CN114095193A - Chip-level photovoltaic power station information security defense system and method - Google Patents
Chip-level photovoltaic power station information security defense system and method Download PDFInfo
- Publication number
- CN114095193A CN114095193A CN202010787343.2A CN202010787343A CN114095193A CN 114095193 A CN114095193 A CN 114095193A CN 202010787343 A CN202010787343 A CN 202010787343A CN 114095193 A CN114095193 A CN 114095193A
- Authority
- CN
- China
- Prior art keywords
- data
- inverter
- module
- security
- acquisition device
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
- G06F21/577—Assessing vulnerabilities and evaluating computer system security
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
- H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1433—Vulnerability analysis
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- General Engineering & Computer Science (AREA)
- Computing Systems (AREA)
- Signal Processing (AREA)
- Computer Networks & Wireless Communication (AREA)
- Theoretical Computer Science (AREA)
- Software Systems (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Health & Medical Sciences (AREA)
- Bioethics (AREA)
- General Health & Medical Sciences (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The invention provides a chip-level photovoltaic power station information security defense system, which comprises: the system comprises an inverter, a data acquisition device, an Internet of things platform and an application module; the inverter is connected with the external equipment, and the inverter is used for adopting a chip-level security defense system to defend the photovoltaic power station circuit from malicious tampering or loophole implantation when the external equipment inputs data to the inverter; the data acquisition device is connected with the inverter and is used for carrying out integrity check on data controlled by the inverter; the Internet of things platform is respectively in communication connection with the data acquisition device and the inverter and is used for establishing communication between data verified by the data acquisition device and the outside for data interaction and providing longitudinal and close butt joint and data security certificate management by adopting a light single-layer IP transparent transmission mode; the application module implements safety measures on the application of the photovoltaic power station software based on the data interaction; the safety reliability of a hardware chip is improved through a hardware sealing mode to encrypt data of a wireless network link layer, and attack means such as hardware near-end encryption signaling conjecture are avoided.
Description
Technical Field
The invention belongs to the technical field of information security of power systems, and relates to a chip-level photovoltaic power station information security defense system and method.
Background
With the rapid development of the internet and photovoltaic energy, a great deal of new business forms emerge, and the current power system is greatly evolved compared with the past. The traditional power system is composed of power generation, power transmission, power transformation, power distribution, power utilization, scheduling and the like, and with the application of smart power grids and information communication technologies, power generation modes begin to become diversified, directions of information flow, power flow and the like all change, and the changes can create greater challenges for information safety of the power system.
Meanwhile, new technologies such as big data, cloud computing, internet of things and mobile internet are applied to the power system in a continuous and deep mode, various new safety risks are introduced while upgrading and reconstructing existing information infrastructure is promoted, and new opportunities and challenges are brought to power system networks and information safety work.
Constructing an active defense system, mainly using key network-related equipment, data acquisition, data storage and data of a power system as main protection objects, and emphasizing the protection on data in the cloud, boundary safety and internal interaction safety in the aspect of cloud computing safety defense; in the aspect of security defense of the internet of things, security protection in terms of mobile communication needs to be performed from the security of a mobile terminal and a mobile channel to the security of mobile internet services.
The current distributed photovoltaic power stations are dispersed all over the country, and the access mode is various, has great potential safety hazard, presents huge challenge to the dispatch management and the network security of power station, through the security access district mode of deployment on the electric wire netting access side, can solve the network security risk problem to a certain extent, but brings the problem that transmission delay is longer, the deployment cost is high, can't support the power station and exert oneself the dispatch simultaneously.
Disclosure of Invention
Aiming at the defects that various new power grid communication and operation safety risks are introduced into the change of the existing power system, and the mode of deploying a safety access area at the access side of a power grid causes long transmission delay, high deployment cost and incapability of supporting power station output scheduling, the invention provides a chip-level photovoltaic power station information safety defense system and a method, which specifically comprise the following steps:
a chip-level photovoltaic power station information security defense system comprises: the system comprises an inverter, a data acquisition device, an Internet of things platform and an application module;
the inverter is connected with external equipment and is used for adopting a chip-level security defense system to defend the photovoltaic power station circuit from malicious tampering or loophole implantation when the external equipment inputs data to the inverter;
the data acquisition device is connected with the inverter and is used for carrying out integrity check on data controlled by the inverter;
the Internet of things platform is respectively in communication connection with the data acquisition device and the inverter and is used for establishing communication between the data verified by the data acquisition device and the outside for data interaction, and longitudinal and close butt joint and data security certificate management are provided by adopting a light single-layer IP transparent transmission mode;
the application module implements a safety measure for the application of the photovoltaic power plant software based on the data interaction.
