Circuit breaker authority control method and device
By setting permission sets for different communication methods of smart circuit breakers and dynamically adjusting permissions according to the operation request rate, the permission control problem of smart circuit breakers under multiple communication methods is solved, thereby improving the safety and flexibility of the power grid.
Patent Information
- Application Number
- CN202511839356.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-08
- Publication Date
- 2026-02-24
AI Technical Summary
Existing smart circuit breakers lack effective access control strategies under various communication methods, leading to increased risks of network attacks and data breaches, and affecting the safety and reliability of the power grid.
Different permission sets are set for different communication methods. The permission level is negatively correlated with the operation request rate. The response strategy of the permission subset is dynamically adjusted by detecting the communication method and rate to restrict the permissions of high-rate requests and prevent malicious operations.
It effectively prevents network attacks and data leaks, improves the safety and reliability of the power grid, and maintains flexible access control to adapt to the security needs of different application scenarios.
Smart Images
Figure CN121567445A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to a circuit breaker access control method and device, belonging to the field of low-voltage power distribution control technology. Background Technology
[0002] With the rapid development of information and communication technologies, traditional power grids are gradually evolving into smart grids, with more and more power distribution components connecting to the Internet through the Internet of Things (IoT). On the one hand, this enables two-way flow of information between the power grid and the network, more efficiently integrates power grid resources, and improves the operability, predictability, and maintainability of the power grid, resulting in a significant increase in reliability and efficiency. On the other hand, the large-scale introduction of the network also leads to the exposure of massive amounts of power equipment data on the Internet. If there are no corresponding security control strategies during monitoring and control, it could lead to the leakage of important data, or more seriously, it could be exploited and attacked by criminals, causing instability or even paralysis of the power grid, seriously endangering the normal operation of the social economy.
[0003] As a core component of the power grid, circuit breakers are becoming increasingly intelligent and networked. Existing smart circuit breakers often have multiple communication methods such as fieldbus, WIFI, Ethernet, NFC, and HPLC to achieve information exchange with the outside world. In order to ensure the safe operation of circuit breakers, it is necessary to study access control strategies related to communication methods. Summary of the Invention
[0004] The technical problem to be solved by the present invention is to overcome the shortcomings of the prior art and provide a circuit breaker access control method that sets and manages access permissions based on communication method and operation request rate, which can effectively improve the safety and reliability of circuit breakers.
[0005] The present invention specifically adopts the following technical solutions to solve the above-mentioned technical problems: A circuit breaker access control method is disclosed, wherein the circuit breaker is an intelligent circuit breaker with external communication capabilities. Corresponding access control sets are pre-defined for different communication methods. Each access control set contains a subset of access control levels corresponding to different access control levels. The access control level of each subset is negatively correlated with the operation request rate level; the higher the operation request rate level, the lower the access control level. When the circuit breaker receives an operation request, it first detects the communication method used for the operation request transmission within the current cycle and responds to the operation request using the access control subset determined in the previous cycle. If the current communication is the initial communication, the operation request is responded to using the highest-level access control subset in the current communication method's access control set. Simultaneously, within the current cycle, the operation request rate is calculated based on the transmitted operation request, and the operation request received in the next cycle is responded to using the access control subset corresponding to the operation request rate level.
[0006] Preferably, the step of setting corresponding permission sets for different communication methods includes: the permission set corresponding to fieldbus-type communication methods includes permission subsets of high, medium, and low permission levels; the permission set corresponding to local area network-type communication methods includes permission subsets of medium and low permission levels; and the permission set corresponding to wide area network-type communication methods includes permission subsets of low permission levels. Preferably, the permission levels include high-level permission, medium-level permission, low-level permission, and no permission. The high-level permission subset includes all operation requests such as system upgrades, password resets, parameter modifications, remote operations, and data queries for the circuit breaker. The medium-level permission subset includes operation requests such as parameter modifications, remote operations, and data queries for the circuit breaker. The low-level permission subset includes operation requests such as data queries for the circuit breaker. The no-permission subset is empty.
