CN116109438A - Data security protection method for electric power Internet of things - Google Patents

Data security protection method for electric power Internet of things Download PDF

Info

Publication number
CN116109438A
CN116109438A CN202211543752.3A CN202211543752A CN116109438A CN 116109438 A CN116109438 A CN 116109438A CN 202211543752 A CN202211543752 A CN 202211543752A CN 116109438 A CN116109438 A CN 116109438A
Authority
CN
China
Prior art keywords
security
data
things
internet
electric power
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN202211543752.3A
Other languages
Chinese (zh)
Inventor
孙沛
李方军
王晶
房晓勇
黎翔
史浩鹏
杨轲
豆奇燕
张平娟
贾娜娟
李�瑞
马凡琳
古文静
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Pingliang Power Supply Co Of State Grid Gansu Electric Power Co
Original Assignee
Pingliang Power Supply Co Of State Grid Gansu Electric Power Co
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Pingliang Power Supply Co Of State Grid Gansu Electric Power Co filed Critical Pingliang Power Supply Co Of State Grid Gansu Electric Power Co
Priority to CN202211543752.3A priority Critical patent/CN116109438A/en
Publication of CN116109438A publication Critical patent/CN116109438A/en
Pending legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q50/00—Information and communication technology [ICT] specially adapted for implementation of business processes of specific business sectors, e.g. utilities or tourism
    • G06Q50/06—Energy or water supply
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/90—Details of database functions independent of the retrieved data types
    • G06F16/95—Retrieval from the web
    • G06F16/955—Retrieval from the web using information identifiers, e.g. uniform resource locators [URL]
    • G06F16/9566—URL specific, e.g. using aliases, detecting broken or misspelled links
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/602—Providing cryptographic facilities or services
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y04—INFORMATION OR COMMUNICATION TECHNOLOGIES HAVING AN IMPACT ON OTHER TECHNOLOGY AREAS
    • Y04S—SYSTEMS INTEGRATING TECHNOLOGIES RELATED TO POWER NETWORK OPERATION, COMMUNICATION OR INFORMATION TECHNOLOGIES FOR IMPROVING THE ELECTRICAL POWER GENERATION, TRANSMISSION, DISTRIBUTION, MANAGEMENT OR USAGE, i.e. SMART GRIDS
    • Y04S40/00—Systems for electrical power generation, transmission, distribution or end-user application management characterised by the use of communication or information technologies, or communication or information technology specific aspects supporting them
    • Y04S40/20—Information technology specific aspects, e.g. CAD, simulation, modelling, system security

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Health & Medical Sciences (AREA)
  • General Physics & Mathematics (AREA)
  • General Health & Medical Sciences (AREA)
  • General Engineering & Computer Science (AREA)
  • Business, Economics & Management (AREA)
  • Computer Security & Cryptography (AREA)
  • Economics (AREA)
  • Databases & Information Systems (AREA)
  • Software Systems (AREA)
  • Computer Hardware Design (AREA)
  • Bioethics (AREA)
  • Strategic Management (AREA)
  • Public Health (AREA)
  • General Business, Economics & Management (AREA)
  • Water Supply & Treatment (AREA)
  • Tourism & Hospitality (AREA)
  • Primary Health Care (AREA)
  • Marketing (AREA)
  • Human Resources & Organizations (AREA)
  • Data Mining & Analysis (AREA)
  • Emergency Protection Circuit Devices (AREA)

Abstract

The invention discloses a data security protection method for an electric power Internet of things, and belongs to the technical field of electric power terminal equipment. The invention utilizes the top layer of the all-service electric power Internet of things (SG-eIOT) to build a security protection system, and consists of two aspects of an edge Internet of things agent self security system and an application layer system. According to the invention, the edge internet of things agent self-security system is designed according to the SG-eIOT architecture, and the security of the internet of things agent self-security is protected from the protection requirements of basic hardware, an operating system and basic software. The application layer system in the invention provides requirements for application security and data security, and is combined with the self-security system of the edge internet of things proxy to form a complete protection system. The invention carries out the complete Internet of things data security protection through communication data security, stored data security, terminal access security, data confidentiality security, data transmission security, data use security and data deletion security.

