Encryption system for solar power generation facility

Abstract

According to one embodiment of the present disclosure, a method for encrypting a photovoltaic power generation facility is disclosed, which is performed by a computing device. The method comprises the steps of: authenticating an inverter upon a request from an authenticated control module; transmitting a first encrypted inverter data request packet from a server to a security module; the security module decrypting the first encrypted inverter data request packet and transmitting it to the authenticated inverter; receiving inverter data from the authenticated inverter and the security module performing a second encryption; and transmitting the second encrypted inverter data from the security module to the server, wherein the first encryption is performed using at least one of a private key or a first symmetric key of the security module, and the second encryption may be performed using at least one of a private key or a second symmetric key of the security module.

Description

Technology Field

[0001] The present disclosure relates to an encryption system for a photovoltaic power generation facility, and specifically to a system for encrypting communication between a power generation facility and a server using a security module, thereby enabling the safe operation and management of the photovoltaic power generation facility. Background Technology

[0003] With the recent intensification of global warming and environmental pollution issues, the demand and necessity for eco-friendly power generation technologies, such as solar power, and alternative energy technologies are rapidly increasing. Consequently, various energy storage and management systems, including solar power generation facilities, are being actively introduced. These facilities collect various data and exchange information with external systems with the goal of a sustainable energy supply.

[0004] In particular, solar power generation facilities must transmit data externally during various operational processes, such as real-time monitoring, execution of control commands, energy distribution, and storage; therefore, secure information exchange is critical during these communication processes. To this end, encryption and authentication technologies are essential for the transmission of information between solar power facilities and external systems. As security threats in interconnected networks continue to increase, it is becoming increasingly difficult to adequately guarantee safety using existing methods alone.

[0005] Therefore, to strengthen communication security related to solar power generation facilities and prevent sensitive information from leaking externally, highly usable or optimized encryption technologies and authentication methods are required; in response to these demands, the development of data protection solutions incorporating appropriate security technologies is emerging as an increasingly important task.

[0006] Korean Registered Patent No. 1675945 (November 8, 2016) discloses a smart card and a method for user authentication based on the smart card. The problem to be solved

[0008] The present disclosure may aim to implement an encryption system for a solar power generation facility optimized for a solar power generation environment by utilizing a security module. The purpose of the encryption system for a solar power generation facility is, for example, to protect control rights regarding data or control commands without exposing control commands and solar power generation data regarding the solar power generation facility to the outside.

[0009] In one embodiment, the security module may be designed to enhance security on the overall communication path by encrypting communication between the control module and the power generation facility in addition to communication between the server and the control module.

[0010] Meanwhile, the technical problem that the present disclosure aims to solve is not limited to the technical problem mentioned above, and various technical problems may be included within the scope obvious to a person skilled in the art from the contents described below. means of solving the problem

[0012] According to one embodiment of the present disclosure for realizing the aforementioned objectives, a method for encrypting a photovoltaic power generation facility is disclosed. The method comprises the steps of: transmitting a first encrypted inverter data request packet from a server to a security module; the security module decrypting the first encrypted inverter data request packet and transmitting it to an authenticated inverter; receiving inverter data from the authenticated inverter and the security module performing a second encryption; and transmitting the second encrypted inverter data from the security module to the server. The first encryption may be performed using at least one of the private key or a first symmetric key of the security module, and the second encryption may be performed using at least one of the private key or a second symmetric key of the security module.

[0013] In one embodiment, the step of authenticating an inverter by means of a request from the authenticated control module may include: the step of the server transmitting a list of security modules to the authenticated control module; the step of the control module requesting inverter authentication data from a security module corresponding to the list; and the step of transmitting a third encrypted inverter authentication data from the security module to the server.

[0014] In one embodiment, the third encryption is performed using at least one of the private key of the security module or the third symmetric key, and the inverter authentication data may include the node number of the inverter.

[0015] In one embodiment, the step of the server transmitting a security module list to the authenticated control module includes the step of the server authenticating the control module using the authentication data of the control module, and the authentication data of the control module may be fourth encrypted data using the private key or fourth symmetric key of the control module.

[0016] In one embodiment, the first encryption and the second encryption may include a symmetric encryption method that utilizes an initialization vector together.

[0017] In one embodiment, the first encryption and the second encryption include a symmetric encryption method that utilizes an initialization vector together, and at least one of the third encryption or the fourth encryption includes an asymmetric encryption method; and can be performed by additionally utilizing a public key.

[0018] In one embodiment, the first encryption and the second encryption include an asymmetric encryption method; and may be performed by additionally utilizing a public key.

[0019] In one embodiment, the security module includes a plurality of security modules, and the inverter includes a plurality of inverters, and each of the plurality of security modules may be configured to correspond to each inverter included in the plurality of inverters.

[0020] In one embodiment, the first encrypted data request packet may include a command to perform an operation for a photovoltaic power generation facility or the inverter.

[0021] In one embodiment, the method may further include the step of the server decrypting the second encrypted inverter data.

[0022] A photovoltaic power generation facility encryption system is disclosed according to one embodiment of the present disclosure for realizing the aforementioned objectives. The system may include: a server that performs a photovoltaic power generation system management service; an inverter that includes a function for monitoring the status of the photovoltaic power generation facility or collecting data; a security module configured in correspondence with the inverter and performing encryption or decryption; and a control module capable of communicating at least temporarily with the server, the power generation facility, the inverter, or the security module. Effects of the invention

[0024] The present disclosure can enhance security regarding control commands for the power generation facility or data of the power generation facility by encrypting at least a portion of the communication path between the photovoltaic power generation facility and the server. For example, the present disclosure may aim to provide an encryption method suitable for a communication environment, such as low-bandwidth communication or data packet transmission optimized for a photovoltaic power generation environment.

[0025] Meanwhile, the effects of the present disclosure are not limited to those mentioned above, and various effects may be included within the scope obvious to a person skilled in the art from the contents described below. Brief explanation of the drawing

[0027] FIG. 1 is a block diagram of a computing device that can be utilized in the implementation of a module according to one embodiment of the present disclosure. FIG. 2 is a structural diagram showing the schematic configuration of an encryption system according to one embodiment of the present disclosure. FIG. 3 is a flowchart schematically illustrating an encryption method according to one embodiment of the present disclosure. FIG. 4 is a flowchart schematically illustrating the authentication process of a control module according to one embodiment of the present disclosure. FIG. 5 is a flowchart schematically illustrating the authentication process of a security module or inverter according to one embodiment of the present disclosure. FIG. 6 is a flowchart schematically illustrating a communication method of an encryption system according to one embodiment of the present disclosure. Specific details for implementing the invention

[0028] Various embodiments are now described with reference to the drawings. In this specification, various descriptions are provided to facilitate an understanding of the present disclosure. However, it is evident that these embodiments can be practiced without such specific descriptions. Furthermore, the present disclosure should be understood to include not only the specifically presented embodiments but also all modifications, equivalents, and substitutions that fall within the technical spirit and scope of the present invention. Various modifications to the present invention will be apparent to those skilled in the art, and technical ideas that a person skilled in the art could conceive without special technical effort based on the contents described in this specification should be interpreted as being included within the technical ideas described in this disclosure.

