Link transparent encryption communication method and device for electric power SCADA (supervisory control and data acquisition) system

Abstract

The invention provides a link transparent encryption communication method and device for an electric power SCADA (supervisory control and data acquisition) system, and the method comprises the steps: building a private protocol transmission link between encryption devices at two ends of the link, and enabling the encryption devices at two ends to respectively build TCP (transmission control protocol) connection with a data transmitting end and a data receiving end, so as to build a TCP proxy segmentation link; the encryption device intercepts and caches a data packet from the sending end, returns a forgery confirmation signal for the message to the sending end, and induces the sending end to maintain a window size in a low-delay state; and after the encryption device encrypts the cached data packet, the encrypted data packet is forwarded to the opposite-end encryption device through the private protocol transmission link, and the decrypted data packet is forwarded to the receiving end. Therefore, the transmission performance of the TCP on a wide area network is actively optimized, and the end-to-end delay of an SCADA control instruction is reduced.

Description

Technical Field

[0001] This invention relates to the field of network security communication technology, and in particular to an adaptive link encrypted communication method and apparatus suitable for power data acquisition and monitoring (SCADA) systems, which utilizes protocol deception to ensure transmission reliability. Background Technology

[0002] The Supervisory Control and Data Acquisition (SCADA) system is the core platform for real-time monitoring and dispatch decision-making in modern power networks. It is responsible for collecting data on the operational status of power generation, transmission, and distribution, and issuing various control commands. It is the central nervous system that ensures the safe, stable, and economical operation of the power grid.

[0003] With the development of smart grids and the evolution of ubiquitous power Internet of Things (IoT) technology, traditional security protection systems based on physical isolation are gradually being broken through. Extensive data exchange is now required between power production control networks and information management networks. This necessitates the transmission of a large amount of sensitive production control data via wide area networks (WANs), exposing it to severe risks of eavesdropping, tampering, replay attacks, and other cyberattacks.

[0004] To establish secure communication channels, the industry typically uses Virtual Private Network (VPN) technology to encrypt and protect the links. However, traditional general-purpose VPN solutions (such as IPSec and SSL VPN) have the following architectural shortcomings when applied to power SCADA scenarios with extremely stringent real-time and reliability requirements:

[0005] Uncontrollable latency and jitter: Power system relay protection, safety and stability control, and other services have deterministic requirements for communication latency at the millisecond or even sub-millisecond level. Traditional VPNs rely on general operating system kernel protocol stacks, whose complex protocol processing flow, intensive encryption and decryption operations, and kernel context switching introduce significant and random latency and jitter, which may cause protection devices to malfunction or fail to operate, leading to major security incidents.

[0006] There is an inherent conflict between the Transmission Control Protocol (TCP) and real-time business requirements: Power SCADA systems widely use TCP-based application layer protocols (such as IEC-104). The slow start and congestion avoidance mechanisms built into the TCP protocol, as well as the "head-of-line blocking" problem caused by packet loss and retransmission, have a dramatically amplified effect in long-distance, high-latency wide area network environments. This means that urgent critical control commands such as "trip" and "open" are easily blocked by the massive amounts of ordinary telemetry and teleindication data packets waiting to be retransmitted, severely compromising the real-time performance of control commands.

[0007] Therefore, there is an urgent need in this field for a link encryption communication solution specifically designed for power SCADA scenarios, which can provide sufficient security strength while also having the ability to accelerate the protocol and reduce latency. Summary of the Invention

[0008] Therefore, the main objective of this invention is to provide a transparent encrypted communication method and apparatus for power SCADA systems, in order to solve the problems mentioned in the background art.

[0009] To achieve the above objectives, according to one aspect of the present invention, a link-transparent encrypted communication method for power SCADA systems is provided, applied to an encryption device connected in series in a communication link, the steps of which include:

[0010] A private protocol transmission link is established between the encryption devices at both ends of the link. TCP connections are established between the encryption devices at both ends and the data sending and receiving ends, respectively, to construct a TCP proxy segmentation link.

[0011] The encryption device intercepts and buffers data packets from the sender and returns a forged acknowledgment signal for the message to the sender, inducing the sender to maintain a window size in a low-latency state;

[0012] After the encryption device encrypts the cached data packets, it forwards them to the other end's encryption device via a private protocol transmission link. After decryption, the data packets are forwarded to the receiving end.

[0013] In a possible preferred embodiment, the private protocol transmission link includes a SACK selective retransmission mechanism to handle packet loss.

[0014] In a possible preferred embodiment, the private protocol transmission link is established based on the UDP encapsulation format.

