A power monitoring system encryption communication method and system based on IEC 60870-5-104 protocol

Abstract

The application discloses an encryption communication method and system of a power monitoring system based on an IEC 60870-5-104 protocol, and belongs to the technical field of power system automation and information security; the method comprises the following steps: creating an encryptor instance through a factory method according to an encryptor type specified by a configuration file, analyzing the data unit type identifier in an APDU frame before the APDU frame is sent through a TCP socket, and dividing the frame into a control type or a monitoring type; adding a frame header identifier and a ciphertext length field after generating ciphertext, and assembling the ciphertext into an encrypted frame for sending. When the TCP socket receives data, the frame type is distinguished through the first byte, and the link encryption state is synchronized: the first byte is an IEC104 standard starting symbol, and then the plaintext mode is set; the preset encrypted frame identifier is set as the encryption mode, and there is no additional handshake delay. The frame header integrity of the encrypted frame is verified, the ciphertext length is analyzed, the standard APDU frame is restored after decryption, and the standard protocol logic processing is performed.

Description

Technical Field

[0001] This invention relates to the field of power system automation and information security technology, and in particular to an encrypted communication method and system for power monitoring systems based on the IEC 60870-5-104 protocol. Background Technology

[0002] The IEC 60870-5-104 protocol (hereinafter referred to as IEC104 protocol) is one of the most widely used network transmission protocols in power systems. Running on top of the TCP / IP protocol stack, it is used to realize real-time monitoring data transmission between the dispatch center (master station) and the substation (slave station), covering business functions such as telemetry, remote signaling, remote control, and remote adjustment. However, this protocol was not designed with network security threats in mind. It lacks a data encryption mechanism, and all Application Layer Protocol Data Units (APDUs) are transmitted in plaintext over the TCP / IP network. Attackers can directly obtain sensitive power production data such as telemetry data, remote signaling status, and remote control commands through network sniffing tools. Furthermore, the protocol does not provide message authentication codes or digital signature mechanisms, posing risks of message tampering, replay attacks, and forgery injection attacks. During the transmission of control commands such as remote control and remote adjustment, this could lead to serious safety accidents such as circuit breaker malfunctions. Finally, the protocol relies solely on the source IP address of the TCP connection for peer identification, lacking cryptographic authentication and posing a risk of man-in-the-middle attacks.

[0003] Existing security hardening solutions all have limitations to varying degrees. IPSec tunnels require complex configuration at the network layer, resulting in high deployment and maintenance costs; vertical encryption authentication devices are dedicated hardware devices, with a single unit costing tens to hundreds of thousands of yuan, making them unsuitable for large-scale distributed new energy power stations.

[0004] Existing secure communication solutions based on national cryptographic algorithms typically rely on dedicated cryptographic hardware, which is prohibitively expensive in terms of hardware procurement and maintenance. Furthermore, they often employ an external deployment model and do not provide pluggable software encryption modules that can be directly embedded into the IEC104 protocol stack. SSL / TLS-based encrypted tunnel solutions require a complete handshake process before data transmission, introducing at least two round-trip times (RTTs). This introduces a non-negligible initialization delay to industrial real-time control protocols like IEC104. Moreover, by applying a uniform security policy to all data within the tunnel, they cannot differentiate the security requirements of telemetry / telecommunication monitoring data from remote control / teleadjustment control commands.

[0005] In addition, existing solutions all rely on a single cryptographic calculation channel. When the cryptographic device fails, the entire encrypted communication link is interrupted, and they lack the ability to independently manage the encryption status of each link in a multi-channel redundant scenario and automatically synchronize during master-slave switching.

[0006] Therefore, there is a need for an encrypted communication method and system for power monitoring systems that can be transparently integrated into the existing IEC104 protocol stack, support flexible switching of multiple algorithms and dual-channel fault tolerance of cryptographic services, adapt to multi-channel redundant architecture, have frame-level differentiated security policy capabilities based on ASDU type, achieve automatic negotiation of encrypted state with zero additional handshake round-trip latency, and have low engineering implementation cost. Summary of the Invention

[0007] The purpose of this invention is to provide an encrypted communication method and system for power monitoring systems based on the IEC 60870-5-104 protocol, so as to solve the above-mentioned technical problems existing in the prior art.

[0008] To achieve the above objectives, the present invention adopts the following technical solution: The present invention provides an encrypted communication method for a power monitoring system based on the IEC 60870-5-104 protocol, comprising the following steps:

[0009] S1: Based on the encryptor type specified in the configuration file, call the encryptor factory method to create the corresponding encryptor instance. The encryptor factory method dynamically creates the corresponding encryptor instance based on the encryptor type enumeration value, realizing plug-and-play switching of multiple encryption algorithms.

[0010] S2: Before the Application Layer Protocol Data Unit (APDU) frame is sent through the TCP socket, the Application Service Data Unit Type Identifier in the APDU frame is parsed, and the current frame is classified into a control frame or a monitoring frame according to the type identifier.

[0011] A high-security protection strategy is applied to the control frames, and encryption, digital signature, and anti-replay protection are performed on the APDU frames to generate ciphertext data; a standard security protection strategy is applied to the monitoring frames, and encryption and integrity verification protection are performed on the APDU frames to generate ciphertext data.

[0012] S3: Add a frame header identifier and a ciphertext length field before the ciphertext data, assemble them into an encrypted transmission frame, and send them through a TCP socket;

[0013] S4: When receiving data on the TCP socket, read the first byte and determine its value: if the first byte is the start character of an IEC104 standard frame, it is determined to be a standard IEC104 plaintext frame, the current link encryption state is set to plaintext mode, and the process is switched to standard IEC104 frame parsing; if the first byte is a preset encryption frame identifier, it is determined to be an encrypted transmission frame, and the current link encryption state is set to encryption mode; the determination of the encryption state is completed in the same TCP read operation of reading the first byte, without introducing additional handshake round-trip delay;

[0014] S5: For the encrypted transmission frame, verify the integrity of the frame header identifier; read the ciphertext length field and parse it into a ciphertext length value; read the ciphertext data according to the ciphertext length value;

[0015] S6: Call the decryption function of the encryptor instance to decrypt the ciphertext data, restore it to a standard IEC104 APDU frame, and hand it over to the standard IEC104 protocol processing logic for further processing.

