WO2021068453A1 - 一种基于报文置换的电网调度远方操作安全许可方法 - Google Patents

一种基于报文置换的电网调度远方操作安全许可方法 Download PDF

Info

Publication number
WO2021068453A1
WO2021068453A1 PCT/CN2020/078907 CN2020078907W WO2021068453A1 WO 2021068453 A1 WO2021068453 A1 WO 2021068453A1 CN 2020078907 W CN2020078907 W CN 2020078907W WO 2021068453 A1 WO2021068453 A1 WO 2021068453A1
Authority
WO
WIPO (PCT)
Prior art keywords
message
permission
communication network
security
network port
Prior art date
Application number
PCT/CN2020/078907
Other languages
English (en)
French (fr)
Inventor
汤震宇
刘明慧
代小翔
曹翔
胡绍谦
Original Assignee
南京南瑞继保电气有限公司
南京南瑞继保工程技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 南京南瑞继保电气有限公司, 南京南瑞继保工程技术有限公司 filed Critical 南京南瑞继保电气有限公司
Publication of WO2021068453A1 publication Critical patent/WO2021068453A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0853—Network architectures or network communication protocols for network security for authentication of entities using an additional device, e.g. smartcard, SIM or a different communication terminal
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q10/00—Administration; Management
    • G06Q10/06—Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
    • G06Q10/063—Operations research, analysis or management
    • G06Q10/0631—Resource planning, allocation, distributing or scheduling for enterprises or organisations
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q50/00—Information and communication technology [ICT] specially adapted for implementation of business processes of specific business sectors, e.g. utilities or tourism
    • G06Q50/06—Energy or water supply
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/12—Protocols specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
    • H04L67/125—Protocols specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks involving control of end-device applications over a network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/16—Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
    • H04L69/163—In-band adaptation of TCP data exchange; In-band control procedures

