Substation control layer network protection method and system

Abstract

The invention discloses a transformer substation station level network protection method and system. A VLAN up-and-down through scheme and a VLAN local deployment scheme are set in a communication architecture between a station level device and a spacer layer device; setting a VLAN (Virtual Local Area Network) division scheme according to a voltage level and a VLAN division scheme according to a publishing / subscribing device in a communication architecture between the spacer layer devices; according to the security index, the configuration index and the VLAN ID resource utilization rate index, optimizing and combining the VLAN division scheme to obtain an alternative network protection architecture; performing analog simulation on each alternative network protection framework, and executing conflict detection; and performing station level network protection by taking the alternative network protection architecture passing the conflict detection as an optimal network protection architecture. According to the method, the VLAN division mode is adopted to improve the network security of the substation control layer, the attack surface is minimized to effectively inhibit known or unknown network threats, the fault area is minimized to provide deterministic guarantee for key services, and the network security is guaranteed.

Description

Technical Field

[0001] This invention belongs to the field of power system automation technology, specifically, it relates to a substation station control layer network protection method and system. Background Technology

[0002] With the continuous development of communication technology, network security issues are becoming increasingly prominent. In 2023, the global power industry had as many as 4,500 network security vulnerabilities, and network security attacks surged by 70% in 2024 compared to the previous year. Currently, the substation control layer network mainly deploys gateways and monitoring backends, while the bay layer mainly deploys measurement and control devices and protection devices. As the core of automation business communication in the substation's production area, the network security of the substation control layer network is of paramount importance. Adding network security management devices can only detect and isolate network anomalies, but cannot prevent them. Adopting a network security management system to ensure the security of the devices themselves and to implement encrypted transmission for business communications is not feasible in the short term. Under the current conditions of the substation control layer network, improving its security is an urgent priority for enhancing network security.

[0003] In existing technologies, the target MAC address of abnormal ultra-long frame packets sent by devices changes randomly, and it cannot be guaranteed that the target MAC address is a fixed value. Therefore, it may be unicast, multicast, or broadcast. Currently, station control layer network devices generally use the default VLAN1 to achieve communication between all station control layer devices. Relying on the learning mechanism of the TCP / IP protocol itself to ensure the transmission of packets between communicating devices, when a device sends an abnormal packet, it may cause all devices to be attacked by abnormal packets, resulting in devices failing to work properly. In the substation station control layer network scenario, there is no existing method to use VLANs to isolate devices and solve the problem of abnormal packets between devices interfering with other non-communication devices. Summary of the Invention

[0004] To address the shortcomings of existing technologies, this invention provides a substation control layer network protection method. It employs VLAN segmentation to enhance the network security of the substation control layer, minimizes the attack surface to effectively suppress known or unknown network threats, minimizes fault areas to provide deterministic protection for critical services, and safeguards network security.

[0005] The present invention adopts the following technical solution.

[0006] This invention proposes a substation control layer network protection method, wherein the communication between substation control layer network devices includes communication between the control layer and bay layer devices and communication between bay layer devices; The methods include: In the communication architecture between the station control layer and the bay layer devices, a VLAN vertical integration scheme and a VLAN local deployment scheme are set up. In the communication architecture between the bay layer devices, a VLAN partitioning scheme based on voltage level and a VLAN partitioning scheme based on the publishing / subscribing device are set up. Based on security indicators, configuration indicators, and VLAN ID resource utilization indicators, the VLAN partitioning schemes are optimized and combined to obtain alternative network protection architectures. Each alternative network protection architecture is simulated and conflict detection is performed. The alternative network protection architecture that passes the conflict detection is selected as the optimal network protection architecture for station control layer network protection.

[0007] The VLAN connectivity scheme includes: each interval layer device is independently assigned a VLAN to communicate directly with the monitoring backend and gateway. The cascade port of the interval switch sends packets with VLAN tags to the central switch. The central switch assigns VLANs according to the VLAN tags carried in the packets and sends them to the monitoring backend and gateway. The gateway and monitoring backend use the default VLAN 1 to communicate with the interval layer devices.

[0008] The VLAN local deployment scheme includes: each interval switch distinguishes between device access ports and cascade ports; each device access port is configured with an independent VLAN to the cascade port; the cascade port contains the VLAN of the device access port of this switch; the cascade port sends packets to the central switch without VLAN tags; the central switch distinguishes between gateway and monitoring backend ports, and non-gateway and non-monitoring backend ports; non-gateway and non-monitoring backend ports are configured with independent VLANs to the gateway and monitoring backend ports.