[0016] Through the above technical solution, the sending end automatically routes the security policy according to the application service data unit type identifier within the same communication link, and the receiving end completes frame type identification and link encryption status synchronization by reading the first byte under the condition of zero additional round-trip delay, thereby realizing differentiated security protection for data of different service types.

[0017] Furthermore, the control frames include frames whose application service data unit type identifier belongs to the remote control / teleadjustment command class, specifically including:

[0018] The identifier values ​​for single-point remote control command type are 45, dual-point remote control command type are 46, setpoint adjustment command type are 47, normalized setpoint adjustment type are 48, short floating-point setpoint adjustment type are 50, and the identifier values ​​for long timescale variants of the above types are 58, 59, 61, 62, and 63, respectively.

[0019] The monitoring frames include frames whose application service data unit type identifier belongs to the remote signaling / telemetry data class, specifically including: single-point remote signaling type identifier value of 1, two-point remote signaling type identifier value of 3, normalized telemetry value type identifier value of 9, scaled telemetry value type identifier value of 11, short floating-point telemetry value type identifier value of 13, normalized telemetry type identifier value with quality description of 21, time-stamped single-point remote signaling type identifier value of 30, and time-stamped two-point remote signaling type identifier value of 31.

[0020] This classification rule covers the most commonly used control and monitoring data frames in new energy power plants, wind farms, and other facilities using the IEC104 protocol, ensuring the integrity of differentiated security policy routing.

[0021] Preferably, the encryptor instance adopts a dual-channel fault-tolerant architecture that prioritizes remote cryptographic services and degrades local cryptographic computation:

[0022] Channel 1 is a remote cryptographic service channel, which sends data and identity parameters to the remote cryptographic service for encryption and decryption operations via the HTTP protocol. When the remote cryptographic service is unavailable, the encryptor automatically switches to Channel 2 and uses the local encryption algorithm library to directly perform encryption and decryption operations. The channel switching is automatically completed by the encryptor based on the return value of the remote cryptographic service call, and is completely transparent to the upper-layer encryption call code.

[0023] This dual-channel architecture eliminates the risk of encrypted communication interruption due to a single point of failure in the cryptographic service, meeting the high availability requirements for continuous operation of the power monitoring system.

[0024] Specifically, the encrypted transmission frame format is as follows: a 3-byte frame header identifier at offsets 0 to 2, a 2-byte ciphertext length field at offsets 3 to 4 (in little-endian), and N bytes of ciphertext data at offsets 5 to N+4. The total length of the encrypted transmission frame is N+5 bytes, where N is the actual number of bytes of ciphertext data. This frame format adds only 5 bytes of fixed overhead. The frame header identifier is naturally mutually exclusive with the IEC104 standard frame start character. The receiving end can determine the frame type simply by reading the first byte, making the parsing logic highly efficient.

[0025] Furthermore, each communication link maintains its encrypted communication state through an encryption state field in an independent link state structure, achieving three-dimensional independent encryption strategy management across the link, algorithm, and data dimensions.

[0026] The link dimension maintains an independent encryption enable state for each communication link, and the encryption state field values ​​of each link are independent of each other;

[0027] The algorithm dimension allows for independent configuration of encryption algorithm types for each communication link, and the encryption factory method creates different types of encryption instance for different links;

[0028] The data dimension automatically selects the security protection level based on the application service data unit type identifier within the same link; the control frame adopts high security level protection; the monitoring frame adopts standard security level protection.

[0029] The three-dimensional strategies can be configured, modified, and combined independently. This three-dimensional strategy management model supports simultaneous mixed communication between the same master station process and both encrypted and unencrypted slave stations, adapting to the needs of phased security upgrades in engineering projects.

[0030] In some embodiments, the method has a multi-layered degradation fault tolerance strategy:

[0031] The first-level degradation is that when the remote cryptographic service is unavailable, the encryptor automatically switches from the remote cryptographic service channel to the local cryptographic calculation channel, so that encrypted communication is not interrupted.

[0032] The second-level degradation involves automatically falling back to plaintext transmission mode when encryption fails or the encryption status field of the current link indicates that encryption is not enabled, and directly sending the original APDU frame through the TCP socket; when decryption fails, an alarm log is recorded and the current TCP connection is actively disconnected, triggering automatic link reconstruction.

[0033] The two-tiered degradation strategy progresses step by step to ensure that communication is not interrupted in the event of any cryptographic module malfunction.

[0034] As a preferred embodiment, the encryption and decryption operations are executed within the network sending and receiving functions, completely transparent to the upper-layer IEC104 protocol processing logic. The encryptor is integrated with the IEC104 protocol stack as an independent static library via a standard interface, requiring no modification to the upper-layer protocol processing code. Adding a new encryption algorithm only requires implementing the encryption, decryption, and destruction function pointers of the encryptor interface and adding corresponding branches to the encryptor factory method, without modifying the upper-layer calling code. This transparent integration method allows existing IEC104 systems to complete security upgrades without modifying any upper-layer protocol processing code, resulting in low engineering implementation costs.

[0035] This invention also provides an encrypted communication system for a power monitoring system based on the IEC 60870-5-104 protocol, used to implement the above method, including:

[0036] The encryptor abstraction layer module is used to define a unified encryptor interface, which includes encryption function pointers, decryption function pointers, and destruction function pointers to enable polymorphic calls to encryption algorithms.

[0037] The encryptor factory module is data-connected to the encryptor abstraction layer module and is used to provide a factory method to dynamically create the corresponding encryptor instance based on the encryptor type enumeration value.

[0038] The encryption sending module is data-connected to the encryption factory module. It is used to parse the application service data unit type identifier of the APDU frame and automatically select the corresponding security protection level according to the business data type before the APDU frame is sent through the TCP socket. It calls the encryption instance to encrypt the APDU frame and assembles it into an encrypted transmission frame before sending it.

[0039] The encrypted receiving module is data-connected to the encryptor factory module. When receiving data via the TCP socket, it automatically determines the frame type by reading the first byte and synchronizes the link encryption status. It performs frame header verification, ciphertext length parsing, ciphertext data reading and decryption restoration on the encrypted transmission frame, and hands the decrypted APDU frame over to the standard protocol processing logic for further processing.