Preferably, the inverter includes: the safety module, the safety CPU, the monitoring module, the MPU memory protection module and the FLASH are connected with each other;
the safety module is used for inputting data to the inverter by external equipment by adopting a chip-level safety defense system and defending when a near-end fault or physical attack is encountered;
the safety CPU is used for supporting the generation of a hardware trusted root and a true random number after the input data passes through the safety module, identifying malicious tampering and vulnerability implantation and protecting, and is also used for reliably protecting the code integrity and simultaneously carrying out digital signature authentication on a code source;
the monitoring module is used for supporting the safe starting of the chip-level CPU and monitoring the running condition of the CPU in real time;
the MPU memory protection module is used for performing high-level protection on a key control area in isolated operation;
the FLASH is used for supporting single fault automatic correction.
Preferably, the data acquisition device includes: the system comprises an integrity check submodule, a communication module, an eSIM and a discrete submodule which are connected with each other;
the integrity checking submodule is used for checking the integrity of system important files, the dynamic measurement of user mode important processes and the measurement of a kernel of data controlled by an inverter of the data acquisition device;
the communication module is used for sealing when the data controlled by the inverter passes through;
the eSIM is used for ensuring safety by adopting code confusion and an eSIM welding mode aiming at different communication modules;
the discrete submodule is used for supporting discrete access of a plurality of terminals of the distributed photovoltaic power station with low time delay requirements to the communication module, and the access time of each terminal is staggered to avoid network congestion and signaling storm.
Preferably, the communication module includes: a wireless network link layer;
the wireless network link layer is connected with the Internet of things platform and used for encrypting communication between the data controlled by the inverter and the Internet of things platform.
Preferably, the eSIM includes: the chip is connected with the communication module;
the chip is provided with codes, and the security is ensured by adopting a secret code confusion mode, so that the attack of decompiling at the near end and the attack of acquiring secret information, which are met by the communication module, can be responded.
Preferably, the data acquisition device further includes: a verification sub-module;
the verification sub-module is connected with the integrity check module, the communication module, the eSIM and the discrete module;
and the verification submodule is used for verifying whether the next level of software to be loaded is tampered by hackers or malicious software when the software is safely started.
Preferably, the internet of things platform includes: the lightweight transmission submodule and the safe deployment submodule are in communication connection;
the lightweight transmission submodule transmits data by adopting a transparent lightweight single-layer IP (Internet protocol), realizes management isolation and operation communication isolation, performs longitudinal and close butt joint processing and data security certificate management on the data verified by the data acquisition device on a management channel, and is also used for performing secondary challenge authentication on a photovoltaic power station;
the safety deployment submodule is used for carrying out software safety deployment on the communication module based on the lightweight single-layer IP, and is also used for initiating malicious terminal isolation after monitoring changes, limiting the spread of fault malicious attacks and further repairing the problems through FOTA or near-end upgrading.
Preferably, the lightweight transmission sub-module includes: the device comprises a transmission unit, an isolation unit and a secondary authentication unit which are connected with each other;
the transmission unit is used for transmitting the data controlled by the inverter in a light single-layer IP transparent transmission mode;
the isolation unit is used for isolating the management and operation communication of the communication module and encrypting the inverter control data passing the integrity check on a management channel;
and the secondary authentication unit is used for identifying high-risk actions of the inverter control data passing the integrity check and carrying out secondary challenge authentication.
Preferably, the secure deployment sub-module includes: the system comprises an individualized public and private key, a firmware abstract, a Resume-ID and a terminal which are connected with each other;
the personalized public and private key is used for generating a personalized public and private key of a single device for the communication module version and key configuration based on the light deployment;
the firmware abstract is used for enabling the corresponding communication module equipment firmware to change when the communication module receives external reason influence or malicious attack, and uploading the firmware abstract generated by the change to the Internet of things platform side;
the Resume-ID is used for supporting a lightweight low-power-consumption safe transmission mode when the Internet of things is in a low-power-consumption application scene, generating the Resume-ID through one-time negotiation, and guaranteeing safe encryption of data reporting for multiple times;
the terminal is used for identifying the abnormal state of the terminal in time and isolating the abnormal state in time based on information comprehensive analysis and combined analysis when a local terminal is in fault or is attacked and is difficult to detect;
wherein the combinatorial analysis comprises: analyzing abnormal time, illegal messages, abnormal flow and suspicious positions of the terminal;
the information comprehensive analysis comprises the following steps: analysis of device behavior, device attributes, device configuration, device alarms, security vulnerability scanning, and global threats.
Preferably, the application module includes: an application layer, a system layer and a network layer which are connected with each other;
the application layer is used for protecting access control, data security, communication and coding security of an application program based on physical and management rules and data interaction;
the system layer protects services which are depended by an operating system, a database, middleware and an application program based on physical and management rules and the data interaction;
and the network layer provides application support for a service system running on the platform of the Internet of things based on physical and management rules and the data interaction.