Description

Data security protection method for electric power Internet of things
Technical Field
The invention belongs to the technical field of power terminal equipment, and particularly relates to a data security protection method for an electric power Internet of things.
Background
The safety production operation of the power grid directly relates to the development of daily life order and national economy of people, and a life cycle analysis and prediction model of the power transformation equipment is built, so that the safety production operation of the power grid can be effectively ensured. The comprehensive automatic system display interface is mainly displayed by a circuit schematic diagram, so that the fault equipment is difficult to quickly locate intuitively, and the problems of long time consumption and high labor cost of fault troubleshooting exist; the intelligent sensing equipment has various data types, lacks a unified management and control platform, has low comprehensive utilization level of data, and is difficult to comprehensively and effectively master the overall operation condition of the transformer substation; the transformer substation lacks an intelligent analysis module for hidden trouble of equipment defects, equipment defects cannot be found in time, and the lean management degree of the equipment is required to be improved; the safety production management is mainly based on people's gaze at present due to the lack of an operation risk early warning function, and the lack of an effective supervision means for full coverage, full period and full process.
The equipment state evaluation system lacks of digital energization, defect positioning and equipment multidimensional state evaluation, and lacks of expert system support, so that the periodic inspection work efficiency is low, and the safety protection of field operation is passive. The method comprises the steps of establishing a device state depth perception library based on artificial intelligence and machine learning technology, constructing a holographic intelligent research and judgment system such as defect active early warning, fault intelligent decision-making, device operation dynamic evaluation, personnel safety control automatic identification and the like, realizing device hidden danger management, timely finding hidden danger pre-judgment, auxiliary decision-making and fault first-aid repair, and guaranteeing the safety production operation requirements of a power grid. The existing protection system is not complete enough, and loopholes are easy to generate when data is used and deleted.
Disclosure of Invention
The invention aims to provide a data security protection method for the electric power Internet of things, which has a complete protection system and encrypts data when the data is used and deleted.
In order to achieve the above object, the present invention adopts the following technical scheme:
a data security protection method for an electric power Internet of things (IOT) utilizes a top layer of an all-service electric power Internet of things (SG-eIOT) to build a security protection guarantee system, and the security protection guarantee system consists of an edge IOT proxy self security system and an application layer system.
According to the characteristics, the edge internet of things agent self-safety system is designed according to the SG-eIOT architecture, and is protected from the protection requirements of basic hardware, an operating system and basic software and the security of the internet of things agent self-safety.
In some examples, the application layer system provides requirements for application security and data security, and is combined with the edge internet of things proxy self-security system to form a complete protection system.
In some examples, the data security is implemented primarily by:
1) Identity authentication: setting a password to ensure the safety of data storage and transmission; meanwhile, protecting the authentication Cookie;
2) Authorization: designing resource access control, verifying user access rights, limiting the access of a user to system-level resources, and uniformly controlling an access mechanism;
3) Input and output verification: verifying input data for which all sources are not within a trusted range; the verification range comprises: a server side and a client side; the input content is normalized and then verified, such as file paths, URL addresses and the like, and is required to be normalized into a standard format and then verified;
4) Session management: when login is successful, using a new session; session data can be stored timely to ensure the safety of the data; when the session reaches a certain survival time, ensuring the safe termination of the session;
5) Encryption: no self-created encryption method is used;
6) Parameter operation: ensuring that the user does not bypass the check, verifying all data sent from the client;
7) Abnormality management: when an abnormality occurs in the program, a detailed error message can be recorded in the log.
According to the characteristics, the data security protection mainly comprises application, a platform, a network, a terminal, internet of things security monitoring, a general management system, terminal layer construction security and terminal layer operation security.
In some examples, the applications are primarily user rights security, business data security, business logic security, and application security monitoring.
In some examples, the platform is primarily southbound transport security, southbound identity authentication, network access control, interface service security, and platform data security.
According to the above features, the network is mainly quantum communication, IPV6 security setup, network partitioning and access control.
According to the characteristics, the terminal is mainly an edge internet of things proxy and an internet of things field device.
