Power distribution network heterogeneous link secure transmission method and system based on graph cut algorithm

Abstract

The application is suitable for the technical field of electric power communication, and provides a power distribution network heterogeneous link security transmission method and system based on a graph cut algorithm, which comprises the following steps: acquiring the topological structure and link state information of a power distribution network heterogeneous communication network, and constructing a weighted directed graph model containing nodes and heterogeneous links; comprehensively considering the bandwidth, delay and channel physical security characteristics of the heterogeneous links, establishing a link comprehensive evaluation model and calculating the comprehensive weights of the links; taking the source node and the destination node as terminals, solving the weighted directed graph model based on the graph cut algorithm, finding the optimal graph cut and the safe transmission path; and distributing the power distribution network data flow to the corresponding heterogeneous links according to the solving result of the graph cut algorithm. The application comprehensively considers the available bandwidth, transmission delay and physical layer security characteristics of the links, establishes a link comprehensive evaluation model through extreme value normalization and weighted summation, and uniformly quantifies the multi-dimensional heterogeneous indexes into comprehensive weights.

Description

Technical Field

[0001] This invention belongs to the field of power communication technology, and in particular relates to a secure transmission method and system for heterogeneous links in power distribution networks based on graph cut algorithm. Background Technology

[0002] With the deepening of smart grid and digital transformation, the power distribution network has evolved from a traditional unidirectional power distribution network into a highly information-based energy Internet of Things. Different links exhibit significant differences in bandwidth capacity, transmission latency, bit error rate characteristics, and physical layer security performance. Furthermore, dynamic changes in network topology, time-varying link quality, and the differentiated security requirements of various services pose severe challenges to data transmission.

[0003] Current mainstream transmission schemes primarily rely on shortest path priority strategies based on OSPF or RIP protocols. These methods use only hop count or a single latency metric as the basis for routing decisions, completely ignoring the real-time occupancy status of available link bandwidth and the quantitative assessment of channel physical security characteristics. In hybrid networking scenarios, this deficiency leads to routing selection being unable to adapt to the multidimensional performance differences of heterogeneous links. For example, when a fiber optic link experiences bandwidth saturation due to video surveillance services, the system may still prioritize that link, ignoring 5G links with higher remaining bandwidth and stronger anti-interference capabilities.

[0004] Meanwhile, existing security mechanisms generally adopt end-to-end fixed encryption strategies, implementing high-strength encryption indiscriminately on fiber optic links and open wireless channels. This not only causes unnecessary consumption of computing resources and increased latency on physically isolated links, but also fails to provide dynamic security protection for wireless links that matches their high-risk characteristics.

[0005] To address the aforementioned issues, existing technologies urgently need improvement. Summary of the Invention

[0006] The purpose of this invention is to provide a secure transmission method and system for heterogeneous links in a power distribution network based on a graph cut algorithm, in order to solve the above-mentioned problems.

[0007] This invention is implemented as follows: a secure transmission method for heterogeneous links in a distribution network based on a graph cut algorithm, comprising the following steps: S1. Obtain the topology and link status information of the heterogeneous communication network of the distribution network, and construct a weighted directed graph model containing nodes and heterogeneous links; S2. Taking into account the bandwidth, delay, and channel physical security characteristics of heterogeneous links, establish a comprehensive link evaluation model and calculate the comprehensive weight of each link. S3. Using the source node and the destination node as terminals, solve the weighted directed graph model based on the graph cut algorithm to find the optimal graph cut and secure transmission path that minimizes the global transmission cost and satisfies the weighted optimization conditions for link security performance. S4. Based on the solution results of the graph cut algorithm, the data stream of the distribution network is allocated to the corresponding heterogeneous links, and differentiated adaptive secure encapsulation transmission is performed according to the link medium type.

[0008] As a further aspect of the present invention, the process of constructing the weighted directed graph model in step S1 is as follows: The communication terminals, gateways, and control centers in the power distribution network are abstracted as a set of nodes in a graph, and the heterogeneous communication links between nodes are abstracted as a set of directed edges. A directed weighted graph is constructed, in which the weight matrix corresponds to the set of directed edges.

[0009] As a further aspect of the present invention, the model for calculating the comprehensive weight of directed heterogeneous links between nodes in step S2 is as follows: The normalized available link bandwidth is multiplied by the bandwidth weight allocation coefficient, plus the normalized link transmission delay (one minus the normalized value) and then multiplied by the delay weight allocation coefficient. Finally, the normalized link security assessment index is multiplied by the security weight allocation coefficient. The sum is used as the comprehensive weight of the directed heterogeneous link. The sum of the three weight allocation coefficients equals one, and the link security assessment index is obtained by mapping the current measured signal-to-noise ratio of the link.

[0010] As a further aspect of the present invention, the parameters in the model method are subjected to dimensionless normalization using an extremum mapping formula, specifically: The normalized available bandwidth of the link is equal to the difference between the current measured available bandwidth value and the minimum available bandwidth value in the historical statistical period, divided by the difference between the maximum and minimum available bandwidth values. The normalized link transmission delay is equal to the difference between the current measured transmission delay value and the minimum transmission delay value within the historical statistical period, divided by the difference between the maximum and minimum transmission delay values. The normalized link security assessment index is equal to the current measured signal-to-noise ratio (SNR) value minus the difference between the minimum SNR values ​​within the historical statistical period, divided by the difference between the maximum and minimum SNR values.

[0011] As a further aspect of the present invention, the process of solving the problem based on the graph cut algorithm in step S3 specifically includes: The data source node and the data destination node are respectively used as the source and sink nodes of the graph cut algorithm; the cut set of a graph is defined as the set of edges that divide the set of nodes into two disjoint subsets, where the source node belongs to the first subset and the destination node belongs to the second subset; Based on the maximum flow minimum cut theorem, the minimum cut set is obtained by using the weight matrix as the capacity constraint. The minimum cut set is identified as the set of security-vulnerable bottlenecks in the heterogeneous links of the distribution network. After avoiding the set of security-vulnerable bottlenecks in the routing topology, a safe transmission path is planned in the remaining security subgraph based on the shortest path first strategy. After circumventing the set of security vulnerabilities, if there is still a connected path from the source node to the destination node in the remaining security subgraph, a secure transmission path is planned based on the shortest path first strategy; if there is no connected path, the minimum cut set is degenerated into the second smallest cut set, and path planning is performed again until a connected path exists.