[0007] Based on the same inventive concept, the following technical solutions can also be obtained: A circuit breaker access control device, wherein the circuit breaker is an intelligent circuit breaker with external communication capabilities; the access control device includes: The permission and threshold setting unit is used to pre-set corresponding permission sets for different communication methods. The permission set includes a permission subset with a corresponding permission level. The permission level of the permission subset is negatively correlated with the operation request rate level. The higher the operation request rate level, the lower the permission level. The permission allocation unit is used to detect the communication method and operation request rate used in the transmission of received operation requests. When the circuit breaker receives an operation request, it first detects the communication method used in the transmission of the operation request in the current cycle, and responds to the operation request with the permission subset determined in the previous cycle. If this communication is the initial communication, it responds to the operation request with the permission subset with the highest level in the current communication method permission set. At the same time, it calculates the operation request rate based on the transmitted operation request in the current cycle, and responds to the operation request received in the next cycle with the permission subset corresponding to the operation request rate level.
[0008] Preferably, the step of setting corresponding permission sets for different communication methods includes: the permission set corresponding to fieldbus-type communication methods includes permission subsets of high, medium, and low permission levels; the permission set corresponding to local area network-type communication methods includes permission subsets of medium and low permission levels; and the permission set corresponding to wide area network-type communication methods includes permission subsets of low permission levels. Preferably, the permission levels include high-level permission, medium-level permission, low-level permission, and no permission. The high-level permission subset includes all operation requests such as system upgrades, password resets, parameter modifications, remote operations, and data queries for the circuit breaker. The medium-level permission subset includes operation requests such as parameter modifications, remote operations, and data queries for the circuit breaker. The low-level permission subset includes operation requests such as data queries for the circuit breaker. The no-permission subset is empty.
[0009] Compared with the prior art, the technical solution of the present invention has the following beneficial effects: This invention sets corresponding permission sets for different communication methods. For example, for MODBUS communication, it sets a permission set including high, medium, low, and prohibited permission subsets; for HPCL communication, it sets a permission set including medium, low, and prohibited permission subsets; and for WIFI communication, it sets a permission set including low and prohibited permission subsets. Furthermore, it determines the permission subset based on the operation request rate; the higher the operation request rate, the lower the permission level of the corresponding permission subset. This effectively prevents risks from malicious operations or network attacks, improving the safety and reliability of the power grid. The permission sets and permission subsets of this invention can be customized by the user according to actual conditions or needs, thus maintaining flexibility while ensuring security. Attached Figure Description
[0010] Figure 1 This is a specific structural example diagram of the circuit breaker access control device of the present invention.
[0011] Figure 2 This is a flowchart of the access control method. Detailed Implementation
[0012] To address the access control problem when smart circuit breakers have multiple communication methods, the present invention proposes to set different access control sets for different communication methods and allocate different access control permissions based on the operation request rate. The higher the operation request rate, the fewer access control permissions are allocated or even no response is given. This can effectively prevent the risks caused by malicious operation or network attack and improve the safety and reliability of the power grid.
[0013] The present invention specifically adopts the following technical solutions to solve the above-mentioned technical problems: A circuit breaker access control method is disclosed, wherein the circuit breaker is an intelligent circuit breaker with external communication capabilities. Corresponding access control sets are pre-defined for different communication methods. Each access control set contains a subset of access control levels corresponding to different access control levels. The access control level of each subset is negatively correlated with the operation request rate level; the higher the operation request rate level, the lower the access control level. When the circuit breaker receives an operation request, it first detects the communication method used for the operation request transmission within the current cycle and responds to the operation request using the access control subset determined in the previous cycle. If the current communication is the initial communication, the operation request is responded to using the highest-level access control subset in the current communication method's access control set. Simultaneously, within the current cycle, the operation request rate is calculated based on the transmitted operation request, and the operation request received in the next cycle is responded to using the access control subset corresponding to the operation request rate level.
