balance critical point and the performance data, including: Extract negotiation round and handshake duration data from the chip access performance record of the low difference group, and identify records with less than a preset standard round threshold and successful authentication; Calculate the ratio of the actual handshake duration to the reference duration in the record to obtain the processing efficiency value; If the processing efficiency value is greater than the efficiency value corresponding to the efficiency balance critical point, extract the related chip parameter combination to form a compatibility rule entry; Add the rule entry to the existing compatibility detection rule library to generate an optimized compatibility detection rule library.

[0008] Further, the access stability performance is analyzed, and the strategy configuration content is dynamically adjusted, including: Read the recommended negotiation parameters from the compatibility detection rule library, monitor the access success rate and handshake duration of the chip in the mixed vendor environment, calculate the standard deviation of the success rate and the duration deviation, and calculate the standard deviation of the success rate and the duration deviation; If the standard deviation or deviation exceeds the preset threshold, it is marked as a stability abnormal chip; According to the proportion of the number of abnormal chips in the vendor distribution, identify the unbalanced combination, calculate the degree of decrease of the average success rate, and obtain the stability imbalance evaluation value; If the stability imbalance evaluation value exceeds the preset imbalance threshold, adjust the upper limit of the negotiation round, the handshake timeout duration, and the upper limit of the retry number, and generate the adjusted strategy configuration content.

[0009] Further, after dynamically adjusting the strategy configuration content, including: According to the strategy configuration content, set the parameter configuration item, deploy it to the network monitoring module, start real-time packet capture, parse negotiation round and timestamp information, calculate actual handshake duration, and form real-time access data stream; The access success rate and the average handshake time length are calculated through the real-time access data stream, a deviation value and a deviation ratio are calculated by comparing with a benchmark value, an access risk degree is determined, and a risk level is obtained; According to the risk level, a pre-established risk mapping relationship is queried, corresponding negotiation round critical values and efficiency critical coefficients are extracted, and an encryption efficiency balance critical point is determined.

[0010] Further, the output final access state monitoring result comprises: A balance point identification report containing critical point values and risk levels is generated for the encryption efficiency balance critical point; According to the balance point identification report, a success rate stability representation, a time length stability representation, and an abnormal frequency representation are determined, and a comprehensive stability index is obtained by adding the preset weight coefficients; If the comprehensive stability index is less than a preset stability standard threshold, it is determined that the monitoring state is stable, and the final access state monitoring result is output; If the index is greater than or equal to the threshold, the access performance record is returned to re-analyze the deviation degree.

[0011] The technical scheme provided by the embodiment of the application can include the following beneficial effects: The application discloses a substation terminal device WAPI network access state monitoring method, aiming at the business problems of access stability fluctuation and efficiency imbalance in a mixed environment caused by the implementation deviation of different manufacturers' chips in key negotiation rounds and encryption handshake time length, forming an access performance record by obtaining negotiation rounds, handshake time length and acceleration call times through a protocol analyzer and a performance collector, identifying the deviation degree according to the record and grouping into a high difference group and a low difference group, extracting an efficiency balance critical point for the high difference group, extracting efficiency integration from the low difference group to a compatibility detection rule library, analyzing stability by optimizing the rule library and dynamically adjusting strategy configuration, obtaining real-time data by deploying a real-time monitoring mechanism in the application to identify a risk level and a critical point, generating a balance point identification report to evaluate representation quantities, outputting a monitoring result when it meets the standard, otherwise, recycling optimization, thereby effectively solving the compatibility problem of multiple manufacturers' chips, realizing efficient and stable network access, and improving the overall encryption performance and reliability of the substation terminal device. BRIEF DESCRIPTION OF DRAWINGS

[0012] Figure 1 A flowchart of a substation terminal device WAPI network access state monitoring method of the application. DETAILED DESCRIPTION

[0013] The technical scheme in the embodiments of the application will be described clearly and in detail in combination with the drawings in the embodiments of the application. The described embodiments are only a part of the embodiments of the application.

[0014] As Figure 1 , the WAPI network access state monitoring method of the substation terminal device in this embodiment can specifically include: S101, obtaining the key negotiation rounds and encryption handshake duration of different manufacturer chips from the substation terminal device, synchronously obtaining the hardware acceleration unit call times, and forming an access performance record containing the negotiation rounds, handshake duration, and acceleration call times.