Preferably, the security defense system further includes: a photovoltaic management module connected with the inverter, the data acquisition device, the Internet of things platform and the application module,
the photovoltaic management module is used for storing and managing photovoltaic power station data of single machine deployment, main standby deployment and distributed deployment.
Based on the same concept, a chip-level photovoltaic power station information security defense method is provided, and comprises the following steps:
when the inverter inputs data to the inverter by external equipment, a chip-level security defense system is adopted to defend the photovoltaic power station circuit from malicious tampering or loophole implantation;
the data acquisition device carries out integrity verification on the data controlled by the inverter;
the Internet of things platform establishes communication between the data verified by the data acquisition device and the outside, performs data interaction, and adopts a transparent transmission mode of a lightweight single-layer IP to provide longitudinal and close butt joint and data security certificate management;
and the application module implements safety measures on the application of the photovoltaic power station software based on the data interaction.
Compared with the prior art, the invention has the beneficial effects that:
1. the invention provides a chip-level photovoltaic power station information security defense system, which comprises: the system comprises an inverter, a data acquisition device, an Internet of things platform and an application module; the inverter is connected with external equipment and is used for adopting a chip-level security defense system to defend the photovoltaic power station circuit from malicious tampering or loophole implantation when the external equipment inputs data to the inverter; the data acquisition device is connected with the inverter and is used for carrying out integrity check on data controlled by the inverter; the Internet of things platform is respectively in communication connection with the data acquisition device and the inverter and is used for establishing communication between the data verified by the data acquisition device and the outside for data interaction, and longitudinal and close butt joint and data security certificate management are provided by adopting a light single-layer IP transparent transmission mode; the application module implements safety measures on the application of the photovoltaic power station software based on the data interaction; the method is characterized in that end cloud cooperative safety protection is realized by combining power station side communication equipment and a cloud Internet of things platform, and the spread of malicious attack of fault work is limited;
2. according to the chip-level photovoltaic power station information security defense system and method, a mode of combining software and hardware encryption is adopted to guarantee the security in the information transmission process, the research provides a communication and hard encryption sealing module, the security and the reliability of a hardware chip are further improved through a hardware sealing mode, the data of a wireless network link layer are encrypted, and attack means such as hardware near-end encryption signaling speculation are avoided;
3. the invention provides a chip-level photovoltaic power station information security defense system and a method, wherein a three-layer security system of photovoltaic power station access, namely control security, transmission security and calculation security, is established, a full ring of information access is covered, the system comprises a core control device, an information acquisition/transmission system and a cloud application system, and an end-to-end information security defense system is established;
4. the chip-level photovoltaic power station information security defense system and the method provided by the invention combine the actual situation of the photovoltaic power station to provide chip-level security protection; the safety of the equipment is enhanced through the control chip, and chip-level safe starting and integrity verification can be realized.
Drawings
FIG. 1 is a system structure diagram of a chip-scale photovoltaic power station information security defense system provided by the present invention;
fig. 2 is a current-stage distributed power station access networking diagram provided in an embodiment of the present invention;
fig. 3 is a diagram of access networking of a distributed power station after security reinforcement according to an embodiment of the present invention;
fig. 4 is a flowchart of a method for defending information security of a chip-scale photovoltaic power station according to the present invention.
Detailed Description
The embodiments of the present invention will be further explained with reference to the drawings.
Example 1:
the invention provides a chip-level photovoltaic power station information security defense system and a method, which are introduced by combining a system structure diagram of a figure 1 for accessing photovoltaic power station information into a three-layer security system of 'control security, transmission security and calculation security', and specifically comprise the following steps:
step 1: the inverter is connected with external equipment, and when the external equipment inputs data to the inverter, a chip-level security defense system is adopted to defend the photovoltaic power station circuit from malicious tampering or loophole implantation;
step 2: the data acquisition device is connected with the inverter and used for carrying out integrity verification on data controlled by the inverter;
and step 3: the Internet of things platform is respectively in communication connection with the data acquisition device and the inverter and is used for establishing communication between the data verified by the data acquisition device and the outside for data interaction, and longitudinal and close butt joint and data security certificate management are provided by adopting a light single-layer IP transparent transmission mode; and 4, step 4: the application module implements safety measures on the application of the photovoltaic power station software based on the data interaction;
wherein, the step 1: the inverter is connected with external equipment, and when external equipment was to the inverter input data, adopt chip level safety defense system, the malicious tampering or the leak implantation that defend photovoltaic power plant circuit appear specifically includes:
the inverter adopts a control chip, the control chip is provided with an independent hardware security module and a security CPU, modern attacking and defending means such as near-end fault injection and physical attack are effectively resisted, chip-level security starting is supported, hardware credible root and true random number generation are supported, malicious tampering in an equipment deployment operation and maintenance stage and a transportation supply stage can be realized, vulnerability implantation is identified and protected, code integrity is reliably protected, and digital signature authentication is carried out on code sources.
