KR20180133034A - Protection system and method of electric power systems - Google Patents

Abstract

The present invention relates to a system and a method for protecting a power facility, and more specifically, to a system for protecting a power facility, which provides a connection security service between a digital protection system power facility (10) based on IEC 61850 standard protocol and a client (20) accessible to the digital protection system power facility (10). The system of the present invention comprises: an authentication unit (100) for authenticating a connection with a power facility protection system by performing login authentication when a client (20) desiring to be connected to a digital protection system power facility (10) receiving a connection security service, transmits a connection request signal; an analysis unit (200) for receiving command information from the client (20) in which a connection is approved, through the authentication unit (100), and analyzing packet information to verify communication information and to block suspicious command information; and a processing unit (300) for performing encryption on the command information verified by the analysis unit (200) through a previously shared password, transmitting the same to the digital protection system power facility (10), receiving response information from the digital protection system power facility (10), and transmitting the same to the client (20).

Description

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a power system protection system,

The present invention relates to a power facility protection system and a method thereof, and more particularly, to a power facility protection system based on the existing IEC 61850 standard protocol and a problem of security vulnerability due to a direct connection between a client user and a connection solution The present invention relates to a power equipment protection system and method for providing a smooth service by configuring a digital power equipment protection system that does not allow access to a direct digital protection system power facility but acts as an intermediary.

Until now, the market in the electric power industry has been focused mainly on the construction of electric power equipment infrastructure. However, as the information infrastructure supporting the monitoring and control of electric power facilities (electric power equipment) is increasingly developed, the importance of reliability of information in electric power systems is emphasized.

Also, because power is one of the most important basic infrastructures in all countries, it is a major concern of cyber attacks.

In recent years, as the smart grid business has been progressed and established, there is a growing demand for security services, as the power equipment is replaced with digital power devices, thereby increasing the risk of exposure to security vulnerabilities.

In particular, there is a growing concern about security threats to the power system protection system based on the international standard IEC 61850 protocol. In fact, when using the IEC 61850 protocol (eg MMS, GOOSE, SMV etc.), IEC 61850 Based protection system power devices can be directly accessed and manipulated so that malicious access and manipulation can cause damage and malfunction of the power devices.

To date, security related issues of digital protection system power equipment have to be solely used for the services provided by the equipment manufacturer. This means that the risk of security issues must be continuously taken This is included.

In this regard, in Korean Patent Laid-Open No. 10-1998-073670 ("Digital Power System Protection Control Device"), a multi-processor is used and data exchange between the processors is performed through a standard bus, The interface is removed by using the modules for communication, and the desired information such as the result of the protection calculation and the state of the electric power facility is easily obtained without restriction and transmitted to the central computer, In the case of a mobile phone.

Korean Patent Laid-Open Publication No. 1998-073670 (published on November 11, 1998).

SUMMARY OF THE INVENTION It is an object of the present invention to provide a digital power equipment protection system that acts as an intermediary without allowing direct access to a digital power system And to provide a power equipment protection system capable of providing a smooth service and a method thereof.

The power facility protection system according to an embodiment of the present invention includes a power protection system based on IEC 61850 standard protocol and a power facility protection system that provides connection security service between clients capable of connecting to the digital protection system power facility (10) of a digital protection system based on IEC 61850 standard protocol and a client (20) capable of connecting with the digital protection system power facility (10) in the power facility protection system Wherein the power facility protection system is configured to perform a login authentication when the client (20) requesting connection to the digital protection system power facility (10) to which the connection security service is provided transfers an access request signal, An authentication unit (100) for authenticating a connection with the power facility protection system by performing an operation An analysis unit (200) for receiving command information from the client (20) to which the connection is applied through the authentication unit (100) and analyzing the packet information to block communication information verification and suspected command information; 200 to the digital protection system power facility 10 and receives the response information from the digital protection system power facility 10. The digital protection system power facility 10 receives the response information from the digital protection system power facility 10, And a processing unit (300) for transmitting to the client (20).

Furthermore, the client 20 decrypts the response information received from the processing unit 300 of the power equipment protection system through the shared password, and releases the connection with the power facility protection system do.

Further, the power facility protection system includes an operation management unit 400 for analyzing connection and disconnection of the client 20 to the power facility protection system, Communication information management unit 500 for analyzing the information transmitted from the digital protection system power facility 10 to the client 20 and the predetermined session management policy, And a security policy unit (600) for setting a connection maintaining period for the connection policy.

Furthermore, the power facility protection system is connected to the power facility protection system, and manages connection and disconnection information of the client 20 analyzed by the behavior management unit 400, And an external integrated management unit (700) for managing transmission / reception information between the client (20) and the digital protection system power facility (10).

Further, the power facility protection system provides a secure communication environment with the power facility protection system of the client 20, and transmits command information to the digital protection system power facility 10 via the client 20, And a client security unit (800) for managing an operation.

A method of protecting a power facility according to an embodiment of the present invention includes: generating a service request information (S100) for receiving a connection request signal from the client to the digital protection system power facility provided with the connection security service; A connection authentication step (S200) of performing login authentication through an access request signal by a request information generating step (S100) and authenticating a connection to the power facility protection system (S200); and the access authentication step (S300) of receiving command information from the client to which the connection is applied through the power control unit (S200) and analyzing the packet information, and transmitting the command information obtained through the analysis step (S300) (S400) for transmitting the encrypted password to the digital protection system power facility after the password is encrypted through the shared password, A response transmission step (S500) of receiving response information according to command information from the digital protection system power facility in the transmission step (S400) and transmitting the response information to the client in the power facility protection system (S500) And a service releasing step (S600) of decrypting the response information transmitted through step S500 through a shared password to confirm response information and then releasing the connection with the power facility protection system .

Furthermore, the analyzing step S300 is characterized by analyzing the packet information to block communication information verification and suspected command information.

The power plant protection system and method according to the present invention having the above-described structure can provide a smooth service by constructing a digital power facility protection system that acts as an intermediary without allowing direct access to power facilities of the digital protection system It is effective.

Through the power equipment protection system and method of the present invention, it is possible to manage the access control management of the client user and access solution that directly access the digital protection system power facility, and the power facility can be managed by wrong command or malicious intention command It is possible to prevent malfunction or damage and to prevent leakage of important information of the electric power facility of the digital protection system such as accident information and to provide the security service of the electric power facility of the digital protection system in a stable and smooth manner .

In addition, as the security threats to the national support network are soaring, there is a growing demand for security-related technologies in public enterprises having power facilities based on digital communication. Through the power equipment protection system and method of the present invention, By establishing various systems connected to grid power facilities and a sound and secure communication environment, it is possible to maximize work efficiency and increase manageability.

1 is a diagram illustrating a power equipment protection system according to an embodiment of the present invention.
2 is a flowchart illustrating a method of a power facility protection system according to an embodiment of the present invention.
3 is a timing diagram illustrating a method of a power plant protection system according to an embodiment of the present invention.
4 is a diagram illustrating a power equipment protection system according to another embodiment of the present invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, a power equipment protection system and method according to the present invention will be described in detail with reference to the accompanying drawings. The following drawings are provided by way of example so that those skilled in the art can fully understand the spirit of the present invention. Therefore, the present invention is not limited to the following drawings, but may be embodied in other forms. In addition, like reference numerals designate like elements throughout the specification.

In this case, unless otherwise defined, technical terms and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. In the following description and the accompanying drawings, A description of known functions and configurations that may unnecessarily obscure the description of the present invention will be omitted.

In addition, a system refers to a collection of components, including devices, mechanisms, and means that are organized and regularly interact to perform the required function.

A power equipment protection system and method according to an embodiment of the present invention is a so-called security box system that includes a server (a power equipment protection system that provides a connection security service), a client (terminal), a network hardware (management PC) Connection solution, etc.).

In particular, a power system protection system and method according to an embodiment of the present invention is a network system connected to an actual digital protection system power facility through which a digital protection system power facility, power surveillance, Is preferable.

In the case of the conventional analog power equipment, the user connects directly to the power equipment through the console box. However, as the digital power equipment is developed, the user (client) based on the IEC 61850 standard protocol can directly use the power equipment Which can lead to considerable security problems. In particular, it is a typical problem such as illegal numerical value of digital electric power equipment information (data), malfunction command control and the like.

However, even in the case of a user based on IEC 61850, the power plant protection system and method according to an embodiment of the present invention restricts a direct connection with a power facility and is necessarily connected through a power facility protection system, The problem can be solved easily.

The power equipment protection system according to an embodiment of the present invention is a system for protecting a power facility by controlling access control of a client (client user and a connection solution) directly connected to a digital protection system power facility and malicious command or malicious command input intentionally It is possible to provide a seamless connection with the digital protection system power facility without allowing direct access to the digital protection system power facility so as to prevent unauthorized leakage of important information such as malfunction or damage or accident information, To a system for providing a connection security service capable of providing a connection security service.

1 is a block diagram of a power equipment protection system according to an embodiment of the present invention. Referring to FIG. 1, a power equipment protection system according to an embodiment of the present invention will be described in detail.

As shown in FIG. 1, the power facility protection system according to an embodiment of the present invention includes a digital protection system power facility 10 based on IEC 61850 standard protocol, and a digital protection system power facility 10 The analysis unit 200 and the processing unit 300 in order to provide a connection security service between the client 20 and the client 20. The respective components of the power equipment protection system may include a connection security service The operation of each configuration can be performed through various control programs preset in the server with the server capable of providing.

For each configuration,

The digital protection system power facility 10 may be any of a variety of electrical equipment of the latest power system using an Ethernet based IEC 61850 communication protocol (MMS, GOOSE, SMV, etc.) IED, and the like).

The client 20 can be classified into a protection system power facility connection client and an IEC 61850 application product. The protection system power facility connection client includes a tool for establishing and setting a driving environment of a predetermined protection system power facility, Refers to a specific terminal (PC or the like) directly connected to a protection system power facility using software, and is preferably a client user possessing a specific terminal.

The IEC 61850 application refers to solutions and systems based on IEC 61850, which means a solution and system in which the protection system power plant is connected to itself without a client user.

As described above, the power facility protection system is preferably a server or the like, and the authentication unit 100, the analysis unit 200, and the processing unit 300 are preferably operated through various control programs.

When the client 20 requesting connection to the digital protection system power facility 10 to which the connection security service is provided transmits the connection request signal, the authentication unit 100 performs login authentication, Can be authenticated.

In detail, the power equipment protection system limits the direct connection between the power equipment of the digital protection system and the client, and the transmission / reception is relayed through the power equipment protection system, thereby solving the problem of direct connection.

To this end, the power plant protection system limits the communication of the client 20 to the digital protection system power facility 10 so as not to communicate with the digital protection system power facility 10, It is possible to make relay communication with the protection system. That is, the configuration that can be connected to the digital protection system power facility 10 is limited to the 'power facility protection system', thereby preventing the direct connection of the client, thereby blocking malicious access to the protection system power device.

In this case, as shown in FIG. 1, the authentication unit 100 of the power equipment protection system according to an embodiment of the present invention includes a server and the like included in the 'power equipment protection system' As shown in FIG. 4, or may be configured to be externally coupled with the client 20 by a separate means.

If the authentication unit 100 is constructed in a separate form, it is most preferable that the authentication unit 100 is constructed in a portable form for each client, and the 'protection system power equipment connection client' When it is desired to connect to the protection system power facility 10, the connection request signal is transmitted through the coupling with the authentication unit 100 carried.

When the client 20 transmits the connection request signal, the authentication unit 100 authenticates the connection with the power facility protection system by performing login authentication.

In detail, when the authentication unit 100 requests a connection from the client 20 to the digital protection system power facility 10, regardless of the type of the IEC 61850 standard protocol, Through the alias, login authentication can be performed.

An alias is an alias of a so-called network environment, which means a substitute label that is used as a means of referring to the same data element or point in a computer program.

When the authentication unit 100 receives a connection request from the client 20 to the digital protection system power facility 10, the authentication unit 100 determines whether or not the alias < RTI ID = 0.0 > In response to the issuance request, an alias of only the client 20 can be generated and transmitted to the client 20 again.

The client 20 confirms the request and generates the service request information and retransmits the information to the authentication unit 100. The authentication unit 100 confirms the service request information, (20) can perform login authentication with the digital protection system power facility (10) to perform relay communication.

According to the login authentication result, when the service is authorized, command information can be transmitted to the digital protection system power facility 10 via relay communication.

On the contrary, when the service is denied according to the login authentication result, the client 20 can not establish direct connection with the digital protection system power facility 10, so that the client 20 can not access the digital protection system power facility 10 in any form.

The analysis unit 200 receives the command information from the client 20 to which the service 20 is connected, that is, the client 20, which is connected to the digital protection system power facility 10 via the authentication unit 100, And analyzes the packet information to block communication information verification and suspected command information.

The command information of the client 20 has a different packet structure according to the IEC 61850 standard protocol.

In detail, when the MMS security method of IEC 61850 standard protocol is used, mutual authentication of PKI method between devices and encryption of a message are implemented through SSL / TLS of a transport layer, A packet structure in which a signature is added,

When using the GOOSE / SVM security method of the IEC 61850 standard protocol, it is preferable that the PKI digital signature value is included in the extension field, and the CRC and the length value are added to the header field.

The analysis unit 200 capable of analyzing the packet structure analyzes the packet information by receiving command information from the client 20 and transmits a Bypass transmission to the digital protection system power facility 10 If it is determined to be an error command, it can be determined that the command information is suspected and can be blocked.

The processing unit 300 can transmit the command information verified through the analysis unit 200 to the digital protection system power facility 10 after encryption through a password previously shared.

In addition, response information for the command information may be received from the digital protection system power facility 10 and relayed to the client 20.

The client 20 can decrypt the response information received through the processing unit 300 through a previously shared password, and then terminates the communication, that is, disconnects the connection security service , It may request to disconnect the power plant protection system.

Here, it is preferable that the pre-shared password is encrypted / decrypted based on a password previously shared with the digital protection system power facility.

The power equipment protection system further includes a behavior management unit 400, a transmission / reception information management unit 500, and a security policy unit 600 as shown in FIG. 1 to provide a more seamless access security service .

The behavior management unit 400 may analyze the connection and disconnection behavior of the client 20 to the power facility protection system.

In detail, the behavior management unit 400 can analyze connection and disconnection behavior of the client 20, and can collect information on the client (0) connected to the power facility protection system, connection date and time information, And so on.

The transmission / reception information management unit 500 may analyze the information transmitted by the client 20 to the digital protection system power facility 10 and transmit the digital protection system power facility 10 to the client 20 The information can also be analyzed.

The transmission / reception information management unit 500 transmits information requested by the client 20 to the digital protection system power facility 10 through the relay connection of the power facility protection system, the received digital protection system power facility 10, Information on the date and time of transmission, and the like can be analyzed. More specifically, the transmission target client information, the connection target power device information, the command information transmitted normally, and the filtered content information can be further analyzed.

The transmission / reception information management unit 500 receives information transmitted from the digital protection system power facility 10 to the client 20, that is, response information to the command information, , And transfer result information. More specifically, it is possible to further analyze the reception target client information and the like.

The security policy unit 600 can set a connection holding period for communication of the client 20 through a session management policy set in advance.

The security policy unit 600 may perform session management of a client and may perform session management through setting a connection maintenance period of the client 20 when an Alias is assigned. It is possible to prevent accesses other than the client connection maintenance period through the automatic change of the alias for each session, and to newly perform the session management through the re-authentication upon expiration of the session.

For this purpose, the security policy unit 600 may provide an interface for setting a session management policy for client authentication, and may be configured to adjust the level of the supervisory command delivered to the digital protection system power facility 10 It can also provide an interface that can be

In this case, the interface for setting a session management policy for client authentication provided by the security policy unit 600 may be provided in the external integrated management unit 700 described below.

In more detail, as shown in FIG. 1, the power equipment protection system according to an embodiment of the present invention further includes an external integrated management unit 700 connected to a server of the power equipment protection system through external communication Lt; / RTI >

The external integrated management unit 700 includes a user interface for listing and managing information collected through the connection security service and setting a policy of the system, for example, an interface for setting a session management policy for client authentication And may manage connection and disconnection behavior information of the client 20 analyzed by the behavior management unit 400. [0033] FIG.

Further, the transmission / reception information managed by the transmission / reception information management unit 500 can be managed through the relay connection between the client 20 and the digital protection system power facility 10.

That is, the external integrated management unit 700 manages the client information, the connection target power device information, the transmission / reception behavior information, the connection date information, the disconnection date information, and the like connected to the digital protection system power facility 10, It can be provided for search on request.

Also, it is possible to manage transmission / reception behavior information, transmission target client information, transmission / reception date information, filtering information, and the like of the digital protection system power facility 10 and provide it so that it can be searched upon request of an external administrator.

At this time, it is preferable that the external administrator is an administrator of the external integrated management unit 700, and performs administrator authentication through ID / PW-based login authentication.

In addition, it is desirable to prevent the data from being modulated and randomly exposed through the construction of the SSL security server.

The power plant protection system according to an embodiment of the present invention includes a plurality of clients 20, in other words, a protection system power facility connection client and an IEC 61850 applied product, A client security unit 800 that provides a secure communication environment with the power facility protection system to the client 20 and is capable of managing command forwarding and sending and receiving operations to the digital protection system power facility 10 via the client 20, As shown in FIG.

The client security unit 800 may be an agent installed in a terminal for accessing a protection system power device when the client 20 is a protection system power facility accessing client. Thus, a secure communication environment can be established with the digital protection system power facility 10, and commands and connection actions to be transmitted to the protection system power equipment can be easily managed.

If the client 20 is an IEC 61850-applied product, the client security unit 800 is preferably an API provided to a solution and system operating on IEC 61850 basis. As described above, It is possible to establish a secure communication environment with the protection system power facility 10, and it is possible to easily manage commands and connection actions to be transmitted to the protection system power device.

When the client security module 800 accesses the power facility protection system, login authentication is preferably performed through the issued alias, and the packet structure at this time is the same as the packet structure described above.

FIG. 2 is a flowchart illustrating a method of a power facility protection system according to an embodiment of the present invention, and FIG. 3 is a timing diagram illustrating a method of a power facility protection system according to an embodiment of the present invention. 2 and 3, a method of a power equipment protection system according to an embodiment of the present invention will be described in detail.

2, the method of a power facility protection system according to an embodiment of the present invention includes a service request information generation step S100, an access authentication step S200, an analysis step S300, an instruction transmission step S400 , A response transmission step (S500), and a service release step (S600).

A method of a power plant protection system according to an embodiment of the present invention includes a connection between a digital protection system power facility 10 based on IEC 61850 standard protocol and a client 20 capable of connecting the digital protection system power facility 10 In order to provide a security service, a server capable of providing a connection security service can be performed as an operation step of each configuration through various control programs preset in the server with a main axis.

For each step,

The service request information generation step S100 may transmit a connection request signal from the client 20 to the digital protection system power facility 10 provided with the connection security service, as shown in FIG.

That is, the client 20 requesting connection to the digital protection system power facility 10 provided with the connection security service can transmit a connection request signal.

The connection authentication step (S200) can authenticate the connection of the client (20) to the power facility protection system by performing login authentication through an access request signal by the service request information generation step (S100).

Accordingly, the method of the electric power facility protection system can restrict the direct connection between the electric power facility of the existing digital protection system and the client, and the transmission / reception is necessarily relayed through the electric power facility protection system, thereby solving the problem of direct connection.

The analysis step (S300) receives the command information from the client (20) to which the connection is granted through the connection authentication step (S200), and analyzes the packet information.

In other words, command information is received from the client 20 to which the connection with the digital protection system power facility 10 is applied, and packet information is analyzed to block communication information verification and suspected command information.

The command information of the client 20 has a different packet structure according to the IEC 61850 standard protocol.

In detail, when the MMS security method of IEC 61850 standard protocol is used, mutual authentication of PKI method between devices and encryption of a message are implemented through SSL / TLS of a transport layer, A packet structure in which a signature is added,

When using the COOSE / SVM security method of the IEC 61850 standard protocol, it is preferable that the PKI digital signature value is included in the extension field, and the CRC and the length value are added to the header field.

Bypass transmission to the digital protection system power facility 10 is performed for the bypassable command. If it is determined that the command is an error command, it can be determined to be suspicious command information and can be blocked.

The command transmission step (S400) may transmit the command information verified through the analysis step (S300) to the digital protection system power facility (10) after proceeding encryption through a pre-shared password.

The response transmission step S500 may receive the response information according to the command information from the digital protection system power facility 10 in the transmission step S400 and may relay the response information to the client 20.

Preferably, the pre-shared password is encrypted based on a password previously shared with the digital protection system power facility.

In the service release step S600, the client 20 decrypts the response information transmitted through the response transmission step S500 through the shared password in advance through the shared password, After this, communication can be terminated, that is, the connection with the connection security service can be released and the connection to the power facility protection system can be canceled.

Here, it is preferable that the pre-shared password is decrypted based on a password previously shared with the digital protection system power facility.

In addition, a method of a power plant protection system according to an embodiment of the present invention may analyze connection and disconnection behavior of the client 20 to the power facility protection system, Information transmitted to the protection system power facility 10 and information transmitted from the digital protection system power facility 10 to the client 20 can also be analyzed.

Furthermore, the external manager manages the client information, the connection target power device information, the transmission / reception behavior information, the connection date information, the disconnection date information, and the like connected to the digital protection system power facility 10, Can be provided for searching.

Also, it is possible to manage transmission / reception behavior information, transmission target client information, transmission / reception date information, filtering information, and the like of the digital protection system power facility 10 and provide it so that it can be searched upon request of an external administrator.

In addition, it is preferable to set a connection maintenance period for communication of the client 20 through a preset session management policy, and to prevent data from being modulated and randomly exposed through the construction of an SSL security server.

The power plant protection system and method according to an embodiment of the present invention is a system and method for protecting a power system by securing an information protection technology of a power system and managing access control of a client directly accessing a digital protection system power facility, The power equipment can be prevented from malfunctioning or being damaged, the leakage of important information such as accident information can be prevented in advance, and a smooth access security service can be provided.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed embodiments, but, on the contrary, And various modifications and changes may be made thereto by those skilled in the art to which the present invention pertains.

Accordingly, the spirit of the present invention should not be construed as being limited to the embodiments described, and all of the equivalents or equivalents of the claims, as well as the following claims, belong to the scope of the present invention .

10: Digital protection system power equipment
20: Client
Power Equipment Protection System
100:
200: Analysis Department
300:
400:
500: Transmission / reception information management section
600: Security Policy Department
700: External integrated management unit
800: Client Security Department

Claims (7)

1. A power facility protection system for providing a connection security service between a digital protection system power facility (10) based on IEC 61850 standard protocol and a client (20) capable of connecting the digital protection system power facility (10)
The power plant protection system
When the client (20) requesting connection to the digital protection system power facility (10) provided with the connection security service transmits a connection request signal, the client (20) performs login authentication and authenticates connection with the power facility protection system (100);
An analysis unit (200) which receives command information from the client (20) to which the connection is applied through the authentication unit (100) and analyzes packet information to block communication information verification and suspected command information; And
And transmits the encrypted command information to the digital protection system power facility 10 after encrypting the verified command information through the shared password through the analysis unit 200 and sends the response to the digital protection system power facility 10 A processing unit 300 for receiving information and transmitting the received information to the client 20;
The power plant protection system comprising:
The method according to claim 1,
The client (20)
And decrypts the response information received from the processing unit (300) of the power facility protection system through a shared password, and disconnects the power facility protection system from the power facility protection system.
3. The method of claim 2,
The power plant protection system
An operation management unit 400 for analyzing connection and disconnection of the client 20 to the power facility protection system;
A transmission / reception information management unit 500 for analyzing information transmitted by the client 20 to the digital protection system power facility 10 and information transmitted from the digital protection system power facility 10 to the client 20; And
A security policy unit 600 for setting a connection maintenance period for communication of the client 20 through a predetermined session management policy;
Further comprising: a power supply control unit for controlling power supply to the power equipment.
The method of claim 3,
The power plant protection system
Connected to the power plant protection system,
The client 20 manages the connection and disconnection information of the client 20 analyzed by the behavior management unit 400 and manages connection and disconnection information between the client 20 analyzed by the transmission / reception information management unit 500 and the digital protection system power facility 10 An external integrated management unit 700 for managing transmission / reception information;
Further comprising: a power supply control unit for controlling power supply to the power equipment.
The method according to claim 1,
The power plant protection system
A client security unit 800 that provides a secure communication environment with the power facility protection system of the client 20 and manages command information and transmission and reception behavior to the digital protection system power facility 10 via the client 20, ;
Further comprising: a power supply control unit for controlling power supply to the power equipment.
A method of a power plant protection system for providing a connection security service between a digital protection system power facility based on IEC 61850 standard protocol and a client capable of connecting with the digital protection system power facility,
In the power facility protection system, a service request information generation step (S100) for receiving a connection request signal from the client to the digital protection system power facility provided with the connection security service;
A connection authentication step (S200) in which login authentication is performed through the connection request signal by the service request information generation step (S100), and a connection to the power facility protection system is authenticated;
An analysis step (S300) of receiving the command information from the client connected through the connection authentication step (S200) and analyzing the packet information in the power equipment protection system (S300);
A command transmission step (S400) of transmitting the encrypted command information to the digital protection system power facility after encrypting the command information through a pre-shared password in the power facility protection system, through the analysis step (S300);
A response transmission step (S500) of receiving response information according to command information from the digital protection system power facility in the transmission step (S400) and transmitting the response information to the client in the power facility protection system; And
The client performs a service releasing step of decrypting the response information transmitted through the response transmission step (S500) through a shared password to confirm response information, and then releasing the connection with the power facility protection system S600);
The method comprising the steps of:
The method according to claim 6,
The analysis step (S300)
Analyzing the packet information, and verifying the communication information and blocking suspicious command information.

Images