[0029] In describing the present invention, detailed descriptions of related prior art are omitted if it is determined that such descriptions could obscure the essence of the invention. However, such omission is not intended to exclude awareness of prior art that can be utilized in relation to the present invention. The present invention should be interpreted in the broadest possible scope consistent with the principles and novel features presented herein.

[0030] Terms such as first, second, third, fourth, etc., may be used to describe various components, but said components should not be limited by said terms. Such terms are used solely for the purpose of distinguishing a specific component from another component, and said specific component may be interpreted differently depending on the embodiment. The terms first, second, etc., used in this disclosure are used merely to describe specific embodiments and are not intended to limit the invention.

[0031] In this disclosure, singular expressions include plural expressions unless the context clearly indicates otherwise. Where the context does not clearly indicate a singular form, the singular in this disclosure should be understood to mean "one or more."

[0032] Furthermore, the terms “comprising” and / or “comprising” mean that the relevant feature and / or component is present, and do not mean that the existence or addition of one or more other features, numbers, steps, actions, components, parts, features, or combinations thereof is excluded in advance.

[0033] In addition, the term "and / or" should be understood to refer to all possible combinations of one or more of the enumerated elements or to include all possible combinations of one or more of the enumerated elements.

[0034] Furthermore, the term "or" should be interpreted not as exclusively referring to any one of the enumerated elements, but as meaning that it includes at least one of the enumerated elements. For example, the expression "use A or B in N" can be interpreted as utilizing A in N; utilizing B in N; or utilizing both A and B in N.

[0035] Furthermore, the term "at least one of A or B" should be interpreted to mean "a case including only A," "a case including only B," or "a case combined with the composition of A and B."

[0036] In the present disclosure, terms such as “module,” “system,” etc., may refer to hardware, firmware, software, a combination of software and hardware, a combination of hardware and firmware, or an execution of software relating to a computing device. For example, a module may be a processor, an object, a component, a procedure executed on a processor, a program, a computing device, or a combination of two or more of these, but is not limited to the examples listed. A module may be included in a specific computing device, but may also be configured to be distributed to two or more computing devices. Such modules may be executed from various computer-readable media. For example, modules may communicate with other modules, devices, components, or elements through local or remote processing by utilizing signals containing one or more data packets. For example, data packets may include data and / or signals from a component interacting with other components in a local system or a distributed system, and data transmitted through a network such as the Internet to other systems.

[0038] Hereinafter, the present invention will be described in detail with reference to the attached drawings, focusing on embodiments of the invention. Identical reference numerals in each drawing indicate identical components, elements, steps, or operations. The drawings attached to this specification should not be interpreted as limiting the content of the invention to the embodiments depicted in the drawings, but should be utilized only as factors to be taken into account when interpreting the technical concept of the invention.

[0040] FIG. 1 is a block diagram of a computing device that can be utilized in the implementation of a module according to one embodiment of the present disclosure.

[0041] The configuration of the computing device (100) illustrated in FIG. 1 is merely a simplified example. In the present disclosure, the exemplary computing device (100) may include other configurations for forming or performing the computing environment of the computing device (100), and only some of the disclosed configurations may constitute the computing device (100). For example, the computing device configuration in the present disclosure may be applied to a server, a security module, and / or a control module.

[0042] A computing device (100) may include at least one of an input / output unit (110), a processing unit (120), a memory unit (130), or a communication unit (140). In the present disclosure, the processing unit (120) may be interpreted as a processing device and may include a processor. In a computing device according to one embodiment of the present disclosure, the input unit (110) and the memory unit (130) may be optional components.

[0043] The input / output unit (110) is a component that provides various input and output means to enable a user to interact with a computing device in one embodiment of the present disclosure, thereby allowing the user to input commands to the device or check information generated by the device. The input / output unit (110) is a configuration that includes at least one of an input unit or an output unit. As an input unit, the input / output unit (110) may include various input devices such as buttons, joysticks, keyboards, mice, touchpads, or touchscreens. Such input devices may include functions that enable the user to perform tasks such as inputting data, executing commands, or selecting elements on the screen. For example, through a touchscreen, the user can interact with the device by intuitively touching the screen directly, which can be exemplified by its use in portable computing devices such as mobile phones or tablets. In terms of an output unit, the input / output unit (110) may include various types of output devices such as a CRT (Cathode Ray Tube) monitor, a display, a speaker, or an LED indicator. For example, the display may provide high-resolution visual output so that the user can clearly see applications or content running on the device. In addition, information delivery utilizing hearing can be performed to the user by providing auditory notifications or signals through a speaker. For example, feedback can be provided to the user through notifications or media playback. The input / output unit (110) may also include output devices such as a head-up display (HUD), augmented reality (AR), and virtual reality (VR) headset to provide an immersive user experience.The input / output unit (110) provides such input or output functions to enable smooth interaction between the user and the device, and can also be utilized for interaction between other devices or other parts other than the input / output unit (110). Through this input / output unit (110), the system, device, component, etc. of the present disclosure can provide an efficient interface, and the input / output unit (110) can be configured in a flexible manner in various environments. The input / output unit (110) is not limited to the examples mentioned above, and various methods or configurations available to a person skilled in the art for the input and output of data or signals may be utilized in the implementation of the input / output unit (110).

[0044] The processing unit (120) is a component responsible for the operation, control, or processing of data and may be composed of one or more cores within the computing device.

[0045] For example, the processing unit (120) may include a processor such as a central processing unit (CPU), a graphics processing unit (GPU), a general purpose graphics processing unit (GPGPU), or a tensor processing unit (TPU) of a computing device. Furthermore, it may additionally include at least one of a Field-Programmable Gate Array (FPGA), a cache memory, or an auxiliary security module. The processing unit (120) may read data or a computer program stored in the memory unit (130) and perform data processing according to one embodiment of the present disclosure. At least one of the CPU, GPU, GPGPU, or TPU of the processing unit (120) may process the execution or learning of a network function. For example, the CPU and the GPGPU may together process the learning of a network function, data classification or processing using a network function, and the execution of encryption and authentication using a network function. In addition, in one embodiment of the present disclosure, processors of a plurality of computing devices may be used together to process the learning of network functions, data classification or processing using network functions, and the execution of encryption and authentication using network functions. In one embodiment of the present disclosure, the computer program executed on the computing device may be a CPU, GPU, GPGPU, or TPU executable program. In the present disclosure, the processing unit (120) may be flexibly configured according to various requirements of the device and includes at least one of a processor, a sensor control device, an auxiliary security module, a data bus, or a cache memory in a form that can be applied by a person skilled in the art without special difficulty.

[0046] According to one embodiment of the present disclosure, the memory unit (130) can store data or information of any form generated or determined by the processing unit (120) and data or information of any form received by the communication unit (140).

