CN117395045A - Multi-protocol ubiquitous access type hydropower plant LCU device based on active comprehensive defense - Google Patents
Multi-protocol ubiquitous access type hydropower plant LCU device based on active comprehensive defense Download PDFInfo
- Publication number
- CN117395045A CN117395045A CN202311359063.1A CN202311359063A CN117395045A CN 117395045 A CN117395045 A CN 117395045A CN 202311359063 A CN202311359063 A CN 202311359063A CN 117395045 A CN117395045 A CN 117395045A
- Authority
- CN
- China
- Prior art keywords
- trusted
- plc
- data
- unit
- access
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 230000007123 defense Effects 0.000 title claims abstract description 42
- 238000004891 communication Methods 0.000 claims abstract description 47
- 230000005540 biological transmission Effects 0.000 claims abstract description 30
- 230000009545 invasion Effects 0.000 claims abstract description 14
- 238000007726 management method Methods 0.000 claims description 49
- 230000006870 function Effects 0.000 claims description 14
- 238000011084 recovery Methods 0.000 claims description 14
- 238000000034 method Methods 0.000 claims description 13
- 238000004458 analytical method Methods 0.000 claims description 10
- 238000012550 audit Methods 0.000 claims description 10
- 238000004364 calculation method Methods 0.000 claims description 9
- XLYOFNOQVPJJNP-UHFFFAOYSA-N water Substances O XLYOFNOQVPJJNP-UHFFFAOYSA-N 0.000 claims description 9
- 230000008447 perception Effects 0.000 claims description 8
- 230000009471 action Effects 0.000 claims description 6
- 238000012423 maintenance Methods 0.000 claims description 6
- 230000002265 prevention Effects 0.000 claims description 6
- 230000004044 response Effects 0.000 claims description 6
- 238000013475 authorization Methods 0.000 claims description 5
- 238000003745 diagnosis Methods 0.000 claims description 5
- 239000000835 fiber Substances 0.000 claims description 5
- 230000008569 process Effects 0.000 claims description 5
- 238000012795 verification Methods 0.000 claims description 4
- 230000002457 bidirectional effect Effects 0.000 claims description 3
- 238000011217 control strategy Methods 0.000 claims description 3
- 238000001514 detection method Methods 0.000 claims description 3
- 239000013307 optical fiber Substances 0.000 claims description 3
- 238000013480 data collection Methods 0.000 claims 1
- 238000013461 design Methods 0.000 abstract description 5
- 238000005516 engineering process Methods 0.000 description 6
- 230000002159 abnormal effect Effects 0.000 description 2
- 238000012549 training Methods 0.000 description 2
- 230000006978 adaptation Effects 0.000 description 1
- 230000007547 defect Effects 0.000 description 1
- 230000001066 destructive effect Effects 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 230000000694 effects Effects 0.000 description 1
- 238000009776 industrial production Methods 0.000 description 1
- 230000008439 repair process Effects 0.000 description 1
- 238000012546 transfer Methods 0.000 description 1
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
- H04L63/0407—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the identity of one or more communicating identities is hidden
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
- H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/40—Network security protocols
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y04—INFORMATION OR COMMUNICATION TECHNOLOGIES HAVING AN IMPACT ON OTHER TECHNOLOGY AREAS
- Y04S—SYSTEMS INTEGRATING TECHNOLOGIES RELATED TO POWER NETWORK OPERATION, COMMUNICATION OR INFORMATION TECHNOLOGIES FOR IMPROVING THE ELECTRICAL POWER GENERATION, TRANSMISSION, DISTRIBUTION, MANAGEMENT OR USAGE, i.e. SMART GRIDS
- Y04S40/00—Systems for electrical power generation, transmission, distribution or end-user application management characterised by the use of communication or information technologies, or communication or information technology specific aspects supporting them
- Y04S40/20—Information technology specific aspects, e.g. CAD, simulation, modelling, system security
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Programmable Controllers (AREA)
Abstract
A multi-protocol ubiquitous access type hydropower plant on-site control unit (Local control unit, LCU) device based on active comprehensive defense belongs to the field of hydropower automation, and particularly relates to a device capable of solving the security problem of data access under the condition of complex Internet of things. The front-end active comprehensive defense unit ensures the credibility and reliability of the accessed equipment and actively defends illegal access and invasion. Programmable controller (Programmable Logic Controller, PLC) data with built-in trusted software is sent to the security module, which returns signed data to the PLC. The PLC and the PLC send the encrypted trusted data to a trusted authentication management layer through various ubiquitous communication protocols in a trusted data transmission layer. The design can ensure the reliable access of the acquisition equipment with various communication modes and communication protocols, and ensure the access safety of the acquisition equipment under the condition of ubiquitous access, and ensure the whole flow credible safety of the industrial control equipment under the guarantee of the active comprehensive defense unit and the credible safety module.
