CN103378654A

CN103378654A - Method for filtering network messages of process level of intelligent substation

Info

Publication number: CN103378654A
Application number: CN201210127898XA
Authority: CN
Inventors: 李力; 吕航; 杨贵; 何学东
Original assignee: NR Electric Co Ltd; NR Engineering Co Ltd
Current assignee: NR Electric Co Ltd; NR Engineering Co Ltd
Priority date: 2012-04-27
Filing date: 2012-04-27
Publication date: 2013-10-30
Anticipated expiration: 2032-04-27
Also published as: CN103378654B

Abstract

Provided is a method for filtering network messages of a process level of an intelligent substation. A network of the process level of the intelligent substation is connected with various devices which comprise a merging unit, an intelligent terminal, a switchboard, a protection device and a measuring and control device, wherein the devices are used for sending and receiving SV messages and GOOSE messages, message filtering modules are additionally arranged between network interfaces and physical layers of the devices, the received messages are filtered additionally in a message filtering mode, traffic limitation is performed on the messages with MAC addresses assigned by the devices, key fields of the messages with the MAC addresses assigned by the devices are recognized, repeated messages are filtered, the messages without the MAC addresses assigned by the devices are discarded or forwarded, and broadcasting messages are discarded or forwarded. According to the method, the accurate management of the GOOSE messages and the SV messages can be achieved through the merging unit, the intelligent terminal, the switchboard, the protection device and the measuring and control device in the intelligent substation.

Description

Transformer station process layer network message filtering method

Technical field

Communicating by letter of this all kinds of devices such as merge cells, intelligent terminal, switch, protective device and measure and control device that relate to digital transformer substation, specifically install sending and receiving SV (sampled value), GOOSE message (transformer substation case towards general object is to be used for satisfying the electric substation automation system rapid message in IEC 61850 standards) filtration method and adopt the device of the method.

Background technology

The transformer station process layer network is by L2 Ethernet switch (L2 switch: be exactly Layer 2 switch; only according to MAC(Media Access Control; medium access control) address etc. is carried out message and is processed; do not have three-tier switch function and the routing functions such as IP) consist of; be used for connecting protective device; measure and control device; intelligent terminal; merge cells etc.; realize GOOSE (Generic Object Oriented Substation Events; transformer substation case towards general object); SV(Sample Value sampled value) networking of signal transmission, the transmission reliability of this information; real-time directly has influence on the Reliability of Microprocessor of protection.Therefore, the various devices on the network should be able to provide enough safety prevention measure to realize filtration to useless message, guarantee that effective GOOSE, SV message can normal transmission and can not be subject to the impact of message or exception message useless on the network.

Various devices on existing GOOSE, the SV network network storm suppressor mode that main dependence switch provides in packet filtering, this mode can realize broadcasting packet, multicast message and unknown unicast message suppressed flow by message classification, can't multicast and unicast message flow, the duplicate message of specifying MAC Address be suppressed, cause can't effectively managing accurately the message flow on the network in the application scenario of process layer, network security has very large hidden danger.

Summary of the invention

The objective of the invention is: a kind of transformer station process layer network message filtering method is provided, solves the problem that present network storm suppressor mode can't carry out for the MAC Address of appointment flow restriction.

Technical solution of the present invention is:Transformer station process layer network message filtering method; be connected with all kinds of devices on the process-level network of intelligent substation; comprise merge cells; intelligent terminal, switch, protective device and measure and control device; described all kinds of device sending and receiving SV and GOOSE message are at network interface and the PHY of described all kinds of devices (PhYsical LAyer, physical layer) increase the packet filtering module between, in the mode of packet filtering the message that receives is carried out extra filtration, the strategy of filtration is: specify the message of MAC Address to carry out flow restriction to all kinds of devices; Specify the critical field of the message of MAC Address to identify to all kinds of devices, filter duplicate message; Do not carry out discard processing or forward process to what all kinds of devices were specified the MAC Address message; Carry out discard processing or forward process for broadcasting packet.By the mode that increases packet filtering (being carried out by filtering module) message that receives is carried out extra filtration, filter the main suppression strategy that adopts: all kinds of devices such as merge cells, intelligent terminal, protection, measure and control device are according to actual needs to the different multicast mac address of all kinds of device configurations.

Specific strategy or the step of filtering are:

1) MAC Address of appointment being carried out flow limits respectively, namely the actual physics flow situation for each MAC Address decides the peak flow values of distributing to this MAC Address, when surpassing this maximum, the flow of this MAC Address generation will be dropped, the flow that guarantees other MAC Address is unaffected, at present, only have network storm to suppress to realize the whole flow restriction of multicast message, can't realize carrying out flow restriction according to MAC Address.

2) (for example identify for the critical field (critical field can be SV test serial number, source MAC, destination-mac address etc.) of specifying the MAC Address message, SV test serial number to same MAC Address repeats identification, and to duplicate message carry out discard processing make receiving terminal receive only one the bag this sequence number message), filter duplicate message, namely only allow the first packet voice to pass through other packet loss.

The mode of in the packet filtering module specific fields (being critical field) that receives and send message being carried out fields match reaches the network message flow is accurately limited purpose.

3) can select as required discard processing or forward process to unspecified MAC Address message; Can select as required discard processing or forward process for broadcasting packet.

Beneficial effect of the present invention: the present invention can realize merge cells in the intelligent substation; all kinds of devices such as intelligent terminal, switch, protective device and measure and control device are to the accurate management of GOOSE and SV network message; solve the problem that the process-level network message can't accurately suppress, solved the hidden danger that may form network storm on the network.Effectively solve the retransmitted problem of process-level network message, useless message takies the effective bandwidth problem.Purify to greatest extent network environment, guaranteed the effective GOOSE on the process-level network, the unobstructed transmission of SV message.