[0012] As a further aspect of the present invention, the process of performing differentiated adaptive secure encapsulation transmission in step S4 specifically includes: Obtain the physical medium type of each link in the planned secure transmission path; If the current hop is a fiber optic link, then the first level of encryption strategy is used; If the current hop is a 5G wireless link or a power line carrier link, a second-level hybrid encryption strategy with a security strength higher than the first level is adopted.

[0013] As a further aspect of the present invention, the method also includes a dynamic graph update mechanism based on time windows: During system operation, a sliding time window is set, with the value ranging from 30 seconds to 300 seconds; the parameter fluctuations of heterogeneous links are monitored in real time. When the maximum relative change rate of any normalized link available bandwidth, normalized link transmission delay, or normalized link security assessment index between nodes exceeds the preset tolerance threshold within the time window, step S2 is triggered to recalculate the comprehensive weight and drive the graph cut algorithm to dynamically update the routing strategy. Meanwhile, when the rate of change of a single sample value of any link parameter relative to the previous sample value exceeds the preset emergency threshold, the weight recalculation is immediately triggered, without being limited by the period of the sliding time window. The maximum relative rate of change is calculated by dividing the difference between the maximum and minimum values ​​of the parameter within the time window by the average value of the parameter within the time window.

[0014] The present invention also provides a secure transmission system for heterogeneous links in a distribution network based on a graph cut algorithm, applicable to the secure transmission method for heterogeneous links in a distribution network based on a graph cut algorithm as described in any one of claims 1 to 7, characterized in that the system comprises: The topology graph construction module is used to obtain the topology and link status information of the heterogeneous communication network of the power distribution network, and construct a weighted directed graph model containing nodes and heterogeneous links. The comprehensive evaluation module is used to comprehensively consider the bandwidth, delay, and channel physical security characteristics of heterogeneous links, establish a comprehensive evaluation model for links, and calculate the comprehensive weight of each link. The graph cut solution module is used to solve the weighted directed graph model with the source node and the destination node as the terminals, based on the graph cut algorithm, to find the optimal graph cut and secure transmission path that minimizes the global transmission cost and satisfies the weighted optimization conditions of link security performance. The secure transmission execution module is used to allocate the power distribution network data stream to the corresponding heterogeneous links based on the solution results of the graph cut algorithm, and to perform differentiated adaptive secure encapsulation transmission according to the link medium type.

[0015] As a further aspect of the present invention, the process of constructing a weighted directed graph model in the topology graph construction module is as follows: The communication terminals, gateways, and control centers in the power distribution network are abstracted as a set of nodes in a graph, and the heterogeneous communication links between nodes are abstracted as a set of directed edges. A directed weighted graph is constructed, in which the weight matrix corresponds to the set of directed edges.

[0016] As a further aspect of the present invention, the model for calculating the comprehensive weight of directed heterogeneous links between nodes during the operation of the comprehensive evaluation module is as follows: The normalized available link bandwidth is multiplied by the bandwidth weight allocation coefficient, plus the normalized link transmission delay (one minus the normalized value) and then multiplied by the delay weight allocation coefficient. Finally, the normalized link security assessment index is multiplied by the security weight allocation coefficient. The sum is used as the comprehensive weight of the directed heterogeneous link. The sum of the three weight allocation coefficients equals one, and the link security assessment index is obtained by mapping the current measured signal-to-noise ratio of the link.

[0017] Compared with the prior art, the beneficial effects of the present invention are as follows: This invention comprehensively considers the available bandwidth, transmission delay, and physical layer security characteristics (signal-to-noise ratio) of a link. It establishes a comprehensive link evaluation model through extreme value normalization and weighted summation, unifying multi-dimensional heterogeneous indicators into a unified comprehensive weight. Compared to traditional routing protocols that rely solely on hop count or single delay, this method accurately reflects the true transmission cost and security reliability of each link. It enables the graph cut algorithm to search for the optimal transmission path that balances performance and security globally, significantly improving the routing decision quality of heterogeneous distribution networks.

[0018] By utilizing the maximum flow minimum cut theorem, the minimum cut set is identified as a set of security-vulnerable bottlenecks in heterogeneous links of the distribution network. This bottleneck set is proactively avoided during routing planning, thus preventing data flow from passing through links that are vulnerable to attack or have a high risk of failure. Furthermore, if the remaining subgraph is not connected after avoidance, it automatically degenerates into the second smallest cut set and iteratively replans, ensuring that a usable transmission path can still be found under extreme conditions, effectively enhancing the survivability and resilience of distribution network communication.

[0019] Furthermore, a sliding time window is set to monitor the fluctuations of link parameters (bandwidth, latency, signal-to-noise ratio) in real time. When the maximum relative rate of change of any parameter within the window exceeds the tolerance threshold, weight recalculation and graph cut route update are automatically triggered. Simultaneously, if the rate of change of a single sample exceeds the emergency threshold, an update is triggered immediately, regardless of the time window period. This mechanism can smooth out short-term noise and quickly respond to sudden link deterioration, significantly shortening the convergence time of traditional routing protocols, effectively avoiding the risk of data loss or hijacking, and ensuring the continuous and reliable operation of distribution network services. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention.

[0021] Figure 1 This is a flowchart of a secure transmission method for heterogeneous links in a power distribution network based on a graph cut algorithm.

[0022] Figure 2 The logic diagram for graph cut solving and path planning is shown.

[0023] Figure 3 This is a block diagram of the structural composition of a secure transmission system for heterogeneous links in a power distribution network based on the graph cut algorithm. Detailed Implementation

[0024] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0025] The specific implementation of the present invention will be described in detail below with reference to specific embodiments.