And secondly, the inverter control chip has multi-core control instruction redundancy backup and monitors the running condition of the CPU in real time. The MPU memory protection unit is provided, so that the isolated operation of a key control area can be realized, and higher-level protection in operation can be realized. FLASH has double Bank backup, FLASH/SRAM supports ECC error correction (single fault automatic correction), and higher storage reliability
And thirdly, uploading inverter information (control data) through data acquisition device information, wherein a control chip of the data acquisition device adopts a safety control chip and supports safety starting, and in the safety starting process, a former component gradually verifies software to be loaded at the next stage, so that the software loaded in the starting process is not tampered by hackers or malicious software. If the software is tampered with, the verification is not passed and the boot process is aborted. Secure boot is used for systems that can accept a suspension of the boot process.
Step 2: the data acquisition device is connected with the inverter, and integrity verification is carried out on data controlled by the inverter, and the data acquisition device specifically comprises:
and fourthly, all information passing through the data acquisition device is subjected to integrity verification, and the integrity verification comprises three aspects of the integrity of important files of the system, the dynamic measurement of important processes in a user state (non-privileged state) and the measurement of a kernel.
Fifthly, 1, a communication and hard encryption sealing module is provided, the safety and reliability of a hardware chip are further improved through a hardware sealing form, data of a wireless network link layer are encrypted, and attack means such as hardware near-end encryption signaling conjecture are avoided;
2. the method provides 1M longitudinal and dense butt joint, adopts a transparent transmission scheme (light-weight transmission sub-module), and provides a light-weight single-layer IP transmission scheme. Data security certificate management is supported. Data is encrypted on the management channel by isolating management and operational communications. And identifying high-risk actions, performing secondary challenge authentication, and avoiding counterfeiting through machine authentication.
Sixthly, aiming at different service requirement scenes, the photovoltaic power station needs to use different types of communication modules (NB-IoT/4G/5G) to construct an information security means in the communication module equipment,
1) code obfuscation and eSIM (Integrated mobile phone card chip)
The distributed photovoltaic scene terminal is usually unattended, and can easily launch near-end physical attack, including means such as near-end SIM card stealing, near-end attack main chip, disassembling and obtaining chip confidential information, and the like. Aiming at the attack of obtaining confidential information by near-end attack and decompilation, a confidential code confusion scheme is adopted to avoid the decompilation of the information, and the introduction is carried out by combining the security reinforced distributed power station access networking diagram of the figure 3.
2) Discrete anti-congestion (discrete sub-module)
In order to deal with the possible congestion scene of distributed photovoltaic ubiquitous mass terminal access, a discrete algorithm is provided, the low-delay requirement terminal discrete access is supported, the terminal access time is staggered, and network congestion and signaling storm are avoided.
And step 3: the thing networking platform respectively with data acquisition device with inverter communication connection for with the data of data acquisition device check-up and the outside communication of establishing carry out data interaction, and adopt the transparent transmission mode of lightweight individual layer IP, provide and indulge close butt joint, data security certificate management, specifically include:
seventhly, constructing a terminal cloud collaborative security scheme (a security deployment sub-module) between the communication module and the Internet of things platform:
1) a low-cost authentication and authorization scheme:
aiming at the light weight requirement of the ubiquitous Internet of things, an advanced light weight credible technology is adopted, the module supports a light weight safety core, and meanwhile, an individualized public and private key of a single device is generated based on a firmware version and key configuration, so that a powerful identity and a credible starting guarantee under light weight deployment are provided.
When the module is affected by external reasons or maliciously attacked, the corresponding firmware characteristics such as firmware inevitably change, and the changes are uploaded to the platform side through the derived firmware abstract in the subsequent security chain building process, and the platform side detects personalized characteristic changes so as to initiate malicious terminal isolation, limit the spread of malicious attack of fault work and further repair the problem through FOTA or near-end upgrading.
2) Low-power consumption safe transmission:
in a ubiquitous internet of things low-power-consumption application scene, because the frequency of data reporting by a user is low and the flow is small, one service reporting data stream can be processed by the same security session generally, and the number of consumed security negotiation interactive signaling can be as high as 7. Under certain service models, the power consumption in the case of encryption may be more than one time that of plaintext transmission. Many ubiquitous internet of things users often have to abandon security means and transmit data through plaintext in order to meet business performance requirements.
In order to solve the problems, a lightweight low-power-consumption safe transmission scheme needs to be supported, the Resume-ID is generated through one-time negotiation, and the safe encryption of data reporting for multiple times is guaranteed.
3) Abnormal terminal detection and isolation:
in the application scene of the ubiquitous Internet of things, massive terminals are accessed in a ubiquitous mode, and a certain local terminal is in fault or is attacked, so that the detection is difficult. The terminal state abnormity needs to be identified in time and isolated in time by means of big data analysis based on comprehensive analysis of information such as equipment behavior, equipment attribute, equipment configuration, equipment alarm, security vulnerability scanning and global threat and based on combined information such as abnormal time, illegal message, abnormal flow and suspicious position of the terminal, so that problem expansion is effectively prevented.