[0015] In a possible preferred embodiment, the method further includes the following steps:

[0016] Monitor the real-time load status of the communication link. When it is determined that the load exceeds the preset first bandwidth utilization threshold, switch to selective encryption mode, and instruct the encryption device to perform instruction recognition processing on the data packet. Selectively encrypt and transmit preset instruction data, while transmitting the remaining instruction data in plaintext.

[0017] In a possible preferred embodiment, the method further includes the following steps:

[0018] Monitor the real-time load status of the communication link. When it is determined that the load exceeds the preset second bandwidth utilization threshold, switch to full traffic plaintext pass-through mode, and cause the encryption device to stop encrypting data packets and only perform line-speed forwarding.

[0019] In a possible preferred embodiment, the method further includes the following steps:

[0020] When the encryption device receives an authenticated emergency pass-through command or detects any of the following system-level faults, it controls the encryption device to close the normally closed physical relay and switch to the physical layer direct connection mode of the network interface.

[0021] To achieve the above objectives and corresponding to the above methods, according to another aspect of the present invention, a link-transparent encrypted communication device for power SCADA systems is provided, the device comprising:

[0022] A storage unit containing a program that implements any of the methods described above, for the control unit and processing unit to retrieve and execute as needed;

[0023] A network interface unit is used to be transparently connected to a communication link;

[0024] The processing unit is used to perform traffic monitoring, protocol processing, data encryption / decryption, and packet depth detection.

[0025] The control unit is configured to monitor the real-time load status of the communication link and adaptively switch the transmission mode.

[0026] The hardware bypass unit includes a physical relay controlled by the control unit for enabling physical layer link pass-through.

[0027] In a possible preferred embodiment, the device is not configured with a service IP address and MAC address, operates at the link layer, and remains transparent to the network layer and link layer protocol headers of the data packets passing through it.

[0028] In a possible preferred embodiment, the physical relay in the hardware bypass unit is a normally closed relay that closes when the device loses power or when the control unit issues a bypass command.

[0029] In a possible preferred embodiment, the processing unit includes a protocol proxy module configured to: terminate a TCP connection from one end, communicate with the peer device via a private protocol, and forge a TCP acknowledgment message to the original sender.

[0030] The transparent encrypted communication method and device for power SCADA systems provided by this invention cleverly optimizes the transmission performance of TCP on wide area networks through "protocol spoofing acceleration" technology, significantly reduces the end-to-end latency of SCADA control commands, and breaks the traditional dilemma that "encryption inevitably leads to high latency".

[0031] Furthermore, in the corresponding implementation, this solution employs a unique multi-level fail-safe state machine—"software bypass (adaptive encryption / full transparency) → hardware bypass (physical pass-through)"—to progressively mitigate single-point-of-failure risks. In particular, the hardware pass-through design based on normally closed relays ensures that the communication link remains uninterrupted even in the extreme case of a complete power outage, meeting the stringent availability requirements of power systems and enhancing the overall system's stealth and anti-attack capabilities. Attached Figure Description

[0032] The accompanying drawings, which form part of this application, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an undue limitation of the invention. In the drawings:

[0033] Figure 1 This is a schematic diagram of the communication link structure of the transparent encrypted communication method for power SCADA systems according to the present invention.

[0034] Figure 2 This is a schematic diagram illustrating the steps of the transparent encrypted communication method for power SCADA systems according to the present invention.

[0035] Figure 3 This is a schematic diagram of the state machine for adaptive switching of device operating modes in the link transparent encrypted communication method for power SCADA systems of the present invention.

[0036] Figure 4 This is a schematic diagram of the link transparent encrypted communication device for power SCADA systems according to the present invention. Detailed Implementation

[0037] To enable those skilled in the art to better understand the technical solutions of the present invention, the specific technical solutions of the present invention will be clearly and completely described below in conjunction with embodiments, so as to help those skilled in the art further understand the present invention. Obviously, the embodiments described in this application are merely some embodiments of the present invention, and not all embodiments. It should be noted that, for those skilled in the art, the embodiments and features in the embodiments of this application can be combined with each other without departing from the concept of the present invention and without conflict. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the disclosure and protection scope of the present invention.

[0038] Furthermore, the terms "first," "second," "S1," "S2," etc., used in the specification, claims, and drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such features can be interchanged where appropriate so that embodiments of the invention described herein can be implemented in orders other than those described herein. At the same time, the stages described in each step are not necessarily to be implemented in the same step; it should be understood that the implementation order of the contents of each step stage can be adjusted and interchanged without violating the inventive concept, so that embodiments of the invention described herein can be implemented in orders other than those described herein. Additionally, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion. Unless otherwise expressly specified and limited, the terms "set," "arrange," "install," "connect," and "link" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; a mechanical connection or an electrical connection; a direct connection or an indirect connection through an intermediate medium; or a connection within two elements. Those skilled in the art can understand the specific meaning of the above terms in this case based on the specific circumstances and in conjunction with existing technology.