[0026] like Figure 1 and Figure 2 As shown, a method for secure transmission of heterogeneous links in a distribution network based on a graph cut algorithm, according to an embodiment of the present invention, includes the following steps: S1. Obtain the topology and link status information of the heterogeneous communication network in the distribution network, and construct a weighted directed graph model containing nodes and heterogeneous links. Specifically, network information can be obtained in various ways. For example, the connection relationships and current operating status between various communication devices in the network can be obtained through manual configuration by the network administrator or periodic manual input. Alternatively, a Network Management System (NMS) can be deployed to periodically poll communication terminals, gateways, and control centers in the distribution network, automatically collecting their topology connection information and real-time link status data. When constructing the weighted directed graph model, one implementation is to simply abstract all communication devices in the network as nodes in the graph, abstract the physical connections between devices as edges, and assign an initial fixed weight to these edges. Another implementation is to abstract communication devices as nodes, unidirectional communication channels as directed edges, and set the initial weight of the edges based on a single metric (e.g., hop count).

[0027] S2. Taking into account the bandwidth, delay, and channel physical security characteristics of heterogeneous links, establish a comprehensive link evaluation model and calculate the comprehensive weight of each link. One approach to comprehensively consider these characteristics is to perform a simple arithmetic average of the bandwidth, delay, and security characteristics to obtain a preliminary comprehensive evaluation value. Another approach is to select only one or two characteristics (e.g., considering only bandwidth and delay) as the evaluation basis. When establishing the comprehensive link evaluation model and calculating the comprehensive weight of each link, a simple linear weighted model can be used, where the weight coefficients of each characteristic are pre-set and fixed. Alternatively, the weight of each link can be determined based on empirical values ​​or an expert system, rather than dynamically calculated based on real-time parameters.

[0028] S3. Using the source and destination nodes as terminals, solve the weighted directed graph model based on the graph cut algorithm to find the optimal graph cut and secure transmission path that minimizes the global transmission cost and satisfies the weighted optimization conditions for link security performance. When solving using the graph cut algorithm, one implementation is to use the standard minimum cut algorithm to directly find the minimum cut set in the graph, without defining the specific avoidance strategy for this cut set in path planning. Another implementation is to only use the graph cut algorithm to identify potential bottlenecks in the network, without directly using its results to guide specific path planning. When finding the optimal graph cut and secure transmission path that minimizes the global transmission cost and satisfies the weighted optimization conditions for link security performance, one implementation is to simply remove all edges from the graph after finding the minimum cut set, and then directly search for the shortest path in the remaining graph, without considering potential network connectivity issues after removal. Another implementation is to only find a path that satisfies the preset security constraints, but does not guarantee that this path has the minimum global transmission cost.

[0029] S4. Based on the solution results of the graph cut algorithm, the distribution network data stream is allocated to the corresponding heterogeneous links, and differentiated adaptive secure encapsulation transmission is performed according to the link medium type. When allocating the distribution network data stream to the corresponding heterogeneous links, one implementation is to simply transmit all data streams through the planned secure path, regardless of the current load of that path. Another implementation is to allocate data streams only based on the one-time path planning result, without subsequent dynamic adjustments. When performing differentiated adaptive secure encapsulation transmission based on the link medium type, one implementation is to use a uniform encryption strategy for all types of links, regardless of their physical medium type. Another implementation is to simply select two preset encryption strengths based on the link type, but lacks more refined adaptive adjustment capabilities.

[0030] Through the above process, this method can provide an optimal transmission path that balances performance and security for critical control commands in the distribution network, and provide customized security protection for different link media, thereby effectively ensuring the safe and reliable operation of distribution network services.

[0031] In a preferred embodiment of the present invention, the process of constructing the weighted directed graph model in step S1 is as follows: The communication terminals, gateways, and control centers in the power distribution network are abstracted as a set of nodes in a graph. The heterogeneous communication links between nodes are abstracted as a set of directed edges. Construct a directed weighted graph ,in Set of directed edges The corresponding weight matrix.

[0032] In this embodiment, the communication terminals, gateways, and control centers in the power distribution network are abstracted as a set of nodes in a graph. , where the set of nodes Nodes are fundamental elements in graph theory, representing discrete entities within a network. In heterogeneous communication scenarios within power distribution networks, these nodes are crucial for information generation, forwarding, processing, and consumption. Abstracting them into nodes allows complex physical network structures to be described and analyzed using mathematical models. This abstraction process can be achieved automatically by a network management system or configuration management database, which automatically discovers and imports the unique identifiers of these devices as node IDs. Alternatively, communication terminals, gateways, and control centers can be identified through manual configuration or by scanning network devices using topology discovery protocols, and then registered as nodes in the graph.

[0033] The heterogeneous communication links between nodes are abstracted as a set of directed edges. Here, the set of directed edges E represents the unidirectional or bidirectional connections between nodes, and these connections are directional. Heterogeneous communication links are channels for data flow, and abstracting them as directed edges reflects the directionality of data transmission, such as from a sensor to a gateway, or from a gateway to a control center. Directionality is crucial for subsequent routing planning. This abstraction process can identify the connections between nodes by parsing the routing tables, interface configurations, or link-layer protocols of network devices, and determine the direction of the edges based on the data flow. Simultaneously, it can also dynamically establish and update the connections of directed edges by monitoring network traffic in real time and analyzing the source and destination IP addresses of data packets.

[0034] Constructing a directed weighted graph ,in Set of directed edges The corresponding weight matrix. Directed weighted graph. It is a mathematical structure in which It is a set of nodes. It is a set of directed edges. It is a matrix whose elements Indicates from node To the node The weights of the edges. This graph model is the foundation for graph cut algorithms. Weight matrix It carries comprehensive evaluation information about the links (such as bandwidth, latency, and security characteristics), enabling graph cut algorithms to find the optimal path based on these weights. The graph can be constructed using an adjacency matrix or an adjacency list to store the graph's structure and weight information. In the adjacency matrix, Directly store edges The weights are assigned to each node; in the adjacency list, each node is associated with a list containing its outgoing edges and their corresponding weights. Alternatively, a graph database (such as Neo4j) can be used to store the graph structure, where nodes and edges are treated as entities, and weights are treated as edge attributes, facilitating efficient graph queries and algorithmic operations.

[0035] In a preferred embodiment of the present invention, the computation node in step S2 To node Comprehensive weight of directed heterogeneous links The model formula is: in, , , , The weighting coefficients for bandwidth, latency, and security characteristics are respectively, satisfying... , This represents the normalized available bandwidth of the link. This is the normalized link transmission delay. This is the normalized link security assessment index, which is obtained by mapping the current measured signal-to-noise ratio of the link.