Definitions

  • the invention belongs to the technical field of electric power automation remote monitoring, and in particular relates to a method for security permission of remote operation of power grid dispatch based on message replacement.
  • the power monitoring system especially the monitoring system of stock operation, has a single permitted path for remote operation of the dispatching end.
  • License security management and control deployment and other issues such as large disturbances mainly include:
  • Deploying the security control measures of the second path of operation permission in the inventory power monitoring system will generally cause greater interference to the operating system, such as front-end devices, vertical encryption authentication devices, and plant-side communication gateways.
  • the change of the communication object will cause the parameter modification of network switching equipment such as network routers and vertical encryption authentication devices.
  • the changes of these communication environment parameters will cause the system stability to be greatly reduced or the debugging workload to be greatly increased.
  • the purpose of the present invention is to propose a security permission method for remote operation of power grid dispatching based on message replacement, by adding an operation permission security gateway to the network channel of the front-end communication exit of the remote operation of the dispatching terminal, and a built-in security gateway is built in the gateway.
  • the Ukey-based security permission module enters the permission instruction to allow this operation after verifying the identity.
  • the operation message security control module in the gateway recognizes the operation message and recognizes the non-operation message after receiving the disapproved instruction. It is forwarded without any modification, the application layer data segment of the operation message is set to zero, and the other network protocol layers of the message remain unchanged and forwarded, so that the passing operation message is kept unchanged while the communication process is unchanged. Change to invalid to block the execution of the operation command.
  • the embodiment of the present invention provides a security permission method for remote operation of power grid dispatching based on message replacement, including:
  • the operation permission security gateway verifies the legality of the connected Ukey
  • the remote operation sent by the front end processor of the dispatcher is identified and forwarded.
  • a pair of communication network port used to connect to the front-end processor of the dispatcher
  • One downward communication network port used to connect with the vertical encryption authentication device of the dispatching terminal
  • VGA port used for display man-machine interface access.
  • operation permission security gateway is built-in:
  • the Ukey-based security permission module is used to perform Ukey authentication and process the input of instructions for whether remote operations are permitted;
  • an operation safety control module which is used to identify and forward the original message between the upper communication network port and the lower communication network port according to the instruction of whether the remote operation is permitted.
  • the operation permission security gateway to perform identity legality verification on the accessed Ukey includes:
  • the Ukey-based security license module uses the verification mechanism of the public key system to verify the legality of the Ukey that the operator accesses to the USB port.
  • inputting the instruction sent by the front end processor of the dispatching terminal whether the remote operation is permitted includes:
  • the remote operation permission or disapproval instruction sent by the front-end computer of the dispatcher is input on the display man-machine interface.
  • the operation security control module recognizes and forwards the original message between the upper communication network port and the lower communication network port, including:
  • the original message will be forwarded directly in both directions between the upper communication network port and the lower communication network port without any modification;
  • the original message sent from the upper communication network port to the lower communication network port is analyzed by the application layer to identify whether it is an operation message;
  • the application layer analysis of the original message sent from the upper communication network port to the lower communication network port to identify whether it is an operation message includes: applying layer data to the message according to a specific communication message protocol definition Whether the content in the segment is an operation instruction is identified, if it is an operation instruction, it is recognized as an operation message, if it is not an operation instruction, it is recognized as a non-operation message.
  • the unlicensed operation message remains unchanged and forwarded at other network protocol layers.
  • the original message is always directly forwarded without any modification.
  • the beneficial effects of the present invention are that a second path can be added to perform safety management and control on whether the operation command is permitted to be executed without changing the scheduling communication routing parameter environment, and has the characteristics of strong adaptability, simple deployment, and safety and effectiveness.
  • Figure 1 is a schematic diagram of the deployment of the operation permission security gateway in the present invention
  • FIG. 2 is a schematic diagram of the logical realization of the Ukey-based security permission module in the present invention
  • Fig. 3 is a schematic diagram of the logic realization of the operation safety control module in the present invention.
  • the invention provides a security permission method for remote operation of power grid dispatch based on message replacement, which is realized by a Ukey-based security permission module and an operation message security control module.
  • an operation permission security gateway is deployed between the front-end processor of the dispatcher and the vertical encryption authentication device, so that the operation commands of the dispatcher's operator workstation pass the front-end processor through the operation permission security gateway and then to the vertical encryption authentication device. Exit.
  • the operation permission security gateway has an upper communication network port on the hardware interface for connecting with the dispatch end front-end processor, a lower communication network port for connecting with the dispatch end vertical encryption authentication device, and one
  • the USB port is used for Ukey access, and a VGA port is used to connect the display man-machine interface.
  • the operation permission security gateway of the embodiment of the present invention has a built-in Ukey-based security permission module for processing remote operation permission instruction input, and the operation security control module is used for identifying and forwarding operation messages under the permission permission instruction. All the front-end processor-to-down communications reach the vertical encryption authentication device of the dispatcher through the operation permission security gateway. There is a one-to-one correspondence between the number of configuration of the operation permission security gateway and the vertical encryption authentication device.
  • the operation permission security gateway of the embodiment of the present invention does not have an IP address itself, and it is insensitive and transparent to the communication between the front-end processor and the vertical encryption authentication device.
  • the Ukey-based security license module uses the verification mechanism of the public key system to verify the legality of the Ukey that the operator accesses to the USB port. After confirming the legality of the operator, it passes through the display connected to the VGA port. On the man-machine interface, input the permission or disapproval instruction for the remote operation from the front-end computer of the dispatching terminal, and transmit the instruction to the operation safety control module.
  • the operation security control module establishes a mechanism for original message identification and forwarding between the upper communication network port and the lower communication network port of the operation permission security gateway.
  • the original message is forwarded directly between the upstream communication network port and the downstream communication network port without any modification; if a disapproval instruction for remote operations is received, it will be sent to the downstream communication network port from the upstream communication network port to the downstream communication network port.
  • the original message is analyzed at the application layer, and whether the content in the application layer data section of the message is an operation instruction is identified according to the specific communication message protocol definition. If it is an operation instruction, it is recognized as an operation message, and if it is not an operation instruction, it is recognized as an operation instruction. Non-operational messages.
  • the original message is directly forwarded without any modification to the non-operation message, all the contents of the application layer data segment are modified and replaced with zero characters for the operation message, and the byte length of the operation message is kept unchanged, and then the TCP calibration is recalculated. Check the value, and then continue to forward the operation message after the correction is set to zero to the downstream communication network port. It should be noted that the disallowed operation messages are forwarded unchanged at other network protocol layers, so that the operation messages that pass the road are corrected to invalid messages while keeping the communication process unchanged. The execution of the operation command is blocked.
  • the message forwarded from the downstream communication network port to the upstream communication network port always keeps the original message directly forwarded without any modification.