[0040] The above four modules form a complete data flow link. The encryptor abstraction layer module and the encryptor factory module realize algorithm polymorphic calls and dynamic creation. The encrypted sending module and the encrypted receiving module respectively complete differentiated encryption encapsulation and zero-RTT automatic negotiation decryption and restoration at the network I / O layer.

[0041] Furthermore, the encryptor factory module employs an instance reuse mechanism, storing pointers to created encryptor instances in a global static array, so subsequent requests of the same type directly return the existing instance. The encryptor factory module supports AES, DES, RSA, and security platform encryptors. The security platform encryptor internally adopts a dual-channel fault-tolerant architecture that prioritizes remote cryptographic services and degrades local cryptographic computation. The instance reuse mechanism avoids the memory overhead and initialization latency caused by repeated creation, while the dual-channel architecture of the security platform encryptor ensures high availability of cryptographic services.

[0042] Preferably, the system further includes a configuration management module, which is data-connected to the encryptor factory module. This module manages encryption parameters via a configuration file, including a system identifier, system name, peer system name, and the address and port number of the remote cryptographic service. The configuration file is read when the encryptor instance is created; during deployment, only the configuration file parameters need to be modified without recompiling the code. This configuration management mechanism eliminates the need for recompilation during system deployment and parameter adjustments, reducing operational costs.

[0043] Furthermore, it also includes a three-dimensional encryption state management module, which is data-connected to the encryption sending module and the encryption receiving module. This module maintains independent encryption state fields in the link state structure of each link, enabling independent three-dimensional encryption strategy management across the link, algorithm, and data dimensions. The three-dimensional encryption state management module ensures that the encryption strategies of each link are independent. When switching between primary and backup channels, the newly activated link automatically synchronizes its encryption state based on the type of the first received frame, without requiring encryption state migration or renegotiation.

[0044] As a preferred embodiment, the system includes a master station encryption module running on the monitoring system side and a slave station encryption module running on the local control unit side. During master-slave channel switching, the newly activated link automatically synchronizes its encryption status based on the type of the first received frame, eliminating the need for encryption status migration or renegotiation. The system supports simultaneous mixed communication between the master station and both encrypted and unencrypted slave stations. This master-slave deployment method meets the needs of phased security upgrades in actual engineering projects, with automatic encryption status synchronization during master-slave channel switching, requiring no manual intervention.

[0045] Compared with the prior art, the present invention has the following beneficial effects:

[0046] 1. By integrating encryption and decryption operations into network sending and receiving functions, the upper-layer IEC104 protocol processing logic is completely transparent. It is integrated with the protocol stack through a standard interface as an independent static library. Existing IEC104 systems can achieve security upgrades without modifying any upper-layer protocol processing code, overcoming the technical problems of difficult integration and high engineering implementation costs of existing security hardening solutions.

[0047] 2. By implementing polymorphic calls to encryption algorithms through the encryptor abstract interface and factory method, adding a new encryption algorithm only requires implementing three function pointers and adding a new branch to the factory method. No modification to the upper-level calling code is required. It supports smooth expansion from classic cryptographic algorithms to national cryptographic algorithms, overcoming the technical problems of existing national cryptographic schemes relying on dedicated hardware and difficulty in algorithm switching.

[0048] 3. Through the dual-channel fault-tolerant architecture of prioritizing remote cryptographic services and degrading local cryptographic calculations within the encryptor, the channel switching is automatically completed based on the return value of the remote service call, which is completely transparent to the upper-layer calling code. This eliminates the risk of interruption of the encrypted communication link due to a single point of failure of the cryptographic service and overcomes the technical problem of existing encryption schemes that rely on a single cryptographic calculation channel and lack fault tolerance and degradation capabilities.

[0049] 4. By parsing the application service data unit type identifier of the APDU frame, the frame is classified into control frame and monitoring frame. High-security protection such as encryption, digital signature and anti-replay is applied to the control frame, while standard-security protection such as encryption and integrity verification is applied to the monitoring frame. Differentiated security protection for data frames of different service types is realized within the same link, which overcomes the technical problem of existing SSL / TLS solutions that adopt a uniform security policy for all data and cannot distinguish between differentiated security requirements.

[0050] 5. By reading the first byte of the TCP data stream at the receiving end, frame type identification and link encryption status synchronization are completed simultaneously in the same read operation, without introducing any additional handshake round-trip delay. The establishment delay of encrypted communication is completely consistent with that of plaintext communication, overcoming the technical problem of introducing additional handshake round-trip delay in existing SSL / TLS-like schemes.

[0051] 6. By using the encryption status field in the independent link status structure of each communication link, three-dimensional independent encryption strategy management of link dimension, algorithm dimension and data dimension is realized. It supports the mixed deployment of plaintext and ciphertext on different links within the same master station process. When switching between master and backup channels, the newly activated link automatically synchronizes the encryption status according to the type of the first frame. This overcomes the technical problem that existing encryption schemes lack the ability to independently manage the encryption status in multi-channel redundancy scenarios.

[0052] 7. By adding a 3-byte frame header identifier and a 2-byte little-endian ciphertext length field before the ciphertext data to form an encrypted transmission frame, the total fixed overhead is only 5 bytes. The frame header identifier and the IEC104 standard frame start character are naturally mutually exclusive. The receiving end only needs to read the first byte to complete the frame type identification. The parsing logic is efficient and adapts to the high-frequency small frame communication characteristics of the IEC104 protocol.

[0053] 8. Encryption parameters are managed through configuration files. During deployment, only the configuration file parameters need to be modified without recompiling the code. The encryption module is integrated as an independent static library. It has been verified in actual hydropower plant computer monitoring system projects. The system runs stably and continuously. Encryption and decryption operations have no significant impact on communication real-time performance. The project implementation cost is low and it is compatible with the existing IEC104 system. Attached Figure Description

[0054] Figure 1 This is a schematic diagram of the overall architecture of the encrypted communication system for the power monitoring system based on the IEC 60870-5-104 protocol in this embodiment.

