Distributed Power Supply Security Analysis for Attack Path Assessment

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

The increasing penetration of distributed power generation in smart grids poses significant network-related performance issues, including security risks from software and hardware vulnerabilities, malicious programs, and complex network environments. These risks can lead to cascading failures and power grid instability when distributed power supply control systems are subjected to coordinated malicious attacks.

Innovation Solution

A multi-terminal collaborative dynamic security analysis method and system that builds a physical-cyber network topology model for distributed power supply control systems. This system assesses cyber and physical domain security risk probabilities, updates risk probabilities in real-time, and identifies target attack paths to evaluate the business damage degree caused by potential attacks.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If distributed power supply control systems adopt multi-channel many-to-many communication to meet distributed control requirements, then control flexibility and responsiveness are improved, but network topology changes increase attack entrances and blur security boundaries

Engineering Contradiction:

Improvedistributed control flexibilityVSAvoidnetwork topology complexity

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The patent segments the distributed power supply control system into multiple isolation zones (production control zone, management information zone, etc.) with clear security boundaries. Each zone has dedicated security devices and policies, transforming the complex many-to-many communication into structured zone-based interactions that maintain control flexibility while reducing attack surfaces.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces security devices (firewalls, intrusion detection systems, authentication servers) as intermediaries between different communication entities. These intermediaries mediate the many-to-many communication relationships, enabling flexible distributed control while providing centralized security management and clear boundary enforcement.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Productivity

If distributed power terminal units are deployed extensively to increase power generation capacity, then productivity is improved, but security risk propagation pathways increase

Engineering Contradiction:

Improvepower generation capacityVSAvoidsecurity risk propagation

Core Design Contradiction:

ProductivityVSObject-affected harmful factors

Solution Approach 1:

The patent divides the extensive network of distributed power terminal units into isolated security zones and assigns security policies to each zone. This segmentation allows numerous terminal units to operate simultaneously for high productivity while containing security risks within specific zones, preventing widespread propagation.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent implements preliminary security measures including pre-deployment of security devices, pre-configured security policies, and proactive risk assessment mechanisms at each distributed terminal unit. These preliminary actions establish security boundaries before attacks can propagate, enabling extensive deployment without proportional increase in risk propagation pathways.

Inventive Principle:

Principle #10Preliminary action

3Measurement precision

If real-time dynamic security analysis is implemented across all distributed power terminal units, then security detection capability is improved, but computational resource consumption increases

Engineering Contradiction:

Improvesecurity risk detection precisionVSAvoidcomputational resource consumption

Core Design Contradiction:

Measurement precisionVSUse of energy by moving object

Solution Approach 1:

The patent segments security analysis into zone-level aggregate analysis and selective detailed analysis. Most terminal units perform lightweight local monitoring, while zone security devices perform comprehensive real-time analysis on aggregated data. This segmentation achieves high detection precision across the entire system while minimizing computational resource consumption at individual terminal units.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent implements partial real-time analysis focused on critical security parameters and high-risk zones, rather than exhaustive analysis of all terminal units simultaneously. Security resources are dynamically allocated to perform detailed analysis only where and when needed, maintaining high detection precision for critical threats while reducing overall computational resource consumption.

Inventive Principle:

Principle #16Partial or excessive action

Data Source

PatentUS20250106240A1Multi-terminal collaborative dynamic security analysis method and system for distributed power supply

Publication Date: 2025.03.27 STATE GRID ZHEJIANG ELECTRIC POWER COMPANY TAIZHOU POWER SUPPLY

AI summary

A multi-terminal collaborative dynamic security analysis method and system for distributed power supply are provided. The method includes building a physical-cyber network topology model for a distributed power supply control system; updating cyber domain security risk probabilities and physical domain security risk probabilities of other units, to achieve a dynamic physical-cyber security risk network topology map; searching a target attack path according to different attack entrances and attack intensities; and taking the target attack path as guidance, to implement a damage degree assessment.