Eighthly, the photovoltaic management system adopts an enterprise-level database management system, and the selected database supports multiple deployment modes such as single machine, main and standby, distributed and the like
And 4, step 4: the application module implements safety measures on the application of the photovoltaic power station software based on the data interaction, and specifically comprises the following steps:
and ninth, the application system adopts software, realizes the security of the application system from the following three layers, and executes the security measures provided by the whole system from the aspects of physical and management rules by providing suggestions of physical layer security and management layer security for the client.
Application layer security solution: protecting applications such as: access control, data security, communication and encoding security, etc.;
system level security solution: protecting services on which an operating system, a database, middleware and an application program depend;
network layer security solution: the whole network is protected, and the support of application is provided for the service system running on the network platform.
The current distributed photovoltaic power stations are dispersed all over the country, and the access mode is various, has great potential safety hazard, presents huge challenge to the dispatch management and the network security of power station, through the security access district mode of deployment on the electric wire netting access side, can solve the network security risk problem to a certain extent, but brings the problem that transmission delay is longer, the deployment cost is high, can't support the power station and exert oneself the dispatch simultaneously.
According to the design of a safe credible integral framework and three-layer safety level, aiming at a distributed photovoltaic power station access scene, three-layer safety is constructed by combining an inverter, a data acquisition device (an integrated communication module and hard encryption) and a cloud platform, and large-scale safe access of the distributed power station is realized under the condition of ensuring the safe access of a power grid through advanced technical application of end cloud cooperative safety, chip-level safe starting and protection, hard encryption and the like, and the introduction is carried out by combining a current-stage distributed power station access networking diagram of fig. 2.
And (4) transmission safety: the data acquisition device chip and the communication module are safely reinforced and longitudinally encrypted;
and (3) calculating safety: computing platform, operating system, database, application system (application module);
and (4) controlling safety: and an inverter control chip.
The method is characterized in that three-layer security is constructed by combining an inverter, a data acquisition device (an integrated communication module and hard encryption) and a cloud platform aiming at the access scene of the distributed photovoltaic power station according to the design of a safe and credible integral framework and three-layer security level, and large-scale security access of the distributed power station is realized under the condition of ensuring the access security of a power grid through advanced technical application of end cloud cooperative security, chip-level security starting and protection, hard encryption and the like.
Example 2:
based on the same concept, the invention provides a chip-level photovoltaic power station information security defense method which is introduced by combining with the method flow chart of fig. 4 and comprises the following steps:
when the inverter inputs data to the inverter by external equipment, a chip-level security defense system is adopted to defend the photovoltaic power station circuit from malicious tampering or loophole implantation;
the data acquisition device carries out integrity verification on the data controlled by the inverter;
the Internet of things platform establishes communication between the data verified by the data acquisition device and the outside, performs data interaction, and adopts a transparent transmission mode of a lightweight single-layer IP to provide longitudinal and close butt joint and data security certificate management;
and the application module implements safety measures on the application of the photovoltaic power station software based on the data interaction.
Preferably, when the inverter inputs data to the inverter by an external device, a chip-level security defense system is adopted to defend the photovoltaic power station circuit from malicious tampering or vulnerability implantation, including:
the safety module adopts a chip-level safety defense system, data are input into the inverter by external equipment, and defense is carried out when near-end faults or physical attacks are encountered;
the safety CPU supports the generation of a hardware trusted root and a true random number after the input data passes through the safety module, identifies malicious tampering and vulnerability implantation and protects, and is also used for reliably protecting the code integrity and simultaneously performing digital signature authentication on a code source;
the monitoring module supports safe startup of a chip-level CPU and monitors the running condition of the CPU in real time;
the MPU memory protection module carries out high-level protection in a key control area for isolated operation;
FLASH supports single fault auto-correction.
Preferably, the data acquisition device performs integrity verification on the data controlled by the inverter, and the integrity verification includes:
the integrity check submodule checks the integrity of important system files, the dynamic measurement of important user state processes and the measurement of a kernel of data controlled by an inverter of the data acquisition device;
the communication module is used for sealing when the data controlled by the inverter passes;
the eSIM adopts code confusion and eSIM welding modes to ensure safety aiming at different communication modules;
the discrete sub-modules support discrete access of a plurality of terminals of the distributed photovoltaic power station with low time delay requirements to the communication module, and the access time of each terminal is staggered to avoid network congestion and signaling storm.
Preferably, the communication module closes and seals when passing through the data controlled by the inverter, and includes:
and the wireless network link layer encrypts the communication between the data controlled by the inverter and the Internet of things platform.
Preferably, the eSIM guarantees security by means of code obfuscation and eSIM welding for different communication modules, including:
the chip is provided with codes, and the security is ensured by adopting a secret code confusion mode, so that the attack of decompiling at the near end and the attack of acquiring secret information, which are met by the communication module, can be responded.
Preferably, the data acquisition device performs integrity check on the data controlled by the inverter, and further includes:
and when the verification sub-module is safely started, verifying whether the next level of software to be loaded is tampered by hackers or malicious software.
Preferably, the internet of things platform will the data of data acquisition device check-up establish communication with the outside, carry out data interaction to adopt the transparent transmission mode of lightweight individual layer IP, provide the close butt joint of indulging, data security certificate management, and right photovoltaic power plant implements the safety measure, includes:
the lightweight transmission submodule transmits data by adopting a transparent lightweight single-layer IP (Internet protocol), realizes management isolation and operation communication isolation, performs longitudinal and close butt joint processing and data security certificate management on the data verified by the data acquisition device on a management channel, and is also used for performing secondary challenge authentication on a photovoltaic power station;
and the safety deployment submodule is used for carrying out software safety deployment on the communication module based on the lightweight single-layer IP and is also used for initiating malicious terminal isolation after monitoring the change so as to limit the spread of fault malicious attack and further repair the problem through FOTA or near-end upgrading.
Preferably, the lightweight transmission submodule adopts transparent lightweight single-layer IP transmission data to realize management isolation and operation communication isolation, and performs longitudinal and dense docking processing and data security certificate management on data verified by the data acquisition device on a management channel, and is further used for performing secondary challenge authentication on the photovoltaic power station, and includes:
transmitting the data controlled by the inverter by adopting a light single-layer IP transparent transmission mode;
isolating management and operation communication of the communication module, and encrypting the inverter control data passing integrity check on a management channel;
and identifying high-risk actions of the inverter control data passing the integrity verification, and performing secondary challenge authentication.
Preferably, the safety deployment submodule is used for performing software safety deployment on the communication module based on the lightweight single-layer IP, and is further used for initiating malicious terminal isolation after monitoring changes, limiting the spread of fault malicious attacks, and further repairing problems through FOTA or near-end upgrading, and includes:
generating an individual public and private key of the single device for the communication module version and key configuration based on the light deployment;
when the communication module receives the influence of external reasons or malicious attack, the corresponding communication module equipment firmware changes, and a firmware abstract generated by the change is uploaded to the Internet of things platform side;
when the Internet of things is in a low-power-consumption application scene, a lightweight low-power-consumption safe transmission mode is supported, Resume-ID is generated through one-time negotiation, and the safe encryption of data reporting for multiple times is guaranteed;
when the local terminal is in fault or is attacked and is difficult to detect, the abnormal state of the terminal is identified in time and isolated in time based on the information comprehensive analysis and the combined analysis;
wherein the combinatorial analysis comprises: analyzing abnormal time, illegal messages, abnormal flow and suspicious positions of the terminal;
the information comprehensive analysis comprises the following steps: analysis of device behavior, device attributes, device configuration, device alarms, security vulnerability scanning, and global threats.
Preferably, the application module implements a safety measure for the application of the photovoltaic power plant software based on the data interaction, including:
the application layer is used for protecting access control, data security, communication and coding security of an application program based on physical and management rules and data interaction;
the system layer protects services which are depended by an operating system, a database, middleware and an application program based on physical and management rules and the data interaction;
and the network layer provides application support for a service system running on the platform of the Internet of things on the basis of physical and management rules and the data interaction.
Preferably, the security defense system further includes:
and the photovoltaic management module is used for storing and managing photovoltaic power station data of single machine deployment, main standby deployment and distributed deployment.
As will be appreciated by one skilled in the art, embodiments of the present application may be provided as a method, system, or computer program product. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.
The present application is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the application. It will be understood that each flow and/or block of the flow diagrams and/or block diagrams, and combinations of flows and/or blocks in the flow diagrams and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
The present invention is not limited to the above embodiments, and any modifications, equivalent replacements, improvements, etc. made within the spirit and principle of the present invention are included in the scope of the claims of the present invention which are filed as the application.
Claims (12)
1. A chip-level photovoltaic power station information security defense system is characterized by comprising: the system comprises an inverter, a data acquisition device, an Internet of things platform and an application module;
the inverter is connected with external equipment and is used for adopting a chip-level security defense system to defend the photovoltaic power station circuit from malicious tampering or loophole implantation when the external equipment inputs data to the inverter;
the data acquisition device is connected with the inverter and is used for carrying out integrity check on data controlled by the inverter;
the Internet of things platform is respectively in communication connection with the data acquisition device and the inverter and is used for establishing communication between the data verified by the data acquisition device and the outside for data interaction, and longitudinal and close butt joint and data security certificate management are provided by adopting a light single-layer IP transparent transmission mode;
the application module implements a safety measure for the application of the photovoltaic power plant software based on the data interaction.