[0047] For example, the memory unit (130) is a component that performs data storage and management functions and can serve to store data temporarily or permanently within a computing device. The memory unit (130) can be composed of various types of memory and, for example, can contribute to optimizing data processing speed through interaction with the processing unit (120). In one embodiment, the memory unit (130) may include a main memory, and the main memory may include at least one type of storage medium among Random Access Memory (RAM), Static Random Access Memory (SRAM), Dynamic Random Access Memory (DRAM), Non-Volatile Dual In-line Memory Module (NVDIMM), Low Power Double Data Rate Memory (LPDDR), Hybrid Memory Cube (HMC), High Bandwidth Memory (HBM), and Persistent Memory (PMEM), but is not limited to the examples listed above. Additionally, for example, the memory unit (130) may include non-volatile memory for long-term storage of data such as key system settings or firmware. Storage devices such as ROM (Read-Only Memory) or flash memory type may be used for the non-volatile memory. In additional embodiments, the memory unit (130) may further include an auxiliary storage device for storing and managing large amounts of data. For example, a Solid State Drive (SSD) or a Hard Disk Drive (HDD) may be included as part of the memory unit, which may be used in applications requiring permanent storage of large amounts of data and fast data transfer.The description of the memory unit (130) described above is merely an example, and the memory unit (130) in the present disclosure is not limited to the examples mentioned above.

[0048] In one embodiment of the present disclosure, the communication unit (140) can perform communication with various wired and wireless networks. Through this, the communication unit (140) can enable stable and efficient data transmission in various communication environments. For example, the network may be the known World Wide Web (WWW). For example, the communication unit (140) may use various wired communication systems such as a Public Switched Telephone Network (PSTN), xDSL (x Digital Subscriber Line), RADSL (Rate Adaptive DSL), MDSL (Multi Rate DSL), VDSL (Very High Speed ​​DSL), UADSL (Universal Asymmetric DSL), HDSL (High Bit Rate DSL), and a Local Area Network (LAN). In the case of wired communication, the communication unit (140) may support various DSL methods or wide area network systems for high-speed data transmission. For example, it is possible to enable stable data transmission and reception by accommodating various forms of wired communication, ranging from public telephone network-based transmission technology to high-speed DSL methods. As another example, in terms of wireless communication, the communication unit (140) can support various frequency and time division methods such as CDMA (Code Division Multi Access), TDMA (Time Division Multi Access), FDMA (Frequency Division Multi Access), OFDMA (Orthogonal Frequency Division Multi Access), and SC-FDMA (Single Carrier-FDMA). These methods are designed to maintain a stable communication connection even while moving.In addition, the communication unit (140) can be easily connected to a Local Area Network (LAN), a Personal Area Network (PAN), or a Wide Area Network (WAN), and can also support short-range wireless technologies such as Bluetooth and infrared (IrDA). Through this, the communication unit (140) can provide optimal connection options suitable for the situation. As such, the communication unit (140) can be compatible with various network types and can function as a universal connection unit. Through this, it can facilitate the smooth exchange of information with other devices within the system and support the effective implementation of various network-based functions. Due to the connectivity and flexibility of the communication unit (140), the system of the present disclosure can selectively apply communication methods or devices suitable for the communication environment, and the configuration and role of the communication unit (140) are not limited to the examples mentioned above.

[0050] Hereinafter, a schematic configuration of an encryption system according to one embodiment of the present disclosure will be described in detail through FIG. 2, and furthermore, an encryption method according to one embodiment of the present disclosure will be described through FIG. 3 to 6.

[0052] FIG. 2 is a structural diagram showing the schematic configuration of an encryption system according to one embodiment of the present disclosure.

[0053] According to one embodiment of the present disclosure, a photovoltaic power generation facility encryption system may include: a server that performs a photovoltaic power generation system management service; an inverter that includes a function for monitoring the status of the photovoltaic power generation facility or collecting data; a security module configured in correspondence with the inverter and performing encryption or decryption; and a control module capable of communicating at least temporarily with the server, the power generation facility, the inverter, or the security module. The encryption system of the present disclosure is not limited to the system configuration depicted in FIG. 2, and reference numerals should also be interpreted as illustrative references to the drawings.

[0055] In one embodiment of the present disclosure, the server (500) can perform the role of centrally managing and optimizing functions such as monitoring, operation, maintenance, and repair of various solar power generation facilities. At this time, the server (500) can perform the role of improving the reliability and efficiency of operation by checking the status of the solar power generation equipment in real time and supporting performance analysis, prediction, maintenance, maximization of energy efficiency, and review of power generation amount. For example, the server (500) may include a communication unit for communication with the solar power generation equipment, and through this, it can be remotely connected to the inverter, sensor, etc. of each power generation equipment. For example, it can collect power generation amount, weather data, panel temperature, and other status information in real time to report or evaluate the operating status or efficiency of the system. Such solar power generation data is transmitted to the server via a communication network, and the server (500) may include a memory unit and a processing unit to store and analyze the received data.

[0056] In the present disclosure, the server (500) can collect data by decrypting encrypted inverter data and can also encrypt data request packets and transmit them to devices such as a control module (300) or a security module (211). For example, the server (500) can generate request packets regarding data to be collected corresponding to each inverter. The generated data request packets can be encrypted by the server (500) and transmitted to the security module (211). For example, encryption or decryption by the server (500) can be performed using an encryption method optimized for a solar power generation environment. For example, a symmetric key and an Initialization Vector (IV) may be used for encryption or decryption in the present disclosure. Alternatively, a private key and a public key may be used for encryption or decryption in the present disclosure. To perform such encryption or decryption, the server (500) may store information regarding the identification number of the security module (211), as well as the symmetric key, private key, or public key.

[0057] Additionally, the server (500) can analyze collected data to support prediction or maintenance. For example, if the possibility of performance degradation or the phenomenon of performance degradation is detected due to contamination of the panel or aging of parts, the server (500) can send a warning to the user through the detected data. Alternatively, the server (500) can transmit its own change or operation command based on a preset value. To this end, the server (500) may include a processing unit (120), and, for example, the processing unit (120) may include an analysis module. In one embodiment, such an analysis module can diagnose the cause of performance degradation and predict future problems through a machine learning algorithm or a prediction model. In this prediction process, past data and time-series data may be utilized together, and the time when the probability of a problem occurring is high can be estimated through pattern recognition based on the data.

[0058] In one embodiment, the server (500) may provide a user interface that allows a user to easily check and control the status of a solar power generation facility through a web interface or a mobile application. Such an interface may provide visualized key information, such as power generation amount, efficiency, or expected maintenance schedule. Furthermore, the server (500) may support prompt action by transmitting real-time notifications regarding potential emergencies or problems.