[0014] Preferably, the step of setting corresponding permission sets for different communication methods includes: the permission set corresponding to fieldbus-type communication methods includes permission subsets of high, medium, and low permission levels; the permission set corresponding to local area network-type communication methods includes permission subsets of medium and low permission levels; and the permission set corresponding to wide area network-type communication methods includes permission subsets of low permission levels. Preferably, the permission levels include high-level permission, medium-level permission, low-level permission, and no permission. The high-level permission subset includes all operation requests such as system upgrades, password resets, parameter modifications, remote operations, and data queries for the circuit breaker. The medium-level permission subset includes operation requests such as parameter modifications, remote operations, and data queries for the circuit breaker. The low-level permission subset includes operation requests such as data queries for the circuit breaker. The no-permission subset is empty.
[0015] Based on the same inventive concept, the following technical solutions can also be obtained: A circuit breaker access control device, wherein the circuit breaker is an intelligent circuit breaker with external communication capabilities; the access control device includes: The permission and threshold setting unit is used to pre-set corresponding permission sets for different communication methods. The permission set includes a permission subset with a corresponding permission level. The permission level of the permission subset is negatively correlated with the operation request rate level. The higher the operation request rate level, the lower the permission level. The permission allocation unit is used to detect the communication method and operation request rate used in the transmission of received operation requests. When the circuit breaker receives an operation request, it first detects the communication method used in the transmission of the operation request in the current cycle, and responds to the operation request with the permission subset determined in the previous cycle. If this communication is the initial communication, it responds to the operation request with the permission subset with the highest level in the current communication method permission set. At the same time, it calculates the operation request rate based on the transmitted operation request in the current cycle, and responds to the operation request received in the next cycle with the permission subset corresponding to the operation request rate level.
[0016] Preferably, the step of setting corresponding permission sets for different communication methods includes: the permission set corresponding to fieldbus-type communication methods includes permission subsets of high, medium, and low permission levels; the permission set corresponding to local area network-type communication methods includes permission subsets of medium and low permission levels; and the permission set corresponding to wide area network-type communication methods includes permission subsets of low permission levels. Preferably, the permission levels include high-level permission, medium-level permission, low-level permission, and no permission. The high-level permission subset includes all operation requests such as system upgrades, password resets, parameter modifications, remote operations, and data queries for the circuit breaker. The medium-level permission subset includes operation requests such as parameter modifications, remote operations, and data queries for the circuit breaker. The low-level permission subset includes operation requests such as data queries for the circuit breaker. The no-permission subset is empty.
[0017] To facilitate public understanding, the technical solution of the present invention will be described in detail below through a specific example and in conjunction with the accompanying drawings: like Figure 1As shown, the circuit breaker of this invention is an intelligent circuit breaker with a series of different communication methods. For ease of explanation, the figure lists several commonly used communication methods for circuit breakers, including fieldbus types: Modbus, Profibus, CAN, DeviceNet; local area network types: IEC61850, HPLC; and wide area network public networks: WiFi, Ethernet, etc. The circuit breaker includes an interface unit, a measurement and protection unit, an access control and threshold setting unit, and an access control allocation unit. The interface unit is the communication interface between the circuit breaker and the outside world, implementing the above-mentioned multiple communication methods through corresponding communication protocols. The measurement and protection unit is the core of the circuit breaker, used to measure parameters such as current and voltage, and to execute a series of protection actions such as short-delay protection, long-delay protection, and overcurrent protection based on the measurement data. The access control and threshold setting unit is used to pre-set corresponding access control sets for different communication methods. The access control set contains a subset of access control levels corresponding to the access control levels. The access control level of the subset of access control is negatively correlated with the operation request rate. The higher the rate setting, the lower the permission level. The permission allocation unit is used to detect the communication method and operation request rate used in the transmission of the received operation request. When the circuit breaker receives an operation request, it first detects the communication method used in the transmission of the operation request in the current cycle, and responds to the operation request with the permission subset determined in the previous cycle. If this communication is the initial communication, it responds to the operation request with the permission subset with the highest level in the current communication method permission set. At the same time, it calculates the operation request rate based on the transmitted operation request in the current cycle, and responds to the operation request received in the next cycle with the permission subset corresponding to the operation request rate setting.
[0018] The access control process of this device is as follows: Step 1: Based on the communication message containing the operation request received by the interface unit, determine the communication method used for transmitting the operation request and detect the operation request rate within the period.