[0009] The VLAN segmentation scheme based on voltage level includes: controlling GOOSE packets within the corresponding voltage level using a VLAN segmentation scheme, with each voltage level using a different VLAN ID.

[0010] The VLAN segmentation scheme for publishers / subscribers includes: limiting GOOSE packets to monitoring and control devices through VLAN configuration, using a unified VLAN ID value that does not overlap with the default VLAN or other VLANs.

[0011] The security metric is the number of devices with different security levels assigned to different VLANs; the configuration metric is the total number of VLANs required for configuration and the complexity of the port-VLAN mapping relationship; and the VLAN ID resource utilization metric is the compactness of the range of VLAN ID values ​​used.

[0012] Conflict detection includes: VLAN ID conflict detection, GOOSE subscription connectivity detection based on substation system configuration description files, and network single point of failure detection.

[0013] This invention also proposes a substation control layer network protection system, comprising: The VLAN segmentation module is used to set up VLAN vertical and horizontal connectivity schemes and VLAN local deployment schemes in the communication architecture between station control layer and bay layer devices; and to set up VLAN segmentation schemes based on voltage level and VLAN segmentation schemes based on publisher / subscriber devices in the communication architecture between bay layer devices. The alternative solution module is used to optimize and combine VLAN partitioning schemes to obtain alternative network protection architectures based on security indicators, configuration indicators, and VLAN ID resource utilization indicators. The solution selection module is used to simulate and perform conflict detection on various candidate network protection architectures. The candidate network protection architecture that passes the conflict detection is selected as the optimal network protection architecture for station control layer network protection.

[0014] The present invention is also a terminal, including a processor and a storage medium; the storage medium is used to store instructions; the processor is used to perform operations according to the instructions to execute the steps of the method.

[0015] The present invention is also a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method.

[0016] The beneficial effects of this invention are that, compared with existing technologies, it subdivides the network from a single broadcast domain into multiple logical security domains through optimized VLAN segmentation. The impact of a compromise or anomaly of a single device is strictly limited to a specific VLAN, preventing free lateral movement within the station control layer network, thus minimizing the attack surface. Core assets such as monitoring backends and gateways are placed in strictly controlled independent VLANs with clear access paths controlled by ACL whitelists, greatly reducing the risk of direct attacks and penetration. Attackers cannot perform a Layer 2 scan of the entire network from a single intrusion point; they must break through layer by layer and VLAN by VLAN, significantly increasing the difficulty and cost of attacks.

[0017] The VLAN connectivity solution provides a dedicated end-to-end logical channel for critical services such as fault recording and protection action information, ensuring minimal communication latency and jitter, and preventing interference from other management traffic. The impact of any device, link, or switch failure is strictly defined by VLAN boundaries, preventing network-wide service interruptions and minimizing the fault domain.

[0018] In the VLAN segmentation scheme based on publish / subscribe devices, multicast packets such as GOOSE / SV are only sent to the actual subscribers, eliminating invalid broadcast flooding and saving network bandwidth and switch processing resources.

[0019] By combining and optimizing quantitative indicators such as security, complexity, and resource utilization, the architecture selection shifts from "experience-driven" to "data-driven," avoiding over-design or under-design. A balanced VLAN ID resource utilization scheme satisfies current isolation requirements while reserving space for future expansion, preventing early network reconfiguration due to improper planning. Attached Figure Description

[0020] Figure 1 This is a flowchart of a substation control layer network protection method proposed in this invention; Figure 2 This is an example diagram of the substation control layer network of a certain substation divided according to the first type of VLAN in an embodiment of the present invention; Figure 3 This is an example diagram of the substation control layer network of a certain substation divided according to the second type of VLAN in an embodiment of the present invention. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of this invention. The embodiments described in this application are merely some embodiments of this invention, and not all embodiments. Based on the spirit of this invention, other embodiments obtained by those skilled in the art without creative effort are all within the protection scope of this invention.

[0022] The current communication relationships between network devices in the substation control layer include: 1) Communication between station control layer and bay layer equipment, including: communication between bay layer protection, measurement and control equipment and station control layer gateway, monitoring backend, etc., using MMS communication.

[0023] 2) Communication between bay-level devices, including: interlocking information exchange between bay-level measurement and control, using GOOSE communication.

[0024] MMS messages are sent without an IEEE 802.1Q VLAN tag, and therefore are transmitted in the network switch's default VLAN 1. The IEEE 61850-8-1 GOOSE message format requires an IEEE 802.1Q VLAN tag; by default, the VLAN ID value of interlocked GOOSE messages is 0, and they are also transmitted in the network switch's default VLAN 1. Therefore, VLANs can be used to isolate interval layer devices, preventing abnormal interference between them and thus improving network security. This solution is also applicable to improving the security of future station control layer networks.

[0025] To achieve the goal of isolating devices through VLANs while ensuring normal communication between devices and improving network protection capabilities, this invention proposes a substation control layer network protection method, such as... Figure 1 As shown, it includes: Step 1: Configure VLAN uplink / downlink and VLAN local deployment schemes in the communication architecture between the station control layer and the bay layer devices.

[0026] Specifically, the VLAN connectivity scheme includes: each interval layer device independently assigns a VLAN to communicate directly with the monitoring backend and gateway; the cascade port of the interval switch sends packets with VLAN tags to the central switch; the central switch assigns VLANs according to the VLAN tags carried in the packets and sends them to the monitoring backend and gateway; the gateway and monitoring backend use the default VLAN 1 to communicate with the interval layer devices. The VLAN uplink / downlink solution proposed in this invention offers high readability, improves isolation between devices, and ensures network security; however, it increases configuration workload. This VLAN uplink / downlink solution directly addresses the stringent requirements of real-time services such as GOOSE / SV in substation automation systems for low latency and high determinism, eliminating routing delays and jitter through direct Layer 2 connections.

[0027] Specifically, the VLAN local deployment scheme includes: each interval switch distinguishes between device access ports and cascade ports, each device access port is configured with an independent VLAN to the cascade port, the cascade port contains the VLAN of the device access port of this switch, the cascade port sends packets to the central switch without VLAN tags, the central switch distinguishes between gateway and monitoring backend ports, and non-gateway and non-monitoring backend ports, and non-gateway and non-monitoring backend ports are configured with independent VLANs to the gateway and monitoring backend ports; The VLAN local deployment scheme proposed in this invention simplifies the VLAN configuration of the VLAN interconnection scheme. The switch configuration is the same, which is suitable for promotion. The VLAN configuration of each interval switch is the same (in the scenario of the same cascade port). The VLAN configuration rules of the central switch are the same as those of the interval switches. The difference is that the cascade port is replaced by the gateway machine and the monitoring backend port.

[0028] Step 2: Configure VLAN segmentation schemes based on voltage level and VLAN segmentation schemes based on publisher / subscriber devices in the communication architecture between interval layer devices.

[0029] Specifically, GOOSE interlocking messages sent between interval-level monitoring and control stations must carry a VLAN tag, and the VLAN tag cannot be 0 or 1, nor can it overlap with the VLANs of other services. In the global VLAN partitioning scheme, all GOOSE messages are fixed with a unified VLAN ID value, which is not repeated with the default VLAN or other VLANs. The global VLAN partitioning scheme is simple and easy to operate, and GOOSE interlocking messages of all voltage levels are transmitted within the same VLAN. However, a network attack in which any port sends the same GOOSE message will affect all devices in the network that receive the GOOSE message.

[0030] Specifically, the VLAN segmentation scheme based on voltage level includes: controlling GOOSE packets within the corresponding voltage level through the VLAN segmentation scheme according to the voltage level, with each voltage level using a different VLAN ID, or simplifying VLAN configuration according to high voltage / low voltage. The VLAN segmentation scheme proposed in this invention, based on voltage level, eliminates communication between devices of different voltage levels, effectively protecting high-voltage devices. However, the configuration and organization workload is significant, as there may be situations where devices of different voltage levels are connected to the same switch, requiring further organization before VLAN segmentation can be performed. In scenarios involving spare ports, clear port identification is necessary.

[0031] Specifically, the VLAN segmentation scheme according to the publisher / subscriber device includes: limiting GOOSE packets to the measurement and control devices through VLAN configuration, using a unified VLAN ID value that does not overlap with the default VLAN or other VLANs; The VLANs proposed in this invention, which are divided according to the publishing / subscribing devices, only include service-related ports, effectively preventing attacks on the measurement and control equipment by packets sent by other devices, and have strong protection capabilities. However, the configuration and sorting workload is large. Before configuring VLANs, it is necessary to sort out the ports of the switch where the measurement and control device is located. In addition, spare ports need to be considered when configuring VLANs to facilitate device migration in case of subsequent port failures.

[0032] Step 3: Based on security indicators, configuration indicators, and VLAN ID resource utilization indicators, optimize and combine VLAN partitioning schemes to obtain alternative network protection architectures.

[0033] Among them, the security indicator is the number of devices with different security levels assigned to different VLANs, the configuration indicator is the total number of VLANs to be configured and the complexity of the port-VLAN mapping relationship, and the VLAN ID resource utilization indicator is the compactness of the range of VLAN ID values ​​used.

[0034] The first alternative network protection architecture: When the security indicators, configuration indicators, and VLAN ID resource utilization indicators are low, the basic protection network protection architecture includes: VLAN division scheme based on voltage level and VLAN local deployment scheme; in the example, the interval layer devices are divided into different VLANs according to their voltage level (such as 220kV, 110kV, 10kV), all station control layer devices (monitoring backend, gateway, etc.) are placed in an independent station control layer VLAN, and all communication between VLANs must go through the three-layer routing function of the core switch, and a basic access control list is deployed on the core switch; the process layer GOOSE / SV network is networked separately (physical or VLAN isolated).

[0035] The second alternative network protection architecture: When the security index is high, the configuration index is medium, and the VLAN ID resource utilization index is low, the enhanced isolation network protection architecture includes: VLAN division scheme based on voltage level, VLAN vertical and horizontal connection scheme, and VLAN local deployment scheme; In the embodiment, an independent vertical connection VLAN is created between the process layer and the interval layer for extremely critical real-time services (such as bus differential protection and main transformer protection). This VLAN only contains relevant devices on the protection link (such as merging units, protection devices, and smart terminals) to form a dedicated channel; On the core switch, a strict policy is configured for the vertical and horizontal connection VLAN to prohibit it from actively accessing any other VLAN, and only allow specific, monitored station control layer hosts (such as fault recorders) to access it unidirectionally.

[0036] The third alternative network protection architecture: When the security index, configuration index, and VLAN ID resource utilization index are high, the service-optimized network protection architecture includes: according to the VLAN partitioning scheme of the publishing / subscribing devices and the VLAN local deployment scheme; in the embodiment, the process layer and the interval layer are based on the GOOSE / SV subscription relationship, and all devices subscribing to the same group of packets (such as all devices with the same protection function) are divided into the same VLAN; the management interfaces of all interval layer devices between the interval layer and the station control layer are assigned to one or more interval layer management VLANs, and the station control layer is placed in an independent VLAN.

[0037] This invention does not employ a single VLAN segmentation scheme, but rather creatively integrates multiple strategies based on device functions, service flow, and security requirements to form a three-dimensional protection architecture. Step 4: Simulate each of the alternative network protection architectures and perform conflict detection. Conflict detection includes: VLAN ID conflict detection, GOOSE subscription connectivity detection based on the substation system configuration description file, and network single point of failure detection.

[0038] Specifically, step 4 includes: Step 4.1: Deploy and test the alternative network protection architecture in the actual network; Step 4.2: Collect network performance data and alarm information after deployment; Step 4.3: Based on the operational performance data and alarm information, adaptively adjust the weights of security indicators, configuration indicators, and VLAN ID resource utilization indicators.

[0039] The network single point of failure detection includes: simulating the disconnection of any critical link in the network physical topology or shutting down any core switch; under the simulated failure state, re-verifying all critical service flows, especially the end-to-end connectivity of GOOSE subscription relationships; if there is a service flow interruption, it is determined that the alternative solution has a single point of failure vulnerability.

[0040] Step 5: Select the alternative network protection architectures through conflict detection as the optimal network protection architecture.

[0041] Based on the VLAN partitioning scheme in the optimal network protection architecture and the detailed configuration scripts of all switches, a visual deployment diagram and port allocation table are generated.

[0042] The method proposed in this invention is implemented in the station control layer network of a substation as follows: 1) Station control layer equipment such as monitoring back-end and gateway machines are connected to the central switch, while bay layer equipment such as protection equipment and measurement and control equipment are connected to any switch such as bay layer switch and central switch; Both the central switch and the interval switches retain the default VLAN1 configuration. The default VLAN1 configuration includes all ports of the switch, and the default PVID of each port is 1. If the communication between the station control layer devices and the interval layer devices does not use the default VLAN transmission, the default VLAN1 configuration can be ignored. When the station control layer devices send messages through the cascade port, they can use the method of sending messages with VLAN tags. Using this method, the station control layer devices are no longer restricted to being connected to the central switch.

[0043] 2) The central switch divides the access port area for station control layer equipment into a cascading port access area; For example, ports 1-10 are used to access station control layer devices, including the actual accessed station control layer devices and reserved access ports for station control layer devices; ports 11-28 are the cascade port access area, which also includes the access ports of the interval switch and reserved ports; the cascade port access area can access interval layer devices and interval layer switches; the cascade port access area communicates with the station control layer device access area in the manner of each port having an independent VLAN, and at the same time, the PVID of each port is configured to be consistent with the port's independent VLAN; the GOOSE message is configured with an independent VLAN, each port of the cascade port is added to this VLAN, and the GOOSE message is configured to be output with a VLAN tag.

[0044] 3) The interval switch divides the interval device access area and the switch to the upstream cascade access area; For example, the interval device access area includes ports 1-24 and G3-G4, and the upstream cascade access area includes ports G1-G2; the interval device access area includes interfaces for accessing the interval device, interfaces for downstream cascaded interval switches, and reserved ports; the upstream cascaded access area includes ports of the interval switch that connect to other switches and reserved ports; each port in the interval device access area is configured with an independent VLAN, and the PVID of each port is configured to be consistent with the port's independent VLAN; the ports in the upstream cascaded access area contain all VLANs of the interval device access area, and the PVID of reserved ports remains unchanged at 1; GOOSE packets are configured with an independent VLAN, each port of the cascaded ports is added to this VLAN, and GOOSE packets are configured to be output with a VLAN tag.

[0045] The recipients of GOOSE interlocking messages are other measurement and control devices. Station control layer devices and protection devices do not receive GOOSE messages. Normal configuration requires limiting the propagation area of ​​GOOSE messages to between measurement and control devices. To simplify configuration, GOOSE messages can be configured for network-wide broadcasting. GOOSE messages are transmitted on the network using a separate VLAN, and a VLAN tag must be included at the switch egress point.

[0046] like Figure 2 As shown, the central switch connects to the monitoring backend, gateway, and reserved ports 1-5, and connects to the interval devices, cascade switch ports, and reserved holes 6-10. Interval switches 1-4 connect to the interval devices, lower-level interval switches, and reserved ports 1-5, G3-G4, and connect to the upper-level interval switches or the central switch via the cascade ports G1-G2.

[0047] The specific VLAN configurations of the central switch and each bay switch are shown in Tables 1 to 4.

[0048] The VLANs of the central switch are shown in Table 1. Ports 6-10 are access ports for cascaded switches, and ports 1-5 are access ports for station control layer devices. Therefore, VLAN 2 is configured to include ports 1-6, VLAN 3 to include ports 1-5 and 7, VLAN 4 to include ports 1-5 and 8, VLAN 5 to include ports 1-5 and 9, VLAN 6 to include ports 1-5 and 10, and VLAN 2000 to include all ports of the central switch. Ports in VLANs 2-6 are configured to output packets without tags, while ports in VLAN 2000 are configured to output packets with VLAN tags. The central switch retains the default VLAN 1, which includes all ports of the central switch and outputs packets without VLAN tags.

[0049] Table 1 VLAN Configuration of the Central Switch

[0050] The PVID settings for the central switch ports are shown in Table 2. Station control layer devices access ports 1-5 are all set to PVID 1, ensuring that communication between station control layer devices and interval layer devices uses the default VLAN 1. Cascaded switch access ports 6, 7, 8, 9, and 10 are set to PVID 6, ensuring that packets sent from each cascaded port communicate with station control layer devices through different VLANs.

[0051] Table 2. Port PVID Configuration of the Central Switch

[0052] The VLANs of interval switches 1-4 are shown in Table 3. Ports G1-G2 are the access ports for the uplink switches, and ports 1-5 and G3-G4 are the access ports for the interval devices. Therefore, VLAN 2 includes ports 1 and G1-G2, VLAN 3 includes ports 2 and G1-G2, VLAN 4 includes ports 3 and G1-G2, VLAN 5 includes ports 4 and G1-G2, VLAN 6 includes ports 5 and G1-G2, VLAN 7 includes ports G1-G3, VLAN 8 includes ports G1-G2 and G4, and VLAN 2000 includes all ports of the interval switches. Ports in VLANs 2-8 are configured to output packets without tags, while ports in VLAN 2000 output packets with VLAN tags. The interval switches retain the default VLAN 1, which includes all ports of the central switch and outputs packets without VLAN tags.

[0053] Table 3 VLAN Configuration of Interval Switches 1-4

[0054] The PVID settings for ports 1-4 of the interval switches are shown in Table 4. Uplink switch access ports G1-G2 are all set to PVID 1 to ensure that communication between the station control layer devices and the interval layer devices uses the default VLAN 1. Interval device access ports are set to PVID 2 for port 1, PVID 3 for port 2, PVID 4 for port 3, PVID 5 for port 4, PVID 6 for port 5, PVID 7 for port G3, and PVID 8 for port G4, ensuring that packets sent from each level of the interconnecting port communicate with the station control layer devices through different VLANs.

[0055] Table 4. Port PVID configuration of switches 1-4

[0056] like Figure 3 As shown, the central switch connects to the monitoring backend, gateway, and reserved ports 1-5; connects to the interval devices, cascade switch ports, and reserved holes 6-10; interval switch 1-interval switch 4 connects to the interval devices, lower-level interval switches, and reserved ports 1-5, G3-G4; and connects to the upper-level interval switches or the central switch via cascade ports G1-G2.

[0057] The specific VLAN configurations of the central switch and each bay switch are shown in Tables 5-14.

[0058] The VLANs of Interval Switch 3 are shown in Table 5. Ports G1-G2 are the access ports for the uplink switches, and ports 1-5 and G3-G4 are the access ports for the interval devices. Therefore, VLAN 12 includes ports 1 and G1-G2, VLAN 13 includes ports 2 and G1-G2, VLAN 14 includes ports 3 and G1-G2, VLAN 15 includes ports 4 and G1-G2, VLAN 16 includes ports 5 and G1-G2, VLAN 17 includes ports G1-G3, VLAN 18 includes ports G1-G2 and G4, and VLAN 2000 includes all ports of the interval switch. Ports in VLANs 12-18 are configured to output packets without tags, while ports in VLAN 2000 output packets with VLAN tags. Interval Switch 3 retains the default VLAN 1, which includes all ports of the central switch and outputs packets without VLAN tags.

[0059] Table 5 VLAN Configuration of Interval Switch 3

[0060] The PVID settings for the ports of bay switch 3 are shown in Table 6. Uplink switch access ports G1-G2 are all set to PVID 1, ensuring that communication between the station control layer devices and bay layer devices uses the default VLAN 1. Bay device access ports 1, 2, 3, 4, 5, G3, and G4 are set to PVID 12, 13, 14, 15, 16, 17, and 18, respectively, ensuring that packets sent from each level of interconnecting port communicate with the station control layer devices through different VLANs.

[0061] Table 6 Port PVID Configuration of Interval Switch 3

[0062] The VLANs of interval switch 4 are shown in Table 7. Ports G1-G2 are the access ports for the uplink switches, and ports 1-5 and G3-G4 are the access ports for the interval devices. Therefore, VLAN 19 includes ports 1 and G1-G2, VLAN 20 includes ports 2 and G1-G2, VLAN 21 includes ports 3 and G1-G2, VLAN 22 includes ports 4 and G1-G2, VLAN 23 includes ports 5 and G1-G2, VLAN 24 includes ports G1-G3, VLAN 25 includes ports G1-G2 and G4, and VLAN 2000 includes all ports of the interval switch. Ports in VLANs 19-25 are configured to output packets without tags, while ports in VLAN 2000 output packets with VLAN tags. Interval switch 3 retains the default VLAN 1, which includes all ports of the central switch and outputs packets without VLAN tags.

[0063] Table 7 VLAN Configuration of Interval Switch 4

[0064] The PVID settings for the ports of bay switch 4 are shown in Table 8. Uplink switch access ports G1-G2 are all set to PVID 1, ensuring that communication between the station control layer devices and bay layer devices uses the default VLAN 1. Bay device access ports 1, 2, 3, 4, 5, G3, and G4 are all set to PVID 19, 20, 21, 22, 23, 24, and 25, ensuring that packets sent from each level of interconnecting port communicate with the station control layer devices through different VLANs.

[0065] Table 8 Port PVID Configuration of Interval Switch 4

[0066] The VLAN segmentation of Interval Switch 1 is shown in Table 9. Ports G1-G2 are the access ports for the uplink switches, and ports 1-5 and G3-G4 are the access ports for the interval devices. Therefore, VLAN 2 is configured to include ports 1 and G1-G2, VLAN 3 to include ports 2 and G1-G2, VLAN 4 to include ports 3 and G1-G2, VLAN 5 to include ports 4 and G1-G2, VLAN 6 to include ports 5 and G1-G2, VLAN 7 to include ports G1-G3, VLAN 8 to include ports G1-G2 and G4, and VLAN 2000 to include all ports of the interval switch. Ports in VLANs 2-8 are configured to output packets without tags, while ports in VLAN 2000 output packets with VLAN tags. Interval Switch 1 retains the default VLAN 1, which includes all ports of the central switch and outputs packets without VLAN tags. The PVID of the idle uplink switch access port G1 can also be set to an unconfigured VLAN value such as 4000 to prevent abnormal attacks on the network through this port.

[0067] Table 9 VLAN Configuration of Interval Switch 1

[0068] The PVID settings for the ports of Interval Switch 1 are shown in Table 10. Uplink switch access ports G1-G2 are all set to PVID 1, ensuring that communication between the station control layer devices and the interval layer devices uses the default VLAN 1. Interval device access ports are configured with unconfigured VLAN values: port 1 is set to PVID 2, port 2 to PVID 3, port 3 to PVID 4, port 4 to PVID 5, port 5 to PVID 6, port G3 to PVID 4000, and port G4 to PVID 4000. This ensures that packets sent from each level of the uplink port communicate with the station control layer devices through different VLANs. Setting the PVIDs of G3-G4 to unconfigured VLAN values ​​is to prevent attacking devices from sending abnormal packets to attack the network through the reserved ports.

[0069] Table 10 Port PVID Configuration of Interval Switch 1

[0070] The VLAN segmentation of Interval Switch 2 is shown in Table 11. Ports G1-G2 are the access ports for the uplink switch, and ports 1-5 and G3-G4 are the access ports for the interval devices. Therefore, VLAN 7 is configured to include ports 1 and G1-G2, VLAN 8 to include ports 2 and G1-G2, VLAN 9 to include ports 3 and G1-G2, VLAN 10 to include ports 4 and G1-G2, VLAN 11 to include ports 5 and G1-G2, and VLAN 2000 to include all ports of the interval switch. Ports in VLANs 7-11 are configured to output packets without tags, while ports in VLAN 2000 are configured to output packets with VLAN tags. Interval Switch 2 retains the default VLAN 1, which includes all ports of the central switch and outputs packets without VLAN tags. The PVID of the idle uplink switch access port G1 can also be set to an unconfigured VLAN value such as 4000 to prevent abnormal attacks on the network through this port.

[0071] Table 11 VLAN Configuration of Interval Switch 2

[0072] The PVID settings for the ports of Interval Switch 2 are shown in Table 12. Uplink switch access ports G1-G2 are all set to PVID 1, ensuring that communication between the station control layer devices and the interval layer devices uses the default VLAN 1. Interval device access ports 1 and G4 are set to unconfigured VLAN values: PVID 1 (7), PVID 2 (8), PVID 3 (9), PVID 4 (10), PVID 5 (11), PVID 4000 (4000), and PVID 4000 (4000). This ensures that packets sent from each level of the uplink port communicate with the station control layer devices through different VLANs. Setting PVIDs for G3-G4 to unconfigured VLAN values ​​ensures that attacking devices can send abnormal packets to attack the network through the reserved ports.

[0073] Table 12 Port PVID Configuration of Interval Switch 2

[0074] The VLAN segmentation of the central switch is shown in Table 13. Ports 6-10 are access ports for cascaded switches, and ports 1-5 are access ports for station control layer devices. Each cascaded port contains VLANs sent up by all downstream switch intervals, including the independent GOOSE VLAN for VLAN 2000. This configuration ensures compatibility. The access ports for station control layer devices contain all VLANs of all downstream switch intervals, but may not include the independent GOOSE VLAN for VLAN 2000. The central switch retains the default VLAN 1, which includes all ports of the central switch and none of them carry VLAN tags.

[0075] Table 13 VLAN Configuration of the Central Switch

[0076] The VLAN division of the central switch is shown in Table 14. The PVID of access ports 1-5 of the station control layer device is set to 1, and the PVID of access ports 6-10 of the cascade switch is set to 4000 or other unconfigured VLANs to prevent abnormal packets from attacking the network through the reserved ports.

[0077] Table 14 Port PVID Configuration of the Central Switch

[0078] This disclosure can be a system, method, and / or computer program product. A computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for causing a processor to implement various aspects of this disclosure.

[0079] Computer-readable storage media can be tangible devices capable of holding and storing instructions for use by an instruction execution device. Computer-readable storage media can be, for example—but not limited to—electrical storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of computer-readable storage media include: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disc read-only memory (CD-ROM), digital multifunction disc (DVD), memory sticks, floppy disks, mechanical encoding devices, such as punch cards or recessed protrusions storing instructions thereon, and any suitable combination of the foregoing. The computer-readable storage media used herein are not to be construed as transient signals themselves, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (e.g., light pulses through fiber optic cables), or electrical signals transmitted through wires.

[0080] The computer-readable program instructions described herein can be downloaded from computer-readable storage media to various computing / processing devices, or downloaded via a network, such as the Internet, local area network, wide area network, and / or wireless network, to an external computer or external storage device. The network may include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards them to the computer-readable storage media in the respective computing / processing device.

[0081] Computer program instructions used to perform the operations of this disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, status setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk, C++, etc., and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The computer-readable program instructions may execute entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, electronic circuitry, such as programmable logic circuitry, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), is personalized by utilizing the status information of the computer-readable program instructions to implement various aspects of this disclosure.

[0082] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the protection scope of the claims of the present invention.

Claims

1. A substation control layer network protection method, wherein communication between substation control layer network devices includes communication between the control layer and bay layer devices and communication between bay layer devices; characterized in that, include: In the communication architecture between the station control layer and the bay layer devices, set up a VLAN top-down and bottom-up connectivity scheme and a VLAN local deployment scheme; Configure VLAN segmentation schemes based on voltage levels and VLAN segmentation schemes based on publish / subscribe devices in the communication architecture between interval layer devices; Based on security metrics, configuration metrics, and VLAN ID resource utilization metrics, the VLAN segmentation schemes are optimized and combined to obtain alternative network protection architectures. Simulate and perform conflict detection on each of the alternative network protection architectures; The alternative network protection architecture based on conflict detection is selected as the optimal network protection architecture for site control layer network protection.

2. The substation control layer network protection method according to claim 1, characterized in that, The VLAN connectivity scheme includes: each interval layer device is independently assigned a VLAN to communicate directly with the monitoring backend and gateway. The cascade port of the interval switch sends packets with VLAN tags to the central switch. The central switch assigns VLANs according to the VLAN tags carried in the packets and sends them to the monitoring backend and gateway. The gateway and monitoring backend use the default VLAN 1 to communicate with the interval layer devices.

3. The substation control layer network protection method according to claim 1, characterized in that, The VLAN local deployment scheme includes: each interval switch distinguishes between device access ports and cascade ports; each device access port is configured with an independent VLAN to the cascade port; the cascade port contains the VLAN of the device access port of this switch; the cascade port sends packets to the central switch without VLAN tags; the central switch distinguishes between gateway and monitoring backend ports, and non-gateway and non-monitoring backend ports; non-gateway and non-monitoring backend ports are configured with independent VLANs to the gateway and monitoring backend ports.

4. The substation control layer network protection method according to claim 1, characterized in that, The VLAN segmentation scheme based on voltage level includes: controlling GOOSE packets within the corresponding voltage level using a VLAN segmentation scheme, with each voltage level using a different VLAN ID.

5. A substation control layer network protection method according to claim 1, characterized in that, The VLAN segmentation scheme for publishers / subscribers includes: limiting GOOSE packets to monitoring and control devices through VLAN configuration, using a unified VLAN ID value that does not overlap with the default VLAN or other VLANs.

6. The substation control layer network protection method according to claim 1, characterized in that, The security metric is the number of devices with different security levels assigned to different VLANs; the configuration metric is the total number of VLANs required for configuration and the complexity of the port-VLAN mapping relationship; and the VLAN ID resource utilization metric is the compactness of the range of VLAN ID values ​​used.

7. A substation control layer network protection method according to claim 1, characterized in that, Conflict detection includes: VLAN ID conflict detection, GOOSE subscription connectivity detection based on substation system configuration description files, and network single point of failure detection.

8. A substation control layer network protection system, used to implement the substation control layer network protection method according to any one of claims 1 to 7, characterized in that, include: The VLAN segmentation scheme module is used to set up VLAN vertical and horizontal connectivity schemes and VLAN local deployment schemes in the communication architecture between station control layer and bay layer devices; Configure VLAN segmentation schemes based on voltage levels and VLAN segmentation schemes based on publish / subscribe devices in the communication architecture between interval layer devices; The alternative solution module is used to optimize and combine VLAN partitioning schemes to obtain alternative network protection architectures based on security indicators, configuration indicators, and VLAN ID resource utilization indicators. The solution selection module is used to simulate and perform conflict detection on various candidate network protection architectures. The candidate network protection architecture that passes the conflict detection is selected as the optimal network protection architecture for station control layer network protection.

9. A terminal, comprising a processor and a storage medium; characterized in that: The storage medium is used to store instructions; The processor is configured to operate according to the instructions to perform the steps of the method according to any one of claims 1-7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the program implements the steps of the method according to any one of claims 1-7.

Images