Description of drawings

Fig. 1 is the structural representation of embodiment of the present invention.

Fig. 2 is the structural representation of another execution mode of the present invention.

Embodiment

It is following that also the invention will be further described by reference to the accompanying drawings according to embodiment:

The equipment such as the switch in the transformer station process layer, protection, observing and controlling, merge cells and intelligent terminal all need to provide 2 or above network interface to come with other corollary apparatus interconnected; when separate between each port, (there is not internal connection between each network interface; different network interfaces such as device) can adopt Fig. 2 to manage, (such as each network interface of switch) can adopt Fig. 1 to manage when mutually having association between each port.

The below at first is described Fig. 2; when we know that the application of device (switch, protection, observing and controlling, merge cells, intelligent terminal etc.) in intelligent substation disposed; we can know that simultaneously each network interface of device needs MAC Address and the flow of sending and receiving message, and we can carry out following setting to the packet filtering module by the CPU of device

1. setting device is managed the direction of flow: manage incoming message flow, outgoing message flow or manage simultaneously the input and output message flow.

2. the maximum stream flow of carrying out of sending and receiving message is set according to different MAC Address, the processing mode (transmit or abandon) of other MAC Address is set simultaneously.

3. the drop policy of duplicate message is set, such as specifying the processing method that occurs the message that sequence number is identical in the identical MAC Address message in the 10ms: only allow the first packet voice by or all abandon etc.

4. the MAC Address quantity of the maximum management of this network interface of setting device.

Suppose that Fig. 2 is merge cells; this device be responsible for that the protection and measurement and control device provides the measurement data of line voltage distribution and electric current and in the mode of SV multicast message by giving the protection measure and control device on the L2 switch; the P_1 port of supposing simultaneously merge cells sends the SV message and receives the GOOSE message, and other ports do not use.The characteristics of merge cells are that the SV message that only sends a kind of address does not receive any SV message, send the message flow of SV generally about 6Mbps; Receive simultaneously the GOOSE message that intelligent terminal sends, the GOOSE message flow is generally the message of several bags of per second.Therefore, we are combined unit P_1 port and carry out following setting:

1. the direction of setting device management flow is for managing simultaneously the input and output message flow.

2. arrange send SV message maximum stream flow be 10Mbps(or greater than 6Mbps), arranging and receiving the GOOSE message flow is that 1Mbps(also can be less, arranges according to actual needs).Or the processing mode that other MAC Address are set is for abandoning.

3. the drop policy that duplicate message is set is that the identical message of sequence number only allows the first packet voice to pass through in the identical MAC Address message of the interior appearance of 50ms, other packet loss.

4. the MAC Address quantity of the maximum management of setting device P_1 network interface is 5 (or still less, satisfying the demand gets final product).

Fig. 1 is the different set-up modes of same packet filtering module with Fig. 2, and the P_1-P_N+1 port uses identical packet filtering module in Fig. 1, and this implementation is adapted at existing in the related situation between a network interface of device.P_1-P_N+1 among Fig. 2 carries out separate configurations to each port, and namely each port adopts the different rules that arranges to carry out work, and regular the same merge cells setting is set, and does not repeat them here.

Claims

1. transformer station process layer network message filtering method, be connected with all kinds of devices on the process-level network of intelligent substation, all kinds of devices comprise merge cells, intelligent terminal, switch, protective device and measure and control device, described all kinds of device sending and receiving SV and GOOSE message, it is characterized in that: between the network interface of described all kinds of devices and physical layer, increase the packet filtering module, in the mode of packet filtering the message that receives is carried out extra filtration; The strategy that filters is: specify the message of MAC Address to carry out flow restriction to all kinds of devices; Specify the critical field of the message of MAC Address to identify to all kinds of devices, filter duplicate message; Do not carry out discard processing or forward process to what all kinds of devices were specified the MAC Address message; Carry out discard processing or forward process for broadcasting packet.

2. transformer station process layer network message filtering method as claimed in claim 1, it is characterized in that: specific strategy or the step of packet filtering are:

1) MAC Address of appointment being carried out flow limits respectively, namely the actual physics flow situation for each MAC Address decides the peak flow values of distributing to this MAC Address, when the flow of this MAC Address generation surpasses this maximum, will be dropped, guarantee that the flow of other MAC Address is unaffected;

2) for the critical field of specifying the MAC Address message, critical field is that SV test serial number, source MAC or destination-mac address are identified; Filter duplicate message, namely only allow the first packet voice to pass through other packet loss;

The mode of in the packet filtering module critical field that receives and send message being carried out fields match reaches the network message flow is accurately limited;

3) unspecified MAC Address message is selected discard processing or forward process as required; Select as required discard processing or forward process for broadcasting packet.

3. transformer station process layer network message filtering method according to claim 1 is characterized in that: a port of the merge cells of intelligent substation sends the SV message and also receives the GOOSE message, and other ports do not use; The SV message that this merge cells only sends a kind of address does not receive any SV message, sends the message flow of SV at 6Mbps; Receive simultaneously the GOOSE message that intelligent terminal sends, the GOOSE message flow is several bags of per second; This port of described merge cells is carried out following setting:

1) direction of setting device management flow is for managing simultaneously the input and output message flow;

2) transmission SV message maximum stream flow being set is 10Mbps, and arranging and receiving the GOOSE message flow is 1Mbps;

3) processing mode of other MAC Address is set for abandoning;

4) drop policy that duplicate message is set is to occur sequence number is identical in the identical MAC Address message message only 5 in the 50ms) allow the first packet voice to pass through other packet loss;

6) the MAC Address quantity of the maximum management of this network interface of setting device is 5.