[0059] Additionally, the server (500) may include a function capable of transmitting control commands to the power generation facility (200). Through this, the server (500) can not only monitor the status of the power generation facility (200) in real time, but also, if necessary, issue various commands remotely to directly control and optimize the operation of the facility. For example, the server (500) can transmit output control commands to the inverter (210) or power converter of the power generation facility to adjust the real-time power generation amount, or adjust the position of the panel to a direction optimized for solar radiation. These commands may be transmitted primarily to respond to weather changes, fluctuations in power demand, unexpected facility malfunctions, etc., thereby maintaining the efficiency and stability of the power generation facility (200) to the maximum. Alternatively, when an abnormal condition of the power generation facility is detected, the server (500) may automatically transmit an initial diagnosis command to determine whether there is a malfunction, or transmit a command to inspect or reboot a specific part. For example, if overheating of the inverter (210) is detected, the server (500) may send a command to temporarily lower the inverter output or switch the system to a safe mode based on a preset value. This function enables an initial response before field maintenance personnel arrive and can provide system stability and rapid troubleshooting.

[0060] Additionally, the server (500) can remotely transmit update files and manage installation when software updates are required. This allows the firmware (301) of each device or facility to be kept up to date and enables immediate updates when performance enhancement and security reinforcement are needed. This remote update function can increase the overall maintenance efficiency of the facility. The firmware (301) may be included in devices such as the control module (300) or security module (211), and may also be configured to be included in other devices or facilities.

[0061] In this way, the server (500) can perform the role of an active management system that, in addition to simply implementing a monitoring function, transmits commands to the power generation facility (200) to control it in real time and optimize the operating status.

[0063] In one embodiment of the present disclosure, the control module (300) may be a module capable of communicating at least temporarily with at least one of a server (500), a power generation facility (200), an inverter (210), or a security module (211). For example, the control module (300) may be configured to include an RTU or a communication module, and each component may perform specific functions to contribute to implementing an efficient and safe control system. The control module (300) may support the operation of a stable and efficient system by performing real-time data collection and processing, secure communication, and transmission of control commands. For example, the control module (300) may receive and process data and commands from a central control system through communication with the server (500). At this time, the control module (300) may support various protocols to enable seamless interoperability with the server (500) and various devices. The control module (300) may enable real-time monitoring and control through communication with the server (500), and may automate data collection and transmission of control commands. At this time, the data request packet received from the server (500) can be transmitted to the inverter (210) or the security module (211) to control the operation of the device, or the safety of the data can be ensured through the security module (211). The operation of the device may be the operation of the inverter or the operation of the power generation facility.

[0064] Communication between the control module (300) and the security module (211) can support secure data transmission in environments where security is required. The security module (211) performs encryption and authentication of data exchanged with the control module (300) to maintain the integrity and confidentiality of the data during transmission. For example, to prevent data leakage or tampering during remote control and monitoring operations, the control module (300) cooperates with the security module (211) to comply with security protocols, and this function can be usefully utilized in industrial IoT environments.

[0065] The control module (300) may perform functions such as power conversion, motor control, and energy management by transmitting control commands through communication with other devices, such as the inverter (210). For example, the control module (300) may communicate directly with the power generation facility (200). When the control module (300) communicates directly or indirectly with the inverter (210), the control module (300) can support efficient and safe energy management by monitoring the inverter (210) in real time and transmitting control commands when necessary while the inverter (210) performs its role as a power conversion device.

[0066] In one embodiment of the present disclosure, the control module (300) may include a Remote Terminal Unit (RTU). An RTU is a device that performs data collection and transmission of control commands from a remote location and can be utilized in various industrial environments. The RTU can collect analog and digital signals by connecting to sensors or actuators, etc., at a remote location, and can transmit them to a central control system such as a server or a Supervisory Control and Data Acquisition (SCADA) system. The RTU has functions such as data collection, signal conversion, and execution of remote control commands, and can exchange data in real time through communication with a central control system. In addition, the RTU supports various industrial standard protocols (e.g., Modbus, DNP3, etc.) to enhance compatibility with existing systems and can remotely control the operation of field equipment by receiving control commands from a central system.

[0067] RTUs can be utilized for efficient monitoring and control, particularly in solar power generation systems. In solar power systems, it is crucial to monitor power generation status in real time and control devices such as inverters to maintain maximum power generation efficiency. RTUs are essential devices for performing these functions; they can collect data from various sensors installed at the power plant site (e.g., current, voltage, temperature, solar irradiance, etc.) and transmit it to a central control system. This enables real-time monitoring of power generation efficiency, output, and equipment status.

[0068] For example, the RTU can communicate with the inverter (210) of the photovoltaic power generation system to perform real-time control. For instance, it can optimize power generation efficiency by adjusting the operation of the inverter (210) according to changes in solar irradiance or temperature, or it can respond immediately by sending a notification to a server or central system in the event of a device failure or anomaly. The RTU can contribute to maintaining the stability of the power grid by monitoring the connection status with the power grid and performing control operations to disconnect or reconnect the connection with the power grid if necessary.

[0069] RTUs can support efficient and stable system operation in solar power generation systems through data collection, inverter control, and grid connection monitoring. Solar power plant operators can monitor power generation status in real time via RTUs and maximize the performance of the entire system by issuing control commands from a central system as needed.

[0071] In one embodiment of the present disclosure, the inverter (210) is a core device for converting power generated from a photovoltaic power generation facility, and is a device for converting direct current power (DC) generated from a power generation facility (200) into alternating current power. In the present disclosure, the inverter receives a direct current voltage generated from a photovoltaic power generation module and can convert it into alternating current power of a constant frequency and voltage. At this time, the inverter (210) can control the voltage or frequency in real time so that the converted power is synchronized with the power grid. To this end, the inverter (210) may include a power conversion circuit and a control circuit, and the control circuit adjusts the output power in accordance with the frequency fluctuations of the power grid. Through this function, the inverter (210) can contribute to the stability of the power grid.

[0072] Additionally, the exemplary inverter (210) may include a Maximum Power Point Tracking (MPPT) function to maximize the power generation of the solar power generation facility. Through the MPPT function, the inverter can optimize power generation efficiency by adjusting the output voltage and current of the solar modules in real time. For example, even if the amount of solar radiation changes due to changes in weather conditions, the power generation can be maximized by supporting the MPPT algorithm to operate at the optimal power point.

[0073] For example, the inverter (210) may include a sensor system capable of monitoring various environmental information such as temperature, humidity, current, or voltage. This allows the operating status of the inverter (210) to be checked in real time, and if an abnormal condition is detected, a warning may be sent to a server or the device may be switched to a safe mode based on a preset value to prevent damage to the device.

[0074] In one embodiment of the present disclosure, the inverter (210) may provide remote control and monitoring functions, and a user may check and control the operating status of the inverter (210) in real time through a server (500). For example, an administrator may adjust the operating mode or output power of the inverter (210) through a remote server, and may remotely reboot the system or perform a diagnosis if necessary based on the results of the status check. Additionally, the inverter (210) may include a function to automatically adjust the power generation output or shut down the system if a problem occurs with the frequency or voltage of the power grid. For example, if an overvoltage occurs in the power grid, the inverter may detect this and lower or shut down the output voltage to safely maintain interaction with the power grid.