[0015] The WAPI protocol data packet of the substation terminal device is read through the protocol parser, the manufacturer identification code and chip model information are extracted from the data packet header, the round count field in the key negotiation message is parsed, the start timestamp and end timestamp of each negotiation round are recorded, the difference between the start timestamp and the end timestamp is calculated to obtain the single-round negotiation time consumption, the handshake duration is obtained by accumulating the time consumption of each round, and the protocol parsing data containing the manufacturer identification, chip model, negotiation rounds, and handshake duration are formed. During the protocol parsing process, the manufacturer identification code is defined as the first two bytes of the data packet header, which represents the unique code of the device manufacturer, and is read from the header offset 0 during parsing; the chip model is defined as the 3rd to 6th byte of the header, which identifies the hardware version, and is read from the offset 2 during parsing. At the same time of the protocol parser working, the performance collector obtains the initial count value before the start of key negotiation and the termination count value after the completion of negotiation by reading the call count register of the hardware acceleration unit of the terminal device, calculates the difference between the two to determine the hardware acceleration unit call times, and if the call times are less than the negotiation rounds in the protocol parsing data, marks the difference as the software processing round times, forms the performance collection data containing the hardware call times and software processing round times. The software processing round times refer to the negotiation rounds in which the hardware acceleration unit does not participate, which are calculated as the difference between the negotiation rounds and the hardware call times, and are used to analyze the impact of software processing on performance. According to the protocol parsing data and the performance collection data, the records are arranged in ascending order of the timestamps of negotiation occurrence, the manufacturer identification, chip model, negotiation rounds, handshake duration, hardware call times, and software processing round times under the same timestamp are aggregated, and a structured access performance record is generated, wherein each data in the access performance record corresponds to a complete WAPI network access process.

[0016] In an exemplary embodiment, the access performance monitoring of the substation terminal device is realized through the cooperative work of the protocol parser and the performance collector. The protocol parser is deployed in the substation communication management unit and is responsible for capturing and parsing the WAPI protocol data packet, while the performance collector directly accesses the hardware registers of the terminal device, and the two maintain the consistency of data collection through a time synchronization mechanism.

[0017] Specifically, the protocol parser obtains the authentication and key agreement messages of the WAPI protocol by network packet capturing. In the message parsing process, the protocol parser first identifies the message type field to determine whether it is a key agreement message, and then extracts the manufacturer identification code from the manufacturer extension field in the message header. The identification code usually occupies 4 bytes, the first two bytes represent the manufacturer number, and the last two bytes represent the chip model. For the identification of the key agreement round, the protocol parser analyzes the sequence number field and the message type field in the message, counts the number of complete four-way handshake processes, and each complete four-way handshake is counted as one round of agreement. The calculation of the handshake duration is by recording the time stamp of the first authentication request message and the time stamp of the last key confirmation message, and the difference between the two is the total handshake duration.

[0018] Illustratively, the performance collector obtains the call information by reading the state register of the terminal device hardware acceleration unit. The hardware acceleration unit usually contains a dedicated encryption coprocessor, which is called when key agreement is performed to accelerate encryption operations. The performance collector reads the value of the call count register as a reference before the agreement begins, and reads it again after the agreement ends. The difference between the two readings is the actual number of calls. When the number of calls of the hardware acceleration unit is less than the number of agreement rounds, it indicates that part of the agreement process is handled in software. This situation usually occurs when the hardware resources are busy or the specific encryption algorithm is not supported by the hardware. By calculating the difference between the number of agreement rounds and the number of hardware calls, the number of software processing rounds can be obtained, which reflects the actual utilization degree of the hardware acceleration capability of the device in the key agreement process.

[0019] S102、According to the access performance record, the implementation deviation degree of each manufacturer chip in the agreement round ratio handshake duration is identified, and the chips with implementation deviation degrees exceeding the industry standard range are marked as a high difference group, and the chips without exceeding the industry standard range are marked as a low difference group, to form a grouped chip access performance record.

[0020] The negotiation round and handshake duration data of each manufacturer's chip are extracted from the access performance record, the single round average time consumption is calculated by dividing the handshake duration by the negotiation round, the standard single round time consumption reference value specified in the substation WAPI access industry specification is obtained, the difference between the single round average time consumption and the standard single round time consumption reference value is calculated, and then divided by the standard single round time consumption reference value and multiplied by 100% to obtain the implementation deviation degree of each manufacturer's chip. The implementation deviation degree is compared with the preset positive and negative 30% deviation threshold range, if the implementation deviation degree exceeds positive 30% or is lower than negative 30%, the manufacturer's chip is marked as a high difference group in the access performance record, if the implementation deviation degree is within the range of positive and negative 30%, it is marked as a low difference group, and an intermediate record containing the difference grouping identifier is formed. The difference grouping identifier in the intermediate record is used for data reorganization, and independent data sets are established according to the high difference group and the low difference group, the original manufacturer identifier, chip model, negotiation round, handshake duration, hardware call times, and newly added deviation degree value and grouping category are retained within each set, and the grouped chip access performance record is generated.