[0036] In this embodiment, the model formula is used to calculate nodes. To node Comprehensive weight of directed heterogeneous links Its function is to integrate multiple heterogeneous performance indicators (bandwidth, latency, security features) of the link into a single, quantifiable comprehensive evaluation value through weighted summation. This linear combination model can intuitively reflect the comprehensive performance of the link in different dimensions, providing a unified input for subsequent graph cut algorithms. In addition to linear weighted summation, this comprehensive weight can also be constructed using various multi-attribute decision-making methods such as the Analytic Hierarchy Process (AHP) or fuzzy comprehensive evaluation.

[0037] Weighting coefficients , , These represent the relative importance of bandwidth, latency, and security features in the overall weighting calculation. By adjusting these coefficients, different performance indicators can be flexibly optimized based on varying business needs or network strategies. For example, fixed values ​​can be preset, manually adjusted according to network administrator configurations, or dynamically learned and optimized using machine learning algorithms based on historical data and business priorities.

[0038] Normalized link available bandwidth This represents the dimensionless value of the currently available bandwidth of the link. Its purpose is to eliminate the influence of different physical dimensions and numerical ranges on the overall weight calculation, ensuring that the bandwidth metric can be compared and weighted on the same order of magnitude as other metrics. = If so, then directly set the normalization value to 1.

[0039] Normalized link transmission delay This represents the dimensionless value of the link transmission delay. Since lower delays are generally better, this value is used in the model. This approach ensures that lower latency contributes more to the overall weight, thus aligning with the optimization direction of bandwidth and security features.

[0040] Normalized link security assessment index This represents the dimensionless value of the physical layer security and reliability of the link. Its purpose is to quantify the link's anti-interference capability and physical layer security, incorporating them into a comprehensive weighted evaluation to ensure that the selected path is not only efficient but also secure. Besides being derived from the signal-to-noise ratio (SNR), this index can also be evaluated and mapped using other physical layer security metrics such as bit error rate (BER), channel capacity, or physical layer key generation rate.

[0041] Link security assessment index It is obtained by mapping the current measured signal-to-noise ratio (SNR) of the link. SNR is a key indicator for measuring the quality of a communication channel, directly reflecting the degree to which the signal is affected by noise and interference during transmission, and thus indirectly characterizing the channel's anti-eavesdropping and anti-interference capabilities. This mapping can be achieved through a pre-set lookup table, piecewise linear function, or nonlinear function (such as the Sigmoid function), converting the original SNR value into a normalized security assessment index between 0 and 1.

[0042] The technical solution of this invention introduces the aforementioned comprehensive weight model, which quantifies data from multiple dimensions such as bandwidth, delay, and physical layer security characteristics of heterogeneous links in the distribution network into a unified comprehensive weight through normalization and weighted summation. This method enables the effective integration and evaluation of heterogeneous link characteristics that were previously difficult to compare directly. Weight allocation coefficients. , , The introduction of this feature further enhances the flexibility of the model, allowing the system to dynamically adjust the importance of each metric based on specific business needs (e.g., prioritizing low latency, high bandwidth, or high security).

[0043] In this way, the weight matrix in the weighted directed graph model is constructed. This allows for a more accurate and comprehensive reflection of the true transmission cost and security reliability of each link. This provides a solid foundation for subsequent optimization based on graph cut algorithms to find the optimal path that minimizes global transmission cost while satisfying the weighted optimization conditions for link security performance. It solves the problem of the difficulty in uniformly quantifying the multi-dimensional characteristics of heterogeneous links, ensuring the effectiveness and robustness of path planning.

[0044] In a preferred embodiment of the present invention, the parameters in the model formula are normalized using an extremum mapping formula for dimensionless normalization: , , in, , , They represent directed links respectively. The currently measured values ​​of available bandwidth, transmission delay, and signal-to-noise ratio; and , and , and These represent the maximum and minimum values ​​of the corresponding parameters within the network's historical statistical period; signal-to-noise ratio. It is reported in real time directly by the link physical layer modulation and demodulation module, and is used to characterize the channel's anti-interference capability and physical layer security and reliability.

[0045] In this embodiment, the normalized available link bandwidth It is by using directed links Current measured available bandwidth value Subtract the minimum bandwidth value within the network's historical statistical period Then divide by the maximum bandwidth value With minimum bandwidth value The difference is used to obtain the bandwidth value. This processing method maps the bandwidth value to a range of 0 to 1, where 1 represents the best historical bandwidth and 0 represents the worst historical bandwidth.

[0046] Normalized link transmission delay A similar calculation method is used, that is, by using directed links Current measured transmission delay value Subtract the minimum latency value within the network's historical statistical period Then divide by the maximum delay value With minimum delay value The difference is used to obtain the result. Since the delay is better the smaller it is, it is usually used in the comprehensive weighting formula. This is to indicate its positive contribution to link performance.

[0047] Normalized link security assessment index This involves using directed links Current measured signal-to-noise ratio value Subtract the minimum signal-to-noise ratio within the historical statistical period of the network Then divide by the maximum signal-to-noise ratio value With minimum signal-to-noise ratio The signal-to-noise ratio is obtained from the difference between the two. The data is reported in real time directly by the link physical layer modulation and demodulation module. This module can be a digital signal processor integrated into the communication chip, or it can be a separate radio frequency front-end and baseband processing unit. Its function is to monitor and provide data on the channel's anti-interference capability and physical layer security and reliability in real time.

[0048] In a preferred embodiment of the present invention, the process of solving the problem based on the graph cut algorithm in step S3 specifically includes: The data source node s and the data destination node t are used as the source and sink nodes of the graph cut algorithm, respectively. Define the cut set of the graph To partition the set of nodes V into sets of edges that are disjoint subsets S and T, where , ; Based on the maximum flow minimum cut theorem for networks, the minimum cut set is obtained by using the weight matrix W as the capacity constraint. The minimum cut set is identified as a set of security-vulnerable bottlenecks in heterogeneous links of the distribution network. After avoiding the security-vulnerable bottleneck set in the routing topology, a secure transmission path is planned in the remaining secure subgraph based on the shortest path first strategy. After avoiding the security-vulnerable bottleneck set, if there is still a connected path from the source node to the destination node in the remaining secure subgraph, a secure transmission path is planned based on the shortest path first strategy; if there is no connected path, the minimum cut set is degenerated into the second smallest cut set (using the Karger algorithm or an edge-based replacement strategy, removing individual edges in the minimum cut set in turn and recalculating the minimum cut of the remaining graph until a cut set that connects the source and sink is found), and path planning is performed again until a connected path exists.

[0049] In this embodiment, the data source node s and the data destination node t are used as the source and sink nodes of the graph cut algorithm, respectively. This operation clarifies the start and end points of the graph cut algorithm, which is the foundation for path planning and ensures that the algorithm finds the optimal path between the correct start and end points. This can be configured through system settings or dynamically specified based on the specific communication task. Define the cut set of the graph. To partition the set of nodes V into sets of edges that are disjoint subsets S and T, where , The minimum cut set, a core concept in graph theory, describes the set of edges separating a source and a sink, and is crucial for identifying network bottlenecks. Its implementation is typically an internal logical operation of an algorithm, such as identification through graph traversal. Based on the maximum flow minimum cut theorem, and using the weight matrix W as a capacity constraint, the minimum cut set is obtained. This step utilizes an important theorem in graph theory to find the most "vulnerable" set of links in the network by solving for the minimum cut; that is, removing these links would result in a disconnect between the source and sink with the minimum sum of their combined weights. Solving for the minimum cut set can employ algorithms such as the Edmonds-Karp algorithm, the Dinic algorithm, or the Push-Relabel algorithm. Identifying this minimum cut set as a set of security-vulnerable bottlenecks in heterogeneous links of the distribution network gives the theoretical minimum cut set a practical security meaning, clearly identifying the set of links in the network most vulnerable to attack or failure. After circumventing the set of security-vulnerable bottlenecks in the routing topology, a secure transmission path is planned in the remaining secure subgraph based on a shortest path-first strategy. This strategy actively avoids identified vulnerable links during path planning, ensuring that the path is not only efficient but also secure. The avoidance method can be to logically set the weights of these links to infinity, and the shortest path-first strategy can employ Dijkstra's algorithm or the A* algorithm. After circumventing the set of security-vulnerable bottlenecks, if a connected path from the source node to the destination node still exists in the remaining secure subgraph, a secure transmission path is planned based on the shortest path-first strategy; if no connected path exists, the minimum cut set is degenerated into the second smallest cut set, and path planning is re-performed until a connected path exists. This mechanism provides a robust path planning strategy, ensuring that even in the extreme case where removing the minimum cut set leads to network disconnection, the system can iteratively find a suboptimal cut set to ultimately find a usable and relatively secure transmission path.

[0050] In a preferred embodiment of the present invention, the process of performing differentiated adaptive secure encapsulation transmission in step S4 is specifically as follows: Obtain the physical medium type of each link in the planned secure transmission path; If the current hop is a fiber optic link, the first-level encryption strategy is adopted, that is, the AES-128-GCM lightweight symmetric encryption algorithm is used in combination with CMAC authentication mode for data encapsulation, and the single-hop encryption processing delay does not exceed 1ms. If the current hop is a 5G wireless link or a power line carrier link, a second-level hybrid encryption strategy with higher security than the first level is adopted. This means using the SM2 asymmetric key negotiation protocol to establish a session key, combined with the SM4 symmetric encryption algorithm (128-bit key length) and the SM3 integrity verification algorithm for encapsulation and transmission; or using the more secure AES-256-GCM combined with the ECDH key exchange system to resist eavesdropping, replay and tampering attacks under open channels.

[0051] In this embodiment, the physical medium type of each link in the planned secure transmission path is obtained to identify the physical transmission medium used by each communication link through which the data stream will pass. Its purpose is to provide a decision-making basis for subsequent differentiated secure encapsulation. Implementation methods may include: storing the physical medium type of the link as a link attribute in the network database during network topology construction; and retrieving the medium information of each link on the path by querying the database after path planning is completed; or, obtaining the medium type of the current hop link in real time through link layer protocol negotiation or physical layer probing mechanisms, such as by reading the configuration information of the network card or communication module. The first-level encryption strategy is a secure encapsulation scheme designed for fiber optic links. Fiber optic links typically have high physical security and are not easily eavesdropped on or tampered with; therefore, lightweight encryption algorithms can be used to reduce processing latency.

[0052] AES-128-GCM is a high-efficiency symmetric encryption algorithm that provides authentication encryption, meaning it simultaneously protects the confidentiality, integrity, and authenticity of data.

[0053] CMAC authentication mode is a message authentication code based on block ciphers used to ensure data integrity and authentication. The limitation of single-hop encryption processing latency not exceeding 1ms aims to ensure that secure encapsulation does not introduce excessive additional burden in latency-sensitive power distribution network services. The second-level hybrid encryption strategy is a secure encapsulation scheme designed for open or semi-open channels such as 5G wireless links or power line carrier links, with a higher security strength than the first level. These links are more vulnerable to attacks such as eavesdropping, replay attacks, and tampering. The hybrid encryption strategy combines the advantages of asymmetric and symmetric encryption.

[0054] The SM2 asymmetric key exchange protocol is used to securely establish session keys, the SM4 symmetric encryption algorithm provides strong confidentiality protection, and the SM3 integrity verification algorithm ensures data integrity and authenticity. As an equivalent solution, AES-256-GCM combined with the ECDH key exchange system can also be used. AES-256-GCM provides a higher level of authentication encryption, while the ECDH (Elliptic Curve Diffie-Hellman) key exchange system provides an efficient and secure key exchange mechanism. These combinations aim to provide stronger resistance to attacks.