[0076] In one embodiment of the present disclosure, the security module (211) may be configured to correspond to the inverter (210) and may be a module that performs encryption or decryption. As another example, the security module (211) may perform an authentication function, and these exemplary functions may utilize methods optimized for each environment depending on the installation environment. For example, the security module (211) may be directly connected to the inverter (210) and perform the role of encrypting data generated or acquired from the inverter (210) and then transmitting it to the control module. Additionally, the security module (211) may perform the role of decrypting an encrypted data request packet received from the control module (300) and then transmitting it to the inverter (210). An exemplary security module (211) may include at least one of encryption key generation, data encryption and decryption, and data integrity verification functions. Through this, the photovoltaic power generation system can maintain the safety of the system and the confidentiality of the data.

[0077] In one embodiment, the security module (211) is assigned a unique encryption key for each system and can use it to encrypt data generated or acquired from the inverter (210). The unique encryption key may be generated or shared when the security module (211) interacts with the initially authenticated control module (300). For example, when the inverter (210) generates real-time power production data, the security module (211) can encrypt the data using the Advanced Encryption Standard (AES) method and then transmit it to the authenticated control module. Subsequently, the control module (300) can decrypt the data using the same key, or the server (500) can decrypt the data using the same key. Through this, even if data leakage to the outside occurs during the communication process between the control module (300) and the inverter (210), it is possible to make it impossible to decrypt the data. Furthermore, as an additional embodiment, the security level can be further strengthened by periodically updating the unique encryption key or by generating a new key for each session.

[0078] In one embodiment, the security module (211) may be configured based on a Public Key Infrastructure (PKI). In this case, the security module may have a pair of a public key and a private key, and while the public key may be made public, the private key is a key that is securely stored within the security module. When the inverter (210) transmits data to the control module (300) or server (500), the security module (211) encrypts the data using the public key and transmits it, and the control module (300) or server (500) that receives the data can decrypt the data using the private key of the security module (211).

[0079] For example, the server (500) can generate a data request packet to be sent to the inverter (210) and sign it using a private key stored in the server so that the data request packet is not exposed or tampered with. At this time, the encryption of the data request packet can be performed using the public key of the security module. In addition, the control module (300) can perform the role of relaying the data request packet and the inverter data. At this time, the control module (300) can verify the data request packet using the server's public key to verify the signature of the server (500). The encryption state of the data is maintained, and the control module (300) can safely transmit the data to the security module (211) without accessing the contents of the data request packet. The security module (211) can decrypt the encrypted data request packet using the private key and restore the original. Through the decrypted data request packet, it can check information or commands necessary for communication with the inverter (210) and transmit them to the inverter (210). As an additional example, when the security module (211) transmits data to the inverter (210), it can sign the data with the security module's private key and encrypt the data with the inverter's public key.

[0080] In one embodiment, the security module (211) can perform authentication data generation and encryption, and perform decryption of the encrypted data request packet and encryption of the inverter data. The security module (211) can obtain authentication data for authentication of the inverter (210) to the security module (211) and encrypt it using a private key and an initialization vector. The authentication data thus encrypted is transmitted to the server (500) through the control module (300). The server (500) can decrypt the authentication data using the security module's public key and the received initialization vector, and if authentication is confirmed, verify that the security module or the inverter (210) is a trusted device. At this time, the server (500) can encrypt the data request packet using the security module's public key while transmitting the data request packet to the security module (211). The encrypted data request packet transmitted to the security module (211) through the control module (300) can be decrypted by the security module (211) using its own private key. The security module (211) can transmit the request packet to the inverter (210) to collect necessary data or execute commands. The inverter (210) can perform a specific operation based on the request packet, or transmit the result of the operation or response data to the security module (211). This response data can be referred to as inverter data. Additionally, the security module (211) can encrypt the received inverter data using a private key and an initialization vector, and transmit the encrypted data and the initialization vector to the server through the control module. At this time, the control module (300) can relay the data to the server (500) while maintaining the encrypted state of the data without checking the content of the data. Finally, the server (500) can decrypt the encrypted inverter data using the security module's public key and the received initialization vector to check the status of the inverter or the requested data.When configuring an encryption system using such public and private keys, it has the advantage of being highly useful even in situations where the data communication environment is poor or the amount of communication data needs to be minimized, compared to methods such as certificates.

[0081] In one embodiment, the security module (211) may acquire authentication data to transmit authentication of the security module or inverter to the server (500) and encrypt the authentication data using a third symmetric key shared with the server (500) and a newly generated Initialization Vector (IV). The encrypted authentication data and IV may be transmitted to the server through the control module. The server (500) may decrypt the encrypted authentication data using the same third symmetric key and IV, and verify whether the device is trustworthy by checking the authentication information of the security module or inverter. To request data or transmit commands to the security module (211) or inverter (210), the server (500) may generate a data request packet and encrypt the request packet using a first symmetric key and a newly generated IV. The encrypted request packet and IV may be transmitted to the security module (211) through the control module (300). The control module (300) may relay the encrypted data request packet but may not access its contents. The security module (211) can decrypt the request packet using the first symmetric key shared with the server (500) and the received IV, and verify the data or command requested by the server (500). The security module (211) can transmit the contents of the decrypted data request packet to the inverter (210) and prepare the necessary response data. The inverter (210) can generate a response to the requested data and command and transmit it to the security module (211). The security module (211) can encrypt the received inverter data using the second symmetric key and a new IV, and then transmit the encrypted inverter data and IV to the server (500) through the control module. Finally, the server (500) can safely verify the status of the inverter or the requested data by decrypting the encrypted inverter data using the same symmetric key shared with the security module (211) and the received IV.When using symmetric keys, the encryption, decryption, and communication processes can be configured relatively simply, and this can be a method to configure an encryption system more efficiently in poor data transmission environments.

[0083] In one embodiment of the present disclosure, the security network (400) is a network that can be utilized when the control module (300) and the server (500) communicate, and is designed to ensure secure data transmission between systems or devices. For example, the security network (400) can protect the confidentiality, integrity, and availability of data from external attacks through encryption, authentication, and access control. For example, the security network (400) may include a Virtual Private Network (VPN). A VPN can protect the user's location and data, etc., by providing an encrypted tunnel so that data can be safely transmitted in a public network environment. In one embodiment, the security network (400) can perform the role of protecting communication between the control module (300) and the server (500). Such a security network (400) can function as an important security layer when the control module communicates with the server in an industrial system or IoT environment. Since communication between the control module (300) and the server (500) may involve sensitive commands and data, authentication or encryption is required to prevent unauthorized access. For example, threats such as man-in-the-middle attacks can be prevented by establishing an encrypted session during data transmission using an encryption protocol such as TLS (Transport Layer Security). Additionally, the security network (400) can maintain the stability of communication between the control module (300) and the server (500) by monitoring traffic or blocking abnormal access using a firewall or an Intrusion Detection System (IDS). The configuration of the security network is not limited to the examples described above, and various communication methods that a person of ordinary skill can utilize without particular difficulty may be used.

[0084] Referring again to FIG. 2, the photovoltaic power generation facility encryption system may include a first communication section (1000-1) and a second communication section (1000-2). The encryption method of the present disclosure includes, as one of its various purposes, preventing external intrusion or data theft that may occur in the first communication section (1000-1) through a security module (211) and an encryption method utilizing the security module.

[0086] FIG. 3 is a flowchart schematically illustrating an encryption method according to one embodiment of the present disclosure.

[0087] According to one embodiment of the present disclosure, a method for encrypting a photovoltaic power generation facility may include an authentication step of a control module (S100), an authentication step of an inverter (S200), a step of transmitting a first encrypted data request packet to a security module (S300), a step of the security module performing encryption or decryption and communicating with the inverter (S320), and a step of transmitting a second encrypted inverter data to a server (S330). Specific details regarding the authentication step of the control module (S100) and the authentication step of the inverter (S200) will be described later with reference to FIGS. 4 and 5.

[0088] According to one embodiment, a solar power generation facility encryption system may transmit a first encrypted data request packet to a security module. The solar power generation facility encryption system may be configured to include a computing device (100), and the computing device (100) may include a plurality of computing devices. For example, the data request packet may be generated by a server or a client, generated by a user's request, or generated by a predefined setting on a server. In this case, the data request packet may be a data transmission unit used to request specific data or transmit commands over a network, and such a packet may include details regarding the request, commands, or the structure and format of the data. In one embodiment, the first encryption may be performed using at least one of the private key of the security module or the first symmetric key. If the private key of the security module is used, the first encryption may be performed using an asymmetric encryption method utilizing the private key and the public key. Alternatively, if the first symmetric key is used, the first encryption may be performed using a symmetric encryption method. When the first encryption is performed using a symmetric encryption method, security can be achieved by utilizing an initialization vector (IV). The first encrypted data request packet from the server can be transmitted to the security module through the control module. At this time, the control module may transmit the first encrypted data request packet to the security module without accessing its contents, or it may transmit it to the security module after performing an integrity verification while maintaining the encryption state of the first encrypted data request packet.

[0089] According to one embodiment, a photovoltaic power generation facility encryption system may enable a security module to communicate with an inverter by performing encryption or decryption. Upon receiving a first encrypted data request packet, the security module may decrypt the first encrypted data request packet and transmit it to the inverter. At this time, the security module may transmit the decrypted data request packet to the inverter as is, or it may transmit the contents of the decrypted data request packet to the inverter after processing or modifying them. The processing or modification may be an operation of processing or modifying the data request packet to suit the communication environment or language of the inverter. Additionally, when the inverter receives the decrypted data request packet or the contents of the data request packet, the inverter may reply to the security module with response data regarding the data request packet. For example, if the data request packet includes a command regarding a photovoltaic power generation facility such as an inverter, the inverter may reply regarding whether the command was executed, the result of execution, etc. As another example, if the data request packet contains a request for power generation amount, weather data, panel temperature, or other status information, the inverter may reply to the security module with response data regarding the request. The security module may perform a second encryption operation on response data including the examples described above. The second encryption may utilize the same encryption method as the first encryption, but is not limited thereto. For example, the first encryption may utilize an asymmetric encryption method, and the second encryption may utilize a symmetric encryption method. As previously mentioned, the response data must be interpreted as identical to the inverter data. The second encrypted inverter data may be transmitted to the server through the control module.At this time, the control module may transmit the second encrypted inverter data to the server without accessing the contents of the second encrypted inverter data, or transmit the second encrypted inverter data to the server after performing an integrity verification while maintaining the encryption state of the second encrypted inverter data.

[0091] FIG. 4 is a flowchart schematically illustrating the authentication process of a control module according to one embodiment of the present disclosure.

[0092] According to one embodiment of the present disclosure, a photovoltaic power generation facility encryption system can perform authentication (S100) of a control module. Such authentication of the control module may be performed by including the step of the control module connecting to a server (S110), the step of transmitting a fourth encrypted control module authentication data to the server (S120), and the step of transmitting a security module list to the control module when the control module authentication is successful (S130-1). Alternatively, if the authentication of the control module fails, it may additionally include the step of performing an authentication failure operation (S130-2).

[0093] In step S110, the control module can access the server through a secure network. For example, the control module can access the server using a VPN, thereby encrypting the entire network traffic and connecting the network through a virtual tunnel. Furthermore, the exemplary control module can additionally utilize HTTPS to further encrypt data between the server and the client, thereby maintaining security even after the VPN exit point. Additionally, by utilizing HTTPS to encrypt data end-to-end, double encryption can be applied so that the data cannot be queried even by the VPN server.

[0094] In the case of step S120, the control module may transmit the fourth encrypted control module authentication data to the server after server connection (S110). For example, the control module authentication data may include the ID or identification number of the control module. For example, the fourth encryption may be performed using the control module's private key or the fourth symmetric key. When performing the fourth encryption using the control module's private key, an asymmetric encryption method may be applied by utilizing the public key together. Additionally, for example, even when an asymmetric encryption method is applied to the fourth encryption, a symmetric encryption method may be used for at least some of the first to third encryptions. Partially utilizing asymmetric encryption in this way may be more efficient than applying asymmetric encryption entirely in cases where the communication environment is poor or where limited data transmission volume and computational costs must be considered. For example, since asymmetric encryption may be inefficient in terms of speed and data size in poor communication environments, such asymmetric encryption may be used only for the initial session key exchange and then switched to symmetric encryption, so that at least some of the first to third encryptions are performed using a symmetric encryption method.

[0095] In the case of step 130-1, after the fourth encrypted control module authentication data is transmitted to the server (S120), if the server successfully authenticates the control module, the security module list may be transmitted to the control module. The security module list may include information regarding at least one security module, and for example, the information regarding the security module may include the ID or identification number of the security module. In the case of step 130-2, after the fourth encrypted control module authentication data is transmitted to the server (S120), if the server fails to authenticate the control module, an authentication failure action may be performed. The authentication failure action may include at least one of refusing connection, temporary locking, warning, sending notification, requesting additional authentication, restricting the provision of debugging information, restricting automatic retries, switching to a safe action, logging, storing forensic data, requesting a reboot or initialization of the control module, returning a false response, or blocking network traffic.

[0097] FIG. 5 is a flowchart schematically illustrating the authentication process of a security module or inverter according to one embodiment of the present disclosure.

[0098] According to one embodiment of the present disclosure, a photovoltaic power generation facility encryption system may perform inverter authentication (S200). Such inverter authentication (S200) may be performed by including the step of requesting inverter authentication data (S210), the step of transmitting a third encrypted inverter authentication data to a server (S220), and the step of transmitting a first encrypted inverter data request packet to a control module when the inverter authentication is successful (S230-1). Alternatively, if the inverter authentication fails, it may include the step of initiating authentication of another inverter (S230-2). In one embodiment, the inverter authentication (S200) may include the step of the server transmitting a security module list to the control module (S130-1). By utilizing the security module list obtained through this step 130-1, the security module and inverter subject to authentication can be designated. Since the security module is installed in correspondence with the inverter, it is obvious that the inverter subject to authentication can be identified by obtaining the security module list.