Description
Technical Field
The invention relates to the technical field of hydropower automation, in particular to a device capable of solving the problem of data access security under the condition of complex Internet of things.
Background
Programmable Logic Controllers (PLCs) are widely used in the fields of industrial automation, infrastructure, building automation, and the like. The security problem of the PLC is important to ensure the normal operation of equipment and the safety of industrial production. Although the security measures of the PLC are continuously perfected in recent years, some problems and challenges still exist. System updating and maintenance: with the continued development of technology, PLC firmware and software need to be updated periodically to repair vulnerabilities and add new functionality.
However, hydropower stations may fail to update PLC systems in time for various reasons (e.g., budget constraints, lack of technicians, etc.), thereby increasing security risks, such as:
1) Network security risk: with the popularization of industrial internet, PLC devices face more and more threats of network attack. A hacker may invade the PLC system by utilizing a vulnerability, tamper equipment parameters or perform destructive attack, and influence the normal operation of the hydropower station;
2) Human misoperation: although PLCs can implement automated control, manual intervention is still required to perform certain operations. Operators may cause system faults or safety accidents due to negligence, misoperation and the like;
3) Lack of safety training: hydropower plant personnel may not receive enough safety training, causing them to fail in operating and maintaining the PLC system, increasing safety risks;
4) Supply chain safety: PLC devices and components may come from different suppliers whose security management levels are staggered; thus, hydropower plants may face supply chain security risks, such as malware, hardware backdoors.
Therefore, the applicant provides a multi-protocol ubiquitous access type hydropower plant LCU device based on active comprehensive defense, which can improve the mode diversity of data acquisition, ensure the credibility of data acquisition and transmission and ensure the safety of the whole aspect of industrial control scenes of the hydropower plant.
Disclosure of Invention
The invention aims to solve the technical defect that security and protection are easy to occur in data access under the condition of complex Internet of things in an industrial control scene of a hydropower plant, and provides a multi-protocol ubiquitous access type hydropower plant LCU device based on active comprehensive defense.
In order to solve the technical problems, the invention adopts the following technical scheme:
the utility model provides a multi-protocol ubiquitous access type hydropower plant LCU device based on initiative comprehensive defense, it includes the credible data perception layer, the output of credible data perception layer is connected with the input of credible data acquisition layer, the output of credible data acquisition layer is connected with the input of credible data transmission layer, the output of credible data transmission layer is connected with the input of credible authentication management layer;
the trusted data acquisition layer transmits the acquired data to the PLC through the low-power-consumption telemetry unit and the Internet of things gateway; the front-end comprehensive defense unit ensures the credibility and reliability of the accessed equipment and actively defends illegal access and invasion; the PLC with the built-in trusted software sends the data to the security module, and the security module sends the signed data to the PLC; the PLC and the PLC send the encrypted trusted data to a trusted authentication management layer through various ubiquitous communication modes in a trusted data transmission layer; the edge calculation module is responsible for carrying out secondary analysis on the collected original data and carrying out front-end fault diagnosis and analysis.
The credible data sensing layer collects analog quantities such as water, oil, gas, voltage, current and the like, switching quantities such as switch and valve positions and the like through various wired or wireless sensors, converts the analog quantities into electric quantities or digital quantities which can be digitally represented and transmitted, and sends collected data in a multi-protocol and multi-communication mode to the credible data collecting layer.
The trusted data acquisition layer comprises a first PLC unit and a second PLC unit;
the first input end of the first PLC unit is connected with the output end of the remote measuring unit, the output end of the first PLC unit is connected with the input end of the first safety module, and the output end of the first safety module is connected with the second input end of the first PCL unit;
the first input end of the second PLC unit is connected with the input end of the Internet of things gateway, the output end of the second PLC unit is connected with the input end of the second safety module, and the output end of the second safety module is connected with the second input end of the second PLC unit;
the remote measuring unit and the Internet of things gateway are both in bidirectional data connection with the front-end comprehensive defense unit;
the third input end of the first PLC unit and the third input end of the second PLC unit are connected with the input end of the edge computing unit; the output end of the edge computing unit is connected with the input end of the trusted data transmission layer.
Under the action of the load balancing cluster, the trusted data transmission layer balances the collection and the up-sending of data, and prevents data storm and frequent request and response; there are a number of ubiquitous forms of communication for data transmission, including wired: RJ45, fiber, cable and wireless: LTE, NB-LOT, WIFI, loRaWAN, etc.; on the premise of keeping reliable communication quality, access of various communication forms is allowed, and omnibearing dispatching load balance is kept.