[0055] In a preferred embodiment of the present invention, the method further includes a dynamic graph update mechanism based on a time window: Set a sliding time window during system operation. The The value ranges from 30 seconds to 300 seconds, with 60 seconds being the preferred value; Real-time monitoring of parameter fluctuations in heterogeneous links, when nodes With nodes Normalize any one of them , or In the time window The maximum relative rate of change Δ exceeds the preset tolerance threshold. When this occurs, step S2 is triggered to recalculate the weights. This drives the graph cut algorithm to dynamically update the routing strategy; simultaneously, when the rate of change of any link parameter's single sample value relative to the previous sample value exceeds a preset emergency threshold... (like When the value is 0.3, the weight recalculation is triggered immediately, without being limited by the period of the sliding time window.

[0056] Wherein, the maximum relative rate of change The preset tolerance threshold The value ranges from 0.05 to 0.15, with a preferred value of 0.10.

[0057] In this embodiment, the time-window-based dynamic graph update mechanism is a strategy for continuously monitoring and adjusting the network model to cope with real-time changes. Its role is to ensure that routing decisions in the distribution network are always based on the latest network state, thereby maintaining the effectiveness and security of transmission paths. This mechanism can be triggered periodically, for example, by checking at fixed time intervals, or by being event-driven when specific network events (such as link failures or performance degradation) are detected. (Sliding time window) This is a window used to collect and analyze link parameter data over a period of time. Its function is to smooth the impact of instantaneous noise or short-term disturbances on parameter evaluation, while also capturing continuous trends in network state changes. This window can be a fixed-length queue; when new parameter samples arrive, the oldest samples are removed to maintain the timeliness of the data within the window. Real-time monitoring of parameter fluctuations in heterogeneous links refers to the system continuously acquiring key performance indicators of each heterogeneous link in the distribution network, such as available bandwidth, transmission delay, and signal-to-noise ratio. This can be achieved by deploying network performance monitoring tools, utilizing the real-time reporting function of the physical layer modem module, or periodically querying device status through network management protocols (such as SNMP). The maximum relative rate of change Δ is an indicator that quantifies the degree of parameter fluctuation. It reflects the stability of the parameter by calculating the maximum, minimum, and average values ​​of the parameter within a sliding time window. This indicator provides a unified, dimensionless measure to determine whether parameter changes are significant enough to warrant a reassessment of link weights. A preset tolerance threshold is also included. This is a pre-set value used to determine whether parameter fluctuations have reached a level requiring an update. Its purpose is to avoid frequent unnecessary weight recalculations and routing updates due to minor, insignificant parameter fluctuations, thereby saving system resources and improving system stability. This threshold can be set empirically or optimized through simulation based on factors such as the business characteristics of the distribution network, real-time requirements, and system computing capabilities. Emergency Threshold This is a threshold higher than the tolerance threshold, used to determine whether the parameters have undergone drastic and sudden changes. Its purpose is to enable immediate response in the event of a sudden link failure or a sharp performance degradation, avoiding delays in critical decisions due to waiting for the sliding time window to end, thereby quickly adjusting routes to ensure business continuity. When any of the above triggering conditions are met, the system will trigger step S2 to recalculate the weights. This drives the graph cut algorithm to dynamically update the routing strategy. This means that the system will re-execute the link comprehensive evaluation model, calculate the latest link weights reflecting the current network conditions, and re-solve the graph cut algorithm based on these new weights to plan a new optimal secure transmission path.

[0058] In a preferred embodiment of the present invention, the weight allocation coefficients α, β, and γ are adaptively configured according to the type of current transmission service in the distribution network: When the service type is a low-latency control service, latency is the priority optimization target, and β is set to ≥ 0.5. The preferred configuration is α=0.2, β=0.6, γ=0.2. When the service type is a large-capacity data collection service, bandwidth is the priority optimization target, and α≥0.5 is set. The preferred configuration is α=0.6, β=0.2, γ=0.2. When the business type is a critical security instruction business, the physical layer security and reliability are the priority optimization targets, and γ is set to ≥ 0.4, with the preferred configuration being α=0.2, β=0.3, and γ=0.5; When the business type is not explicitly specified, the default load balancer configuration α=0.33, β=0.34, γ=0.33 is used.

[0059] In this embodiment, the technical solution of the present invention introduces an adaptive configuration mechanism for weight allocation coefficients α, β, and γ, enabling the secure transmission method for heterogeneous links in the distribution network to dynamically adjust the relative importance of various performance indicators in the comprehensive link evaluation model according to the type of the current transmission service. Specifically, after acquiring the topology and link status information of the heterogeneous communication network in the distribution network and constructing a weighted directed graph model containing nodes and heterogeneous links, the system first identifies the service type of the data stream to be transmitted. Based on the identified service type, such as low-latency control, high-capacity data acquisition, or critical security instructions, the system adjusts the weight allocation coefficients of bandwidth, latency, and security features accordingly. For example, for low-latency control services, the proportion of the latency weight β is increased to ensure it is not less than 0.5, thereby calculating the comprehensive weight of the directed heterogeneous links between node i and node j. At that time, latency contributes more to the link cost.

[0060] This dynamic adjustment ensures that the link comprehensive evaluation model accurately reflects the actual needs of current services. This makes the optimal graph cut and secure transmission path subsequently solved using the graph cut algorithm not only minimize global transmission cost but also best meet the specific optimization objectives of the current service. In this way, the method overcomes the limitations of fixed-weight schemes in handling diverse service needs, enabling more intelligent and efficient utilization of distribution network communication resources, thereby significantly improving transmission performance and reliability in different service scenarios.

[0061] Figure 3 The diagram shows the structural composition of a distribution network heterogeneous link secure transmission system based on a graph cut algorithm. As a preferred embodiment of the technical solution of this invention, a distribution network heterogeneous link secure transmission system 10 based on a graph cut algorithm is also provided. The distribution network heterogeneous link secure transmission system 10 based on the graph cut algorithm includes: The topology graph construction module 11 is used to obtain the topology and link status information of the heterogeneous communication network of the distribution network and construct a weighted directed graph model containing nodes and heterogeneous links. The comprehensive evaluation module 12 is used to comprehensively consider the bandwidth, delay and channel physical security characteristics of heterogeneous links, establish a comprehensive evaluation model for links and calculate the comprehensive weight of each link. The graph cut solving module 13 is used to solve the weighted directed graph model based on the graph cut algorithm with the source node and the destination node as the terminals, and to find the optimal graph cut and secure transmission path that minimizes the global transmission cost and satisfies the weighted optimization conditions of link security performance. The secure transmission execution module 14 is used to allocate the power distribution network data stream to the corresponding heterogeneous links according to the solution results of the graph cut algorithm, and perform differentiated adaptive secure encapsulation transmission according to the link medium type.

[0062] Furthermore, the process of constructing a weighted directed graph model in the topology graph construction module 11 is as follows: The communication terminals, gateways, and control centers in the power distribution network are abstracted as a set of nodes in a graph, and the heterogeneous communication links between nodes are abstracted as a set of directed edges. A directed weighted graph is constructed, in which the weight matrix corresponds to the set of directed edges.

[0063] Specifically, the model for calculating the comprehensive weight of directed heterogeneous links between nodes during the operation of the comprehensive evaluation module 12 is as follows: The normalized available link bandwidth is multiplied by the bandwidth weight allocation factor, plus the normalized link transmission delay (one minus the normalized value), and then multiplied by the delay weight allocation factor. Finally, the normalized link security assessment index is multiplied by the security weight allocation factor. The sum of these three weight allocation factors equals one, and the link security assessment index is obtained by mapping the current measured signal-to-noise ratio of the link. In fact, the above system and method correspond to each other. The topology graph construction module 11 is used to execute step S1, that is, to obtain the topology and link status information of the heterogeneous communication network of the distribution network, and to construct a weighted directed graph model containing nodes and heterogeneous links. In actual deployment, this module periodically polls the communication terminals, gateways and control centers in the distribution network through the network management system, and collects the connection relationships and link status parameters between nodes in real time, including key indicators such as available bandwidth, transmission delay and signal-to-noise ratio, and then constructs a dynamically updated weighted directed graph model to provide basic data support for subsequent link evaluation.

[0064] The comprehensive evaluation module 12 is used to execute step S2, which comprehensively considers the bandwidth, delay, and channel physical security characteristics of heterogeneous links, establishes a comprehensive link evaluation model, and calculates the comprehensive weight of each link. This module adopts a non-linear weighted fusion mechanism, which sums the normalized available bandwidth, transmission delay, and security evaluation index of the links according to preset weight allocation coefficients to obtain weight values ​​reflecting the comprehensive performance of the links. The weight allocation coefficients can be dynamically adjusted according to the service type. For example, for low-latency control services, the weight coefficient of delay characteristics is increased to β≥0.5; for critical security command services, the weight coefficient of security characteristics is increased to γ≥0.4 to ensure that the evaluation results accurately match the service requirements.

[0065] The graph cut solving module 13 executes step S3, which uses the source and destination nodes as terminals and solves the weighted directed graph model based on the graph cut algorithm to find the optimal graph cut and secure transmission path that minimizes the global transmission cost and satisfies the weighted optimization conditions for link security performance. This module utilizes the maximum flow minimum cut theorem to identify a set of security-vulnerable bottlenecks in the network. After avoiding these bottlenecks in the routing topology, it plans a secure transmission path in the remaining secure subgraph. When no connected path exists in the remaining secure subgraph, the module can degenerate to the second smallest cut set and replan the path to ensure the continuity of data transmission. This graph cut analysis mechanism based on global topology effectively avoids the shortcomings of traditional routing protocols that only focus on locally optimal paths and ignore security weaknesses.

[0066] The secure transmission execution module 14 executes step S4, which allocates the power distribution network data stream to the corresponding heterogeneous links based on the solution results of the graph cut algorithm, and performs differentiated adaptive secure encapsulation transmission according to the link medium type. For fiber optic links, this module adopts a first-level encryption strategy, using the AES-128-GCM lightweight symmetric encryption algorithm combined with CMAC authentication mode, with a single-hop encryption processing delay of no more than 1ms. For 5G wireless links or power line carrier links, a second-level hybrid encryption strategy is adopted, combining the SM2 asymmetric key negotiation protocol with the SM4 symmetric encryption algorithm, or equivalently using AES-256-GCM combined with the ECDH key exchange system, to provide protection strength commensurate with the link security risks. This differentiated encapsulation mechanism avoids excessive encryption overhead on physically isolated links while ensuring data security under open channels.

[0067] The technical solution of this invention forms a closed-loop, dynamically updated system architecture through the collaborative work of the aforementioned modules. When link state parameters fluctuate, the system can trigger weight recalculation and route updates based on a sliding time window mechanism. For example, when the maximum relative change rate of the signal-to-noise ratio of a link within a time window exceeds a preset tolerance threshold of 0.10, the comprehensive evaluation and weight calculation module immediately recalculates the link weights, driving the graph cut solution and path planning module to update the secure transmission path. If the rate of change of a single sampled value of a link parameter exceeds an emergency threshold of 0.30, an update is triggered immediately without time window restrictions, thereby significantly shortening the convergence time of traditional routing protocols from several seconds to tens of seconds and effectively avoiding the risk of data loss or hijacking.

[0068] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A secure transmission method for heterogeneous links in a distribution network based on a graph cut algorithm, characterized in that, Includes the following steps: S1. Obtain the topology and link status information of the heterogeneous communication network of the distribution network, and construct a weighted directed graph model containing nodes and heterogeneous links; S2. Taking into account the bandwidth, delay, and channel physical security characteristics of heterogeneous links, establish a comprehensive link evaluation model and calculate the comprehensive weight of each link. S3. Using the source node and the destination node as terminals, solve the weighted directed graph model based on the graph cut algorithm to find the optimal graph cut and secure transmission path that minimizes the global transmission cost and satisfies the weighted optimization conditions for link security performance. S4. Based on the solution results of the graph cut algorithm, the data stream of the distribution network is allocated to the corresponding heterogeneous links, and differentiated adaptive secure encapsulation transmission is performed according to the link medium type.

2. The method for secure transmission of heterogeneous links in a distribution network based on graph cut algorithm according to claim 1, characterized in that, The process of constructing the weighted directed graph model in step S1 is as follows: The communication terminals, gateways, and control centers in the power distribution network are abstracted as a set of nodes in a graph, and the heterogeneous communication links between nodes are abstracted as a set of directed edges. A directed weighted graph is constructed, in which the weight matrix corresponds to the set of directed edges.

3. The method for secure transmission of heterogeneous links in a distribution network based on graph cut algorithm according to claim 2, characterized in that, The model for calculating the comprehensive weight of directed heterogeneous links between nodes in step S2 is as follows: Multiply the normalized available link bandwidth by the bandwidth weight allocation coefficient, add the normalized link transmission delay (one minus the normalized value) and then multiply the result by the delay weight allocation coefficient, and add the normalized link security assessment index multiplied by the security weight allocation coefficient. The sum is used as the comprehensive weight of the directed heterogeneous link. The sum of the three weighting coefficients is equal to one, and the link security assessment index is obtained by mapping the current measured signal-to-noise ratio of the link.

4. The method for secure transmission of heterogeneous links in a distribution network based on graph cut algorithm according to claim 3, characterized in that, The parameters in the aforementioned model are normalized using an extremum mapping formula for dimensionless normalization, specifically: The normalized available bandwidth of the link is equal to the difference between the current measured available bandwidth value and the minimum available bandwidth value in the historical statistical period, divided by the difference between the maximum and minimum available bandwidth values. The normalized link transmission delay is equal to the difference between the current measured transmission delay value and the minimum transmission delay value within the historical statistical period, divided by the difference between the maximum and minimum transmission delay values. The normalized link security assessment index is equal to the current measured signal-to-noise ratio (SNR) value minus the difference between the minimum SNR values ​​within the historical statistical period, divided by the difference between the maximum and minimum SNR values.

5. The method for secure transmission of heterogeneous links in a distribution network based on graph cut algorithm according to claim 1, characterized in that, The process of solving the problem based on the graph cut algorithm in step S3 specifically includes: The data source node and the data destination node are respectively used as the source and sink nodes of the graph cut algorithm; the cut set of a graph is defined as the set of edges that divide the set of nodes into two disjoint subsets, where the source node belongs to the first subset and the destination node belongs to the second subset; Based on the maximum flow minimum cut theorem, the minimum cut set is obtained by using the weight matrix as the capacity constraint. The minimum cut set is identified as the set of security-vulnerable bottlenecks in the heterogeneous links of the distribution network. After avoiding the set of security-vulnerable bottlenecks in the routing topology, a safe transmission path is planned in the remaining security subgraph based on the shortest path first strategy. After circumventing the set of security vulnerabilities, if there is still a connected path from the source node to the destination node in the remaining security subgraph, a secure transmission path is planned based on the shortest path first strategy; if there is no connected path, the minimum cut set is degenerated into the second smallest cut set, and path planning is performed again until a connected path exists.

6. The method for secure transmission of heterogeneous links in a distribution network based on graph cut algorithm according to claim 5, characterized in that, The process of performing differentiated adaptive secure encapsulation transmission in step S4 is as follows: Obtain the physical medium type of each link in the planned secure transmission path; If the current hop is a fiber optic link, then the first level of encryption strategy is used; If the current hop is a 5G wireless link or a power line carrier link, a second-level hybrid encryption strategy with a security strength higher than the first level is adopted.

7. The method for secure transmission of heterogeneous links in a distribution network based on graph cut algorithm according to claim 3, characterized in that, This method also includes a time-window-based dynamic graph update mechanism: During system operation, a sliding time window is set, with the value ranging from 30 seconds to 300 seconds; the parameter fluctuations of heterogeneous links are monitored in real time. When the maximum relative change rate of any normalized link available bandwidth, normalized link transmission delay, or normalized link security assessment index between nodes exceeds the preset tolerance threshold within the time window, step S2 is triggered to recalculate the comprehensive weight and drive the graph cut algorithm to dynamically update the routing strategy. Meanwhile, when the rate of change of a single sample value of any link parameter relative to the previous sample value exceeds the preset emergency threshold, the weight recalculation is immediately triggered, without being limited by the period of the sliding time window. The maximum relative rate of change is calculated by dividing the difference between the maximum and minimum values ​​of the parameter within the time window by the average value of the parameter within the time window.

8. A secure transmission system for heterogeneous links in a distribution network based on a graph cut algorithm, applied to the secure transmission method for heterogeneous links in a distribution network based on a graph cut algorithm as described in any one of claims 1 to 7, characterized in that, The system includes: The topology graph construction module is used to obtain the topology and link status information of the heterogeneous communication network of the power distribution network, and construct a weighted directed graph model containing nodes and heterogeneous links. The comprehensive evaluation module is used to comprehensively consider the bandwidth, delay, and channel physical security characteristics of heterogeneous links, establish a comprehensive evaluation model for links, and calculate the comprehensive weight of each link. The graph cut solution module is used to solve the weighted directed graph model with the source node and the destination node as the terminals, based on the graph cut algorithm, to find the optimal graph cut and secure transmission path that minimizes the global transmission cost and satisfies the weighted optimization conditions of link security performance. The secure transmission execution module is used to allocate the power distribution network data stream to the corresponding heterogeneous links based on the solution results of the graph cut algorithm, and to perform differentiated adaptive secure encapsulation transmission according to the link medium type.

9. The method for secure transmission of heterogeneous links in a distribution network based on graph cut algorithm according to claim 8, characterized in that, The process of constructing a weighted directed graph model in the topology graph construction module is as follows: The communication terminals, gateways, and control centers in the power distribution network are abstracted as a set of nodes in a graph, and the heterogeneous communication links between nodes are abstracted as a set of directed edges. A directed weighted graph is constructed, in which the weight matrix corresponds to the set of directed edges.

10. The method for secure transmission of heterogeneous links in a distribution network based on graph cut algorithm according to claim 9, characterized in that, The comprehensive evaluation module calculates the comprehensive weight of directed heterogeneous links between nodes using the following model: Multiply the normalized available link bandwidth by the bandwidth weight allocation coefficient, add the normalized link transmission delay (one minus the normalized value) and then multiply the result by the delay weight allocation coefficient, and add the normalized link security assessment index multiplied by the security weight allocation coefficient. The sum is used as the comprehensive weight of the directed heterogeneous link. The sum of the three weighting coefficients is equal to one, and the link security assessment index is obtained by mapping the current measured signal-to-noise ratio of the link.

Images