Landscapes

  • Engineering & Computer Science (AREA)
  • Business, Economics & Management (AREA)
  • Human Resources & Organizations (AREA)
  • Economics (AREA)
  • Health & Medical Sciences (AREA)
  • Strategic Management (AREA)
  • Tourism & Hospitality (AREA)
  • Marketing (AREA)
  • General Health & Medical Sciences (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • General Physics & Mathematics (AREA)
  • Signal Processing (AREA)
  • Computing Systems (AREA)
  • General Business, Economics & Management (AREA)
  • Entrepreneurship & Innovation (AREA)
  • Physics & Mathematics (AREA)
  • Development Economics (AREA)
  • Computer Security & Cryptography (AREA)
  • Operations Research (AREA)
  • Quality & Reliability (AREA)
  • Computer Hardware Design (AREA)
  • Game Theory and Decision Science (AREA)
  • Educational Administration (AREA)
  • General Engineering & Computer Science (AREA)
  • Medical Informatics (AREA)
  • Public Health (AREA)
  • Water Supply & Treatment (AREA)
  • Primary Health Care (AREA)
  • Small-Scale Networks (AREA)

Abstract

本发明公开一种基于报文置换的电网调度远方操作安全许可方法，该方法在调度端前置机通信出口的网络通道上增加设置操作许可安全网关，该网关中内置的基于Ukey安全许可模块在校验身份合法后输入是否允许本次操作的许可指令，该网关中操作安全控制模块收到不许可的指令后对原始报文进行识别，对非操作报文不做任何修改直接转发，对操作报文的应用层数据段置零值后转发而对该报文其他网络协议层保持原样不变转发，从而在保持通信过程不变的情况下将过路的操作报文改为无效，阻断操作命令的执行。本发明可以实现在不改变调度通信路由参数环境的前提下对操作命令进行是否许可执行的安全管控，具有适应性强、部署简单、安全有效、无感介入的特点。

Description

一种基于报文置换的电网调度远方操作安全许可方法 技术领域
本发明属于电力自动化远程监控技术领域，特别涉及一种基于报文置换的电网调度远方操作安全许可方法。
背景技术
随着电力系统二次系统的网络化、数字化和智能化，电力系统二次监控系统的网络安全变得日益迫切，电力监控系统尤其是存量运行的监控系统，其调度端远方操作存在许可路径单一、许可安全管控部署扰动性大等问题，主要有：
1)调度端远方操作目前仅仅由操作员工作站进行操作，在操作的时候虽然有操作员和监护员双重认证，但是实际在网络上这种操作许可的路径是单一的，都是从操作员工作站到前置机到纵向加密认证装置，如果调度机房中计算机网络系统受到病毒感染等网络入侵攻击，机房中的操作员工作站和前置机都将变得不可靠，那这种单一路径的操作许可的安全性将大打折扣。
2)在存量电力监控系统中部署第二条路径的操作许可安全管控措施，一般会带来对运行系统的较大干扰，比如会导致前置机、纵向加密认证装置、厂站端通信网关机的通信对象的变化，导致网络路由器、纵向加密认证装置等网络交换设备的参数修改，这些通信环境参数的变化将导致系统稳定性大大下降或者调试工作量的大幅度增加。
发明内容
本发明的目的在于提出一种基于报文置换的电网调度远方操作安全许可方法，通过在调度端远方操作的前置机通信出口的网络通道上增加设置操作许可安全网关，在该网关中内置的基于Ukey的安全许可模块在校验身份合法后输入是否允许本次操作的许可指令，该网关中操作报文安全控制模块收到不许可的指令后对操作报文进行识别，对非操作报文不做任何修改原样转发，对操作报文的应用层数据段置零值而对该报文其他网络协议层保持原样不变转发，从而在保持通信过程不变的情况下将过路的操作报文改为无效，以此阻断操作命令的执行。
为了达成上述目的，本发明采用的技术方案如下：
本发明实施例提供一种基于报文置换的电网调度远方操作安全许可方法，包括：
在调度端的前置机和纵向加密认证装置之间部署操作许可安全网关；
操作许可安全网关对接入的Ukey进行身份合法性校验；
根据Ukey身份合法性校验结果，输入调度端前置机发送的远方操作是否被许可的指令；
根据所述远方操作是否被许可的指令，对调度端前置机发送的远方操作进行识别和转发。
进一步的，所述操作许可安全网关配置：
一个对上通信网口，用于和调度端的前置机连接；
一个对下通信网口，用于和调度端的纵向加密认证装置连接；
一个USB口，用于Ukey接入；
以及一个VGA口，用于显示器人机界面接入。
进一步的，所述操作许可安全网关内置：
基于Ukey的安全许可模块，用于进行Ukey的身份验证，以及处理远方操作是否许可的指令输入；
和操作安全控制模块，用于根据所述远方操作是否许可的指令，对对上通信网口和对下通信网口之间的原始报文进行识别和转发。
进一步的，所述操作许可安全网关对接入的Ukey进行身份合法性校验，包括：
基于Ukey的安全许可模块通过公钥体系的验签机制对操作许可员接入USB口的Ukey进行身份合法性校验。
进一步的，所述根据Ukey身份合法性校验结果，输入调度端前置机发送的远方操作是否被许可的指令，包括：
对接入USB口的Ukey确认身份合法后，通过在显示器人机界面上输入对调度端前置机发送的远方操作许可或者不许可的指令。
进一步的，所述操作安全控制模块对对上通信网口和对下通信网口之间的原始报文进行识别和转发，包括：
如果收到对远方操作的许可指令，则在对上通信网口和对下通信网口之间双向直接转发原始报文，不做任何修改；
如果收到对远方操作的不许可指令，则对对上通信网口向对下通信网口发送的原始报文进行应用层分析，识别是否为操作报文；
如果是非操作报文，则不做任何修改直接转发原始报文；
如果是操作报文，则将应用层数据段内容全部修正置换为零字符，并保持操作报文的字节数长度不变，重新计算TCP校验值，将修正置零后的操作报文继续向对下通信网口转发。
进一步的，所述对对上通信网口向对下通信网口发送的原始报文进行应用层分析，识别是否为操作报文，包括：根据具体的通信报文规约定义对报文应用层数据段中内容是否为操作指令进行鉴别，如果是操作指令则识别为操作报文，如果不是操作指令则识别为非操作报文。
进一步的，对不许可的操作报文在其他网络协议层保持原始报文不变转发。
进一步的，对于对下通信网口向对上通信网口转发的报文始终保持直接转发原始报文，不做任何修改。
本发明的有益效果是：能在不改变调度通信路由参数环境的前提下增加第二条路径对操作命令进行是否许可执行的安全管控，具有适应性强、部署简单、安全有效的特点。
附图说明
图1为本发明中的操作许可安全网关部署示意图；
图2为本发明中的基于Ukey的安全许可模块逻辑实现示意图；
图3为本发明中的操作安全控制模块逻辑实现示意图。
具体实施方式
下面对本发明作进一步描述。以下实施例仅用于更加清楚地说明本发明的技术方案，而不能以此来限制本发明的保护范围。
本发明提供一种基于报文置换的电网调度远方操作安全许可方法，通过基于Ukey的安全许可模块和操作报文安全控制模块实现。
参见图1，在调度端的前置机和纵向加密认证装置之间部署操作许可安全网关，使得调度端操作员工作站的操作命令在经过前置机后都经由操作许可安全网关再到纵向加密认证装置出口。
本发明实施例中，操作许可安全网关，在硬件接口上具备一个对上通信网口用于和调度端前置机连接、一个对下通信网口用于和调度端纵向加密认证装置连接、一个USB口用于Ukey接入、以及一个VGA口用于连接显示器人机界面。
本发明实施例的操作许可安全网关内置基于Ukey的安全许可模块用于处理远方操作是否许可的指令输入，以及操作安全控制模块用于在是否许可的指令下对操作报文进行识别和转发。所有的前置机对下通信均经由操作许可安全网关到达调度端的纵向加密认证装置。操作许可安全网关的配置数量和纵向加密认证装置一一对应。
本发明实施例的操作许可安全网关本身不具备IP地址，其对前置机和纵向加密认证装置之间的通信是无感透明的。
参见图2，基于Ukey的安全许可模块通过公钥体系的验签机制对操作许可员接入USB口的Ukey进行身份合法性校验，在确认操作许可员身份合法后通过在VGA口连接的显示器人机界面上输入对调度端前置机过来的远方操作许可或者不许可的指令，并将该指令传递到操作安全控制模块。
参见图3，操作安全控制模块在操作许可安全网关的对上通信网口和对下通信网口之间建立原始报文识别和转发的机制，如果收到对远方操作的许可指令，则在对上通信网口和对下通信网口之间双向直接转发原始报文，不做任何修改；如果收到对远方操作的不许可指令，则对对上通信网口向对下通信网口发送的原始报文进行应用层分析，根据具体的通信报文规约定义对报文应用层数据段中内容是否为操作指令进行鉴别，如果是操作指令则识别为操作报 文，如果不是操作指令则识别为非操作报文。
对非操作报文不做任何修改直接转发原始报文，对操作报文将应用层数据段内容全部修正置换为零字符，并保持操作报文的字节数长度不变，然后重新计算TCP校验值，然后将修正置零后的操作报文继续向对下通信网口转发。需要注意的是，对该不许可的操作报文在其他网络协议层保持原样不变转发，从而实现了在保持通信过程不变的情况下，将过路的操作报文修正为无效报文，以此阻断操作命令的执行。
同时不管收到基于Ukey的安全许可模块下发的指令是许可还是不许可，对下通信网口向对上通信网口转发的报文始终保持直接转发原始报文，不做任何修改。
以上所述仅是本发明的优选实施方式，应当指出，对于本技术领域的普通技术人员来说，在不脱离本发明技术原理的前提下，还可以做出若干改进和变形，这些改进和变形也应视为本发明的保护范围。

Claims (9)

  1. 一种基于报文置换的电网调度远方操作安全许可方法，其特征在于，包括：
    在调度端的前置机和纵向加密认证装置之间部署操作许可安全网关；
    操作许可安全网关对接入的Ukey进行身份合法性校验；
    根据Ukey身份合法性校验结果，输入调度端前置机发送的远方操作是否被许可的指令；
    根据所述远方操作是否被许可的指令，对调度端前置机发送的远方操作进行识别和转发。
  2. 根据权利要求1所述的一种基于报文置换的电网调度远方操作安全许可方法，其特征在于，所述操作许可安全网关配置：
    一个对上通信网口，用于和调度端的前置机连接；
    一个对下通信网口，用于和调度端的纵向加密认证装置连接；
    一个USB口，用于Ukey接入；
    以及一个VGA口，用于显示器人机界面接入。
  3. 根据权利要求2所述的一种基于报文置换的电网调度远方操作安全许可方法，其特征在于，所述操作许可安全网关内置：
    基于Ukey的安全许可模块，用于进行Ukey的身份验证，以及处理远方操作是否许可的指令输入；
    和操作安全控制模块，用于根据所述远方操作是否许可的指令，对对上通信网口和对下通信网口之间的原始报文进行识别和转发。
  4. 根据权利要求3所述的一种基于报文置换的电网调度远方操作安全许可方法，其特征在于，所述操作许可安全网关对接入的Ukey进行身份合法性校验，包括：
    基于Ukey的安全许可模块通过公钥体系的验签机制对操作许可员接入USB口的Ukey进行身份合法性校验。
  5. 根据权利要求3所述的一种基于报文置换的电网调度远方操作安全许可方法，其特征在于，所述根据Ukey身份合法性校验结果，输入调度端前置机发送的远方操作是否被许可的 指令，包括：
    对接入USB口的Ukey确认身份合法后，通过在显示器人机界面上输入对调度端前置机发送的远方操作许可或者不许可的指令。
  6. 根据权利要求3所述的一种基于报文置换的电网调度远方操作安全许可方法，其特征在于，所述操作安全控制模块对对上通信网口和对下通信网口之间的原始报文进行识别和转发，包括：
    如果收到对远方操作的许可指令，则在对上通信网口和对下通信网口之间双向直接转发原始报文，不做任何修改；
    如果收到对远方操作的不许可指令，则对对上通信网口向对下通信网口发送的原始报文进行应用层分析，识别是否为操作报文；
    如果是非操作报文，则不做任何修改直接转发原始报文；
    如果是操作报文，则将应用层数据段内容全部修正置换为零字符，并保持操作报文的字节数长度不变，重新计算TCP校验值，将修正置零后的操作报文继续向对下通信网口转发。
  7. 根据权利要求6所述的一种基于报文置换的电网调度远方操作安全许可方法，其特征在于，所述对对上通信网口向对下通信网口发送的原始报文进行应用层分析，识别是否为操作报文，包括：根据具体的通信报文规约定义对报文应用层数据段中内容是否为操作指令进行鉴别，如果是操作指令则识别为操作报文，如果不是操作指令则识别为非操作报文。
  8. 根据权利要求6所述的一种基于报文置换的电网调度远方操作安全许可方法，其特征在于，对不许可的操作报文在其他网络协议层保持原始报文不变转发。
  9. 根据权利要求6所述的一种基于报文置换的电网调度远方操作安全许可方法，其特征在于，对于对下通信网口向对上通信网口转发的报文始终保持直接转发原始报文，不做任何修改。
PCT/CN2020/078907 2019-10-09 2020-03-12 一种基于报文置换的电网调度远方操作安全许可方法 WO2021068453A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910952642.4A CN110768965B (zh) 2019-10-09 2019-10-09 一种基于报文置换的电网调度远方操作安全许可方法
CN201910952642.4 2019-10-09

Publications (1)

Publication Number Publication Date
WO2021068453A1 true WO2021068453A1 (zh) 2021-04-15

Family

ID=69331183

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/078907 WO2021068453A1 (zh) 2019-10-09 2020-03-12 一种基于报文置换的电网调度远方操作安全许可方法

Country Status (2)

Country Link
CN (1) CN110768965B (zh)
WO (1) WO2021068453A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114094702A (zh) * 2021-11-16 2022-02-25 国网福建省电力有限公司 电网调度指令全场景一键执行方法
CN114844676A (zh) * 2022-04-02 2022-08-02 国网湖北省电力有限公司 一种电力监控系统网络安全威胁应急处置系统及方法

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110768965B (zh) * 2019-10-09 2021-12-10 南京南瑞继保电气有限公司 一种基于报文置换的电网调度远方操作安全许可方法
CN112187729A (zh) * 2020-09-08 2021-01-05 南京南瑞继保电气有限公司 一种操作许可安全管控系统及方法

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107018134A (zh) * 2017-04-06 2017-08-04 北京中电普华信息技术有限公司 一种配电终端安全接入平台及其实现方法
US20170352245A1 (en) * 2016-06-06 2017-12-07 Intertrust Technologies Corporation Anomaly detection systems and methods
CN109981568A (zh) * 2019-02-15 2019-07-05 中国南方电网有限责任公司 一种基于双通道身份认证的变电站远方操作安全防护方法
CN110768965A (zh) * 2019-10-09 2020-02-07 南京南瑞继保电气有限公司 一种基于报文置换的电网调度远方操作安全许可方法