[0099] For example, step S210 may be a step in which a control module requests inverter authentication data from an inverter or security module that is the subject of authentication. In this case, the inverter authentication data may, for example, include an ID or identification number of the inverter. The inverter authentication data including the ID or identification number of the inverter may also include a node number. The node number is a number used to uniquely identify a device in a network system. For example, a security module may search for or request the inverter authentication data and receive the authentication data from the inverter.

[0100] Furthermore, step S220 may be a step of encrypting the inverter authentication data a third time and transmitting the third-encrypted inverter authentication data to a server. At this time, the third encryption may be performed by a security module. For example, the third encryption may be performed using at least one of the security module's private key or the third symmetric key. When performing the third encryption using the security module's private key, an asymmetric encryption method may be applied by utilizing the public key together. Also, for example, even when an asymmetric encryption method is applied to the third encryption, a symmetric encryption method may be used for at least some of the first and second encryptions. Partially utilizing asymmetric encryption in this way may be more efficient than applying asymmetric encryption entirely in cases where the communication environment is poor or where limited data transmission volume and computational costs must be considered. For example, since asymmetric encryption may be inefficient in terms of speed and data size in poor communication environments, such asymmetric encryption may be used only for the initial session key exchange and then switched to symmetric encryption, so that at least some of the first and second encryptions are performed using a symmetric encryption method.

[0101] After step S220, if the authentication of the inverter is successful, the photovoltaic power generation facility encryption system may transmit the first encrypted inverter data request packet to the control module (S230-1). At this time, the first encryption may be performed using at least one of the private key of the security module or the first symmetric key. In one embodiment, the server may obtain the private key of the security module during the inverter authentication step (S200), and may perform the first encryption of the inverter data request packet using the obtained private key and public key of the security module. An asymmetric encryption method may be used for this first encryption. Alternatively, when the inverter data request packet is first encrypted using the first symmetric key, the first encryption may be performed by utilizing an initialization vector together. The initialization vector may serve to enhance security by adding randomness to the encryption of the block, thereby generating different ciphertexts even if the same data is encrypted. Alternatively, if the authentication of the inverter fails after S220, the photovoltaic power generation facility encryption system may include the step of starting the authentication of another inverter (S230-2). In cases where the inverter's certification fails, various certification failure actions may be performed in addition to certifying other inverters.

[0102] In the present disclosure, encryption may utilize symmetric encryption, asymmetric encryption, lightweight encryption, combinations of symmetric and asymmetric encryption, stream ciphers, block ciphers (AES-CTR, AES-GCM, etc.), Pre-Shared Key (PSK) based communication methods, or TLS / DTLS (Datagram Transport Layer Security), but is not limited to the examples mentioned. It will be readily understood that a person skilled in the art can make modifications without particular difficulty based on the contents of the present disclosure.

[0103] As previously explained, when utilizing a symmetric encryption method in the present disclosure, an initialization vector may be utilized. For example, symmetric encryption may proceed in the order of dividing data into blocks and encrypting each block with a symmetric key. In this case, the initialization vector (IV) may be used to add randomness to the encryption of a specific data block. For example, the specific data block may be the first data block. If the data is not divided to fit a fixed block size, padding may be added. The first block may be encrypted with the symmetric key after performing an operation with the initialization vector. Subsequent blocks may be processed by encrypting the result of an operation with the previous ciphertext block with the symmetric key. Alternatively, the initialization vector may be treated as a counter value, encrypted with the symmetric key, and then a ciphertext may be generated through an operation with each data block. The decryption process for such symmetric encryption may proceed in the reverse order of the encryption process. Symmetric encryption may utilize symmetric encryption algorithms such as AES (Advanced Encryption Standard), DES (Data Encryption Standard), Blowfish, Twofish, ChaCha20, SEED, CAMELLIA, and GOST, but is not limited thereto. In this disclosure, the first symmetric key, the second symmetric key, the third symmetric key, and the fourth symmetric key may be different symmetric keys, but some of them may be the same symmetric key. When symmetric keys are generated differently, even if a specific symmetric key is exposed, the symmetric key in other communication segments remains secure, thereby enhancing the communication security of the system. Additionally, by maintaining the independence of the communication path, stability in the interaction between devices in a system with relatively high complexity can be enhanced. For example, symmetric keys may be configured to be updated at regular intervals, and keys may be protected using a hardware security module (HSM) or a security area.

[0104] The asymmetric encryption method in the present disclosure may be a method of encryption utilizing a private key and a public key. A public key is a key that can be publicly shared and may also be referred to as a shared key. A private key is a key known only to the device, module, or entity that possesses the key. If a sender intends to encrypt data to protect it, the data can be encrypted using the recipient's public key. Since data encrypted with a public key can only be decrypted using the private key paired with that public key, only the recipient can view the data. This ensures that the data is protected even if it is intercepted in transit when the recipient transmits it to a public network or a secure network. Conversely, if encryption is performed to verify the authenticity of data or for authentication purposes, the sender can encrypt the data using their own private key. Since data encrypted with a private key can only be decrypted using the sender's public key, the device, module, or user possessing the public key is capable of decrypting the data. This method can be used to prove that the data was generated by the private key owner. Decryption for asymmetric encryption can proceed in the reverse order of the encryption process. Data encrypted with a public key can be decrypted by the recipient using their own private key, and data encrypted with a private key can be decrypted using the public key. Asymmetric encryption can be used in algorithms such as RSA, RSA, and ECC (Elliptic Curve Cryptography), and is not limited to the examples mentioned above. Such asymmetric encryption methods can be utilized in a hybrid manner by combining them with symmetric encryption. For example, keys can be exchanged or shared via asymmetric encryption during the initial session, and then the encryption method can be switched to symmetric encryption to transmit and receive data.

[0106] FIG. 6 is a flowchart schematically illustrating a communication method of an encryption system according to one embodiment of the present disclosure.

[0107] According to one embodiment of the present disclosure, a server (500) may transmit a first encrypted inverter data request packet to a control module (300), the control module (300) may transmit the first encrypted inverter data request packet to a security module (211), the security module (211) may transmit a decrypted inverter data request packet to an inverter (210), the inverter (210) may transmit inverter data to the security module (211), the security module (211) may transmit a second encrypted inverter data to the control module (300), and the control module (300) may transmit the second encrypted inverter data to the server (500). In this communication method, certain steps may be omitted or multiple steps may be combined as needed, and are not necessarily limited to the order mentioned.

[0109] In the present disclosure, the inverter may include a plurality of inverters, and the security module may include a plurality of security modules. The security module may be configured to correspond to each inverter. In this case, each security module may be configured to be detachable or installable to each inverter. For example, the inverter may include a first inverter (210), a second inverter (220), and a third inverter (230). Additionally, the security module may include a first security module (211), a second security module (221), and a third security module (231). For example, the first security module may be configured to correspond to the first inverter (210). Any one of the security modules may be referred to as the first security module, and this designation is intended to distinguish it from other security modules and should not be interpreted as implying any other limitations. In addition, any one of the inverters may be referred to as the first inverter, and this designation is intended to distinguish it from other inverters and should not be interpreted as implying any other limitations.

[0111] The present disclosure may be implemented through a combination of hardware and software, including computer-executable instructions and program modules executed on one or more computers. The method of the present disclosure may be implemented on various computer devices, such as a single processor, a multiprocessor system, a personal computer, a handheld computing device, or a programmable electronic device, and is not limited to the examples mentioned.

[0112] Generally, a program module may include routines, programs, components, data structures, etc., that perform specific tasks or implement specific data types. Various methods of the present disclosure may also be executed in a distributed computing environment through communication between remote devices, in which case the program module may be located in a local or remote memory device.

[0113] Computer-readable media can be used to store computer instructions, data structures, program modules, etc., in various forms such as volatile, non-volatile, transient, non-transient, removable, and non-removable. For example, computer-readable storage media may include RAM, ROM, EEPROM, flash memory, CD-ROM, DVD, magnetic disk, etc., and these can be media that store data and provide desired information.

[0114] In addition, computer-readable transmission media include media capable of transmitting commands and data through transmission mechanisms such as carrier waves or modulated data signals, and include both wired and wireless networks. Combinations of these media can also be classified as computer-readable transmission media.

[0115] A computer may consist of a processing unit, system memory, and a system bus, and the system bus may be connected to various bus architectures such as a memory bus and a peripheral device bus. System memory may include ROM or RAM, and this memory may include a Basic Input / Output System (BIOS) that provides the computer's basic input / output functions and information at startup.

[0116] A computer includes various storage devices such as hard disk drives, floppy disk drives, and optical disk drives, which are connected to a system bus and can provide volatile or non-volatile storage of data and instructions. HDDs, FDDs, and optical drives can be connected through their respective interfaces and may include interfaces necessary for the implementation of external drives, such as USB (Universal Serial Bus) or IEEE 1394.

[0117] Computers store various program modules, such as operating systems, application programs, other program modules, and program data, and these programs can be cached in RAM. This can be executed on various commercial operating systems and combinations thereof.

[0118] Users can input information into the computer through input devices such as keyboards and mice, and these input devices can be connected to processing units through input device interfaces connected to the system bus. Display devices, such as monitors, can be connected to the system bus, through which the computer's output can be provided.

[0119] Computers can be logically connected to remote computers in network environments such as Local Area Networks (LANs) and Wide Area Networks (WANs). In this case, they are connected to the network via wired and wireless communication network interfaces or modems, and can also connect to external networks such as the Internet. In a networked environment, parts of program modules may be stored on remote storage devices.

[0120] Computers can communicate with various wireless devices, such as printers, scanners, PDAs, or communication satellites. Through wireless technologies like Wi-Fi and Bluetooth, data is transmitted and received within base stations, and wireless communication can be utilized to support connections between computers and internet access. These Wi-Fi networks can provide secure, reliable, and high-speed wireless connections using IEEE 802.11 technology.

[0121] Through such computing environments, various devices and functions can be integrated, and the invention described in this disclosure may be implemented or practiced in a single or distributed computing environment. It should be understood that the order or hierarchical structure of the steps expressed in the presented process may be an example of this disclosure. Within the scope described in this disclosure, each step included in the processes may be rearranged, and the order and hierarchical structure may be changed without departing from the description of this disclosure. This disclosure provides various elements of steps through the claims, but is not limited only to the order or hierarchical structure presented.

[0122] The descriptions of the presented embodiments are provided to enable a person skilled in the art to practice the present invention, and various modifications based on these embodiments may be made by a person skilled in the art. Thus, the present disclosure is not limited to the presented embodiments and should be interpreted in the broadest possible scope in consideration of the technical concept and technical significance described in the present disclosure.

Claims

Claim 1 A method for encrypting a photovoltaic power generation facility, comprising: a step in which a server authenticates a control module based on fourth encrypted control module authentication data; a step in which, if the authentication of the control module is successful, the server transmits a list of security modules to the control module; a step in which the control module requests inverter authentication data of an inverter corresponding to the security module from a security module included in the list of security modules; a step in which the security module encrypts the inverter authentication data a third time and transmits the third encrypted inverter authentication data to the server through the control module; a step in which the server authenticates an inverter based on the third encrypted inverter authentication data; a step in which, if the authentication of the inverter is successful, the server transmits a first encrypted inverter data request packet to the security module through the control module; a step in which the security module decrypts the first encrypted inverter data request packet and transmits it to the authenticated inverter; and a step in which the security module receives inverter data from the authenticated inverter and performs a second encryption. A method comprising the step of transmitting second encrypted inverter data from the security module through the control module to the server, wherein the control module relays the first encrypted inverter data request packet and the second encrypted inverter data while maintaining the encryption state of the first encrypted inverter data request packet and the second encrypted inverter data without accessing the contents of the first encrypted inverter data request packet and the second encrypted inverter data, wherein the first encryption is performed using at least one of the private key or the first symmetric key of the security module, the second encryption is performed using at least one of the private key or the second symmetric key of the security module, the third encryption is performed using at least one of the private key or the third symmetric key of the security module, and the fourth encrypted control module authentication data is data encrypted using the private key or the fourth symmetric key of the control module. Claim 2 delete Claim 3 In claim 1, the inverter authentication data includes the node number of the inverter. Claim 4 delete Claim 5 A method according to claim 1, wherein the first encryption and the second encryption include a symmetric encryption method that utilizes an initialization vector together. Claim 6 In claim 5, the first encryption and the second encryption include a symmetric encryption method utilizing an initialization vector together, and at least one of the third encryption or the fourth encryption includes an asymmetric encryption method; and a method further performed by utilizing a public key. Claim 7 A method according to claim 1, wherein the first encryption and the second encryption include an asymmetric encryption method; and further performed by utilizing a public key. Claim 8 A method according to claim 5, 6, or 7, wherein the security module comprises a plurality of security modules, the inverter comprises a plurality of inverters, and each of the plurality of security modules is configured to correspond to each inverter included in the plurality of inverters. Claim 9 In claim 8, the method wherein the first encrypted data request packet includes a command to perform an operation for a solar power generation facility or the inverter. Claim 10 In claim 9, the method further comprises the step of the server decrypting the second encrypted inverter data. Claim 11 A photovoltaic power generation facility encryption system communicating by utilizing the method of claim 1, comprising: a server that performs a photovoltaic power generation system management service; an inverter that includes a status monitoring or data collection function of said photovoltaic power generation facility; a security module configured in correspondence with said inverter and performing encryption or decryption; and a control module capable of communicating at least temporarily with said server, said power generation facility, said inverter, or said security module.

Images