[0019] Step 2: The permission allocation unit reads the permission subset corresponding to the current operation request rate from the permission set corresponding to the current communication method set in the permission and threshold setting unit; The permission set contains a subset of permissions corresponding to the permission level. The permission level of the permission subset is negatively correlated with the operation request rate level. The higher the operation request rate level, the lower the permission level. The operation request rate can be divided into several levels by a pre-set operation request rate threshold. Each level corresponds to a different permission level. That is, different operation request rate levels correspond to different permission subsets of the permission set. The higher the operation request rate level, the lower the permission level. Table 1 below shows the permission set set for a certain communication method and the permission subsets corresponding to different operation request rates. The permission set for this communication method includes the following operation requests: parameter query, fault query, test trip, parameter setting, opening and closing operation, firmware upgrade, and password reset. In fieldbus-type communication methods: the operation request rate is divided into four levels by three operation request rate thresholds (normal threshold, low-risk threshold, and high-risk threshold). The level is as follows: below the normal threshold is the normal level; above the normal threshold but below the low-risk threshold is the low-risk level; above the low-risk threshold but below the high-risk threshold is the high-risk level; and above the high-risk threshold is the prohibited level. These levels are assigned the corresponding high, medium, low, and none permission levels as shown in Table 1. The high-level permission subset is equivalent to the permission set, containing all operation permissions for this communication method. The medium-level permission subset includes the operation requests for parameter query, fault query, test trip, and parameter setting. The low-level permission subset only includes the data query operations for parameter query and fault query. In local area network communication: the operation request rate is divided into three levels by two operation request rate thresholds (normal threshold and risk threshold). The level is normal if it is less than the normal threshold, risky if it is greater than the normal threshold but less than the risk threshold, and prohibited if it is greater than the risk threshold. The level is given medium, low and no permission respectively. In the communication mode of a wide area network (WAN) public network: the operation request rate is divided into two levels by an operation request rate threshold (normal threshold). The level is below the normal threshold and the level is above the normal threshold. The two levels are respectively given low and no permission levels. Table 1
[0020] Step 3: The permission allocation unit responds to the operation request of the next cycle according to the corresponding permission subset.
[0021] This invention supports the configuration of permission subsets corresponding to different operation request rates for different communication methods, thus meeting users' permission management needs for different application scenarios based on their actual requirements. For example, users can choose to assign higher permission levels to fieldbus-type communication methods, such as Modbus and Profibus, to meet on-site control needs; while for higher-risk remote network communication monitoring methods such as Ethernet and WiFi, users can also assign appropriate permission levels based on their assessment. In other words, it assigns a high-permission subset to low-risk communication methods according to user needs, and a relatively low-permission subset to relatively high-risk communication methods. To further illustrate this, several specific embodiments are given below: Example 1 This embodiment uses Modbus communication and firmware upgrade functionality as examples, and divides the time interval into T0, T1, T2...Tn with a 1-second detection period: Step 1: During the T0 detection cycle, the intelligent processing unit receives the firmware upgrade handshake request communication message sent by the user and determines that the current communication mode is Modbus fieldbus. Step 2: Read the permission set pre-configured by the user for Modbus communication. In this embodiment, a subset of permissions including high, medium, low, and no permission levels is selected. Step 3: Read the operation request rate thresholds that the user has pre-configured for Modbus communication. In this embodiment, the normal threshold (10 frames / s), low-risk threshold (20 frames / s), and high-risk threshold (50 frames / s) are selected. Step 4: During the T0 detection period, since it is the initial communication and the operation request rate has not been statistically determined, the firmware upgrade handshake request is responded to using the highest permission level subset contained in the permission set of this communication method, and the firmware upgrade request is approved. Step 5: During the T0 detection cycle, the intelligent processing unit counts the number of firmware upgrade request frames received within a 1-second cycle. If the count result shows that the operation request rate is less than the normal threshold (10 frames / s), a subset of high-level permissions is granted to the operation requests during the T1 detection cycle. Step Six: During the T1 detection cycle, the intelligent processing unit responds to the firmware upgrade data request using a subset of permissions with a high permission level; Step 7: During the T1 detection cycle, the intelligent processing unit counts the number of firmware upgrade request frames received within a 1-second cycle. The result shows that the operation request rate is greater than the normal threshold (10 frames / s) and less than the low-risk threshold (20 frames / s). The operation requests during the T2 detection cycle are then granted a subset of permissions with medium permission level. Step 8: During the T2 detection cycle, due to the medium access level of communication, the intelligent processing unit does not support the firmware upgrade function, refuses to respond to the firmware upgrade request, the firmware upgrade process times out, and the firmware upgrade fails. Step 9: During the T2 detection cycle, the intelligent processing unit counts the number of firmware upgrade request frames received within a 1-second cycle. If the count result shows that the operation request rate is less than the normal threshold (10 frames / s), a subset of high-level permissions is granted to the communication requests during the T3 detection cycle. Step 10: During the T3 detection cycle, the intelligent processing unit re-receives the firmware upgrade handshake request sent by the user. Since the communication permission is at a high permission level, the intelligent processing unit supports the firmware upgrade function, responds to the firmware upgrade handshake request, and agrees to the firmware upgrade request. Step 11: During the T3 detection cycle, the intelligent processing unit counts the number of firmware upgrade request frames received within a 1-second cycle. The result shows that the operation request rate is less than the normal threshold (10 frames / s). The communication requests during the T4 detection cycle are granted a subset of permissions with a high permission level. Step 12: During the T4 detection cycle, the intelligent processing unit responds to firmware upgrade data requests using a high-privilege level; Step 13: During the T4 detection cycle, the intelligent processing unit counts the number of firmware upgrade request frames received within 1 second. The result shows that the operation request rate is less than the normal threshold (10 frames / s). A subset of operation requests in the T5 detection cycle is granted a higher permission level. Step Fourteen: Repeat Step Twelve and Step Thirteen for the T5, T6, ..., Tn detection cycles until the firmware upgrade is complete.
[0022] Example 2: This embodiment uses WIFI communication and parameter setting operation requests as examples, and divides the time into T0, T1, T2...Tn with a detection period of 1 second: Step 1: During the T0 detection cycle, the intelligent processing unit receives the parameter setting request communication message sent by the user and determines that the current communication mode is WIFI; Step 2: Read the set of permissions that the user has pre-configured for the WIFI communication method. In this embodiment, a subset of permissions containing low and no permission levels is selected. Step 3: Read the operation request rate threshold that the user has pre-configured for the WIFI communication method. In this embodiment, the normal threshold (100 frames / s) is selected. Step 4: During the T0 detection period, since it is the initial communication and the operation request rate has not been statistically determined, the highest permission level (low permission level) request contained in the permission set of this communication method is used to respond, and the parameter setting request is rejected (the parameter setting requirement is at least the medium permission level).
[0023] Example 3 This embodiment uses the IEC61850 communication method as an example, and takes the continuous transmission of multiple operation request signals within one cycle as an example, with a detection cycle of 1 second, and the time is divided into T0, T1, T2...Tn: Step 1: During the T0 detection cycle, the intelligent processing unit receives the operation request signal sent by the user and determines that the current communication mode is IEC61850; Step 2: Read the permission set pre-configured by the user for the IEC61850 communication method. In this embodiment, a subset of permissions containing medium, low, and no permission levels is selected. Step 3: Read the operation request rate threshold that the user has pre-configured for the IEC61850 communication method. In this embodiment, the normal threshold (30 frames / s) and the risk threshold (50 frames / s) are selected. Step 4: During the T0 detection cycle, signals such as parameter query, fault query, test trip, parameter setting, opening / closing operation, firmware upgrade, and password reset are received. Since this is the initial communication period and the operation request rate is not yet statistically determined, the highest permission level (medium permission level) in the permission set of this communication method is used to respond to operation requests. Parameter query, fault query, test trip, parameter setting, and opening / closing operations are responded to, while firmware upgrade and password reset requests are rejected (these two requests require a high permission level). Step 5: During the T0 detection period, the intelligent processing unit counts the number of operation request frames received within a 1-second period. If the operation request rate is less than the normal threshold (30 frames / s), a subset of medium-level permissions is assigned to the operation requests during the T1 detection period. During the T1 detection period, the intelligent processing unit responds to the operation requests using this subset of medium-level permissions. If the operation request rate is greater than the normal threshold (30 frames / s) but less than the risk threshold (50 frames / s), a subset of low-level permissions is assigned to the operation requests during the T1 detection period. During the T1 detection period, the intelligent processing unit responds to the operation requests using this subset of low-level permissions. If the operation request rate is greater than the risk threshold (50 frames / s), a subset of no-level permissions is assigned to the operation requests during the T1 detection period. During the T1 detection period, the intelligent processing unit refuses to respond to any operation requests.
Claims
1. A circuit breaker access control method, wherein the circuit breaker is an intelligent circuit breaker with external communication function; characterized in that, A corresponding permission set is pre-defined for different communication methods. The permission set contains a subset of permissions with corresponding permission levels. The permission level of the permission subset is negatively correlated with the operation request rate level; the higher the operation request rate level, the lower the permission level. When the circuit breaker receives an operation request, it first detects the communication method used for the operation request transmission in the current cycle and responds to the operation request with the permission subset determined in the previous cycle. If this communication is the initial communication, the operation request is responded to with the highest-level permission subset in the current communication method's permission set. Simultaneously, the operation request rate is calculated based on the transmitted operation request in the current cycle, and the operation request received in the next cycle is responded to with the permission subset corresponding to the operation request rate level.
2. The circuit breaker access control method as described in claim 1, characterized in that, The provision of corresponding permission sets for different communication methods includes: The permission set corresponding to fieldbus-type communication methods includes subsets of permissions at high, medium, and low permission levels; The permission set corresponding to local area network (LAN) communication methods includes a subset of permissions at medium and low permission levels; The permission set corresponding to the communication method of the wide area public network class includes a subset of permissions with low permission levels.
3. The circuit breaker access control method as described in claim 1 or 2, characterized in that, The permission levels include high-level permission, medium-level permission, low-level permission, and no permission. The high-level permission subset includes all operation requests such as system upgrade, password reset, parameter modification, remote operation, and data query for the circuit breaker. The medium-level permission subset includes operation requests such as parameter modification, remote operation, and data query for the circuit breaker. The subset of permissions with low-level privileges includes operation requests such as data querying of circuit breakers; The subset of permissions that are not granted is empty.
4. A circuit breaker access control device, wherein the circuit breaker is an intelligent circuit breaker with external communication function; characterized in that, The access control device includes: The permission and threshold setting unit is used to pre-set corresponding permission sets for different communication methods. The permission set includes a permission subset with a corresponding permission level. The permission level of the permission subset is negatively correlated with the operation request rate level. The higher the operation request rate level, the lower the permission level. The permission allocation unit is used to detect the communication method and operation request rate used in the transmission of received operation requests. When the circuit breaker receives an operation request, it first detects the communication method used in the transmission of the operation request in the current cycle, and responds to the operation request with the permission subset determined in the previous cycle. If this communication is the initial communication, it responds to the operation request with the permission subset with the highest level in the current communication method permission set. At the same time, it calculates the operation request rate based on the transmitted operation request in the current cycle, and responds to the operation request received in the next cycle with the permission subset corresponding to the operation request rate level.
5. The circuit breaker access control device as described in claim 4, characterized in that, The provision of corresponding permission sets for different communication methods includes: The permission set corresponding to fieldbus-type communication methods includes subsets of permissions at high, medium, and low permission levels; The permission set corresponding to local area network (LAN) communication methods includes a subset of permissions at medium and low permission levels; The permission set corresponding to the communication method of the wide area public network class includes a subset of permissions with low permission levels.
6. The circuit breaker access control device as described in claim 4, characterized in that, The permission levels include high-level permission, medium-level permission, low-level permission, and no permission. The high-level permission subset includes all operation requests such as system upgrade, password reset, parameter modification, remote operation, and data query for the circuit breaker. The medium-level permission subset includes operation requests such as parameter modification, remote operation, and data query for the circuit breaker. The subset of permissions with low-level privileges includes operation requests such as data querying of circuit breakers; The subset of permissions that are not granted is empty.