[0021] Exemplarily, in an embodiment, the performance difference evaluation of the manufacturer's chip of the substation terminal device quantifies the differences of different manufacturers in the WAPI protocol implementation by calculating the implementation deviation degree. The implementation deviation degree reflects the degree of deviation of the key negotiation efficiency of each manufacturer's chip from the industry standard. The calculation of the implementation deviation degree is based on the single round average time consumption. In the substation WAPI network access scene, due to the differences in design concept and hardware architecture, the time required for different manufacturers' chips to complete the same negotiation round is significantly different. The industry standard single round time consumption reference value is usually derived from the substation communication specification issued by State Grid Corporation of China, which is based on the average performance level of mainstream manufacturer equipment and is generally set to not more than 50 milliseconds per round of negotiation. When the single round average time consumption of a certain manufacturer's chip is 65 milliseconds, the deviation degree is calculated as follows: the difference between 65 and 50 is 15, which is divided by 50 and multiplied by 100% to obtain a positive 30% deviation degree. This deviation degree calculation method considers both the absolute time difference and the severity of the deviation degree through the relative proportion.

[0022] Preferably, the threshold range of positive and negative 30% is determined based on the actual operation experience of the substation. The deviation within this range is considered to be a reasonable interval of normal manufacturing process difference and protocol implementation optimization, and the deviation beyond this range indicates significant performance anomaly or protocol implementation defect.

[0023] Exemplarily, the chips of the high difference group often show two extreme cases: the chips with a deviation degree exceeding positive 30% usually have problems of hardware performance bottleneck or low protocol implementation efficiency; the chips with a deviation degree lower than negative 30% may simplify some security verification processes although they are fast.

[0024] In a possible implementation, the grouped data is reorganized to establish independent data sets according to the difference categories, and complete performance index records are maintained within each set. The data sets are stored in a linked list structure; through this grouping mechanism, the substation network management personnel can formulate differentiated monitoring strategies for devices with different degrees of difference, implement intensive monitoring on high-difference group devices, and adopt routine monitoring on low-difference group devices, thereby improving the pertinence and efficiency of overall network access monitoring.

[0025] S103, for the high-difference group chip access performance record, extract the correlation between the key negotiation round and the encryption speed, identify the inflection point position caused by the increase of negotiation round and the decline of speed, and determine the inflection point position as the efficiency balance critical point.

[0026] Read the historical access data of each manufacturer's chip from the high-difference group chip access performance record, sort the negotiation rounds from small to large, extract multiple access records under the same round, calculate the average handshake time corresponding to each round, form a corresponding sequence of negotiation round and average handshake time, and construct a round time mapping table. According to the round time mapping table, calculate the time length growth rate between adjacent three rounds, subtract the average handshake time of the previous round from the average handshake time of the next round, and then divide by the round interval to obtain the time length change slope. When the time length change slope changes from zero or negative value to positive value, mark the round as a performance turning point. For the performance turning point, verify the change amplitude of the handshake time before and after the point, calculate the difference between the average handshake time of the two rounds after the turning point and the average handshake time of the two rounds before the turning point, and if the difference exceeds the preset proportion threshold of the average time before the turning point, confirm that the turning point is a speed decline inflection point. Through the negotiation round number corresponding to the speed decline inflection point, combined with the ratio of the handshake time under the round to the theoretical minimum time length, calculate the efficiency decay coefficient, and when the efficiency decay coefficient reaches the preset critical threshold, the corresponding round position is determined as the efficiency balance critical point.

[0027] Exemplarily, in an embodiment, the performance inflection point identification for high-difference group chips is achieved by analyzing the correlation changes between negotiation rounds and encryption processing time length. The inflection point identification mechanism is based on the slope mutation detection of the performance curve, which can accurately locate the critical position where the chip performance changes from linear variation to nonlinear decay. When extracting historical data from the high-difference group chip access performance records, the time sequence characteristics and integrity of the data need to be considered. Each manufacturer's chip may experience multiple WAPI access processes in different time periods, and the negotiation rounds of each access may vary due to different network environments and security strategies. By reading the access records within 30 consecutive days, the complete data sequence of the negotiation rounds increasing from 1 to 10 is selected, the records of abnormal interruption or timeout are excluded, and the valid data of normal handshake completion are retained. The construction of the round time length mapping table involves the aggregation processing of multi-dimensional data. For the same negotiation round, there may be multiple access records at different times, and the handshake time length of these records may vary due to different device loads and network congestion levels. The statistical mean method is used to process this difference. First, the median of the handshake time length of all records under each round is calculated, and the abnormal values deviating from the median by more than twice the standard deviation are excluded, and then the arithmetic mean of the remaining data is calculated. This processing method can eliminate the influence of occasional interference factors and obtain the round time length corresponding relationship that can truly reflect the performance characteristics of the chip. The mapping table is stored in a key-value pair structure, with the negotiation round number as the key and the average handshake time length corresponding to the round as the value, forming a continuous mapping sequence from 1 to 10. The calculation of the slope of the time length change is realized by the difference method. For the nth round, the slope calculation formula is the average handshake time length of the n+1th round minus the average handshake time length of the n-1th round, divided by 2. This central difference method can more accurately reflect the change trend than simple forward difference or backward difference. When the slope value suddenly increases from a negative value or a small value close to zero to a positive value, it indicates that the performance starts to show a decay trend.

[0028] In a possible implementation, the marking of the performance turning point is based on two conditions of slope sign change and numerical jump. The sign change refers to the change of the slope from a non-positive value to a positive value, and the numerical jump refers to the increase of the absolute value of the slope by more than twice the absolute value of the previous slope. Only when both conditions are met, it is marked as a potential performance turning point.

[0029] Exemplarily, the inflection point verification process needs to comprehensively consider the performance difference before and after the turning point. In the actual operation environment of the substation, some temporary performance fluctuations may lead to false turning point identification. By calculating the average handshake time mean of the two rounds before the turning point as the baseline value, and then calculating the average handshake time mean of the two rounds after the turning point, the difference between the two reflects the amplitude of the performance change. When this difference exceeds the preset proportion threshold of the baseline value, it means that the performance has indeed deteriorated significantly, and the turning point is confirmed as a real speed decline inflection point. The preset proportion threshold is usually set between fifteen percent and twenty-five percent, and the specific value is determined according to the tolerance of the substation to the access delay. Further, the calculation of the efficiency decay coefficient introduces the theoretical minimum length as a reference baseline. The theoretical minimum length refers to the shortest time required by the chip to complete the specified round of negotiation under ideal network conditions. This value is usually obtained through the technical specification book provided by the chip manufacturer, or determined through benchmark testing in a laboratory environment. The efficiency decay coefficient is equal to the ratio of the actual handshake time to the theoretical minimum length. The larger the coefficient, the more serious the efficiency loss. The theoretical minimum length is determined by the minimum handshake time marked in the chip specification book provided by the manufacturer. If the specification book data is not available, the shortest handshake time is recorded as the theoretical minimum length through multiple access experiments in a standard test environment. The determination of the efficiency balance critical point needs to consider the balance between security and efficiency. When the efficiency decay coefficient reaches the preset critical threshold, it means that the security improvement brought by continuing to increase the negotiation round has not made up for the loss of efficiency. The preset critical threshold is generally set between 1.5 and 2.0, indicating that the actual time consumption is 1.5 to 2 times the theoretical minimum value.

[0030] For example, a certain manufacturer's chip has an efficiency decay coefficient of 1.48 when the negotiation round is 5, and the coefficient suddenly increases to 1.85 when the round is 6, exceeding the critical threshold of 1.8. Therefore, round 6 is determined as the efficiency balance critical point. This critical point provides a quantitative basis for subsequent access strategy optimization, enabling the substation to develop differentiated negotiation round upper limits for different chips, avoiding excessive performance loss while ensuring necessary security.

[0031] S104, extract the processing efficiency performance of the simplified negotiation process from the low difference group chip access performance record, integrate the chips with processing efficiency performance higher than the efficiency balance critical point into the compatibility detection rule library, and form an optimized compatibility detection rule library.

[0032] The negotiation round and handshake duration data of each chip are extracted from the low-difference group chip access performance records, the access records with negotiation round less than a preset standard round threshold and handshake authentication success are identified, the preset standard round threshold is set according to the WAPI protocol specification, the ratio of the actual handshake duration in the identified records to the reference duration corresponding to the standard round threshold is calculated, and the processing efficiency value is obtained by dividing the reference duration by the actual handshake duration. According to the comparison between the processing efficiency value and the aforementioned efficiency balance critical point, if the processing efficiency value is greater than the efficiency value corresponding to the efficiency balance critical point, the manufacturer identification, chip model, actual negotiation round and handshake duration parameters of the chip are extracted, the parameters are combined to form a compatibility rule item, and the item is added to the existing compatibility detection rule library to generate an optimized compatibility detection rule library containing the new rule item.

[0033] Exemplarily, in an embodiment, the simplified process of the low-difference group chip is identified based on the comparison analysis of negotiation rounds. The simplified process refers to an optimization scheme for improving access efficiency by reducing unnecessary negotiation steps under the premise of ensuring security authentication. The preset standard round threshold is usually set to 4 rounds, which is the standard negotiation round recommended in the WAPI protocol specification. When the actual negotiation round of a chip is 2 rounds or 3 rounds and the authentication is successful, it indicates that the chip adopts a simplified process. The calculation of the processing efficiency value is realized by comparing the actual performance with the reference performance. The reference duration is the average time consumption of 4 standard negotiation rounds, which is 80 milliseconds. If the actual 2-round negotiation only consumes 35 milliseconds, the processing efficiency value is 80 divided by 35, which is about 2.3. The compatibility detection rule library stores rule items in the form of key-value pairs. The key is the combination of the manufacturer identification and the chip model, and the value contains parameters such as recommended negotiation round and expected handshake duration. When the processing efficiency value exceeds the efficiency balance critical point, it indicates that the simplified process of the chip ensures security while achieving higher efficiency. These successful cases are integrated into the rule library for reference by other similar devices.

[0034] S105, analyze the access stability performance of each chip in the mixed manufacturer environment through the optimized compatibility detection rule library, dynamically adjust the compatibility strategy configuration when the access stability performance presents fluctuation imbalance, and form the adjusted strategy configuration content.

[0035] The recommended negotiation parameters of each chip of various manufacturers are read through the optimized compatibility detection rule library, the access success rate and the handshake time length of each chip in a continuous time window are monitored in a mixed manufacturer environment, the standard deviation value of the success rate in the time window is calculated, the deviation degree of the handshake time length relative to the mean value is calculated, when the standard deviation value exceeds the preset stability threshold or the deviation degree exceeds the preset deviation threshold, the chip is marked as a stability abnormal chip. According to the manufacturer distribution of the stability abnormal chip, the proportion of the number of abnormal chips under each manufacturer combination is counted, and the manufacturer combination whose proportion exceeds the preset proportion is identified as an unbalanced combination. The historical configuration parameter sequence of the unbalanced combination is extracted from the compatibility detection rule library, the decreasing degree of the success rate mean value in the last three time windows is calculated, and a stability imbalance evaluation value is obtained. For the stability imbalance evaluation value, if the evaluation value exceeds the preset imbalance threshold, according to the mapping relationship between the imbalance degree and the negotiation parameter, the upper limit value of the negotiation round of the corresponding manufacturer chip is reduced, the upper limit of the handshake timeout length and the retry number is increased, a configuration parameter group containing the adjusted negotiation round, timeout length and retry number is generated, and an adjusted strategy configuration content is formed.

[0036] For example, in an embodiment, the access stability monitoring in a mixed manufacturer environment is realized through multi-dimensional index analysis in a continuous time window. The time window is set to a monitoring period of 5 minutes, which can capture the performance fluctuation characteristics in a short period of time, while avoiding the interference of incidental abnormalities on the overall evaluation. Stability monitoring involves the calculation and evaluation of two core indicators. The standard deviation value of the access success rate reflects the dispersion degree of the access success probability at different times. In the actual operation of a substation, the access success rate of each chip should normally be maintained at more than 95% with a fluctuation range of less than 3%. When the success rate of a chip of a certain manufacturer fluctuates greatly in a time window, such as 98% in the first minute, 85% in the second minute and 92% in the third minute, this sharp fluctuation will cause the standard deviation value to exceed the preset 5% stability threshold. The deviation degree of the handshake time length is obtained by calculating the relative deviation of the actual time length from the average time length in the window. When the deviation degree exceeds 20%, it indicates that the timing performance of the chip has unstable factors. This instability is often caused by hardware resource competition or protocol implementation defects. Based on statistical principles, an unbalanced combination is identified when more than 30% of the chips under a specific manufacturer combination are marked as stability abnormal. The stability imbalance evaluation value is obtained by calculating the decreasing rate of the success rate mean value in the last three time windows. The greater the decreasing rate, the more serious the imbalance.

[0037] Exemplarily, the parameter adjustment follows a preset mapping relationship table. When the imbalance evaluation value is in the mild imbalance interval, the negotiation round upper limit is reduced from 4 rounds to 3 rounds, and the handshake timeout duration is increased from 100 milliseconds to 150 milliseconds; when in the severe imbalance interval, the negotiation round is further reduced to 2 rounds, and the timeout duration is increased to 200 milliseconds, while the retry number is increased from 2 times to 3 times. The adjusted strategy configuration content is stored in the form of a configuration file, containing the individualized parameter settings of various vendor chips, realizing the differentiated management of different devices in a mixed environment, thereby maintaining the stability of the overall network access.

[0038] S106, according to the adjusted strategy configuration content, a real-time monitoring mechanism is deployed in the state monitoring system to obtain the real-time negotiation round and handshake duration of WAPI network access, identify the access stability risk level and the corresponding encryption efficiency balance critical point.

[0039] According to the adjusted strategy configuration content, parameter configuration items are set in the state monitoring system and deployed to the network monitoring module of the substation terminal device, the configuration collection frequency is set to a preset period, the real-time capture of WAPI protocol packets is started, the negotiation round count field and timestamp information are parsed from the packets, the start time and end time of each access process are recorded, the actual handshake duration is calculated, and the real-time access data stream containing device identification, negotiation round, and handshake duration is formed. The access success rate and average handshake duration of the current period are calculated through the real-time access data stream, compared with the reference value in the strategy configuration content, the success rate deviation and duration deviation proportion are calculated, the access risk degree is determined according to the combination of the deviation value and the deviation proportion, when both indicators are within the threshold, it is determined as low risk, one item is over limit, it is determined as medium risk, both items are over limit, it is determined as high risk, and the access stability risk level is obtained. The access stability risk level is used to query the pre-established risk mapping relationship, which records the negotiation round upper limit and efficiency decay critical coefficient corresponding to different risk levels, the negotiation round critical value and efficiency critical coefficient corresponding to the current risk level are extracted, and the encryption efficiency balance critical point under the risk level is determined. According to the comparison result of the encryption efficiency balance critical point and the real-time monitoring data, when the negotiation round exceeds the critical value or the efficiency coefficient is lower than the critical coefficient, an abnormal event is recorded, the risk evaluation record is updated, and the monitoring result containing the real-time negotiation round, handshake duration, risk level, and corresponding critical point is output.

[0040] Exemplarily, the real-time monitoring mechanism of the state monitoring system is deployed based on a distributed architecture. A monitoring module is deployed at a key node of a substation network, and unified management and dynamic updating of parameters are achieved through issuance of strategy configuration content, forming a monitoring network covering all terminal devices in the substation. The deployment of the monitoring system involves three levels of configuration. At the network level, WAPI protocol message traffic is copied to a monitoring port through port mirroring function of a switch; at the application level, a protocol analysis engine is deployed to perform deep analysis on the message; and at the data level, a time series database is established to store real-time collected access data. The parameter configuration items include key parameters such as collection period, cache size, and timeout threshold, which are adjusted according to the network load and device scale of the substation. The collection period is usually set to between 100 milliseconds and 1 second, which can ensure real-time data and will not cause excessive burden on the network. The core of real-time data collection lies in accurate analysis of WAPI protocol messages and extraction of key information. The authentication process of the WAPI protocol includes certificate verification, key agreement, identity confirmation, and other stages, each of which has a specific message format and field definition. The monitoring system determines the current authentication stage by identifying the message type field, extracts basic information such as source address, target address, and sequence number from the message header, and analyzes key parameters such as negotiation round count, encryption algorithm identifier, and key length from the message payload. The negotiation round is identified by counting the number of key agreement request and response message pairs, and each completed request-response pair is counted as one negotiation round. The handshake duration is calculated from the timestamp of the first authentication request message to the timestamp of the last key confirmation message, and the difference between the two is the complete handshake time.

[0041] Preferably, the risk level is determined by a multi-dimensional evaluation method. The access success rate deviation is obtained by calculating the difference between the current period success rate and the baseline success rate, and the baseline success rate is derived from the statistical mean during the normal operation period. The time length deviation ratio is the ratio of the actual handshake time length to the baseline time length, reflecting the deviation of the current performance from the normal level. When the success rate deviation is within 5% and the time length deviation ratio is within 1.2 times, it is determined as low risk; when either indicator exceeds but the other indicator is normal, it is determined as medium risk; and when both indicators are significantly out of limit, it is determined as high risk.

[0042] In one possible implementation, the risk mapping relationship is established by combining historical data analysis and expert experience. The mapping relationship is stored in the form of a lookup table, including three key fields of risk level, negotiation round upper limit, and efficiency decay critical coefficient. Low risk corresponds to a more relaxed parameter setting, allowing more negotiation rounds and lower efficiency requirements; high risk adopts strict parameter limits, reducing negotiation rounds and increasing efficiency requirements.

[0043] Exemplarily, the determination of the encryption efficiency balance critical point needs to comprehensively consider the security requirements and performance constraints. In the low-risk state, the system can tolerate more negotiation rounds to obtain higher security, the critical point is set to 6 rounds of negotiation, and the efficiency coefficient is not less than 0.6; in the medium-risk state, the critical point is adjusted to 4 rounds of negotiation, and the efficiency coefficient is not less than 0.7; in the high-risk state, to avoid system collapse, the critical point is reduced to 2 rounds of negotiation, and the efficiency coefficient is required to be above 0.8. The calculation of the efficiency coefficient is based on the ratio of the theoretical minimum time consumption to the actual time consumption, which reflects the proportion of the actual running efficiency of the system relative to the ideal state. This dynamic adjustment mechanism can adaptively balance the relationship between security and efficiency according to the changes of the network state. Further, the record of abnormal events contains key information such as time stamp, device identification, abnormal type, and overrun parameter value. When the negotiation rounds exceed the critical value, the system records the number of excess rounds and the corresponding handshake time consumption; when the efficiency coefficient is lower than the critical coefficient, the actual efficiency value and the possible reason for performance decline are recorded, the efficiency coefficient is the reciprocal of the ratio of handshake time to negotiation rounds, which is used to evaluate the encryption efficiency; the handshake time and negotiation rounds are obtained by real-time access to data streams, and the efficiency coefficient = 1 / (handshake time / negotiation rounds) is calculated.

[0044] For example, after deploying the monitoring mechanism in a certain 220kV substation, it is detected that some devices are in a medium-risk state during the morning peak period, and the upper limit of negotiation rounds is automatically adjusted from 4 rounds to 3 rounds, and the handshake success rate is improved from 92% to 96%, effectively avoiding access failures caused by network congestion. Through this real-time monitoring and dynamic adjustment mechanism, the substation can optimize the access performance according to the actual running state while ensuring the security of the WAPI network, and realize the dynamic balance between security and efficiency.

[0045] S107, generate a balance point identification report for the encryption efficiency balance critical point, extract stable monitoring characteristics from the report, and output the final access state monitoring result when the stable monitoring characteristics meet the preset standard, otherwise loop back to access performance record to identify the deviation degree.

[0046] The balance point identification report containing the critical point value, corresponding risk level and monitoring period is generated for the encryption efficiency balance critical point, the variance of the ratio of the number of access successes to the total number of times is extracted from the report as a success rate stability representation, the ratio of the standard deviation to the mean of the handshake length is extracted as a length stability representation, and the ratio of the number of abnormal events to the total number of monitoring times is extracted as an abnormal frequency representation. The three representation quantities are added according to the preset weight coefficient to obtain a comprehensive stability index. According to the comparison between the comprehensive stability index and the preset stability standard threshold value, if the index value is less than the threshold value, it is determined that the monitoring state is stable, and a final access state monitoring result containing the current monitoring state, risk level and critical point configuration is output. If the index value is greater than or equal to the threshold value, it is determined that there is an unstable factor, and the initial data needs to be recalculated to verify the accuracy, so as to avoid misjudgment due to deviation accumulation, and return to the initial access performance record to recalculate the implementation deviation degree of each manufacturer chip and execute the subsequent process.

[0047] Exemplarily, in an embodiment, the generation and evaluation mechanism of the balance point identification report is realized through comprehensive analysis of multi-dimensional representation quantities. The report summarizes the key performance indicators in the monitoring period, providing quantitative basis for stability evaluation.

[0048] Specifically, the selection of the three stability representation quantities is based on the performance characteristics of different dimensions. The success rate stability representation is obtained by calculating the variance of the access success rate in multiple time windows, reflecting the fluctuation degree of the success rate. The length stability representation adopts the coefficient of variation, that is, the ratio of the standard deviation to the mean, eliminating the influence of dimension, so that length data of different orders of magnitude are comparable. The abnormal frequency representation statistics the occurrence frequency of abnormal events, directly reflecting the stability degree of the system. The weight coefficients of the comprehensive stability index are usually set to 0.4, 0.4 and 0.2, respectively corresponding to the three representation quantities. This weight distribution reflects the emphasis on performance stability. Among them, the success rate stability and the length stability are set to 0.4, and the abnormal frequency is set to 0.2. The reason is that the success rate and the length directly affect the access performance and user experience, which need to be paid attention to, while the abnormal frequency is important but the influence is relatively controllable, so the weight is low. The design of the cyclic optimization mechanism considers the adaptive adjustment needs of the monitoring system. When the comprehensive stability index exceeds the threshold value, it indicates that the current deviation degree calculation may not be accurate enough, and the initial data needs to be analyzed again. This cycle usually converges within 2 to 3 times, avoiding the monitoring deviation caused by improper initial parameter setting, and realizing the iterative optimization of monitoring accuracy.

[0049] The above-described embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that they can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacements for part of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for monitoring the WAPI network access status of substation terminal equipment, characterized in that, include: Data related to access performance is obtained from substation terminal equipment to form an access performance record that includes negotiation rounds and handshake duration. The access performance records are analyzed to determine the deviation of each manufacturer's chips in terms of negotiation rounds, handshake duration, and grouped according to the differences in the deviation, generating grouped chip access performance records. Extract performance correlations from the grouped chip access performance records to determine the efficiency balance critical point; The compatibility detection rule base is optimized by comparing the efficiency balance critical point with the performance data results, the access stability performance is analyzed, and the strategy configuration content is dynamically adjusted. Deploy a real-time monitoring mechanism based on the strategy configuration to identify access stability risks and output the final access status monitoring results.

2. The method for monitoring the WAPI network access status of substation terminal equipment as described in claim 1, characterized in that, The process of obtaining access performance-related data from substation terminal equipment to form an access performance record including negotiation rounds and handshake duration includes: Obtain the protocol data packets of the substation terminal equipment, extract the manufacturer identifier and chip model information from the header of the data packets, parse the round count field in the key negotiation message, calculate the difference between the start timestamp and the end timestamp of each round of negotiation to obtain the time consumed in a single round of negotiation, and sum up the time consumed in each round to obtain the handshake duration, thus forming the protocol parsing data; Simultaneously, the call count register of the hardware acceleration unit is read, the difference between the initial count value and the final count value is calculated, the number of hardware calls and the number of software processing rounds are determined, and performance acquisition data is formed. The protocol parsing data and performance collection data are sorted in ascending order based on timestamps and aggregated to generate a structured access performance record.