2. The security defense system of claim 1, wherein the inverter comprises: the safety module, the safety CPU, the monitoring module, the MPU memory protection module and the FLASH are connected with each other;
the safety module is used for inputting data to the inverter by external equipment by adopting a chip-level safety defense system and defending when a near-end fault or physical attack is encountered;
the safety CPU is used for supporting the generation of a hardware trusted root and a true random number after the input data passes through the safety module, identifying malicious tampering and vulnerability implantation and protecting, and is also used for reliably protecting the code integrity and simultaneously carrying out digital signature authentication on a code source;
the monitoring module is used for supporting the safe starting of the chip-level CPU and monitoring the running condition of the CPU in real time;
the MPU memory protection module is used for performing high-level protection on a key control area in isolated operation;
the FLASH is used for supporting single fault automatic correction.
3. The security defense system of claim 1, wherein the data acquisition device comprises: the system comprises an integrity check submodule, a communication module, an eSIM and a discrete submodule which are connected with each other;
the integrity checking submodule is used for checking the integrity of system important files, the dynamic measurement of user mode important processes and the measurement of a kernel of data controlled by an inverter of the data acquisition device;
the communication module is used for sealing when the data controlled by the inverter passes through;
the eSIM is used for ensuring safety by adopting code confusion and an eSIM welding mode aiming at different communication modules;
the discrete submodule is used for supporting discrete access of a plurality of terminals of the distributed photovoltaic power station with low time delay requirements to the communication module, and the access time of each terminal is staggered to avoid network congestion and signaling storm.
4. The security defense system of claim 3, wherein the communication module comprises: a wireless network link layer;
the wireless network link layer is connected with the Internet of things platform and used for encrypting communication between the data controlled by the inverter and the Internet of things platform.
5. The security defense system of claim 3, wherein the eSIM comprises: the chip is connected with the communication module;
the chip is provided with codes, and the security is ensured by adopting a secret code confusion mode, so that the attack of decompiling at the near end and the attack of acquiring secret information, which are met by the communication module, can be responded.
6. The security defense system of claim 3, wherein the data acquisition device further comprises: a verification sub-module;
the verification sub-module is connected with the integrity check module, the communication module, the eSIM and the discrete module;
and the verification submodule is used for verifying whether the next level of software to be loaded is tampered by hackers or malicious software when the software is safely started.
7. The security defense system of claim 1, wherein the internet of things platform comprises: the lightweight transmission submodule and the safe deployment submodule are in communication connection;
the lightweight transmission submodule transmits data by adopting a transparent lightweight single-layer IP (Internet protocol), realizes management isolation and operation communication isolation, performs longitudinal and close butt joint processing and data security certificate management on the data verified by the data acquisition device on a management channel, and is also used for performing secondary challenge authentication on a photovoltaic power station;
the safety deployment submodule is used for carrying out software safety deployment on the communication module based on the lightweight single-layer IP, and is also used for initiating malicious terminal isolation after monitoring changes, limiting the spread of fault malicious attacks and further repairing the problems through FOTA or near-end upgrading.
8. The security defense system of claim 7, wherein the lightweight transmission sub-module comprises: the device comprises a transmission unit, an isolation unit and a secondary authentication unit which are connected with each other;
the transmission unit is used for transmitting the data controlled by the inverter in a light single-layer IP transparent transmission mode;
the isolation unit is used for isolating the management and operation communication of the communication module and encrypting the inverter control data passing the integrity check on a management channel;
and the secondary authentication unit is used for identifying high-risk actions of the inverter control data passing the integrity check and carrying out secondary challenge authentication.
9. The security defense system of claim 6, wherein the security deployment sub-module comprises: the system comprises an individualized public and private key, a firmware abstract, a Resume-ID and a terminal which are connected with each other;
the personalized public and private key is used for generating a personalized public and private key of a single device for the communication module version and key configuration based on the light deployment;
the firmware abstract is used for enabling the corresponding communication module equipment firmware to change when the communication module receives external reason influence or malicious attack, and uploading the firmware abstract generated by the change to the Internet of things platform side;
the Resume-ID is used for supporting a lightweight low-power-consumption safe transmission mode when the Internet of things is in a low-power-consumption application scene, generating the Resume-ID through one-time negotiation, and guaranteeing safe encryption of data reporting for multiple times;
the terminal is used for identifying the abnormal state of the terminal in time and isolating the abnormal state in time based on information comprehensive analysis and combined analysis when a local terminal is in fault or is attacked and is difficult to detect;
wherein the combinatorial analysis comprises: analyzing abnormal time, illegal messages, abnormal flow and suspicious positions of the terminal;
the information comprehensive analysis comprises the following steps: analysis of device behavior, device attributes, device configuration, device alarms, security vulnerability scanning, and global threats.