In some examples, the internet of things security monitoring is mainly security situation analysis and display, terminal and network security management, application security monitoring, business logic security, device monitoring agent.
Compared with the prior art, the invention has the beneficial effects that:
1) According to the invention, the edge internet of things agent self-security system is designed according to the SG-eIOT architecture, and the security of the internet of things agent self-security is protected from the protection requirements of basic hardware, an operating system and basic software.
2) The application layer system in the invention provides requirements for application security and data security, and is combined with the self-security system of the edge internet of things proxy to form a complete protection system.
3) The invention carries out the complete Internet of things data security protection through communication data security, stored data security, terminal access security, data confidentiality security, data transmission security, data use security and data deletion security.
Drawings
Fig. 1 is a schematic structural diagram of a data security protection method for an electric power internet of things.
Detailed Description
Embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. While embodiments of the present invention are illustrated in the drawings, it should be understood that the present invention may be embodied in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art. Those skilled in the art can derive alternative solutions from the following description without departing from the spirit and scope of the invention.
A data security protection method for an electric power Internet of things (IOT) utilizes a top layer of an all-service electric power Internet of things (SG-eIOT) to build a security protection guarantee system, and the security protection guarantee system consists of an edge IOT proxy self security system and an application layer system.
The edge internet of things agent self-safety system is designed according to the SG-eIOT architecture, and is protected from the protection requirements of basic hardware, an operating system and basic software.
The application layer system provides requirements for application security and data security, and is combined with the self-security system of the edge internet of things proxy to form a complete protection system.
The data security protection is realized mainly by the following aspects:
1) Identity authentication: setting a password to ensure the safety of data storage and transmission; meanwhile, protecting the authentication Cookie;
2) Authorization: designing resource access control, verifying user access rights, limiting the access of a user to system-level resources, and uniformly controlling an access mechanism;
3) Input and output verification: verifying input data for which all sources are not within a trusted range; the verification range comprises: a server side and a client side; the input content is normalized and then verified, such as file paths, URL addresses and the like, and is required to be normalized into a standard format and then verified;
4) Session management: when login is successful, using a new session; session data can be stored timely to ensure the safety of the data; when the session reaches a certain survival time, ensuring the safe termination of the session;
5) Encryption: no self-created encryption method is used;
6) Parameter operation: ensuring that the user does not bypass the check, verifying all data sent from the client;
7) Abnormality management: when an abnormality occurs in the program, a detailed error message can be recorded in the log.
The data security protection mainly comprises application, a platform, a network, a terminal, internet of things security monitoring, a general management system, terminal layer construction security and terminal layer operation security.
According to the invention, the application security mainly comprises user authority security, service data security, service logic security and application security monitoring.
According to the invention, the platform security mainly comprises southbound transmission security, southbound identity authentication, network access control, interface service security and platform data security.
According to the invention, network security is mainly quantum communication, IPV6 security setup, network partitioning and access control.
According to the invention, the terminal security is mainly edge internet of things proxy and internet of things field device.
Edge internet of things proxy security
According to the invention, the safety monitoring of the Internet of things mainly comprises safety situation analysis and display, terminal and network safety management, application safety monitoring, service logic safety and equipment monitoring agent.
Identity authentication based on an asymmetric encryption algorithm and encryption communication based on the symmetric encryption algorithm are needed to be carried out between the internet of things agent and the electric power internet of things terminal equipment.
Terminal data protection
1) Communication data security
The system may support data security communications such as TLS/SSL protocol communications.
Confidentiality: the system may encrypt the desired communication data content via a security component. The security component should support the function of encrypting and decrypting data based on an encryption algorithm.
Integrity: the system can perform integrity protection and verification on the required communication data content through a security component. The security component should have the functions of digital digest, MAC generation and verification of the data.