[0055] Figure 2 This is a schematic diagram of the cryptographer factory pattern class structure in this embodiment.

[0056] Figure 3 This is a schematic diagram of the encrypted transmission module processing flow in this embodiment.

[0057] Figure 4 This is a schematic diagram of the frame type identification and decryption process of the encrypted receiving module in this embodiment.

[0058] Figure 5 This is a schematic diagram of the encrypted transmission frame format in this embodiment.

[0059] Figure 6 This is a schematic diagram of a complete encrypted communication interaction sequence between the master station and the slave station in this embodiment.

[0060] Figure 7 This is a schematic diagram of the independent management architecture of the three-dimensional encryption strategy in a multi-channel redundancy scenario in this embodiment.

[0061] Figure 8 This is a schematic diagram of the dual-channel fault-tolerant architecture of the security platform encryptor in this embodiment.

[0062] Figure 9 This is a schematic diagram of the routing rules for the differentiated security policy based on the application service data unit type in this embodiment. Detailed Implementation

[0063] The present application will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the following embodiments are used to illustrate the technical solutions of the present application, and are not intended to limit the scope of protection of the present application.

[0064] In one implementation, combined with Figure 1The system architecture shown fully describes the basic implementation process of an encrypted communication system for a power monitoring system based on the IEC 60870-5-104 protocol. This implementation uses a computer monitoring system project of a hydropower plant as an application scenario. The monitoring system's host computer runs the master station encryption module, and each local control unit runs the slave station encryption module. The two sides conduct encrypted communication via the plant's local area network using the IEC104 protocol.

[0065] The encryptor abstraction layer module defines a unified encryptor interface that includes encryption function pointers, decryption function pointers, and destruction function pointers. It enables polymorphic calls to encryption algorithms, decoupling the upper-layer encryption call code from the underlying specific encryption algorithm and supporting plug-and-play replacement.

[0066] Encryptor factory module combination Figure 2 The class structure shown provides a factory method to dynamically create encryptor instances based on the encryptor type enumeration value, supporting four types: AES encryptor, DES encryptor, RSA encryptor, and security platform encryptor. It employs a global static array instance reuse mechanism, checking if an instance of the requested type already exists in the array. If it does, it returns directly; otherwise, it allocates memory for the corresponding structure, binds three function pointers, reads the configuration file's identity parameters, and stores them in the array slot. The security platform encryptor internally adopts a dual-channel fault-tolerant architecture that prioritizes remote cryptographic services and degrades local cryptographic computation. See details... Figure 8 .

[0067] The configuration management module manages the system identifier, system name, peer system name, and address and port number of the remote cryptographic service through a configuration file. The configuration file is read when the encryptor instance is created, and only the configuration file parameters need to be modified during deployment, without recompiling the code.

[0068] Encrypted sending module combined Figure 3 The processing flow shown executes the following steps within the network sending function and before the APDU frame is sent via the TCP socket:

[0069] Parse the 7th byte of the APDU frame to obtain the application service data unit type identifier; if the type identifier belongs to the remote control / remote adjustment command class (including single-point remote control command type identifier value of 45, dual-point remote control command type identifier value of 46, setpoint adjustment command type identifier value of 47, normalized setpoint adjustment type identifier value of 48, short floating-point setpoint adjustment type identifier value of 50 and its long time-scale variant type identifier values ​​of 58, 59, 61, 62, 63), it is determined to be a control frame, and the control command protection interface is called to apply triple protection of encryption, digital signature and anti-replay serial number to the APDU frame;

[0070] If the type identifier belongs to the telemetry / teleinary data category (including single-point telemetry type identifier value of 1, double-point telemetry type identifier value of 3, normalized telemetry value type identifier value of 9, scaled telemetry value type identifier value of 11, short floating-point telemetry value type identifier value of 13, normalized telemetry type identifier value of 21 with quality description, single-point telemetry type identifier value of 30 with time stamp, double-point telemetry type identifier value of 31 with time stamp, etc.), it is determined to be a monitoring frame, and the monitoring data protection interface is called to apply encryption and integrity verification protection to the APDU frame;

[0071] If encryption is successful and the current link encryption status field indicates that encryption is enabled, allocate an N+5 byte buffer, write a 3-byte fixed frame header identifier at offset 0 to 2, write the ciphertext length value in little-endian order at offset 3 to 4, copy N bytes of ciphertext data starting at offset 5, assemble them into an encrypted transmission frame, and send it through a TCP socket; if the encryption operation fails or encryption is not enabled on the link, it will be downgraded to sending the original APDU frame in plaintext to ensure uninterrupted communication.

[0072] Combination Figure 9 The application service data unit type differentiated security policy routing rules shown indicate that the encrypted transmission module performs classification routing on the application service data unit type identifier in the APDU frame:

[0073] The control branch contains remote control / remote adjustment command type identifiers (single-point remote control command type identifier value is 45, dual-point remote control command type identifier value is 46, setpoint adjustment command type identifier value is 47, normalized setpoint adjustment type identifier value is 48, short floating-point setpoint adjustment type identifier value is 50 and its long timescale variant type identifier values ​​58, 59, 61, 62, 63). This branch is routed to the control command protection interface, which applies triple protection to the APDU frame: encryption, digital signature, and anti-replay serial number.

[0074] The monitoring branch contains remote signaling / telemetry data type identifiers (single-point remote signaling type identifier value is 1, two-point remote signaling type identifier value is 3, normalized telemetry value type identifier value is 9, scaled telemetry value type identifier value is 11, short floating-point telemetry value type identifier value is 13, normalized telemetry type identifier value with quality description is 21, time-stamped single-point remote signaling type identifier value is 30, and time-stamped two-point remote signaling type identifier value is 31). This branch is routed to the monitoring data protection interface to apply encryption and integrity verification protection to the APDU frame.

[0075] The security effects of differentiated routing are compared as follows: For control frames (typical frame length is about 14 bytes), after high-security processing, the encrypted frame contains SM4 encrypted APDU ciphertext, SM2 digital signature (about 64 bytes), anti-replay monotonically increasing sequence number (8 bytes), and message authentication code. Even if an attacker intercepts and attempts to replay the encrypted frame, the verification interface of the receiving end will detect the duplicate sequence number or signature mismatch and refuse to execute, effectively preventing serious accidents such as circuit breaker malfunction.