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104065485A (zh) * 2014-07-04 2014-09-24 中国南方电网有限责任公司 电网调度移动平台安全保障管控方法
CN105721490A (zh) * 2015-07-01 2016-06-29 北京东润环能科技股份有限公司 智能采集终端、主站系统及其数据处理方法
CN109391659B (zh) * 2017-08-10 2021-03-30 南京南瑞继保电气有限公司 一种远方实时监控方法及系统
CN108965326A (zh) * 2018-08-21 2018-12-07 南京国电南自电网自动化有限公司 一种基于用户身份认证的主子站安全通信控制方法和系统
CN109103986A (zh) * 2018-08-27 2018-12-28 南京南瑞继保电气有限公司 变电站远方操作安全防护方法及系统

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20170352245A1 (en) * 2016-06-06 2017-12-07 Intertrust Technologies Corporation Anomaly detection systems and methods
CN107018134A (zh) * 2017-04-06 2017-08-04 北京中电普华信息技术有限公司 一种配电终端安全接入平台及其实现方法
CN109981568A (zh) * 2019-02-15 2019-07-05 中国南方电网有限责任公司 一种基于双通道身份认证的变电站远方操作安全防护方法
CN110768965A (zh) * 2019-10-09 2020-02-07 南京南瑞继保电气有限公司 一种基于报文置换的电网调度远方操作安全许可方法

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114094702A (zh) * 2021-11-16 2022-02-25 国网福建省电力有限公司 电网调度指令全场景一键执行方法
CN114094702B (zh) * 2021-11-16 2024-03-08 国网福建省电力有限公司 电网调度指令全场景一键执行方法
CN114844676A (zh) * 2022-04-02 2022-08-02 国网湖北省电力有限公司 一种电力监控系统网络安全威胁应急处置系统及方法
CN114844676B (zh) * 2022-04-02 2023-12-05 国网湖北省电力有限公司 一种电力监控系统网络安全威胁应急处置系统及方法

Also Published As

Publication number Publication date
CN110768965A (zh) 2020-02-07
CN110768965B (zh) 2021-12-10

Similar Documents

Publication Publication Date Title
WO2021068453A1 (zh) 一种基于报文置换的电网调度远方操作安全许可方法
CN110996318B (zh) 一种变电站智能巡检机器人安全通信接入系统
US9118716B2 (en) Computer system, controller and network monitoring method
JP3954385B2 (ja) 迅速なパケット・フィルタリング及びパケット・プロセシングのためのシステム、デバイス及び方法
CN104539600B (zh) 一种支持过滤iec104协议的工控防火墙实现方法
CN106060003A (zh) 一种网络边界单向隔离传输装置
CN104519065B (zh) 一种支持过滤Modbus TCP协议的工控防火墙实现方法
CN110337799A (zh) 具有车辆内部的数据网络的机动车以及运行机动车的方法
CN105847251B (zh) 采用s7协议的工控系统安全防护方法及系统
WO2016127555A1 (zh) 控制应用程序权限的方法及控制器
CN112787959B (zh) 一种流量调度方法和系统
US20060191006A1 (en) Denial-of-service-attack protecting method, denial-of-service attack protecting system, denial-of-service attack protecting device, repeater, denial-of-service attack protecting program, and program for repeater
US20130275620A1 (en) Communication system, control apparatus, communication method, and program
CN102217248B (zh) 分布式分组流检查和处理
CN106230640A (zh) 一种安全规则端口配置方法和设备
CN109167774B (zh) 一种数据报文及在防火墙上的数据流安全互访方法
KR102412933B1 (ko) 소프트웨어 정의 네트워크 기반 망 분리 서비스를 제공하는 시스템 및 방법
CN108206828A (zh) 一种双重监测安全控制方法及系统
KR20160036182A (ko) 레거시 네트워크 프로토콜 기능과 ｓｄｎ 기능이 하이브리드하게 동작하는 오픈플로우 동작 방법
CN108810009B (zh) 一种l2tp数据处理方法、设备及系统
CN111585972B (zh) 面向网闸的安全防护方法、装置及网络系统
CN106358188A (zh) 一种链路切换方法、装置及系统
CN112187729A (zh) 一种操作许可安全管控系统及方法
US20170331838A1 (en) Methods and computing devices to regulate packets in a software defined network
JP2018064228A (ja) パケット制御装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20874021

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20874021

Country of ref document: EP

Kind code of ref document: A1