The trusted authentication management layer consists of a trusted management server and an authentication encryption server; the method mainly realizes the functions of identity authentication, access control, intrusion prevention, security audit, backup and recovery; each uplink or downlink message contains a unique identifier and a trusted signature, so that the accessed object is ensured to be a trusted object; the communication between the PLC and the communication between the PLC and an upper computer or other equipment can be protected under the holding of the national encryption algorithm, and data leakage or tampering can be prevented; under the addition of IP and physical address white lists and black lists, multi-factor authentication, role authorization and other technologies are used for improving access security; implementing a strict access control strategy to ensure that only authorized personnel can access the PLC device; when external scanning or external access or external invasion exists, the threat can be directly cut off; auditing the behavior of each operation or process to ensure that all operations are compliant and do not exceed the own red line; the backup and restore function can perform unified management and backup disaster recovery on device parameters or configuration files in the whole network so as to restore when problems occur.
When the device works, the following steps are adopted:
step 1: the trusted data sensing layer collects temperature, water pressure, flow, oil pressure and oil level through various wired or wireless sensors, and converts original values of air pressure into analog quantities such as voltage, current and the like; switching values of a travel switch, a valve, a breaker, a knife switch position and the like are converted into digital quantity representation which can be processed and transmitted by a machine, and collected data are sent to a PLC unit through a low-power-consumption telemetry unit and an Internet of things gateway;
step 2: the front end comprehensive defense unit of the trusted data acquisition layer ensures the credibility and reliability of the accessed equipment and actively defends illegal access and invasion, and once the defense unit detects that unknown equipment is accessed or illegal invaded, real-time alarms are written into a security log, the access of the unknown equipment is refused, and the connection is disconnected;
step 3: after the front-end comprehensive defense unit confirms that no abnormal equipment is accessed, the PLC unit with built-in trusted software firstly sends data to the security module, the security module signs the data packet sent by the PLC unit, and then the data packet is returned to the PLC unit; then, the PLC unit forwards the data packet containing the digital signature to an edge computing server by using an encryption channel;
step 4: the edge computing server communicates with the trusted management server and the authentication encryption server which are positioned in the trusted authentication management layer, namely by a trusted data transmission layer-ubiquitous communication mode or protocol: transmitting the data packet to a trusted authentication management layer in a wired mode (RJ 45, optical fiber, cable) or a wireless mode (LTE, NB-LOT, WIFI, loRaWAN);
step 5: the trusted authentication management layer comprises a set of trusted authentication management system (software), a trusted management server and an authentication encryption server, the trusted authentication management system is flexible to deploy, is compatible with various virtualization platforms or entity servers, and maintenance personnel can realize a series of functions including identity authentication, access control, intrusion detection, encryption algorithm selection, security audit, backup and recovery through a graphical interface.
Compared with the prior art, the invention has the following technical effects:
the invention provides a multi-protocol ubiquitous access type hydropower plant LCU device based on active comprehensive defense.
1) The traditional hydropower plant LCU device does not carry out identity authentication on various devices accessing the data acquisition layer, has no safety configuration, and can communicate with the PLC unit after being well configured with a network. The front-end comprehensive defense unit in the design uses a digital certificate technology to ensure that the low-power-consumption telemetry unit of the trusted data acquisition layer and the internet of things are trusted devices; the front-end comprehensive defense unit can monitor the accessed equipment in real time, and other equipment of the trusted data acquisition layer is refused to be accessed after the unknown equipment is accessed. The acquisition equipment of various communication modes and communication protocols can be reliably accessed, and meanwhile, the access safety of the acquisition equipment under the condition of ubiquitous access is ensured;
2) And the data acquisition layer of the traditional hydropower plant LCU device can not carry out safe encryption and digital signature on the data packet when the PLC unit sends the data. Once an attacker invades the acquisition layer network, the data packet sent by the PLC unit is tampered, and the stable operation of the hydropower plant is threatened greatly. The PLC unit with the built-in trusted software in the design firstly forwards the encrypted data packet to the security module for digital signature, the security module returns the data packet with the digital signature to the PLC unit, the built-in trusted software of the PLC unit verifies the signature, and the data packet is forwarded to the edge computing server after being confirmed to be not tampered;
in summary, under the assurance of the active comprehensive defense unit and the trusted security module, the access security of the industrial control equipment is ensured, and the confidentiality and the integrity of the industrial data packet are ensured.
Drawings
The invention is further illustrated in the following with reference to fig. 1 and examples:
fig. 1 is a schematic view of the overall structure of the device of the present invention.
Detailed Description
As shown in fig. 1, a multi-protocol ubiquitous access type hydropower plant LCU device based on active comprehensive defense comprises the following four layers of designs:
a first layer: the credible data sensing layer is composed of various sensors, and temperature, water pressure, flow, oil pressure, oil level and original value of air pressure are collected through various sensors and converted into analog quantities such as voltage, current and the like; alternatively, the switching values of the travel switch, the valve, the breaker, the knife switch position and the like are converted into digital values which can be processed and transmitted by the machine to represent the values. The data collected by the trusted data sensing layer can be sent to the trusted data collecting layer in various communication protocols and modes;
a second layer: the trusted data acquisition layer consists of six modules, including a low-power consumption telemetry unit, an Internet of things gateway, a front-end comprehensive defense unit, a PLC with built-in trusted software, a security module and an edge calculation server. The low-power consumption remote measuring unit and the Internet of things gateway are responsible for collecting the switching value and the analog value of the sensing layer. The front-end comprehensive defense unit is used for guaranteeing the credibility and reliability of the accessed equipment and actively defending illegal invasion, and the front-end comprehensive defense unit realizes the credibility authentication of various types of internet-of-things gateways and telemetry units. Once the unknown equipment is accessed, the front-end comprehensive defense unit alarms in real time and writes the alarms into a security log, and the access of the unknown equipment is refused. The original data of the trusted data perception layer is forwarded to the PLC through a gateway or a telemetry unit; in order to ensure the authenticity and integrity of data, the PLC with built-in trusted software firstly sends the data to a security module, and the security module signs the data sent by the PLC and then returns the data to the PLC. In order to ensure confidentiality of industrial data, the PLC and the PLC, and the PLC and the edge computing server all adopt encrypted channel communication. The edge computing server is responsible for carrying out secondary analysis on the collected original data and carrying out front-end fault diagnosis and analysis. The original data is processed by the edge computing server and then sent to the trusted data transmission layer (ubiquitous communication mode or protocol).
Third layer: under the action of the load balancing cluster, the trusted data transmission layer balances the forwarding of data packets in an industrial scene, prevents data storm and frequent request and response, reduces the network packet loss rate and improves the reliability of the network. The so-called ubiquitous communication scheme or protocol, i.e. by wire: RJ45, fiber, cable, or wireless: LTE, NB-LOT, WIFI, loRaWAN, etc. On the premise of keeping reliable communication quality, the adaptation of various communication modes or protocols is realized as much as possible, and the load balance of omnibearing dispatching is kept.
Fourth layer: the trusted authentication management layer consists of a trusted management server and an authentication encryption server. The method mainly realizes the functions of identity authentication, access control, intrusion prevention, security audit, backup and recovery. Each uplink or downlink message contains a unique identifier and a trusted signature, so that the accessed object is ensured to be a trusted object. The communication between the PLC and between the PLC and an upper computer or other equipment can be protected under the holding of the national encryption algorithm, and the data is prevented from being divulged or tampered by an attacker. Under the addition of the IP address and the physical address white list and the blacklist, the access security is improved by using technologies such as multi-factor identity verification, role authorization and the like. Enforcing the mandatory access control policy ensures that only authorized personnel can access the PLC device. When there is an extraneous scan or illegal access or intrusion, the threat can be cut off directly. In addition, the trusted authentication management layer audits the behavior of each operation or process, so that all operations are guaranteed to be compliant and do not exceed own red lines. The backup and restore function can perform unified management and backup disaster recovery on device parameters or configuration files in the whole network so as to restore when problems occur.
The utility model provides a multi-protocol ubiquitous access type hydropower plant LCU device based on initiative comprehensive defense, it includes trusted data perception layer 1, the output of trusted data perception layer 1 is connected with the input of trusted data acquisition layer 2, the output of trusted data acquisition layer 2 is connected with the input of trusted data transmission layer 3, the output of trusted data transmission layer 3 is connected with the input of trusted authentication management layer 4;
the trusted data acquisition layer 2 transmits the acquired data to the PLC through the low-power-consumption telemetry unit and the Internet of things gateway; the front-end comprehensive defense unit ensures the credibility and reliability of the accessed equipment and actively defends illegal access and invasion; the PLC with the built-in trusted software sends the data to the security module, and the security module sends the signed data to the PLC; the PLC and the PLC send the encrypted trusted data to the trusted authentication management layer 4 through various ubiquitous communication modes in the trusted data transmission layer 3; the edge calculation module is responsible for carrying out secondary analysis on the collected original data and carrying out front-end fault diagnosis and analysis.
The trusted data sensing layer 1 collects analog quantities such as water, oil, gas, voltage, current and the like, switching quantities such as switch and valve positions and the like through various wired or wireless sensors, converts the analog quantities into electrical quantities or digital quantities which can be digitally represented and transmitted, and sends collected data in a multi-protocol and multi-communication mode to the trusted data collecting layer 2.
The trusted data acquisition layer 2 comprises a first PLC unit 2-1 and a second PLC unit 2-2;
the first input end of the first PLC unit 2-1 is connected with the output end of the remote measuring unit 2-3, the output end of the first PLC unit 2-1 is connected with the input end of the first safety module 2-4, and the output end of the first safety module 2-4 is connected with the second input end of the first PCL unit 2-1;
the first input end of the second PLC unit 2-2 is connected with the input end of the Internet of things gateway 2-5, the output end of the second PLC unit 2-2 is connected with the input end of the second safety module 2-7, and the output end of the second safety module 2-7 is connected with the second input end of the second PLC unit 2-2;
the telemetry unit 2-3 and the Internet of things gateway 2-5 are both connected with the front-end comprehensive defense unit 2-6 in a bidirectional data manner;
the third input end of the first PLC unit 2-1 and the third input end of the second PLC unit 2-2 are connected with the input end of the edge calculation unit 2-8; the output of the edge calculation unit 2-8 is connected to the input of the trusted data transfer layer 3.
The trusted data transmission layer 3 balances the collection and the up-sending of data under the action of the load balancing cluster, so that data storm and frequent request and response are prevented; there are a number of ubiquitous forms of communication for data transmission, including wired: RJ45, fiber, cable and wireless: LTE, NB-LOT, WIFI, loRaWAN, etc.; on the premise of keeping reliable communication quality, access of various communication forms is allowed, and omnibearing dispatching load balance is kept.
The trusted authentication management layer 4 consists of a trusted management server and an authentication encryption server; the method mainly realizes the functions of identity authentication, access control, intrusion prevention, security audit, backup and recovery; each uplink or downlink message contains a unique identifier and a trusted signature, so that the accessed object is ensured to be a trusted object; the communication between the PLC and the communication between the PLC and an upper computer or other equipment can be protected under the holding of the national encryption algorithm, and data leakage or tampering can be prevented; under the addition of IP and physical address white lists and black lists, multi-factor authentication, role authorization and other technologies are used for improving access security; implementing a strict access control strategy to ensure that only authorized personnel can access the PLC device; when external scanning or external access or external invasion exists, the threat can be directly cut off; auditing the behavior of each operation or process to ensure that all operations are compliant and do not exceed the own red line; the backup and restore function can perform unified management and backup disaster recovery on device parameters or configuration files in the whole network so as to restore when problems occur.
When the device works, the following steps are adopted:
step 1: the trusted data sensing layer collects temperature, water pressure, flow, oil pressure and oil level through various wired or wireless sensors, and converts original values of air pressure into analog quantities such as voltage, current and the like; switching values of a travel switch, a valve, a breaker, a knife switch position and the like are converted into digital quantity representation which can be processed and transmitted by a machine, and collected data are sent to a PLC unit through a low-power-consumption telemetry unit and an Internet of things gateway;
step 2: the front end comprehensive defense unit of the trusted data acquisition layer ensures the credibility and reliability of the accessed equipment and actively defends illegal access and invasion, and once the defense unit detects that unknown equipment is accessed or illegal invaded, real-time alarms are written into a security log, the access of the unknown equipment is refused, and the connection is disconnected;
step 3: after the front-end comprehensive defense unit confirms that no abnormal equipment is accessed, the PLC unit with built-in trusted software firstly sends data to the security module, the security module signs the data packet sent by the PLC unit, and then the data packet is returned to the PLC unit; then, the PLC unit forwards the data packet containing the digital signature to an edge computing server by using an encryption channel;
step 4: the edge computing server communicates with the trusted management server and the authentication encryption server which are positioned in the trusted authentication management layer, namely by a trusted data transmission layer-ubiquitous communication mode or protocol: transmitting the data packet to a trusted authentication management layer in a wired mode (RJ 45, optical fiber, cable) or a wireless mode (LTE, NB-LOT, WIFI, loRaWAN);
step 5: the trusted authentication management layer comprises a set of trusted authentication management system (software), a trusted management server and an authentication encryption server, the trusted authentication management system is flexible to deploy, is compatible with various virtualization platforms or entity servers, and maintenance personnel can realize a series of functions including identity authentication, access control, intrusion detection, encryption algorithm selection, security audit, backup and recovery through a graphical interface.
The multi-protocol ubiquitous access type hydropower plant LCU device based on the active comprehensive defense comprises a front-end comprehensive defense unit for guaranteeing the credibility and reliability of accessed equipment and actively defending illegal access and invasion.
The utility model provides a multi-protocol ubiquitous access type hydropower plant LCU device based on initiative comprehensive defense, the PLC of built-in trusted software sends the data to the security module, and the security module sends signed data to the PLC. The PLC and the PLC send the encrypted trusted data to a trusted authentication management layer through various ubiquitous communication modes in a trusted data transmission layer.
A multi-protocol ubiquitous access type hydropower plant LCU device based on active comprehensive defense, a trusted data transmission layer balances data acquisition and uploading under the action of a load balancing cluster, and data storm and frequent request and response are prevented.
The utility model provides a multi-protocol ubiquitous access type hydropower plant LCU device based on initiative comprehensive defense, trusted authentication management layer comprises trusted management server and authentication encryption server. The method mainly realizes the functions of identity authentication, access control, intrusion prevention, security audit, backup and recovery.
Examples:
the credible data sensing layer collects analog quantities such as water, oil, gas, voltage, current and the like, switching quantities such as a switch, a valve position and the like through various wired or wireless sensors, converts the analog quantities into electric quantities or digital quantities which can be digitally represented and transmitted, and sends collected data in a multi-protocol and multi-communication mode to the credible data collecting layer; and the trusted data acquisition layer transmits the acquired data to the PLC through the low-power-consumption telemetry unit and the gateway of the Internet of things. The front-end comprehensive defense unit ensures the credibility and reliability of the accessed equipment and actively defends illegal access and invasion. The PLC with the built-in trusted software sends the data to the security module, and the security module sends the signed data to the PLC. The PLC and the PLC send the encrypted trusted data to a trusted authentication management layer through various ubiquitous communication modes in a trusted data transmission layer; the edge calculation module is responsible for carrying out secondary analysis on the collected original data and carrying out front-end fault diagnosis and analysis. Under the action of the load balancing cluster, the trusted data transmission layer balances the collection and the up-sending of data, and prevents data storm and frequent request and response. There are a number of ubiquitous forms of communication for data transmission, including wired: RJ45, fiber, cable and wireless: LTE, NB-LOT, WIFI, loRaWAN, etc. On the premise of keeping reliable communication quality, access of various communication forms is allowed, and omnibearing dispatching load balance is kept. The trusted authentication management layer consists of a trusted management server and an authentication encryption server. The method mainly realizes the functions of identity authentication, access control, intrusion prevention, security audit, backup and recovery. Each uplink or downlink message contains a unique identifier and a trusted signature, so that the accessed object is ensured to be a trusted object. The communication between the PLC and the communication between the PLC and an upper computer or other equipment can be protected under the holding of the national encryption algorithm, and data leakage or tampering can be prevented. Under the addition of IP and physical address white lists and black lists, multi-factor authentication, role authorization and other technologies are used to improve access security. A strict access control policy is enforced to ensure that only authorized personnel can access the PLC device. When there is external scanning or external access or external intrusion, the threat can be cut off directly. The behavior of each operation or process is audited, so that all operations are compliant and do not exceed the own red line. The backup and restore function can perform unified management and backup disaster recovery on device parameters or configuration files in the whole network so as to restore when problems occur.
The multi-protocol ubiquitous access type hydropower plant LCU device based on active comprehensive defense can solve the security problem of data access under the condition of complex Internet of things. The method is characterized in that a trusted data sensing layer collects analog quantities such as water, oil, gas, voltage, current and the like, switching quantities such as a switch and a valve position and the like through various wired or wireless sensors, converts the analog quantities into electrical quantities or digital quantities which can be digitally represented and transmitted, and sends the collected data to a PLC (programmable logic controller) through a low-power-consumption telemetry unit and an Internet of things gateway. The front-end comprehensive defense unit ensures the credibility and reliability of the accessed equipment and actively defends illegal access and invasion. The PLC with the built-in trusted software sends the data to the security module, and the security module sends the signed data to the PLC. The PLC and the PLC send the encrypted trusted data to a trusted authentication management layer through various ubiquitous communication modes in a trusted data transmission layer. The design can ensure the reliable access of the acquisition equipment with various communication modes and communication protocols, and ensure the access safety of the acquisition equipment under the condition of ubiquitous access, and ensure the whole flow credible safety of the industrial control equipment under the guarantee of the active comprehensive defense unit and the credible safety module. The multi-protocol ubiquitous access type hydropower plant LCU device based on active comprehensive defense has wide significance under the condition of prominent network security problem in the industrial control field.
Claims (6)
1. The utility model provides a multi-protocol ubiquitous access type hydropower plant LCU device based on initiative comprehensive defense, which is characterized by comprising a trusted data perception layer (1), wherein the output end of the trusted data perception layer (1) is connected with the input end of a trusted data acquisition layer (2), the output end of the trusted data acquisition layer (2) is connected with the input end of a trusted data transmission layer (3), and the output end of the trusted data transmission layer (3) is connected with the input end of a trusted authentication management layer (4);
the trusted data acquisition layer (2) transmits the acquired data to the PLC through the low-power-consumption telemetry unit and the Internet of things gateway; the front-end comprehensive defense unit ensures the credibility and reliability of the accessed equipment and actively defends illegal access and invasion; the PLC with the built-in trusted software sends the data to the security module, and the security module sends the signed data to the PLC; the PLC and the PLC send the encrypted trusted data to a trusted authentication management layer (4) through various ubiquitous communication modes in a trusted data transmission layer (3); the edge calculation module is responsible for carrying out secondary analysis on the collected original data and carrying out front-end fault diagnosis and analysis.
2. The device according to claim 1, characterized by the trusted data perception layer (1) collects analog quantities of water, oil, gas, voltage, current, switching quantities of switch and valve position through various wired or wireless sensors, converts the switching quantities into electrical quantities or digital quantities which can be digitally represented and transmitted, and sends the collected data in multiple protocols and multiple communication modes to the trusted data collection layer (2).
3. The apparatus according to claim 2, characterized in that the trusted data acquisition layer (2) comprises a first PLC unit (2-1), a second PLC unit (2-2);
the first input end of the first PLC unit (2-1) is connected with the output end of the telemetry unit (2-3), the output end of the first PLC unit (2-1) is connected with the input end of the first safety module (2-4), and the output end of the first safety module (2-4) is connected with the second input end of the first PCL unit (2-1);
the first input end of the second PLC unit (2-2) is connected with the input end of the Internet of things gateway (2-5), the output end of the second PLC unit (2-2) is connected with the input end of the second safety module (2-7), and the output end of the second safety module (2-7) is connected with the second input end of the second PLC unit (2-2);
the remote measuring unit (2-3) and the Internet of things gateway (2-5) are connected with the front-end comprehensive defense unit (2-6) in a bidirectional data mode;
the third input end of the first PLC unit (2-1) and the third input end of the second PLC unit (2-2) are connected with the input end of the edge calculation unit (2-8); the output end of the edge calculation unit (2-8) is connected with the input end of the trusted data transmission layer (3).
4. The device according to claim 1, characterized in that the trusted data transmission layer (3) balances the collection and uploading of data under the action of the load balancing cluster, preventing data storms and frequent requests and responses; there are a number of ubiquitous forms of communication for data transmission, including wired: RJ45, fiber, cable and wireless: LTE, NB-LOT, WIFI, loRaWAN; on the premise of keeping reliable communication quality, access of various communication forms is allowed, and omnibearing dispatching load balance is kept.
5. The apparatus according to claim 1, characterized in that the trusted authentication management layer (4) consists of a trusted management server and an authentication encryption server; the method mainly realizes the functions of identity authentication, access control, intrusion prevention, security audit, backup and recovery; each uplink or downlink message contains a unique identifier and a trusted signature, so that the accessed object is ensured to be a trusted object; the communication between the PLC and the communication between the PLC and an upper computer or other equipment can be protected under the holding of the national encryption algorithm, and data leakage or tampering can be prevented; under the addition of IP and physical address white lists and black lists, the techniques of multi-factor identity verification and role authorization are used for improving the access security; implementing a strict access control strategy to ensure that only authorized personnel can access the PLC device; when external scanning or external access or external invasion exists, the threat can be directly cut off; auditing the behavior of each operation or process to ensure that all operations are compliant and do not exceed the own red line; the backup and restore function can perform unified management and backup disaster recovery on device parameters or configuration files in the whole network so as to restore when problems occur.
6. The device according to any one of claims 1 to 4, characterized in that it is operated by the following steps:
step 1: the trusted data sensing layer (1) collects temperature, water pressure, flow, oil pressure and oil level through various wired or wireless sensors, and the original value of air pressure is converted into analog quantities such as voltage and current; the switching values of a travel switch, a valve, a breaker and a knife switch are converted into digital quantity representation which can be processed and transmitted by a machine, and collected data are sent to a PLC unit through a low-power-consumption telemetry unit (2-3) and an Internet of things gateway (2-5);
step 2: the front end of the trusted data acquisition layer (2) synthesizes a defending unit (2-6) to ensure that the accessed equipment is reliable and actively defends illegal access and invasion, when the trusted data acquisition layer has unknown equipment access, the defending unit (2-6) can identify the access request, verify the authenticity of a digital certificate of the accessed equipment, the access equipment is classified as trusted equipment after verification, if the verification fails, namely the defending unit (2-6) detects that the unknown equipment is accessed or illegally invaded, real-time alarms are written in a security log, the access of the unknown equipment is refused, the connection is disconnected, and if the unknown equipment is accessed but approved by operation and maintenance personnel, the defending unit (2-6) only allows the access to the trusted data acquisition layer (2) after the operation and maintenance personnel is required to manually make certificates and distribute the certificates to the equipment;
step 3: after the front-end comprehensive defense unit (2-6) confirms that no unknown equipment is accessed, the PLC unit with built-in trusted software firstly encrypts a data packet to be sent by using a symmetric cryptographic algorithm (optional type), then sends the encrypted data packet to the security module, signs the data packet sent by the PLC unit by the security module, and then returns a new data packet with a signature to the PLC unit; then, the PLC unit forwards the data packet containing the digital signature to an edge computing unit (2-8);
step 4: the edge computing server communicates with the trusted management server and the authentication encryption server which are positioned in the trusted authentication management layer, namely by a trusted data transmission layer-ubiquitous communication mode or protocol: transmitting the data packet to a trusted authentication management layer in a wired mode (RJ 45, optical fiber, cable) or a wireless mode (LTE, NB-LOT, WIFI, loRaWAN);
step 5: the trusted authentication management layer comprises a set of trusted authentication management system (software), a trusted management server and an authentication encryption server, the trusted authentication management system is flexible to deploy, is compatible with various virtualization platforms or entity servers, and maintenance personnel can realize a series of functions including identity authentication, access control, intrusion detection, encryption algorithm selection, security audit, backup and recovery through a graphical interface.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202311359063.1A CN117395045A (en) | 2023-10-19 | 2023-10-19 | Multi-protocol ubiquitous access type hydropower plant LCU device based on active comprehensive defense |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202311359063.1A CN117395045A (en) | 2023-10-19 | 2023-10-19 | Multi-protocol ubiquitous access type hydropower plant LCU device based on active comprehensive defense |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN117395045A true CN117395045A (en) | 2024-01-12 |
Family
ID=89435486
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202311359063.1A Pending CN117395045A (en) | 2023-10-19 | 2023-10-19 | Multi-protocol ubiquitous access type hydropower plant LCU device based on active comprehensive defense |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN117395045A (en) |
-
2023
- 2023-10-19 CN CN202311359063.1A patent/CN117395045A/en active Pending
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| Gao et al. | SCADA communication and security issues | |
| CN106789015B (en) | Intelligent power distribution network communication safety system | |
| Parvania et al. | Hybrid control network intrusion detection systems for automated power distribution systems | |
| EP2866407A1 (en) | Protection of automated control systems | |
| Coates et al. | A trust system architecture for SCADA network security | |
| US10700871B2 (en) | Securing network communications on industrial automation systems | |
| CN214306527U (en) | Gas pipe network scheduling monitoring network safety system | |
| KR20090102469A (en) | System and method for data protection and security of scada network based on dnp | |
| Abouzakhar | Critical infrastructure cybersecurity: A review of recent threats and violations | |
| Taylor et al. | Enhancing integrity of modbus TCP through covert channels | |
| Khodabakhsh et al. | Cyber-risk identification for a digital substation | |
| Tyav et al. | A comprehensive review on smart grid data security | |
| Dolezilek et al. | Cybersecurity based on IEC 62351 and IEC 62443 for IEC 61850 systems | |
| McCary et al. | Smart grid attacks and countermeasures | |
| Jung et al. | Design on SCADA test-bed and security device | |
| Vittor et al. | Cyber security-security strategy for distribution management system and security architecture considerations | |
| Liang et al. | A study on cyber security of smart grid on public networks | |
| Zhou et al. | Mind the gap: Security analysis of metro platform screen door system | |
| Gao | Cyberthreats, attacks and intrusion detection in supervisory control and data acquisition networks | |
| CN117395045A (en) | Multi-protocol ubiquitous access type hydropower plant LCU device based on active comprehensive defense | |
| Sukumara et al. | Cyber security–security strategy for distribution management system and security architecture considerations | |
| Patel et al. | Analysis of SCADA Security models | |
| CN111565167B (en) | Generalized remote operation information safety device and safety operation and maintenance method for intelligent substation | |
| KR20130001767A (en) | Data comunication system for communication security | |
| Rakas et al. | Cyber security issues in conductor temperature and meteorological measurement based DLR system |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |