CN110012447A - The system and method for network security control function is realized in substation based on wireless sensor - Google Patents

Abstract

The present invention relates to the system for realizing network security control function based on wireless sensor in a kind of substation, including wireless sensor and wireless data acquisition terminal, the wireless sensor and wireless data acquisition terminal are the Star Network structure of non-relay node.The invention further relates to a kind of methods for realizing network security control function based on wireless sensor in substation.Using the system and method for realizing network security control function in substation of the invention based on wireless sensor, the characteristics of wireless sensor micropower is run is fully considered, has systematically devised the control management of network security.The management for being key is that the unique encodings based on MCU are automatically generated by software, and can only be read by flashburn tools, each sensor has independent key, is not necessarily to key generator, and efficient and convenient, safety is low in cost, without additional power consumption.

Description

A system for realizing network security control function based on wireless sensor in substation and method

technical field

The invention relates to the field of Internet of Things, in particular to the field of wireless transmission in substations, and in particular to a system and method for realizing network security control functions based on wireless sensors in substations.

Background technique

With the development and wide application of Internet of Things technology, wireless sensor networks based on wireless micropower are gradually applied in the current substations. Taking the platen state monitoring system as an example, it includes two parts: platen state sensor and data acquisition terminal. The platen state sensor senses the platen state in real time based on the non-electrical principle, and the data acquisition terminal realizes the aggregation, reception and processing of the small wireless signals sent by the platen position sensor, and communicates with the external application system. Wireless sensor networks are usually based on ISM frequency bands, such as 433MHz, 2.4GHz. These frequency bands do not require licenses or fees, and only need to comply with a certain transmission power (generally lower than 1W), and do not cause interference to other frequency bands. Influenced by the factors of its own node characteristics and its own node characteristics, the wireless sensor network of substations faces the following three network security risks in actual operation:

1) The privacy of data transmission is low, and it is easy to be monitored and parsed by external systems, resulting in information leakage.

2) From the signal interference in the process of wireless communication, the attacker uses the method of frequency interference to destroy the signal received by the sensor node and destroy the connection between the sensor node and the acquisition terminal.

3) The attacker forges sensor nodes to achieve the purpose of invading the acquisition terminal, and further intrudes into the internal communication network of the substation through the acquisition terminal as a relay, causing serious network security incidents.

SUMMARY OF THE INVENTION

The purpose of the present invention is to overcome the shortcomings of the above-mentioned prior art, and to provide a system and method for realizing network security control function based on wireless sensors in substations with good encryption, strong communication capability and wide application range.

In order to achieve the above purpose, the system and method for realizing the network security control function based on the wireless sensor in the substation of the present invention are as follows:

The system for realizing network security control function based on wireless sensors in the substation is mainly characterized in that the system includes wireless sensors and wireless data acquisition terminals, and the wireless sensors and wireless data acquisition terminals are satellites without relay nodes. The wireless sensor is used for transmitting wireless signals, and the wireless data acquisition terminal is used for receiving and processing the signals sent by the wireless sensor.

Preferably, the wireless sensor includes:

a first micro-control unit for managing and controlling communication resources;

The first wireless transceiver module is connected with the first micro-control unit through a serial peripheral interface, and is used for transmitting and receiving wireless signals.

Preferably, the wireless data collection terminal includes:

The second micro-control unit is used to manage and control the communication resources;

The second wireless transceiver module is connected with the second micro-control unit through the serial peripheral interface, and is used for transmitting and receiving wireless signals;

The second serial port transceiver module is connected with the second micro-control unit through the serial peripheral interface, and is used for sending and receiving signals through the serial port.

Preferably, the first wireless transceiver module includes a first wireless transceiver sending buffer and a first wireless transceiver receiving buffer, both of which are connected to the first micro-control unit.

Preferably, the second wireless transceiver module includes a second wireless transceiver sending buffer and a second wireless transceiver receiving buffer, both of which are connected to the second micro-control unit.

Preferably, the second serial port transceiver module includes a second serial port transceiver sending buffer and a second serial port transceiver receiving buffer, both of which are connected to the second micro-control unit.

Preferably, the first wireless transceiver sending buffer and the first wireless transceiver receiving buffer have a maximum size of 64 bytes.

Preferably, the second wireless transceiver sending buffer and the second wireless transceiver receiving buffer have a maximum size of 64 bytes.

Preferably, the second serial port sending and receiving buffer and the second serial port sending and receiving buffer have a maximum size of 255 bytes.

The main feature of the wireless sensor-based network security control method in a substation based on the above-mentioned system is that the method includes the following steps:

(1) The described wireless sensor and wireless data acquisition terminal download the serial number key and the corresponding key list;

(2) The wireless sensor encrypts the application data in the sending and receiving messages through an automatically generated key;

(3) The wireless data acquisition terminal obtains the corresponding key according to the node number of the wireless sensor, and restores it to actual application data;

(4) The wireless data acquisition terminal performs encryption processing through its key, and the wireless sensor performs data decryption.

Preferably, data encryption is performed in the described step (2) and step (4), specifically:

Data is encrypted according to the following formula:

TDATA[n]=DATA[n]+PKey[k]+CRC[r];

Among them, TDATA[n] is the value at the nth byte position of the application data encryption, DATA[n] is the value at the nth byte position of the application data, and PKey[k] is the kth byte of the key The value at the byte position, where k is the remainder of N divided by 4, and r is the remainder of N divided by 2.

Preferably, in the described step (3) and step (4), data decryption is performed, specifically:

The data is decrypted according to the following formula:

DATA[n]=TDATA[n]-PKey[k]-CRC[r];

Among them, TDATA[n] is the value at the nth byte position of the application data encryption, DATA[n] is the value at the nth byte position of the application data, and PKey[k] is the kth byte of the key The value at the byte position, where k is the remainder of N divided by 4, and r is the remainder of N divided by 2.

The system and method for realizing the network security control function based on the wireless sensor in the substation of the present invention are adopted, and the characteristics of the micro-power operation of the wireless sensor are fully considered, and the network security control management is systematically designed. The key management is based on the unique code of the MCU, which is automatically generated by the software, and can only be read by the programming tool. additional power consumption. The external communication module is independent, and the cache is placed in the communication module, which realizes the active processing of data and effectively avoids memory overflow attacks. The serial communication scheme is used for external communication, which effectively eliminates the security of the network communication interface in the Ethernet mode.

Description of drawings

FIG. 1 is the external communication hardware structure of the wireless sensor of the system for realizing the network security control function based on the wireless sensor in the substation of the present invention.

FIG. 2 is the external communication hardware structure of the wireless data acquisition terminal of the system for realizing the network security control function based on the wireless sensor in the substation of the present invention.

Detailed ways

In order to describe the technical content of the present invention more clearly, further description will be given below with reference to specific embodiments.

The system for realizing network security control function based on wireless sensors in the substation of the present invention includes:

A wireless sensor and a wireless data collection terminal, the wireless sensor and the wireless data collection terminal are both star network structures without relay nodes, the wireless sensor is used for transmitting wireless signals, and the wireless data collection terminal is used for Receive and process signals sent by wireless sensors.

As a preferred embodiment of the present invention, the wireless sensor includes:

a first micro-control unit for managing and controlling communication resources;

The first wireless transceiver module is connected with the first micro-control unit through a serial peripheral interface, and is used for transmitting and receiving wireless signals.

As a preferred embodiment of the present invention, the wireless data collection terminal includes:

The second micro-control unit is used to manage and control the communication resources;

The second wireless transceiver module is connected with the second micro-control unit through the serial peripheral interface, and is used for transmitting and receiving wireless signals;

The second serial port transceiver module is connected with the second micro-control unit through the serial peripheral interface, and is used for sending and receiving signals through the serial port.

As a preferred embodiment of the present invention, the first wireless transceiver module includes a first wireless transceiver sending buffer and a first wireless transceiver receiving buffer, both of which are connected to the first micro-control unit.

As a preferred embodiment of the present invention, the second wireless transceiver module includes a second wireless transceiver sending buffer and a second wireless transceiver receiving buffer, both of which are connected to the second micro-control unit.

As a preferred embodiment of the present invention, the second serial port transceiver module includes a second serial port transceiver sending buffer and a second serial port transceiver receiving buffer, both of which are connected to the second micro-control unit.

As a preferred embodiment of the present invention, the first wireless transceiver sending buffer and the first wireless transceiver receiving buffer have a maximum size of 64 bytes.

As a preferred embodiment of the present invention, the second wireless transceiver sending buffer and the second wireless transceiver receiving buffer have a maximum size of 64 bytes.

As a preferred embodiment of the present invention, the second serial port sending and receiving buffer and the second serial port sending and receiving buffer have a maximum size of 255 bytes.

The wireless sensor-based network security control method in the substation based on the above-mentioned system of the present invention includes the following steps:

(1) The described wireless sensor and wireless data acquisition terminal download the serial number key and the corresponding key list;

(2) The wireless sensor encrypts the application data in the sending and receiving messages through an automatically generated key;

(3) The wireless data acquisition terminal obtains the corresponding key according to the node number of the wireless sensor, and restores it to actual application data;

(4) The wireless data acquisition terminal performs encryption processing through its key, and the wireless sensor performs data decryption.

As a preferred embodiment of the present invention, data encryption is performed in the steps (2) and (4), specifically:

Data is encrypted according to the following formula:

TDATA[n]=DATA[n]+PKey[k]+CRC[r];

Among them, TDATA[n] is the value at the nth byte position of the application data encryption, DATA[n] is the value at the nth byte position of the application data, and PKey[k] is the kth byte of the key The value at the byte position, where k is the remainder of N divided by 4, and r is the remainder of N divided by 2.

As a preferred embodiment of the present invention, data decryption is performed in the steps (3) and (4), specifically:

The data is decrypted according to the following formula:

DATA[n]=TDATA[n]-PKey[k]-CRC[r];

Among them, TDATA[n] is the value at the nth byte position of the application data encryption, DATA[n] is the value at the nth byte position of the application data, and PKey[k] is the kth byte of the key The value at the byte position, where k is the remainder of N divided by 4, and r is the remainder of N divided by 2.

In the specific implementation of the present invention, the characteristics of wireless sensor nodes in substations, such as limited energy, weak communication capability, and small storage space, are fully considered, and combined with actual engineering deployment conditions and network security management requirements, the hardware structure design, data The network security design has been carried out in many aspects such as transmission mechanism, data transmission encryption, external transmission interface and protocol limitation, and a set of comparative Complete network security solutions to realize wireless sensor network security control in substations.

1. External communication modularized separate hardware architecture:

The MCU and communication resources are independently modularized and separated hardware architecture. The MCU runs independently, and it manages and controls the communication resources. The communication resource buffer is isolated from the MCU, which avoids the penetration of the MCU by overflow attacks, and communicates with each other. The module adopts interrupt notification + cache read and write mode for data exchange.

The wireless transceiver data receiving and sending buffers are located in the wireless transceiver module, and the maximum buffer is 64 bytes. Communication resource buffers are isolated from the MCU.

The serial port transceiver data receiving and sending buffers are located in the serial port transceiver module, the maximum buffer is 255 bytes, and the communication resource buffer is isolated from the MCU.

Wireless network coverage control: Micro-power wireless transceiver module is selected, the wireless transmission distance of the sensor does not exceed 50 meters, the platen state sensor and the data acquisition terminal adopt a star network structure without relay nodes, and the sensor collects the data collection terminal locally. Receive, effectively control the range of wireless transmission.

2. Data transmission encryption and decryption processing:

Each wireless sensor and wireless data acquisition terminal generates a four-byte unique key according to the built-in production serial number of the MCU during production. The key is generated when the software module is powered on and is read by the software burning tool. .

First, define a unified sending and receiving data format for wireless sending and receiving data:

3. The process of data encryption and decryption is as follows:

1) During engineering configuration, download the wireless sensor number and the corresponding key list to the wireless sensor node number, the wireless data acquisition terminal, and download the key of the wireless data acquisition terminal to which the sensor belongs.

2) When the wireless sensor sends and receives a message, the automatically generated key is used to encrypt the application data in the sent and received message.

The data encryption algorithm is as follows:

TDATA[n]=DATA[n]+PKey[k]+CRC[r];

TDATA[n] is the value at the nth byte position after applying data encryption;

DATA[n] is the value at the nth byte position of the application data;

PKey[k] is the value at the kth byte position of the key;

k = remainder of N divided by 4;

r=N is divided by the remainder of 2;

CRC[r] is a 2-byte check code.

3) After the wireless data acquisition terminal receives the message sent by the wireless sensor, it finds the corresponding key according to the node number of the sensor, and then restores it to the actual application data. The decryption algorithm of the data is as follows:

DATA[n]=TDATA[n]－PKey[k]－CRC[r]

4) The wireless data collection terminal uses its own key for encryption processing when sending data, and the wireless sensor uses the wireless data collection terminal to decrypt the data. The encryption and decryption algorithm is the same as above.

4. Anti-replication attack control of wireless data acquisition terminal: In order to prevent the signal sent by the wireless sensor from being monitored and sent to the wireless data acquisition terminal with high frequency copying and high-frequency data attack, the data sent by the wireless sensor is sent with counts, and the wireless data collection The terminal only processes data larger than the buffered send count, otherwise it will be discarded directly.

5. Security control of the wired data output port of the wireless data acquisition terminal: the external transmission of the acquisition terminal adopts RS485 serial communication, and the MODBUS communication protocol (RTU) is selected. The acquisition terminal does not actively send data to the outside world. Data interaction mode. The following is a list of functions supported by the collection terminal:

The sensor is generally installed in the control room of the substation, and the personnel of the substation other than the power company cannot enter. Try to control the wireless network coverage within the substation, which can prevent the wireless signal from being maliciously monitored by outsiders.

Using serial communication is a relatively common network security control method. The TCP/IP communication protocol of Ethernet is an open standard. Most network attacks are implemented based on the Ethernet TCP/IP protocol. Through RS485 serial communication, the network security threat of Ethernet can be effectively avoided. MODBUS is a general industrial data exchange protocol. It is a server-controlled protocol. The server can control the reading range and content of data well, and can effectively control the range of external information output.

The overall workflow of this technical solution is as follows:

(1) Each wireless sensor uses the programmer to write the executable file of the running software;

(2) Each wireless sensor is powered on, automatically runs the program, and automatically generates a four-byte unique key (for example: 00460028) according to the MCU production serial number. This key is a unique code, and all wireless sensors are different;

(3) The program writer reads the 4-byte key in the running memory of each wireless sensor;

(4) The wireless data acquisition terminal uses software to write and run the software executable file;

(5) The data acquisition terminal is powered on, automatically runs the program, and automatically generates a four-byte unique key (eg: 003B0068) according to the MCU production serial number, which is a unique code;

(6) The programmer downloads the key and node number of the wireless data acquisition terminal to which it belongs to each wireless sensor. The node number is sorted from 1, and the node number is unique within the range of the wireless data acquisition terminal to which it belongs. The wireless sensor is sending This number is included in the message;

(7) The writer downloads all the wireless sensor numbers and the corresponding key list collected by the wireless data collection terminal;

(8) The wireless sensor encrypts the sent message with its own key;

(9) After the wireless transmission module of the wireless data acquisition terminal receives the message, it sends a request to the MCU to process an interrupt;

(10) The wireless data acquisition terminal MCU reads the message data in the buffer, and finds the corresponding key to decrypt according to the node number in the message;

(11) The wireless data collection terminal parses the sending count in the data, compares it with the last sending count of the wireless sensor in the cache, and only processes packets larger than the cached sending count;

(12) The wireless data acquisition terminal uses its own key to encrypt the sent message before sending the message;

(13) After the wireless transmission module of the wireless sensor receives the message, it sends a request to the MCU to process an interrupt;

(14) The wireless sensor MCU reads the message data in the buffer, decrypts it with the preset wireless data acquisition terminal key, and then performs data processing;

(15) The external system sends a data read request message (MODBUS protocol 03 or 01 message) to the wireless data acquisition terminal through the RS485 serial port;

(16) After receiving the message, the serial port module of the data acquisition terminal sends a request to the MCU to process an interrupt;

(17) The data acquisition terminal MCU reads the buffered data in the serial port module to filter the message, and only processes the MODBUS protocol 03 or message;

(18) The data acquisition terminal MCU organizes the reply message into the serial port module buffer according to the read content request, and calls the serial port module to send the interface to send data.

The system and method for realizing the network security control function based on the wireless sensor in the substation of the present invention are adopted, and the characteristics of the micro-power operation of the wireless sensor are fully considered, and the network security control management is systematically designed. The key management is based on the unique code of the MCU, which is automatically generated by the software, and can only be read by the programming tool. additional power consumption. The external communication module is independent, and the cache is placed in the communication module, which realizes the active processing of data and effectively avoids memory overflow attacks. The serial communication scheme is used for external communication, which effectively eliminates the security of the network communication interface in the Ethernet mode.

In this specification, the invention has been described with reference to specific embodiments thereof. However, it will be evident that various modifications and changes can still be made without departing from the spirit and scope of the invention. Accordingly, the specification and drawings are to be regarded in an illustrative rather than a restrictive sense.

Claims (12)

1. a system for realizing network security control function based on wireless sensor in a substation, is characterized in that, described system comprises wireless sensor and wireless data acquisition terminal, and described wireless sensor and wireless data acquisition terminal are both no relay nodes The star network structure, the wireless sensor is used to transmit wireless signals, and the wireless data acquisition terminal is used to receive and process the signals sent by the wireless sensor. 2. The system for realizing network security control function based on wireless sensors in a substation according to claim 1, wherein the wireless sensors comprise: a first micro-control unit for managing and controlling communication resources; The first wireless transceiver module is connected with the first micro-control unit through a serial peripheral interface, and is used for transmitting and receiving wireless signals. 3. The system for realizing network security control function based on wireless sensors in a substation according to claim 1, wherein the wireless data acquisition terminal comprises: The second micro-control unit is used to manage and control the communication resources; The second wireless transceiver module is connected with the second micro-control unit through the serial peripheral interface, and is used for transmitting and receiving wireless signals; The second serial port transceiver module is connected with the second micro-control unit through the serial peripheral interface, and is used for sending and receiving signals through the serial port. 4 . The system for realizing network security control function based on wireless sensors in a substation according to claim 2 , wherein the first wireless transceiver module comprises a first wireless transceiver sending buffer zone and a first wireless transceiver receiving buffer zone. 5 . , which are all connected with the first micro-control unit. 5 . The system for realizing network security control function based on wireless sensors in a substation according to claim 3 , wherein the second wireless transceiver module comprises a second wireless transceiver sending buffer and a second wireless transceiver receiving buffer. 6 . , all connected with the second micro-control unit. 6. The system for realizing network security control function based on wireless sensors in a substation according to claim 3, wherein the second serial port transceiver module comprises a second serial port transceiver sending buffer and a second serial port transceiver receiving buffer , all connected with the second micro-control unit. 7 . The system for realizing network security control function based on wireless sensors in a substation according to claim 4 , wherein the first wireless transceiver sending buffer and the first wireless transceiver receiving buffer have a maximum size of 64 bytes. 8 . 8 . The system for implementing network security control functions based on wireless sensors in a substation according to claim 5 , wherein the second wireless transceiver sending buffer and the second wireless transceiver receiving buffer have a maximum size of 64 bytes. 9 . 9 . The system for realizing network security control function based on wireless sensors in a substation according to claim 5 , wherein the second serial port sending and receiving buffer and the second serial sending and receiving buffer are up to 255 bytes. 10 . 10. A wireless sensor-based network security control method in a substation based on the system according to claim 1, wherein the method comprises the following steps: (1) The described wireless sensor and wireless data acquisition terminal download the serial number key and the corresponding key list; (2) The wireless sensor encrypts the application data in the sending and receiving messages through an automatically generated key; (3) The wireless data acquisition terminal obtains the corresponding key according to the node number of the wireless sensor, and restores it to actual application data; (4) The wireless data acquisition terminal performs encryption processing through its key, and the wireless sensor performs data decryption. 11. The wireless sensor-based network security control method in a substation according to claim 10, wherein data encryption is performed in the step (2) and step (4), specifically: The data is encrypted according to the following formula: TDATA[n]=DATA[n]+PKey[k]+CRC[r]; Among them, TDATA[n] is the value at the nth byte position of the application data encryption, DATA[n] is the value at the nth byte position of the application data, and PKey[k] is the kth byte of the key The value at the byte position, k is the remainder of N divided by 4, r is the remainder of N divided by 2, and CRC[r] is the check code. 12. The method for realizing the network security control method based on wireless sensors in a substation according to claim 10, wherein the data decryption is performed in the step (3) and the step (4), specifically: The data is decrypted according to the following formula: DATA[n]=TDATA[n]-PKey[k]-CRC[r]; Among them, TDATA[n] is the value at the nth byte position of the application data encryption, DATA[n] is the value at the nth byte position of the application data, and PKey[k] is the kth byte of the key The value at the byte position, k is the remainder of N divided by 4, r is the remainder of N divided by 2, and CRC[r] is the check code.