10. The security defense system of claim 1, wherein the application module comprises: an application layer, a system layer and a network layer which are connected with each other;
the application layer is used for protecting access control, data security, communication and coding security of an application program based on physical and management rules and data interaction;
the system layer protects services which are depended by an operating system, a database, middleware and an application program based on physical and management rules and the data interaction;
and the network layer provides application support for a service system running on the platform of the Internet of things based on physical and management rules and the data interaction.
11. The security defense system of claim 1, further comprising: a photovoltaic management module connected with the inverter, the data acquisition device, the Internet of things platform and the application module,
the photovoltaic management module is used for storing and managing photovoltaic power station data of single machine deployment, main standby deployment and distributed deployment.
12. A chip-level photovoltaic power station information security defense method is characterized by comprising the following steps:
when the inverter inputs data to the inverter by external equipment, a chip-level security defense system is adopted to defend the photovoltaic power station circuit from malicious tampering or loophole implantation;
the data acquisition device carries out integrity verification on the data controlled by the inverter;
the Internet of things platform establishes communication between the data verified by the data acquisition device and the outside, performs data interaction, and adopts a transparent transmission mode of a lightweight single-layer IP to provide longitudinal and close butt joint and data security certificate management;
and the application module implements safety measures on the application of the photovoltaic power station software based on the data interaction.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010787343.2A CN114095193A (en) | 2020-08-06 | 2020-08-06 | Chip-level photovoltaic power station information security defense system and method |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010787343.2A CN114095193A (en) | 2020-08-06 | 2020-08-06 | Chip-level photovoltaic power station information security defense system and method |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN114095193A true CN114095193A (en) | 2022-02-25 |
Family
ID=80295264
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202010787343.2A Pending CN114095193A (en) | 2020-08-06 | 2020-08-06 | Chip-level photovoltaic power station information security defense system and method |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN114095193A (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN117318173A (en) * | 2023-09-27 | 2023-12-29 | 南方电网数字电网研究院有限公司 | Multi-core heterogeneous chip applied to high-power cascading inverter |
-
2020
- 2020-08-06 CN CN202010787343.2A patent/CN114095193A/en active Pending
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN117318173A (en) * | 2023-09-27 | 2023-12-29 | 南方电网数字电网研究院有限公司 | Multi-core heterogeneous chip applied to high-power cascading inverter |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| Gunduz et al. | Cyber-security on smart grid: Threats and potential solutions | |
| Goel et al. | Security challenges in smart grid implementation | |
| EP3906652B1 (en) | Protecting a telecommunications network using network components as blockchain nodes | |
| CN110336774B (en) | Mixed encryption and decryption method, equipment and system | |
| Gupta et al. | RETRACTED: Prevailing and emerging cyber threats and security practices in IoT-Enabled smart grids: A survey | |
| Jeong et al. | An efficient authentication system of smart device using multi factors in mobile cloud service architecture | |
| Girdhar et al. | Hidden markov models-based anomaly correlations for the cyber-physical security of ev charging stations | |
| CN113722683B (en) | Model protection method, device, equipment, system and storage medium | |
| CN102333068B (en) | SSH and SFTP (Secure Shell and Ssh File Transfer Protocol)-based tunnel intelligent management and control system and method | |
| CN115065469B (en) | Data interaction method and device for power internet of things and storage medium | |
| Ramadan | Internet of things (iot) security vulnerabilities: A review | |
| CN111246407B (en) | Data encryption and decryption method and device for short message transmission | |
| Venkatachary et al. | Cybersecurity challenges in energy sector (virtual power plants)-can edge computing principles be applied to enhance security? | |
| Ismail et al. | Mobile cloud database security: problems and solutions | |
| Jumani et al. | Fog computing security: A review | |
| Wang et al. | Secure access method of power internet of things based on zero trust architecture | |
| CN105162592B (en) | A kind of method and system of certification wearable device | |
| CN114095193A (en) | Chip-level photovoltaic power station information security defense system and method | |
| Altaleb et al. | Addressing Cybersecurity Challenges in 5G-enabled IoT and Critical Infrastructures: A Comprehensive Overview | |
| Varadharajan et al. | Techniques for Enhancing Security in Industrial Control Systems | |
| Fei et al. | Design and implementation of raspberry house: an IoT security framework | |
| CN110290113A (en) | Device identification building method, device and computer readable storage medium based on PoW algorithm | |
| Das et al. | Smart City Vulnerabilities: An Overview | |
| Alakbarov | Security issues and solution mechanisms in cloud computing systems: a review | |
| Wu et al. | IoT Security Architecture |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| DD01 | Delivery of document by public notice | ||
| DD01 | Delivery of document by public notice |
Addressee: CHINA ELECTRIC POWER RESEARCH INSTITUTE Co.,Ltd. Person in charge of patentsThe principal of patent Document name: Notification of conformity |
|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |