TW201729567A - Centralized protection method for distributed smart grid and system thereof capable of defending against threats from an external network and defending against attacks from the internal of a smart grid - Google Patents

Abstract

A centralized protection technology for a distributed smart grid provided in the present invention is a protection mechanism which provides network communication to each of terminal elements and network relay devices in a wired or wireless smart grid, so as to route communication data transmitted in the smart grid to an information security device for matching and perform subsequent processing processes according to a matching result and a corresponding security strategy. The protection technology can not only defend against threats from an external network, but also defend against attacks from the internal of the smart grid, so as to improve security. In contrast to the protection technology of the prior art which requires periodically updating security rules on each of the network communication devices or terminal elements, the present invention only requires updating a centralized security rule database of the information security device to achieve protection of the distributed terminal elements in the smart grid, thereby dramatically reducing management complexity, and improving entire protection security of the smart grid.

Description

Centralized protection method and system for decentralized smart grid

The invention relates to the security protection technology of the Internet of Things, in particular to a centralized protection method and system for a distributed smart grid.

Smart grid (Smart Grid) uses information and communication technology to detect supply and demand information on the supply and use sides of power, to adjust the production and transmission of power at the supply end, or to adjust the power consumption of the use end. Saving energy, reducing losses and enhancing the reliability of the power grid, therefore, for the smart grid networking equipment, it has the dual role of power transmission and information transmission.

In order to ensure the information security of network devices, many different protection technologies have been disclosed in the prior art. For example, in the case of CN103944896A in China, the front-end security module is embedded in each web server, and intercepted. The smart grid security protection system that sends the HTTP request to the web server and then performs the subsequent processing according to the matching result and its corresponding security policy. This is the security guard of the server, especially the web server.

In another case, in European EP26084461A1, the encrypted communication between the network devices of the smart grid is transmitted through two domains, and different keys are used in the two domains, thereby improving the transmission of the message. Security, but it does not provide appropriate protection mechanisms for network devices in the smart grid.

Furthermore, it is known that the security protection technology for sensors such as smart meters, relay routers, or network component devices is like the United States. US8510835B1 discloses that a security device such as a firewall is installed at the entrance and exit of the gateway to defend against external attacks. As for the protection of internal attacks, as disclosed in the case of US20120060152A1, a corresponding defense rule is formulated for the attack behavior to be protected, and periodically. The modification of the internal components of the firmware, these protection technologies are not easy to update and cumbersome inconvenience, it is not a good protection technology.

Therefore, the main object of the present invention is to provide a centralized protection method and system for a distributed smart grid, which can monitor network traffic of an internal network without separately setting and updating defense rules for individual networked devices. Internal network traffic on the network is properly protected to ensure security.

Therefore, in order to achieve the above object, the centralized protection method and system for the distributed smart grid provided by the present invention are to enable the transmission of information between most network units in a smart grid such as a smart meter or a sensor. Before being transmitted to the target, it is firstly circulated to a security unit for inspection, and based on the result of the check, it is decided whether to intercept the message or transmit it to the original transmission target.

The message transmission between each of the network units is via a relay unit.

The message transmission of the internal network is controlled by one or more controllers via the relay unit to control the path of transmission.

The controller is an open flow controller, and the relay unit includes a plurality of routers.

Specifically, when each of the network elements and the security unit are not in the same subnet When the message is bypassed by the network address, the rewritten destination address is the address of the security unit, so that the message can be smoothly sent to the security unit for inspection, and the message is checked for security. Then, the network address is converted, and the destination address is rewritten as the address of the original transmission destination to complete the predetermined message transmission.

(10) ‧‧‧Centralized protection system for decentralized smart grids

(20)‧‧‧Network Unit

(21) (22) (23) ‧ ‧ smart meter

(24)‧‧‧Air conditioning switch

(30) ‧‧‧ Security Unit

(40) ‧‧‧Relay Unit

(41)(42)(43)(44)(45)‧‧‧Network relay equipment

(50) ‧ ‧ controller

The first figure is a schematic representation of a preferred embodiment of the invention.

Referring to the first embodiment, a centralized protection system (10) for a distributed smart grid according to a preferred embodiment of the present invention includes a majority of network units (20) and a security unit (30). A relay unit (40) and a controller (50).

Each of the network units (20) is electrically connected to each other by an internal network, and the messages can be transmitted between the two via the internal network, which can be a device with a message transmission requirement in the smart grid, except for example. In addition to the terminal equipment such as the smart meter (21) (22) (23) and the air conditioner switch (24), it can also be used in equipment such as power lines or substation and control facilities. In the example, only the terminal equipment contained in the drawings will be described, but not limited to it.

The security unit (30) is a well-known security device for checking network traffic, such as an Intrusion Protection System. The preferred configuration is based on the smart grid. The internal network and the external Internet can protect the information transmitted between the internal network and the external Internet, thereby protecting the smart grid from external Internet attacks. The security unit (30) has the same function as the conventional technology to defend against external Internet attacks, and in the present invention, the security unit (30) has the special effect of defending against attacks from internal Internet.

The relay unit (40) is interposed between each of the network unit (20) and the security unit (30), and has a plurality of network relay devices (41) (42) (43) (44) ( 45), each of which is directly connected to the corresponding network unit (20) or the security unit (30) to facilitate the transmission of information of the network unit (20) in the internal network, wherein Each of the network relay devices is a network unit (20) having a transfer function such as a smart meter, or a relay router having a strong communication capability.

The controller (50) is located in the internal network to control all or a part of the network relay device to which the relay unit (40) belongs, and to obtain better transmission efficiency, The controller (50) is an OpenFlow controller, and can be based on, for example, an OpenFlow protocol, planning a transmission path of the message, and directing the controlled network relay device.

By means of the centralized protection system (10) of the distributed smart grid, the centralized protection method of the distributed smart grid provided by the present invention can be implemented, for example, when a message is intended to be transmitted from the smart meter (22) to In the air conditioner switch (24), the controller (50) uses the network relay device (41) to packet the message from the network relay device (41), following the network relay device (42) (45) The path is bypassed to the security unit (30) for checking. When the result of the message packet inspection does not violate the established security rules of the security unit (30), the message is packetized via the network according to the shortest path principle. The shortest path of the device (45) (42) (43) (44) is transmitted to the air conditioning switch (24) of the original transmission target, and if the message packet is checked as an attack message, the message is packetized. Discard, do not transmit, so as to achieve the effect of protection.

According to this, the security unit (30) can not only protect against attacks from the external Internet, but also block attacks from the internal network of the smart grid. Compared to traditional decentralized protection technology, it is more convenient to update the firmware or safety rules to help maintain the best protection.

In addition, in response to different situations in actual use, for the transmission of the message packet, the controller (50) can be appropriately controlled, for example:

First, when the sender and the receiver of the message packet do not have the need for security check, they can define the rules that need to be bypassed by the security unit (30), and if they are transmitted from the smart meter (21) to the smart meter ( 23) The message packet, which is transmitted between its messages when there is no security check, the controller (50) directly plans the shortest path via the network relay device (41) (42) (43) The path directly transmits the message packet to the smart meter (23) without being bypassed to the security unit for inspection.

Second, when most of the network relay devices to which the relay unit (40) belongs, if there is a device that is not controlled by the controller (50), if the network relay device (42) is not supported OpenFlow's traditional Layer 2 Ethernet Switch, the controller (50) can be used to control the network relay device (41) and network relay device ( 45), and between the controlled network relay device (45) and the network relay device (43), respectively establish a tunnel (Tunnel), and the message packet that should be checked by the security unit (30) It is transmitted via the established tunnel.