[0039] To overcome the problems of large latency and easy blocking of critical instructions caused by existing general encryption technologies in power SCADA scenarios, such as... Figures 1 to 2 As shown, this invention provides a link-transparent encrypted communication method for power SCADA systems, applicable to encryption devices connected in series in a communication link. The example steps include:

[0040] Step S1 establishes a private protocol transmission link between the encryption devices at both ends of the link, and establishes TCP connections between the encryption devices at both ends and the data sending end and receiving end respectively, so as to construct a TCP proxy segmentation link;

[0041] In step S2, the encryption device intercepts and buffers data packets from the sender, and returns a forged acknowledgment signal for the packet to the sender, inducing the sender to maintain the window size in a low-latency state.

[0042] After the encryption device encrypts the cached data packet in step S3, it forwards it to the other end encryption device through a private protocol transmission link, and then forwards it to the receiving end after decryption.

[0043] For example, such as Figure 1 As shown in the figure, this embodiment demonstrates the workflow of this encrypted communication when the substation side (sender) sends a TCP-based IEC-104 protocol message to the dispatch center side (receiver).

[0044] To significantly reduce end-to-end latency of SCADA control commands and achieve relatively accelerated transmission, this example proposes a TCP proxy segmentation mechanism. Specifically, a local encryption device (encryption machine A) deployed at the substation outlet transparently intercepts the TCP SYN connection request initiated by the sender. Encryption machine A, representing the receiver, completes a TCP three-way handshake with the sender, establishing a local TCP connection (Conn1). Simultaneously, encryption machine A, through an out-of-band or initial negotiation channel, notifies the peer encryption device (encryption machine B) deployed at the dispatch center entrance, which then initiates a TCP connection to the actual receiver, establishing connection Conn2. Thus, the original end-to-end TCP connection is transparently segmented into two parts.

[0045] To induce the sender to maintain a low-latency window size, this example proposes an ACK forgery and high-speed transmission scheme. The sender sends packet A via Conn1. Upon receiving this packet, encryption device A immediately stores it in a buffer queue and then forges an ACK acknowledgment message (ACK A') for packet A and returns it to the sender. Since this process occurs within a local area network, the latency is extremely low (typically <1ms). Upon receiving this fast ACK, the sender's TCP stack mistakenly believes that the network conditions are excellent and the data has been quickly acknowledged by the peer. Therefore, it maintains or even increases its congestion window, thus continuously and rapidly sending subsequent packets such as Packet B and Packet C.

[0046] Next, encryption machine A is responsible for encrypting the payload of the buffered data packets (Packet A, B, C...) and adding a header containing private sequence numbers, integrity check codes, etc., encapsulating them into private protocol data units. These units are transmitted through a pre-established efficient private tunnel (e.g., based on UDP encapsulation) between encryption machines A and B. When encryption machine B receives the private protocol data units, it decrypts, verifies, and sorts them to restore the original application layer data (e.g., IEC-104 APDU). Then, encryption machine B forwards the data in order to the actual receiving end via Conn2. The process is the same if reverse data transmission is required.

[0047] The above example scheme, employing ACK spoofing and TCP connection segmentation techniques, effectively solves the head-of-line blocking and window limitation problems of TCP in wide area network environments, significantly reducing the transmission latency of SCADA control commands. Furthermore, optimized tunneling between encrypted devices can further improve transmission efficiency.

[0048] In an optional implementation, the private protocol transmission link can also be configured with reliable transmission mechanisms such as Selective Repeat (SACK) for TCP. If packet loss occurs in the tunnel, encryption machines A and B can be responsible for rapid retransmission, while the sending and receiving ends are completely unaware of this. Their TCP connection status is not affected by the quality of the wide area network and will not trigger the TCP speed-down mechanism, thereby ensuring the stability of the entire link.

[0049] Furthermore, to provide a more reliable communication guarantee mechanism, in an optional implementation, the method steps also include:

[0050] Step S4 monitors the real-time load status of the communication link. When it is determined that the load exceeds the preset first bandwidth occupancy threshold, the selective encryption mode is switched, and the encryption device performs instruction recognition processing on the data packet. The preset instruction data is selectively encrypted and transmitted, while the remaining instruction data is transmitted in plaintext.

[0051] For example, such as Figure 3 As shown, the network security centralized management and control system continuously monitors and samples (e.g., at 1-second intervals) to calculate the network port bandwidth utilization (load rate). When the load rate is lower than a preset threshold (e.g., 90%), it is in the default working state, and the device uses the normal mode (full traffic encryption acceleration) to perform connection segmentation, ACK spoofing, and end-to-end encryption on all TCP traffic as described in the above embodiment.

[0052] When the load rate is detected to consistently exceed a first threshold (e.g., 90%), the device switches modes. The device activates the Deep Packet Inspection (DPI) engine. For identified IEC-104 messages, the "Type ID" (TI) field is parsed: if the TI value belongs to a critical control command set (e.g., TI=45, 46, 47...), encryption and acceleration processing are still performed according to the normal mode procedure. If the TI value belongs to a normal data set (e.g., TI=1, 3, 9...), the device skips encryption and complex protocol proxy processing, directly modifies the MAC address, and forwards the message in plaintext. In congestion situations, this mode can sacrifice the security of some non-critical data in exchange for absolute uninterrupted operation and low latency of critical control channels.

[0053] Furthermore, in an optional implementation, if the load rate rises sharply to a second threshold (e.g., 99%) or CPU utilization becomes excessively high, the device switches to a full-traffic plaintext pass-through mode. In this mode, the encryption / decryption module and protocol acceleration module are disabled, and data flows through a simplified forwarding path for line-rate processing, with all traffic passed through in plaintext. This mode aims to prevent the device from crashing due to overload and ensure minimal link connectivity.

[0054] Furthermore, the reliability of power systems may be at risk from single points of failure. Traditional encryption devices, as active processing nodes in the network, are prone to becoming performance bottlenecks or even completely failing when network traffic surges, equipment resources are overloaded, or software failures occur, causing communication link interruptions. This is unacceptable for power grid systems that require "99.999%" reliability.

[0055] Therefore, in order to provide a more reliable communication guarantee mechanism, in an optional implementation, the method steps also include:

[0056] Step S5: When the encryption device receives an authenticated emergency pass-through command or detects any of the following system-level faults, it controls the encryption device to close the normally closed physical relay and switch to the physical layer direct connection mode of the network interface.

[0057] Specifically, this mode is a hardware pass-through mode (emergency / failure) as a last resort mechanism, and its triggering conditions include:

[0058] - Received a strongly authenticated "emergency pass-through" digital command from the secure centralized management system;

[0059] - The device's internal hardware watchdog timer has timed out (indicating a possible software deadlock).

[0060] - Device power failure or restart, etc.

[0061] When any of the above conditions are met, mode activation sends a signal to the hardware bypass unit of the encryption device. This unit contains a normally closed physical relay whose coil is energized during normal device operation, causing the relay to open and allowing current to flow through the mainboard circuitry. When a shoot-through is triggered, the coil is de-energized, and the relay automatically closes under spring action, physically shorting the receive line (RX) of the network input port (WAN) and the transmit line (TX) of the output port (LAN), and vice versa. This achieves a purely physical layer wire direct connection, ensuring that the communication link remains physically connected even if the device is completely powered off or the mainboard is damaged. This completely eliminates the risk of the encryption device being a single point of failure, meeting the extreme reliability requirements of power systems.

[0062] On the other hand, corresponding to the above method examples, such as Figure 4 As shown, the present invention also proposes a link-transparent encrypted communication device for power SCADA systems, examples of which include:

[0063] A storage unit containing a program that implements the method described in any of the above examples, for the control unit and processing unit to retrieve and execute as needed;

[0064] A network interface unit is used to be transparently connected to a communication link;

[0065] The processing unit is used to perform traffic monitoring, protocol processing, data encryption / decryption, and packet depth detection.

[0066] The control unit is configured to monitor the real-time load status of the communication link and adaptively switch the transmission mode.

[0067] The hardware bypass unit includes a physical relay controlled by the control unit for enabling physical layer link pass-through.

[0068] The device described herein does not have a configured service IP address or MAC address, operates at the link layer, and remains transparent to the network layer and link layer protocol headers of passing data packets. The physical relays in the hardware bypass unit are normally closed relays, closing when the device loses power or when the control unit issues a pass-through command. The processing unit includes a protocol proxy module, which is configured to: terminate the TCP connection from one end, communicate with the peer device via a private protocol, and forge a TCP acknowledgment message to the original sender.

[0069] In summary, the transparent encrypted communication method and device for power SCADA systems provided by this invention cleverly optimizes TCP transmission performance over wide area networks through "protocol spoofing acceleration" technology, significantly reducing end-to-end latency of SCADA control commands and breaking the traditional dilemma that "encryption inevitably leads to high latency." Furthermore, this solution's unique multi-level fault-safe state machine, employing "software bypass (adaptive encryption / full transparent transmission) → hardware bypass (physical pass-through)," progressively mitigates single-point failure risks. In particular, the hardware pass-through design based on normally closed relays ensures that the communication link remains uninterrupted even in extreme situations where the device is completely powered off, meeting the stringent availability requirements of power systems and enhancing the overall system's concealment and anti-attack capabilities.

[0070] The preferred embodiments of the present invention disclosed above are merely illustrative of the invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the invention to the specific implementations described. Clearly, many modifications and variations can be made based on the content of this specification. This specification selects and specifically describes these embodiments to better explain the principles and practical applications of the invention, thereby enabling those skilled in the art to better understand and utilize the invention. The present invention is limited only by the claims and their full scope and equivalents. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the invention should be included within the protection scope of the invention.

[0071] Those skilled in the art will understand that, besides implementing the system, apparatus, unit, and its modules provided by this invention in purely computer-readable program code, the same program can be implemented in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, the system, apparatus, and its modules provided by this invention can be considered a hardware component, and the modules included therein for implementing various programs can also be considered structures within the hardware component; alternatively, modules for implementing various functions can be considered both software programs implementing the method and structures within the hardware component.

[0072] Furthermore, all or part of the steps in the methods of the above embodiments can be implemented by a program instructing related hardware. This program is stored in a storage medium and includes several instructions to cause a microcontroller, chip, or processor to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, a portable hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0073] Furthermore, various different implementations of the present invention can be combined arbitrarily, as long as they do not violate the spirit of the present invention, they should also be regarded as the content disclosed in the present invention.

Claims

1. A link-transparent encrypted communication method for power SCADA systems, applied to an encryption device connected in series in a communication link, comprising the following steps: A private protocol transmission link is established between the encryption devices at both ends of the link. TCP connections are established between the encryption devices at both ends and the data sending and receiving ends, respectively, to construct a TCP proxy segmentation link. The encryption device intercepts and buffers data packets from the sender and returns a forged acknowledgment signal for the message to the sender, inducing the sender to maintain a window size in a low-latency state; After the encryption device encrypts the cached data packets, it forwards them to the peer encryption device through a private protocol transmission link, and then forwards them to the receiving end after decryption.

2. The method according to claim 1, wherein the private protocol transmission link includes a SACK selective retransmission mechanism to handle packet loss.

3. The method according to claim 1, wherein the private protocol transmission link is established based on the UDP encapsulation format.

4. The method according to claim 1, wherein the step further comprises: Monitor the real-time load status of the communication link. When it is determined that the load exceeds the preset first bandwidth utilization threshold, switch to selective encryption mode, and instruct the encryption device to perform instruction recognition processing on the data packet. Selectively encrypt and transmit preset instruction data, while transmitting the remaining instruction data in plaintext.

5. The method according to claim 1, wherein the step further comprises: Monitor the real-time load status of the communication link. When it is determined that the load exceeds the preset second bandwidth utilization threshold, switch to full traffic plaintext pass-through mode, and cause the encryption device to stop encrypting data packets and only perform line-speed forwarding.

6. The method of claim 1, wherein the step further comprises: When the encryption device receives an authenticated emergency pass-through command or detects any of the following system-level faults, it controls the encryption device to close the normally closed physical relay and switch to the physical layer direct connection mode of the network interface.

7. A link-transparent encrypted communication device for power SCADA systems, the device comprising: A storage unit containing a program that implements the method as described in any one of claims 1 to 6, for the control unit and processing unit to retrieve and execute as needed; A network interface unit is used to be transparently connected to a communication link; The processing unit is used to perform traffic monitoring, protocol processing, data encryption / decryption, and packet depth detection. The control unit is configured to monitor the real-time load status of the communication link and adaptively switch the transmission mode. The hardware bypass unit includes a physical relay controlled by the control unit for enabling physical layer link pass-through.

8. The apparatus according to claim 7, wherein the apparatus is not configured with a service IP address and a MAC address, operates at the link layer, and maintains transparency of the network layer and link layer protocol headers for the data packets passing through it.

9. The apparatus according to claim 7, wherein the physical relay in the hardware bypass unit is a normally closed relay that closes when the apparatus loses power or when the control unit issues a bypass command.

10. The apparatus of claim 7, wherein the processing unit includes a protocol proxy module configured to: terminate a TCP connection from one end, communicate with the peer device via a private protocol, and forge a TCP acknowledgment message to the original sender.

Images