[0076] For monitoring frames (typically about 26 bytes long), after standard security level processing, the encrypted frame contains SM4 encrypted APDU ciphertext and SM3 message authentication code (32 bytes). This ensures data confidentiality and integrity without introducing additional computation and bandwidth overhead for digital signatures, while also taking into account the real-time requirements of high-frequency transmission of monitoring data. Figure 9 The classification tree structure intuitively displays the type identification range of the above two branches and their corresponding security protection level mapping relationship, covering the most commonly used control and monitoring data frame types in the IEC104 protocol in new energy power plants.

[0077] Combination Figure 5 The encrypted transmission frame format shown consists of three fields concatenated sequentially: a 3-byte frame header identifier (fixed values ​​0xAA, 0xAA, 0xAA) at offsets 0 to 2, a 2-byte ciphertext length field at offsets 3 to 4 (in little-endian order, with the lower 8 bits first and the higher 8 bits last), and N bytes of ciphertext data at offsets 5 to N+4. The total length of the encrypted transmission frame is N+5 bytes.

[0078] The first byte of the frame header identifier, 0xAA, is naturally mutually exclusive with the fixed start character 0x68 mandated by the IEC104 international standard. The receiving end can complete the frame type determination in the same TCP read operation by reading the first byte, without the need for additional type negotiation overhead.

[0079] The ciphertext length field uses 2-byte little-endian encoding, supporting a maximum ciphertext length of 65535 bytes, far exceeding the actual requirement of the IEC104 protocol's maximum APDU length of 253 bytes. The fixed overhead of the encrypted transmission frame is only 5 bytes. Considering that a typical IEC104 protocol telemetry frame is about 30 bytes, the additional overhead is about 16.7%; considering that the maximum APDU frame is 253 bytes, the additional overhead is only about 2.0%, with minimal impact on communication bandwidth, adapting to the high-frequency, small-frame communication characteristics of the IEC104 protocol.

[0080] The link test frame (TESTFR act / con, U frame, 4 bytes in length) is always sent and received in the standard IEC104 plaintext format (first byte 0x68), without encryption or decryption, ensuring that the link activity detection does not depend on the normal operation of the encryption module.

[0081] Encrypted receiving module combined Figure 4 The processing flow shown performs the following processing on the data received from the TCP socket within the network receive function:

[0082] Read the first byte and determine its value; if the first byte is the start character of the IEC104 standard frame, set the current link encryption status field to plaintext mode and process it according to the standard IEC104 protocol frame parsing process; if the first byte is the preset encrypted frame identifier, set the current link encryption status field to encryption mode, continue to read the next 4 bytes and verify the integrity of the frame header identifier. If the verification fails, it is determined to be an invalid frame and the link is disconnected.

[0083] After successful verification, the next 2 bytes are parsed into a ciphertext length value N in little-endian order. N bytes of ciphertext data are read from the TCP socket, and the decryption function of the encryptor instance is called to restore it into a standard IEC104 APDU frame, which is then handed over to the standard protocol processing logic for further processing.

[0084] If the decryption operation fails or the plaintext length is abnormal, an alarm log containing the link number, peer address and reason for failure will be recorded, the current TCP connection will be disconnected, and the link will be automatically rebuilt.

[0085] The frame type identification and link encryption status synchronization mentioned above are completed in the same TCP read operation that reads the first byte, without introducing additional handshake round-trip delay.

[0086] 3D encryption status management module combined Figure 7 The architecture shown maintains an independent encryption state field in the link state structure of each link, realizing three-dimensional independent encryption strategy management of link dimension × algorithm dimension × data dimension, and supporting plaintext and ciphertext hybrid deployment of up to 8 links.

[0087] The link dimension maintains the encryption enable state independently for each communication link, and the encryption state field values ​​of each link are independent of each other; the algorithm dimension configures the encryption algorithm type independently for each link, and creates different types of encryptor instances for different links through the factory method; the data dimension automatically selects the security protection level according to the application service data unit type identifier within the same link, with control frames using high security level protection and monitoring frames using standard security level protection.

[0088] Each of the three-dimensional strategies can be configured, modified, and combined independently, supporting a total of 8 links × multiple algorithms × 2 security levels of strategy combination.

[0089] In another implementation, combined Figure 8 The dual-channel fault-tolerant architecture shown describes in detail the implementation process of the dual-channel fault-tolerant encryption in the security platform's encryptor.

[0090] During normal operation, the encryptor's encryption function sends data and identity parameters to the remote cryptographic service via the HTTP protocol. The remote cryptographic service uses a hardware security module or a software cryptographic module to perform encryption operations using the national cryptographic algorithm and generate digital signatures, and returns the ciphertext via an HTTP response.

[0091] When the remote cryptographic service is unavailable (including HTTP connection timeout, service error status code return, network unreachable), the degradation logic inside the encryptor is automatically triggered, skipping the HTTP call and directly performing encryption and decryption operations using the local encryption algorithm library; channel switching is automatically completed based on the return value of the remote service call, which is completely transparent to the upper-layer calling code; the channel status is determined independently for each encryption operation, and when the remote service is restored to availability, subsequent encryption requests are automatically switched back to the remote channel without manual intervention.

[0092] In a real-world engineering verification at a hydropower plant, after the remote cryptographic service was manually stopped, the first encryption request automatically switched to the local encryption channel after a timeout was detected. The switchover was automatically switched back after the remote service was restored. The entire switching process had no impact on the IEC104 communication link.

[0093] In another implementation, the process of managing and implementing a three-dimensional independent encryption strategy is described in a scenario where the main station is configured with eight redundant communication links.

[0094] Each link state structure independently maintains an encryption state field, initially defaulting to plaintext mode. After a link is activated, the receiving end automatically sets the encryption state field based on the type of the first received frame, without the need for encryption state migration or renegotiation. Different links can specify different encryptor types through configuration files, for example, link 1 can be configured with an AES encryptor, and link 2 can be configured with a security platform encryptor.

[0095] Within the same link, the sending function automatically routes the security level based on the application service data unit type identifier; when switching between primary and backup channels, the newly activated link automatically synchronizes the encryption status based on the first frame type; the system supports the master station to conduct mixed communication with both encrypted and unencrypted slave stations simultaneously, meeting the needs of phased security upgrades in engineering projects.

[0096] In some implementations, the specific implementation of a multi-layered degradation fault tolerance strategy is described. The first layer of degradation is cryptographic service degradation: when the remote cryptographic service is unavailable, the encryptor automatically switches from the remote cryptographic service channel to the local cryptographic calculation channel, ensuring uninterrupted encrypted communication. The second layer of degradation is encrypted transmission degradation: when encryption operation fails or the encryption status field of the current link indicates that encryption is not enabled, it automatically falls back to plaintext transmission mode, directly sending the original APDU frame via TCP socket; when decryption fails, an alarm log is recorded and the current TCP connection is actively disconnected, triggering automatic link reconstruction. These two layers of degradation are progressively enhanced to ensure uninterrupted communication under any cryptographic module malfunction.

[0097] In another implementation, combined Figure 6 The master-slave encrypted communication interaction sequence shown in the figure fully describes the six-stage interaction process of a master-slave encrypted communication.

[0098] Phase 1 (TCP Connection Establishment): The master station's link management thread actively initiates a TCP connection request to the slave station, with the target port being IEC104 standard port 2404 or the port number specified in the configuration file; the slave station's link management thread calls accept() to accept the connection, and after completing the TCP three-way handshake, both parties enter the connection establishment state.

[0099] Phase Two (IEC104 Link Startup): The master station sends a start data transmission U-frame (STARTDT act), and the slave station replies with a start data transmission confirmation U-frame (STARTDT con) upon receiving it. The link status of both parties changes from inactive to active, and data interaction begins. The above start frames are sent and received in standard IEC104 plaintext format (first byte 0x68) without encryption.

[0100] Phase 3 (Initialization and General Call): The master station sends a general call command frame, and the slave stations reply with general call confirmation frames in sequence and upload full telemetry and telecontrol data in batches; the slave station sends an initialization end frame to notify the master station that initialization is complete and normal data interaction can be performed; the above initialization frames determine whether to encrypt and encapsulate based on the link encryption status field.

[0101] Phase 4 (Bilibilitative Data Interaction): The station-side network sending function performs ASDU type identification and differentiated encryption encapsulation on each APDU frame to be sent (including periodic telemetry and teleindication uploads, emergency event uploads, remote control return confirmation frames, etc.), assembles it into an encrypted transmission frame, and then sends it.

[0102] The master station's network receiving function reads the first byte. If it is a preset encrypted frame identifier, it enters the decryption process, parses the frame header to obtain the ciphertext length, reads the ciphertext data, calls the decryption function to restore it to a standard APDU frame, and then sends it to the standard protocol processing logic. The master station's sending function and the slave station's receiving function execute a symmetrical encryption sending and decryption receiving process. Figure 6 The zero-RTT encryption state negotiation point is marked in the code. The first data frame after the link is activated carries encryption state information. The receiving end completes the communication mode determination while parsing the first byte, without the need for a separate key negotiation stage.

[0103] Phase 5 (Link Maintenance and Test Frame Processing): After the link idle timeout, both parties maintain link activity through test frames (TESTFRact / con, U frames); test frames are always sent and received in standard IEC104 plaintext format without encryption or decryption, ensuring that link status detection does not depend on the normal operation of the encryption module, and the zero RTT characteristic of link activity detection also applies to encrypted communication links.

[0104] Phase Six (Exception Handling and Degradation): If the decryption operation fails, an alarm log containing the link number, peer address, and reason for failure is recorded. The current TCP connection is actively disconnected and the link is automatically rebuilt. If the encryption operation fails, the original APDU frame is automatically downgraded to plaintext to ensure that communication is not completely interrupted due to encryption module malfunction. If the link is disconnected due to timeout, the link management thread automatically triggers TCP reconnection. After successful reconnection, the encrypted communication link is re-established according to Phases Two to Four. The newly activated link automatically synchronizes the encryption status according to the type of the first frame received, without manual intervention.

[0105] In some embodiments, an industrial application example of the present invention in a computer monitoring system of a hydropower plant is described.

[0106] Deployment scenario: Two operator stations that also serve as monitoring servers in the power plant's central control room run IEC104 master station encryption modules. A total of six local units, including four sets of unit local control units and two sets of common local control units, each run IEC104 slave station encryption modules. The master station connects to each slave station via the plant's gigabit Ethernet and uses the IEC104 protocol for real-time bidirectional data interaction.

[0107] Communication architecture: The master station is configured with 8 redundant communication links (1 link for each local control unit plus 2 shared backup links), and the slave station supports simultaneous connection of multiple master stations (simultaneous connection of dual-machine hot standby master stations); a security platform encryptor is adopted, and the key is uniformly managed by the power plant power monitoring system security protection platform.

[0108] Communication overhead: The fixed overhead of a single-link encrypted transmission frame is 5 bytes. The additional overhead is about 16.7% based on a typical telemetry frame of 30 bytes and about 2.0% based on a maximum APDU frame of 253 bytes. The latency of single-frame encryption and decryption operations is in the microsecond range, which has no significant impact on the real-time performance of communication.

[0109] Operational Results: The system ran continuously for over 720 hours without any communication interruptions, bit errors, or timing anomalies during encryption and decryption operations. Encryption status was automatically synchronized during link switching, requiring no manual intervention. In the event of a remote cryptographic service failure, the system automatically switched to the local encryption channel and automatically switched back upon service recovery. The entire switching process had no impact on the IEC104 communication link. The system meets the reliability and security requirements of power monitoring systems, is compatible with existing IEC104 protocol stacks, and has low implementation costs.

[0110] In another implementation, comparative experimental data demonstrates the performance advantages of the zero-additional-round-trip-latency encrypted state negotiation mechanism over traditional TLS schemes.

[0111] In a local area network environment (round-trip latency less than 1 millisecond), from the establishment of a TCP connection to the transmission of the first frame of IEC104 encrypted data, the latency of the present invention is approximately the TCP three-way handshake latency plus the STARTDT frame interaction latency (approximately 2 milliseconds), which is completely consistent with traditional plaintext IEC104 communication. Under the same conditions, the latency of the TLS 1.2 scheme is increased by approximately 8 milliseconds (the TLS handshake requires 4 round trips), including ClientHello / ServerHello interaction, certificate exchange, and key negotiation processes.

[0112] In a wide area network environment (round-trip latency of 50 milliseconds), the additional latency of the TLS 1.2 scheme reaches approximately 200 milliseconds. Although the link startup timing of the IEC104 protocol (T1 / T2 / T3 parameters are usually set at the level of 15 seconds / 10 seconds / 20 seconds) does not directly cause timeouts, in multi-channel redundancy scenarios with frequent link switching, the cumulative latency will significantly affect the system response performance.

[0113] The encryption state negotiation of this invention fully reuses the normal data stream of the IEC104 protocol—the receiving end reads the first byte (1 byte) and simultaneously completes frame type identification and link encryption state synchronization (when the first byte is the start character of the IEC104 standard frame, it is set to plaintext mode; when the first byte is the preset encrypted frame identifier, it is set to encrypted mode). No independent handshake round-trip process is required, and the encryption communication establishment delay is zero with zero additional round-trip delay. It is particularly suitable for time-sensitive industrial real-time control application scenarios of the IEC104 protocol.

[0114] The technical solution disclosed in this embodiment achieves the following technical effects through the synergistic effect of the above-mentioned technical features:

[0115] Encryption and decryption operations are performed within the network sending and receiving functions, which are completely transparent to the upper-layer IEC104 protocol processing logic. Existing IEC104 systems can achieve security upgrades without modifying any upper-layer protocol processing code.

[0116] The encryptor abstract interface and factory method implement polymorphic support for encryption algorithms. To add a new encryption algorithm, only three function pointers need to be implemented and a new branch needs to be added to the factory method.

[0117] The dual-channel fault-tolerant architecture of the security platform encryptor eliminates the risk of communication interruption caused by a single point of failure in the cryptographic service; the frame-level differentiated security policy based on the application service data unit type identifier applies triple protection to control frames and standard protection to monitoring frames within the same link, balancing security and real-time performance.

[0118] The receiving end completes frame type identification and link encryption state synchronization in the same TCP read operation by reading the first byte, achieving zero additional handshake round-trip latency;

[0119] The three-dimensional independent encryption strategy management supports multi-link plaintext-ciphertext hybrid deployment and seamless primary / backup switching; the encrypted transmission frame only adds 5 bytes of fixed overhead, and the frame header identifier is naturally mutually exclusive with the IEC104 standard frame start character, making the parsing logic highly efficient.

[0120] The encryption module is integrated with the protocol stack as an independent static library through a standard interface. During deployment, only the configuration file parameters need to be modified, resulting in low engineering implementation costs. The multi-layered degradation strategy ensures that communication is not interrupted in the event of any cryptographic module failure.

[0121] The above modules work together to achieve a complete closed loop of transparent encryption integration, differentiated security protection, zero RTT state negotiation, independent management of multiple links, and high availability and fault tolerance.

[0122] It is understood that the specific implementation methods of the aforementioned encryptor type, frame header identifier, remote cryptographic service channel protocol, and encryption status field type are not limited to those described above. The encryptor type can also be a dedicated implementation of the national cryptographic standard SM2 / SM3 / SM4 or a post-quantum cryptographic algorithm. The frame header identifier can also adopt other preset identifier byte sequences that are naturally mutually exclusive with the IEC104 standard frame start character. The remote cryptographic service channel can also use other remote procedure call protocols to communicate with the security platform backend. The encryption status field type can be flexibly selected according to the actual number of links and policy complexity. The above parameters and implementation methods can be flexibly configured according to specific application scenarios and deployment conditions. All the above variations are within the protection scope of this application.

Claims

1. A method for encrypted communication in a power monitoring system based on the IEC 60870-5-104 protocol, characterized in that, Includes the following steps: S1: Based on the encryptor type specified in the configuration file, call the encryptor factory method to create the corresponding encryptor instance; S2: Before the Application Layer Protocol Data Unit (APDU) frame is sent through the TCP socket, the Application Service Data Unit Type Identifier in the APDU frame is parsed, and the current frame is classified into a control frame or a monitoring frame according to the type identifier. A high-security protection strategy is applied to the control frame, and encryption, digital signature and anti-replay protection are performed on the APDU frame to generate ciphertext data; The monitoring frames are protected by a standard security level policy, and the APDU frames are protected by encryption and integrity verification to generate ciphertext data. S3: Add a frame header identifier and a ciphertext length field before the ciphertext data, assemble them into an encrypted transmission frame, and send them through a TCP socket; S4: When receiving data on the TCP socket, read the first byte and determine its value: if the first byte is the start character of an IEC104 standard frame, it is determined to be a standard IEC104 plaintext frame, the current link encryption state is set to plaintext mode, and the process is switched to standard IEC104 frame parsing; if the first byte is a preset encryption frame identifier, it is determined to be an encrypted transmission frame, and the current link encryption state is set to encryption mode; the determination of the encryption state is completed in the same TCP read operation of reading the first byte, without introducing additional handshake round-trip delay; S5: For the encrypted transmission frame, verify the integrity of the frame header identifier; read the ciphertext length field and parse it into a ciphertext length value; read the ciphertext data according to the ciphertext length value; S6: Call the decryption function of the encryptor instance to decrypt the ciphertext data, restore it to a standard IEC104 APDU frame, and hand it over to the standard IEC104 protocol processing logic for further processing.

2. The encrypted communication method for a power monitoring system according to claim 1, characterized in that, The control frames include frames whose application service data unit type identifier belongs to the remote control / teleadjustment command class, specifically including: The identifier values ​​for single-point remote control command type are 45, dual-point remote control command type are 46, setpoint adjustment command type are 47, normalized setpoint adjustment type are 48, short floating-point setpoint adjustment type are 50, and the identifier values ​​for long timescale variants of the above types are 58, 59, 61, 62, and 63, respectively. The monitoring frames include frames whose application service data unit type identifier belongs to the remote signaling / telemetry data class, specifically including: single-point remote signaling type identifier value of 1, two-point remote signaling type identifier value of 3, normalized telemetry value type identifier value of 9, scaled telemetry value type identifier value of 11, short floating-point telemetry value type identifier value of 13, normalized telemetry type identifier value with quality description of 21, time-stamped single-point remote signaling type identifier value of 30, and time-stamped two-point remote signaling type identifier value of 31.

3. The encrypted communication method for a power monitoring system according to claim 1, characterized in that, The encryptor instance employs a dual-channel fault-tolerant architecture that prioritizes remote cryptographic services and degrades local cryptographic computation. Channel 1 is a remote cryptographic service channel, which sends data and identity parameters to the remote cryptographic service for encryption and decryption operations via the HTTP protocol; when the remote cryptographic service is unavailable, the encryptor automatically switches to Channel 2 and uses the local encryption algorithm library to directly perform encryption and decryption operations. The channel switching is automatically completed internally by the encryptor based on the return value of the remote cryptographic service call, and is completely transparent to the upper-layer encryption call code.

4. The encrypted communication method for a power monitoring system according to claim 1, characterized in that, The frame format of the encrypted transmission frame is as follows: The encrypted transmission frame consists of a 3-byte frame header identifier at offset 0 to 2, a 2-byte ciphertext length field at offset 3 to 4 (in little-endian), and N bytes of ciphertext data at offset 5 to N+4. The total length of the encrypted transmission frame is N+5 bytes, where N is the actual number of bytes of the ciphertext data.

5. The encrypted communication method for a power monitoring system according to claim 1, characterized in that, Each communication link maintains its encrypted communication state through an encryption state field in an independent link state structure, enabling three-dimensional independent encryption policy management across the link, algorithm, and data dimensions. The link dimension maintains an independent encryption enable state for each communication link, and the encryption state field values ​​of each link are independent of each other; The algorithm dimension allows for independent configuration of encryption algorithm types for each communication link, and the encryption factory method creates different types of encryption instance for different links; The data dimension automatically selects the security protection level based on the application service data unit type identifier within the same link; the control frame adopts high security level protection; the monitoring frame adopts standard security level protection. The three-dimensional strategies can be configured, modified, and combined independently.

6. The encrypted communication method for a power monitoring system according to claim 1, characterized in that, The method employs a multi-layered degradation fault tolerance strategy: The first-level degradation is that when the remote cryptographic service is unavailable, the encryptor automatically switches from the remote cryptographic service channel to the local cryptographic calculation channel, so that encrypted communication is not interrupted. The second-level degradation involves automatically falling back to plaintext transmission mode when encryption fails or the encryption status field of the current link indicates that encryption is not enabled, and directly sending the original APDU frame through the TCP socket; when decryption fails, an alarm log is recorded and the current TCP connection is actively disconnected, triggering automatic link reconstruction.

7. The encrypted communication method for a power monitoring system according to claim 1, characterized in that: The encryption and decryption operations are performed within the network sending and receiving functions, and are completely transparent to the upper-layer IEC104 protocol processing logic. The encryptor is integrated with the IEC104 protocol stack via a standard interface as an independent static library, without requiring modification of the upper-layer protocol processing code. To add a new encryption algorithm, it is only necessary to implement the encryption function pointer, decryption function pointer, and destruction function pointer of the encryptor interface and add the corresponding branch in the encryptor factory method, without modifying the upper-layer calling code.

8. A power monitoring system encrypted communication system based on the IEC 60870-5-104 protocol, used to implement the method described in any one of claims 1 to 7, characterized in that, include: The encryptor abstraction layer module is used to define a unified encryptor interface, which includes encryption function pointers, decryption function pointers, and destruction function pointers to enable polymorphic calls to encryption algorithms. The encryptor factory module is data-connected to the encryptor abstraction layer module and is used to provide a factory method to dynamically create the corresponding encryptor instance based on the encryptor type enumeration value. The encryption sending module is data-connected to the encryption factory module. It is used to parse the application service data unit type identifier of the APDU frame and automatically select the corresponding security protection level according to the business data type before the APDU frame is sent through the TCP socket. It calls the encryption instance to encrypt the APDU frame and assembles it into an encrypted transmission frame before sending it. The encrypted receiving module is data-connected to the encryptor factory module. When receiving data via the TCP socket, it automatically determines the frame type by reading the first byte and synchronizes the link encryption status. It performs frame header verification, ciphertext length parsing, ciphertext data reading and decryption restoration on the encrypted transmission frame, and hands the decrypted APDU frame over to the standard protocol processing logic for further processing.

9. The encrypted communication system for power monitoring system according to claim 8, characterized in that: The encryption factory module adopts an instance reuse mechanism, storing the pointers of the created encryption instances in a global static array, so that subsequent requests of the same type can directly return the existing instance. The encryption factory module supports encryption types including AES encryption, DES encryption, RSA encryption, and security platform encryption. The security platform's encryptor employs a dual-channel fault-tolerant architecture that prioritizes remote cryptographic services and degrades local cryptographic computation.

10. The encrypted communication system for power monitoring system according to claim 8, characterized in that, It also includes a configuration management module and a 3D encryption status management module: The configuration management module is data-connected to the encryptor factory module and is used to manage encryption parameters through a configuration file. The encryption parameters include system identifier, system name, peer system name, and the address and port number of the remote cryptographic service. The configuration file is read when the encryptor instance is created, and only the parameters of the configuration file need to be modified during deployment without recompiling the code. The three-dimensional encryption state management module is data-connected to the encryption sending module and the encryption receiving module. It is used to maintain independent encryption state fields in the link state structure of each link, so as to realize three-dimensional independent encryption strategy management of link dimension, algorithm dimension and data dimension.

11. The encrypted communication system for power monitoring system according to claim 8, characterized in that, The system includes a master station encryption module running on the monitoring system side and a slave station encryption module running on the local control unit side; when switching between master and backup channels, the newly activated link automatically synchronizes the encryption status according to the type of the first frame received, without the need for encryption status migration or renegotiation; The system supports simultaneous mixed communication between the master station and both encrypted and unencrypted slave stations.

Images