3. The method for monitoring the WAPI network access status of substation terminal equipment as described in claim 1, characterized in that, The analysis of the implementation deviation of each manufacturer's chips in the negotiation rounds and handshake duration based on the access performance records, and the grouping according to the differences in implementation deviation, includes: Extract negotiation rounds and handshake duration data from the access performance records, and calculate the average time per round. Obtain the standard single-round time reference value in the industry standard, calculate the ratio of the difference between the average single-round time and the standard single-round time reference value, and obtain the implementation deviation degree; Based on the comparison between the achieved deviation degree and the preset deviation threshold range, if it exceeds the range, it is marked as a high difference group; if it is within the range, it is marked as a low difference group, thus forming an intermediate record. The data is reconstructed using the difference group identifiers in the intermediate records to establish data sets for high difference groups and low difference groups, and to generate grouped chip access performance records.

4. The method for monitoring the WAPI network access status of substation terminal equipment as described in claim 1, characterized in that, The process of extracting performance correlations from grouped chip access performance records and determining the efficiency balance critical point includes: Historical access data is read from the chip access performance records of the high-difference group, sorted by negotiation round, and the average handshake duration for each round is calculated to form a round duration mapping table. The duration growth rate between adjacent rounds is calculated based on the round duration mapping table to obtain the duration change slope. When the slope changes from zero or negative to positive, it is marked as a performance inflection point. Verify the change in handshake duration before and after the performance inflection point. If the difference exceeds a preset proportional threshold, the speed decrease inflection point is confirmed. The efficiency balance critical point is determined by the number of negotiation rounds and the efficiency decay coefficient corresponding to the inflection point.

5. The method for monitoring the WAPI network access status of substation terminal equipment as described in claim 1, characterized in that, The optimization of the compatibility detection rule base based on the efficiency balance critical point and performance data comparison results includes: Extract negotiation rounds and handshake duration data from the low-difference group chip access performance records, and identify records that have successfully authenticated but have fewer negotiation rounds than the preset standard round threshold. Calculate the ratio of the actual handshake duration to the baseline duration in the recorded data to obtain the processing efficiency value; If the processing efficiency value is greater than the efficiency value corresponding to the efficiency balance critical point, then relevant chip parameter combinations are extracted to form compatibility rule entries. Add the rule entries to the existing compatibility detection rule base to generate an optimized compatibility detection rule base.

6. The method for monitoring the WAPI network access status of substation terminal equipment as described in claim 1, characterized in that, The analysis of access stability performance and the dynamic adjustment of policy configuration include: The recommended negotiation parameters are read from the compatibility detection rule base to monitor the access success rate and handshake duration of chips in a mixed vendor environment, and the standard deviation of the success rate and the degree of deviation of the duration are calculated. If the standard deviation or deviation exceeds a preset threshold, it is marked as a chip with abnormal stability. Based on the distribution of manufacturers, the percentage of abnormal chips is statistically analyzed to identify unbalanced combinations, the degree of decrease in the average success rate is calculated, and a stability imbalance assessment value is obtained. If the stability imbalance assessment value exceeds the preset imbalance threshold, the upper limit of the negotiation rounds, the handshake timeout duration, and the upper limit of the number of retries will be adjusted to generate the adjusted strategy configuration content.

7. The method for monitoring the WAPI network access status of substation terminal equipment as described in claim 1, characterized in that, After configuring the dynamic adjustment strategy, it includes: Set the parameter configuration items according to the policy configuration content, deploy them to the network monitoring module, start real-time capture of protocol messages, parse the negotiation rounds and timestamp information, calculate the actual handshake duration, and form a real-time access data stream. The access success rate and average handshake duration are calculated using the real-time access data stream. By comparing them with the benchmark value, the deviation value and deviation ratio are calculated to determine the degree of access risk and obtain the risk level. Based on the risk level, query the pre-established risk mapping relationship, extract the corresponding negotiation round critical value and efficiency critical coefficient, and determine the encryption efficiency balance critical point.

8. The method for monitoring the WAPI network access status of substation terminal equipment as described in claim 7, characterized in that, The output of the final access status monitoring result includes: Generate a balance point identification report that includes the critical point value and risk level for the balance point of encryption efficiency; Based on the equilibrium point identification report, the success rate stability characterization, duration stability characterization, and abnormal frequency characterization are determined, and a comprehensive stability index is obtained by adding them according to preset weight coefficients. If the comprehensive stability index is less than the preset stability standard threshold, the monitoring status is determined to be stable, and the final access status monitoring result is output.

Images