Specifically, the above information is encapsulated by adding another layer header to the original message header. For example, the controller (50) can adjust the comparison table of the network relay device (41), adding a new rule. In order to "receive the message from the smart meter (22) and the purpose is the air conditioner switch (24), add another layer header and the source of the newly added outermost header by using the encapsulation technique outside the original message header. The new rule in the comparison table for setting the network relay device (41) and the purpose of setting the network relay device (45) and adjusting the network relay device (45) is "when receiving the network from the network" Relay device (41) Decapsulation is performed when the message is loaded, the outermost header is removed, the original message is restored, and the message is transmitted to the security unit (30), whereby the message packet is bypassed to the resource. The security unit (30) checks, and when the check result is normal, the message packet is sent to the network relay device (45), and then transmitted to the original transmission destination according to the shortest path principle.

Third, when the internal network of the smart grid has different subnets, for example, the network relay device (42) is to divide the network relay device (41) (43) (45) into three subnet segments. a third-level router (Layer-3 Router), the controller (50) can control the network relay device (41), when receiving the message packet of the smart meter (22) to be transmitted to the air conditioner switch (24), Perform Network Address Translation and rewrite the destination address to the address of the security unit (30) so that the message packet is based on the third-order router routing table of the network relay device (42). The (Routing Table) rule is sent to the security unit (30) for checking. When the message packet is checked as a non-attack message, the message packet is rewritten to the destination address via the network relay device (45). The target air conditioner switch (24) address transmits the message packet to the original transmission destination.

Fourth, when the internal network communicates by means of a wireless network such as ZigBee, and even if each of the network units (20) also functions as a network relay device, the device having the relay function is enabled. It is better to be controlled by the controller (50). When the received message is judged to be necessary for security check, it must be sent to the security unit (30) for inspection, which is the implementation of the protection method. It is not affected by changes in the way the network is communicated.

(10) ‧‧‧Centralized protection system for decentralized smart grids

(20)‧‧‧Network Unit

(21) (22) (23) ‧ ‧ smart meter

(24)‧‧‧Air conditioning switch

(30) ‧‧‧ Security Unit

(40) ‧‧‧Relay Unit

(41)(42)(43)(44)(45)‧‧‧Network relay equipment

(50) ‧ ‧ controller

Claims (12)

A centralized protection method for a distributed smart grid is such that a message transmitted by a plurality of network units within a smart grid is transmitted to a security unit via a relay unit for inspection, when the checked message does not violate the When the security rules of the security unit are sent to the original transmission destination via the relay unit, when the checked message violates the security rules of the security unit, the transmission of the message is suspended, thereby providing the network of the smart grid. The defense of the internal communication of the road. The centralized protection method of the distributed smart grid according to claim 1, wherein the information transmission of the smart grid internal network controls the transmission path by a controller. The centralized protection method for the distributed smart grid according to claim 2, wherein the controller is an OpenFlow controller. The centralized protection method of the distributed smart grid according to claim 1, 2 or 3, wherein the relay unit includes a plurality of routers or switches. The method for centralized protection of a distributed smart grid according to claim 1, 2 or 3, wherein the message packet is encapsulated and transmitted. The centralized protection method for the distributed smart grid according to claim 1, 2 or 3, wherein the message packet is subjected to Network Address Translation, and the destination address of the original transmission destination is rewritten or rewritten as The address of the security unit is used to route the message packet to the security unit. The centralized protection method for the distributed smart grid according to claim 6, wherein the message packet checked to be secure is subjected to Network Address Translation, and the destination address is rewritten or rewritten as the original transmission destination. After the address is transferred to the original transfer destination. A centralized protection system for a distributed smart grid, comprising: Most of the network units are electrically connected to each other by an internal network; a relay unit is interposed between the network units for transmitting information to each other between the network units. After checking to confirm that it is safe, it will be transferred to the original transfer destination. The centralized protection system of the distributed smart grid according to claim 8 further includes a security unit for checking messages and intercepting network traffic of the attack. The centralized protection system of the distributed smart grid according to claim 8 or 9, further comprising a controller for planning a transmission path and controlling the execution of the relay unit. The centralized protection system of the distributed smart grid according to claim 10, wherein the controller is an OpenFlow controller. A centralized protection system for a distributed smart grid according to claim 8 or 9, wherein the relay unit has a plurality of routers or switches.