Non-repudiation: the system can non-repudiation protect and verify the communication data in need by the security component. The security component should have the functions of digitally signing, message digest and verifying the data content.
2) Storage data security
The system protects data stored by applications on the system architecture, and particularly comprises the step of prohibiting modification of object data by unauthorized users and application software.
Confidentiality: the system should provide an efficient and rational data storage scheme for the encrypted storage of important system data (e.g., configuration and control information, logs, audit records, etc.). The system can encrypt and hide the needed stored data content through a security component.
Integrity: the system can perform integrity protection and verification on the needed stored data content through a security component.
Data backup and recovery: the system should have backup and restore functions for important data of the system (such as basic data for ensuring normal operation of the system).
Data loss protection: and setting a storage space exhaustion buffer alarm area, sending alarm information in time when the storage space of the system is about to be exhausted, and supporting an authorized storage function of opening the temporary storage area.
3) Terminal access security
Before the terminal accesses the internet of things platform and business application of the company through the internet of things proxy, the terminal should pass through security authentication and authorization.
Local communication security: the local communication (comprising the terminal to the internet of things agent and the terminal to the terminal) is reasonably protected by adopting a cryptographic algorithm on the premise of meeting the service performance requirement.
And (3) safety authentication of the field terminal: before local communication, identity authentication should be performed through a uniformly defined security interface. For a field terminal with enough computing capability, an asymmetric cryptographic algorithm is adopted to realize two-way identity authentication between the field terminal and an internet of things agent or between the terminals based on a digital certificate.
The field terminal is safe in transmission: after the on-site terminal and the internet of things agent complete identity authentication, the transmission data should be protected by adopting a cryptographic algorithm.
The application layer data is subjected to importance identification by the organization of the related business authorities, corresponding protection measures are formulated, and the integrity, confidentiality and backup restoration capability of the business data are ensured. For data transmission and data sharing, corresponding auditing and desensitizing measures should be formulated.
Data security includes data confidentiality security design (data storage security design, data transmission security design, data usage security design, data deletion security design), data integrity security design, and data availability security design.
1) Data confidentiality security design
(1) Data storage security design
Confidentiality protection is carried out on the transmitted sensitive information by using an encryption technology; and storing the system service data in an encryption mode.
2) Data transmission security design
The transmission of system service data among systems adopts encryption and HTTPS transmission modes; the file is transmitted by using a secure transmission protocol (such as HTTPS, SFTP and other encryption transmission protocols); and the communication safety of the client and the server is ensured by means of encryption, data signature and the like.
3) Data use security design
The system end user accesses the business information and data according to strict authority control, and the authority control supports layering, structuring and regional setting; the user is not allowed to directly connect with the database, and the connection of the database adopts the connection of an application level; without exposing database connection information to the application system, the database user password in the application system configuration file must be encrypted.
4) Data deletion security design
(1) And deleting the service data, not directly operating at the database level, carrying out at the application level, and strictly controlling the authority of a user to delete the data.
(2) Data integrity security design
The integrity of the service data in the transmission process is ensured, a malicious attacker is prevented from intercepting, tampering and deleting the data, and a cryptographic mechanism using a secret key is adopted; after the proposal communication, encrypting a session process in the communication process; encryption of SSL is used for transmission during network data exchange.
(3) Data availability security design
Uniformly storing data in an application system data center, and establishing a data center disaster tolerance, including hardware level and application level disaster tolerance, so as to ensure the safety and availability of the data; load balancing is set from the network, hardware and application system levels, so that the stability of data access is ensured; verifying the service data according to a data format preset by an application system, and adopting a transmission mode of a TCP protocol for the service data with higher availability; and the data exchange among the systems adopts a formulated uniform and universal data exchange format.
The foregoing is merely a specific implementation of the disclosure, but the scope of the embodiments of the disclosure is not limited thereto, and any person skilled in the art may easily think of changes, substitutions or combinations within the technical scope of the embodiments of the disclosure or under the ideas of the embodiments of the disclosure, and all fall within the scope of the embodiments of the disclosure.

Claims (10)

1. A data security protection method for an electric power Internet of things is characterized in that a security protection guarantee system is built by utilizing the top layer of an all-service electric power Internet of things (SG-eIOT), and the security protection guarantee system consists of an edge Internet of things proxy self security system and an application layer system.
2. The method for protecting the data security of the electric power Internet of things according to claim 1, wherein the edge Internet of things agent self-security system is designed according to an SG-eOT architecture, and is protected from basic hardware, operating system and basic software protection requirements and Internet of things agent self-security.
3. The method for protecting data security of the electric power Internet of things according to claim 1, wherein the application layer system provides requirements for application security and data security, and is combined with a self-security system of an edge Internet of things proxy to form a complete protection system.
4. The data security protection method of the electric power internet of things according to claim 1, wherein the data security protection is mainly realized by the following aspects:
1) Identity authentication: setting a password to ensure the safety of data storage and transmission; meanwhile, protecting the authentication Cookie;
2) Authorization: designing resource access control, verifying user access rights, limiting the access of a user to system-level resources, and uniformly controlling an access mechanism;
3) Input and output verification: verifying input data for which all sources are not within a trusted range; the verification range comprises: a server side and a client side; the input content is verified after normalization processing, and the input content is verified after normalization into a standard format;
4) Session management: when login is successful, using a new session; session data can be stored timely to ensure the safety of the data; when the session reaches a certain survival time, ensuring the safe termination of the session;
5) Encryption: no self-created encryption method is used;
6) Parameter operation: ensuring that the user does not bypass the check, verifying all data sent from the client;
7) Abnormality management: when an abnormality occurs in the program, a detailed error message can be recorded in the log.
5. The method for protecting data security of the electric power internet of things according to claim 1, wherein the data security protection mainly comprises application, platform, network, terminal, internet of things security monitoring, general management system, terminal layer construction security and terminal layer operation security.
6. The method for protecting data security of the electric power internet of things according to claim 5, wherein the application is mainly user authority security, business data security, business logic security and application security monitoring.
7. The method for protecting data security of the electric power internet of things according to claim 5, wherein the platform is mainly used for security in south-oriented transmission, security in south-oriented identity authentication, network access control, security in interface service and security in platform data.
8. The method for protecting data security of the electric power internet of things according to claim 5, wherein the network is mainly quantum communication, IPV6 security setting, network partitioning and access control.
9. The method for protecting data security of the electric power Internet of things according to claim 5, wherein the terminal is mainly an edge Internet of things agent and an Internet of things field device.
10. The method for protecting data security of the electric power Internet of things according to claim 5, wherein the Internet of things security monitoring mainly comprises security situation analysis and display, terminal and network security management, application security monitoring, business logic security and equipment monitoring agent.
CN202211543752.3A 2022-12-03 2022-12-03 Data security protection method for electric power Internet of things Pending CN116109438A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202211543752.3A CN116109438A (en) 2022-12-03 2022-12-03 Data security protection method for electric power Internet of things

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202211543752.3A CN116109438A (en) 2022-12-03 2022-12-03 Data security protection method for electric power Internet of things

Publications (1)

Publication Number Publication Date
CN116109438A true CN116109438A (en) 2023-05-12

Family

ID=86262132

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202211543752.3A Pending CN116109438A (en) 2022-12-03 2022-12-03 Data security protection method for electric power Internet of things

Country Status (1)

Country Link
CN (1) CN116109438A (en)

Similar Documents

Publication Publication Date Title
CN106789015B (en) Intelligent power distribution network communication safety system
CN105430000A (en) Cloud computing security management system
CN110798474A (en) Power data transmission safety protection system based on Beidou short message communication mode
CN212486798U (en) Electric power sensing equipment based on block chain technology
CN109936555A (en) A kind of date storage method based on cloud platform, apparatus and system
CN114866346B (en) Password service platform based on decentralization
CN110768963B (en) Trusted security management platform with distributed architecture
CN113542212B (en) Virtual power plant peak shaving instruction safety authentication method
Chen et al. [Retracted] A System for Trusted Recovery of Data Based on Blockchain and Coding Techniques
CN107465688B (en) Method for identifying network application permission of state monitoring and evaluating system
CN110633956A (en) Information safety protection system of interactive service type microgrid
CN116109438A (en) Data security protection method for electric power Internet of things
CN113630249B (en) Quantum network access security trusteeship client platform
CN109413111A (en) A kind of security access system and method based on wisdom data center
CN115361273A (en) Block chain-based electric power operation and maintenance safety supervision and emergency management and control system and method
Zhang et al. Design and implementation of IEC61850 communication security protection scheme for smart substation based on bilinear function
CN111769632B (en) Distributed power source secure communication method and system adopting NB-IOT technology
Liu et al. Research on Secure Access Technology of Electric Power Wireless Private Network Based on Hybrid Encryption
CN111597525A (en) Resource management system security platform
Seo et al. The green defenders
Ji Strategic Analysis and Research of Network Communication Security in the Age of Big Data
Miyaho et al. Study of a secure backup network mechanism for disaster recovery and practical network applications
Jiang et al. Tobacco industry data security protection system
Longzhu et al. Research and exploration of the data security compliance inspection technology based on the large-scale call platform of the customer service center
Yi The Network Security Analysis System Design Based on B/S Structure: An Approach Research

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination