CN113132976A - Differential protection method and system for distributed wireless communication power distribution network - Google Patents

Differential protection method and system for distributed wireless communication power distribution network Download PDF

Info

Publication number
CN113132976A
CN113132976A CN202110512177.XA CN202110512177A CN113132976A CN 113132976 A CN113132976 A CN 113132976A CN 202110512177 A CN202110512177 A CN 202110512177A CN 113132976 A CN113132976 A CN 113132976A
Authority
CN
China
Prior art keywords
card
access gateway
secure
cpe terminal
safe
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
CN202110512177.XA
Other languages
Chinese (zh)
Other versions
CN113132976B (en
Inventor
王进帅
盖平
王文华
李志荣
章灵芝
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
State Grid Siji Location Service Co ltd
State Grid Information and Telecommunication Co Ltd
Original Assignee
State Grid Information and Telecommunication Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by State Grid Information and Telecommunication Co Ltd filed Critical State Grid Information and Telecommunication Co Ltd
Priority to CN202110512177.XA priority Critical patent/CN113132976B/en
Publication of CN113132976A publication Critical patent/CN113132976A/en
Application granted granted Critical
Publication of CN113132976B publication Critical patent/CN113132976B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
    • H—ELECTRICITY
    • H02—GENERATION; CONVERSION OR DISTRIBUTION OF ELECTRIC POWER
    • H02J—CIRCUIT ARRANGEMENTS OR SYSTEMS FOR SUPPLYING OR DISTRIBUTING ELECTRIC POWER; SYSTEMS FOR STORING ELECTRIC ENERGY
    • H02J13/00—Circuit arrangements for providing remote indication of network conditions, e.g. an instantaneous record of the open or closed condition of each circuitbreaker in the network; Circuit arrangements for providing remote control of switching means in a power distribution network, e.g. switching in and out of current consumers by using a pulse code signal carried by the network
    • H02J13/00006—Circuit arrangements for providing remote indication of network conditions, e.g. an instantaneous record of the open or closed condition of each circuitbreaker in the network; Circuit arrangements for providing remote control of switching means in a power distribution network, e.g. switching in and out of current consumers by using a pulse code signal carried by the network characterised by information or instructions transport means between the monitoring, controlling or managing units and monitored, controlled or operated power network element or electrical equipment
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/16—Implementing security features at a particular protocol layer
    • H04L63/168—Implementing security features at a particular protocol layer above the transport layer
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
    • Y02E—REDUCTION OF GREENHOUSE GAS [GHG] EMISSIONS, RELATED TO ENERGY GENERATION, TRANSMISSION OR DISTRIBUTION
    • Y02E60/00—Enabling technologies; Technologies with a potential or indirect contribution to GHG emissions mitigation
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y04—INFORMATION OR COMMUNICATION TECHNOLOGIES HAVING AN IMPACT ON OTHER TECHNOLOGY AREAS
    • Y04S—SYSTEMS INTEGRATING TECHNOLOGIES RELATED TO POWER NETWORK OPERATION, COMMUNICATION OR INFORMATION TECHNOLOGIES FOR IMPROVING THE ELECTRICAL POWER GENERATION, TRANSMISSION, DISTRIBUTION, MANAGEMENT OR USAGE, i.e. SMART GRIDS
    • Y04S40/00—Systems for electrical power generation, transmission, distribution or end-user application management characterised by the use of communication or information technologies, or communication or information technology specific aspects supporting them
    • Y04S40/12—Systems for electrical power generation, transmission, distribution or end-user application management characterised by the use of communication or information technologies, or communication or information technology specific aspects supporting them characterised by data transport means between the monitoring, controlling or managing units and monitored, controlled or operated electrical equipment
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y04—INFORMATION OR COMMUNICATION TECHNOLOGIES HAVING AN IMPACT ON OTHER TECHNOLOGY AREAS
    • Y04S—SYSTEMS INTEGRATING TECHNOLOGIES RELATED TO POWER NETWORK OPERATION, COMMUNICATION OR INFORMATION TECHNOLOGIES FOR IMPROVING THE ELECTRICAL POWER GENERATION, TRANSMISSION, DISTRIBUTION, MANAGEMENT OR USAGE, i.e. SMART GRIDS
    • Y04S40/00—Systems for electrical power generation, transmission, distribution or end-user application management characterised by the use of communication or information technologies, or communication or information technology specific aspects supporting them
    • Y04S40/12—Systems for electrical power generation, transmission, distribution or end-user application management characterised by the use of communication or information technologies, or communication or information technology specific aspects supporting them characterised by data transport means between the monitoring, controlling or managing units and monitored, controlled or operated electrical equipment
    • Y04S40/126—Systems for electrical power generation, transmission, distribution or end-user application management characterised by the use of communication or information technologies, or communication or information technology specific aspects supporting them characterised by data transport means between the monitoring, controlling or managing units and monitored, controlled or operated electrical equipment using wireless data transmission
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y04—INFORMATION OR COMMUNICATION TECHNOLOGIES HAVING AN IMPACT ON OTHER TECHNOLOGY AREAS
    • Y04S—SYSTEMS INTEGRATING TECHNOLOGIES RELATED TO POWER NETWORK OPERATION, COMMUNICATION OR INFORMATION TECHNOLOGIES FOR IMPROVING THE ELECTRICAL POWER GENERATION, TRANSMISSION, DISTRIBUTION, MANAGEMENT OR USAGE, i.e. SMART GRIDS
    • Y04S40/00—Systems for electrical power generation, transmission, distribution or end-user application management characterised by the use of communication or information technologies, or communication or information technology specific aspects supporting them
    • Y04S40/20—Information technology specific aspects, e.g. CAD, simulation, modelling, system security

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Power Engineering (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

The application provides a differential protection method and a differential protection system for a distributed wireless communication power distribution network. And the data of the differential protection device is encrypted by the safe TF card, the encrypted data is forwarded to the CPE terminal by the safe access gateway, and the data is not required to be encrypted and decrypted by the safe access gateway in the whole process, so that the time delay loss of data transmission is reduced, and the efficiency of differential protection is improved.

Description

Differential protection method and system for distributed wireless communication power distribution network
Technical Field
The application relates to the technical field of communication, in particular to a differential protection method and system for a distributed wireless communication power distribution network.
Background
With the access of a large number of distributed power sources, higher requirements are put on the fault handling capacity of the power distribution network. The traditional fault treatment of the power distribution network utilizes a differential protection scheme based on the low time delay characteristic of optical fibers, but the cost of laying the optical fibers in urban areas is high, and distribution points which are difficult to cover by the optical fibers exist.
As wireless communication technology matures, its characteristics of low latency, high bandwidth and no need for optical fiber cabling provide the potential for solving the above-mentioned problems.
However, the security of the current power distribution network differential protection scheme based on the wireless communication technology is low.
Disclosure of Invention
In order to solve the above technical problems, embodiments of the present application provide a distributed wireless communication power distribution network differential protection method and system, so as to achieve the purpose of ensuring the security of the differential protection method, and the technical scheme is as follows:
a differential protection method for a distributed wireless communication power distribution network comprises the following steps:
after the first CPE terminal is powered on, initializing a safety TF card of the first CPE terminal, and establishing connection with a safety access gateway in a mobile network;
the first CPE terminal negotiates with the safety access gateway to determine a target encryption algorithm of the safety TF card;
the first CPE terminal sends certificate information of the safe TF card to the safe access gateway, wherein the certificate information of the safe TF card comprises a decryption key of the safe TF card;
the secure access gateway at least sends a decryption key of the secure TF card and the target encryption algorithm to a second CPE terminal;
the first CPE terminal receives data from a first differential protection device and sends the data collected by the first differential protection device to the safe TF card;
the safety TF card encrypts data of the first differential protection device by using the target encryption algorithm and the encryption key to obtain encrypted data, and sends the encrypted data to the safety access gateway;
the security access gateway sends the encrypted data to the second CPE terminal;
and the second CPE terminal decrypts the encrypted data by using the target encryption algorithm and the decryption key to obtain the data of the first differential protection device.
Optionally, the negotiating between the first CPE terminal and the secure access gateway to determine the target encryption algorithm of the secure TF card includes:
the first CPE terminal sends a first message to the security access gateway, wherein the first message comprises an SSL protocol version number, an encryption suite, a key exchange algorithm and an MAC algorithm which are supported by the security TF card;
the security access gateway selects one SSL protocol version number, an encryption suite, a key exchange algorithm and an MAC algorithm from SSL protocol version numbers, encryption suites, key exchange algorithms and MAC algorithms supported by the security TF card as a target SSL protocol version number, a target encryption suite, a target key exchange algorithm and a target MAC algorithm, wherein the target encryption suite comprises a target encryption algorithm;
and the security access gateway sends a second message containing the target SSL protocol version number, the target encryption suite, the target key exchange algorithm and the target MAC algorithm to the first CPE terminal.
Optionally, the sending, by the first CPE terminal, the certificate information of the secure TF card to the secure access gateway includes:
and the first CPE terminal receives the certificate information of the safe access gateway and sends the certificate information of the safe TF card to the safe access gateway after verifying that the certificate information of the safe access gateway is legal.
Optionally, the sending, by the secure access gateway, at least the decryption key of the secure TF card and the target encryption algorithm to the second CPE terminal includes:
and the secure access gateway verifies the certificate information of the secure TF card, and at least sends a decryption key of the secure TF card and the target encryption algorithm to a second CPE terminal after verifying that the certificate information of the secure TF card is legal.
Optionally, after the secure access gateway sends at least the decryption key of the secure TF card and the target encryption algorithm to the second CPE terminal, the method further includes:
a network virtual server respectively allocates a first fixed IP address and a second fixed IP address to the first CPE terminal and the second CPE terminal from an internet protocol IP address pool of the network virtual server, wherein the first fixed IP address and the second fixed IP address belong to the same network segment;
the sending the encrypted data to the secure access gateway includes:
sending the encrypted data to the secure access gateway by using the first fixed IP address;
the sending, by the secure access gateway, the encrypted data to the second CPE terminal includes:
and the secure access gateway sends the encrypted data to the second CPE terminal by using the second fixed IP address.
Optionally, the method further includes:
the second CPE terminal sends the data collected by the first differential protection device to a second differential protection device;
and the second differential protection device carries out line fault detection according to the data collected by the first differential protection device and the data of the second differential protection device.
A distributed wireless communication distribution network differential protection system comprises: the system comprises a first CPE terminal, a safety TF card, a first differential protection device, a safety access gateway, a second CPE terminal and a second differential protection device;
the first CPE terminal is used for initializing a safe TF card after being electrified, establishing connection with a safe access gateway in a mobile network, negotiating with the safe access gateway, determining a target encryption algorithm of the safe TF card, and sending certificate information of the safe TF card to the safe access gateway, wherein the certificate information of the safe TF card comprises a decryption key of the safe TF card;
the secure access gateway is used for at least sending the decryption key of the secure TF card and the target encryption algorithm to a second CPE terminal;
the first CPE terminal is also used for receiving data from a first differential protection device and sending the data collected by the first differential protection device to the safe TF card;
the safety TF card is used for encrypting the data of the first differential protection device by using the target encryption algorithm and the encryption key to obtain encrypted data, and sending the encrypted data to the safety access gateway;
the secure access gateway is further configured to send the encrypted data to the second CPE terminal;
and the second CPE terminal is used for decrypting the encrypted data by using the target encryption algorithm and the decryption key to obtain the data of the first differential protection device.
Optionally, the first CPE terminal is specifically configured to send a first message to the secure access gateway, where the first message includes an SSL protocol version number, an encryption suite, a key exchange algorithm, and an MAC algorithm supported by the secure TF card;
the secure access gateway is specifically configured to:
selecting one SSL protocol version number, an encryption suite, a key exchange algorithm and an MAC algorithm from SSL protocol version numbers, encryption suites, key exchange algorithms and MAC algorithms supported by the secure TF card as a target SSL protocol version number, a target encryption suite, a target key exchange algorithm and a target MAC algorithm, wherein the target encryption suite comprises the target encryption algorithm;
and sending a second message containing the target SSL protocol version number, the target encryption suite, the target key exchange algorithm and the target MAC algorithm to the first CPE terminal.
Optionally, the first CPE terminal is specifically configured to:
and receiving the certificate information of the safe access gateway, and sending the certificate information of the safe TF card to the safe access gateway after verifying that the certificate information of the safe access gateway is legal.
Optionally, the secure access gateway is specifically configured to:
and verifying the certificate information of the safe TF card, and at least sending the decryption key of the safe TF card and the target encryption algorithm to a second CPE terminal after verifying that the certificate information of the safe TF card is legal.
Optionally, the system further includes:
the network virtual server is used for respectively allocating a first fixed IP address and a second fixed IP address to the first CPE terminal and the second CPE terminal from an internet protocol IP address pool of the network virtual server, and the first fixed IP address and the second fixed IP address belong to the same network segment;
the secure TF card is specifically configured to send the encrypted data to the secure access gateway by using the first fixed IP address;
the secure access gateway is specifically configured to send the encrypted data to the second CPE terminal using the second fixed IP address.
Optionally, the second CPE terminal is configured to send data collected by the first differential protection device to a second differential protection device;
and the second differential protection device is used for detecting the line fault according to the data acquired by the first differential protection device and the data of the second differential protection device.
Compared with the prior art, the beneficial effect of this application is:
in the application, the secure TF card is installed in the CPE terminal, and encrypts the data of the differential protection device through the secure TF card, and sends the encrypted data to another CPE terminal through the secure access gateway, so as to implement the secure transmission of the data of the differential protection device and ensure the security of the differential protection method.
And the data of the differential protection device is encrypted by the safe TF card, the encrypted data is forwarded to the CPE terminal by the safe access gateway, and the data is not required to be encrypted and decrypted by the safe access gateway in the whole process, so that the time delay loss of data transmission is reduced, and the efficiency of differential protection is improved.
Drawings
In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed to be used in the description of the embodiments are briefly introduced below, and it is obvious that the drawings in the following description are only some embodiments of the present application, and it is obvious for those skilled in the art to obtain other drawings based on these drawings without inventive labor.
FIG. 1 is a schematic diagram of a differential protection topology provided by an embodiment of the present application;
fig. 2 is a schematic flowchart of a differential protection method for a distributed wireless communication power distribution network according to embodiment 1 of the present application;
fig. 3 is a schematic flowchart of a differential protection method for a distributed wireless communication power distribution network according to embodiment 2 of the present application;
fig. 4 is a schematic flowchart of a differential protection method for a distributed wireless communication power distribution network according to embodiment 3 of the present application;
fig. 5 is a schematic flowchart of a differential protection method for a distributed wireless communication power distribution network according to embodiment 4 of the present application;
fig. 6 is a schematic flowchart of a differential protection method for a distributed wireless communication power distribution network according to embodiment 5 of the present application.
Detailed Description
The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application, and it is obvious that the described embodiments are only a part of the embodiments of the present application, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present application.
In order to make the aforementioned objects, features and advantages of the present application more comprehensible, the present application is described in further detail with reference to the accompanying drawings and the detailed description.
The differential protection method for the distributed wireless communication distribution network provided by the present application is described with reference to fig. 1 and fig. 2, where fig. 1 is a differential protection topology diagram, in fig. 1, 5G CPE1 may represent a first CPE terminal, and 5G CPE2 may represent a second CPE terminal, and it should be noted that fig. 1 is only an example and is not intended to limit the differential protection topology structure.
Referring to fig. 2, a schematic flowchart of a differential protection method for a distributed wireless communication power distribution network provided in embodiment 1 of the present application is shown in fig. 2, where the method may include, but is not limited to, the following steps:
step S11, after the first CPE terminal is powered on, the safety TF (TransFlash) card is initialized, and the connection is established with the safety access gateway in the mobile network.
After the first CPE terminal initializes the safe TF card, the first CPE terminal can send a PIN verification code to the safe TF card, and the safe TF card can verify the identity of the terminal based on the PIN verification code and prevent the SIM card of the terminal from being stolen.
The first CPE terminal establishes a connection with a secure access gateway in the mobile network, which may be understood as: the first CPE terminal starts an automatic dialing program, is connected to the mobile network from the air interface through the wireless communication module, and establishes connection with a security access gateway in the mobile network.
The wireless communication module can be, but is not limited to: 4G module or 5G module. In the case that the wireless communication module is a 4G module, the mobile network may be a 4G network. In the case that the wireless communication module is a 5G module, the mobile network may be a 5G network.
In this embodiment, the secure TF card may be, but is not limited to: and (4) a national network chip.
The first CPE terminal may be understood as a customer premises equipment, which may be a wireless repeater for transceiving data over a wireless network.
Step S12, the first CPE terminal negotiates with the secure access gateway to determine a target encryption algorithm of the secure TF card.
The target encryption algorithm may be, but is not limited to: and (4) a national network encryption algorithm.
The negotiating, by the first CPE terminal and the secure access gateway, to determine the target encryption algorithm of the secure TF card may include:
s1201, the first CPE terminal sends a first message to the security access gateway, wherein the first message comprises an SSL protocol version number, an encryption suite, a key exchange algorithm and an MAC algorithm which are supported by the security TF card.
The encryption suite supported by the secure TF card may include one or more encryption algorithms.
S1202, the security access gateway selects one SSL protocol version number, an encryption suite, a key exchange algorithm and an MAC algorithm from SSL protocol version numbers, encryption suites, key exchange algorithms and MAC algorithms supported by the security TF card as a target SSL protocol version number, a target encryption suite, a target key exchange algorithm and a target MAC algorithm, wherein the target encryption suite comprises a target encryption algorithm;
s1203, the secure access gateway sends a second message containing the target SSL protocol version number, the target encryption suite, the target key exchange algorithm and the target MAC algorithm to the first CPE terminal.
Step S13, the first CPE terminal sends the certificate information of the secure TF card to the secure access gateway, where the certificate information of the secure TF card includes a decryption key of the secure TF card.
And step S14, the secure access gateway at least sends the decryption key of the secure TF card and the target encryption algorithm to a second CPE terminal.
And step S15, the first CPE terminal receives data collected by the first differential protection device, and sends the data collected by the first differential protection device to the secure TF card.
In this embodiment, the first differential protection device collects data and sends the collected data to the first CPE terminal. The data collected by the first differential protection device includes, but is not limited to: current data and/or voltage data on the line.
And step S16, the secure TF card encrypts the data collected by the first differential protection device by using the target encryption algorithm and the encryption key to obtain encrypted data, and sends the encrypted data to the secure access gateway.
And step S17, the security access gateway sends the encrypted data to the second CPE terminal.
The second CPE terminal may be understood as a customer premises equipment, which may be a wireless forwarding device, for transceiving data over a wireless network.
And step S18, the second CPE terminal decrypts the encrypted data by using the target encryption algorithm and the decryption key to obtain the data acquired by the first differential protection device.
It should be noted that the first CPE terminal and the second CPE terminal are only used to distinguish two different CPE terminals, and are used to limit the types of the CPE terminals. The interaction process between any two CPE terminals can be referred to in the related description of steps S11-S18.
In the application, the secure TF card is installed in the CPE terminal, and encrypts the data of the differential protection device through the secure TF card, and sends the encrypted data to another CPE terminal through the secure access gateway, so as to implement the secure transmission of the data of the differential protection device and ensure the security of the differential protection method.
And the data of the differential protection device is encrypted by the safe TF card, the encrypted data is forwarded to the CPE terminal by the safe access gateway, and the data is not required to be encrypted and decrypted by the safe access gateway in the whole process, so that the time delay loss of data transmission is reduced, and the efficiency of differential protection is improved.
As another alternative embodiment of the present application, referring to fig. 3, a flowchart of an embodiment 2 of a distributed wireless communication power distribution network differential protection method provided by the present application is provided, where this embodiment mainly describes a refinement scheme of the distributed wireless communication power distribution network differential protection method described in the foregoing embodiment 1, and as shown in fig. 3, the method may include, but is not limited to, the following steps:
step S21, after the first CPE terminal is powered on, the secure TF card is initialized, and a connection is established with a secure access gateway in the mobile network.
Step S22, the first CPE terminal negotiates with the secure access gateway to determine a target encryption algorithm of the secure TF card.
The detailed procedures of steps S21-S22 can be found in the description related to steps S11-S12 in example 1.
Step S23, the first CPE terminal receives the certificate information of the secure access gateway, and after verifying that the certificate information of the secure access gateway is legal, sends the certificate information of the secure TF card to the secure access gateway, where the certificate information of the secure TF card includes a decryption key of the secure TF card.
Step S23 is a specific implementation manner of step S13 in example 1.
And step S24, the secure access gateway at least sends the decryption key of the secure TF card and the target encryption algorithm to a second CPE terminal.
And step S25, the first CPE terminal receives data from the first differential protection device, and sends the data collected by the first differential protection device to the secure TF card.
And step S26, the secure TF card encrypts the data of the first differential protection device by using the target encryption algorithm and the encryption key to obtain encrypted data, and sends the encrypted data to the secure access gateway.
And step S27, the security access gateway sends the encrypted data to the second CPE terminal.
And step S28, the second CPE terminal decrypts the encrypted data by using the target encryption algorithm and the decryption key to obtain data of the first differential protection device.
The detailed procedures of steps S24-S28 can be found in the description related to steps S14-S18 in example 1.
In this embodiment, the first CPE terminal receives the certificate information of the secure access gateway, and sends the certificate information of the secure TF card to the secure access gateway after verifying that the certificate information of the secure access gateway is legal, so that the security of the differential protection method can be further improved.
As another alternative embodiment of the present application, referring to fig. 4, a flowchart of an embodiment 3 of a distributed wireless communication power distribution network differential protection method provided by the present application is provided, where this embodiment mainly describes a refinement scheme of the distributed wireless communication power distribution network differential protection method described in the foregoing embodiment 2, and as shown in fig. 4, the method may include, but is not limited to, the following steps:
step S31, after the first CPE terminal is powered on, the secure TF card is initialized, and a connection is established with a secure access gateway in the mobile network.
Step S32, the first CPE terminal negotiates with the secure access gateway to determine a target encryption algorithm of the secure TF card.
Step S33, the first CPE terminal receives the certificate information of the secure access gateway, and after verifying that the certificate information of the secure access gateway is legal, sends the certificate information of the secure TF card to the secure access gateway, where the certificate information of the secure TF card includes a decryption key of the secure TF card.
The detailed procedures of steps S31-S33 can be referred to the related descriptions of steps S21-S23 in embodiment 2, and are not described herein again.
Step S34, the security access gateway verifies the certificate information of the security TF card, and after the certificate information of the security TF card is verified to be legal, at least the decryption key of the security TF card and the target encryption algorithm are sent to the second CPE terminal.
Step S34 is a specific implementation manner of step S24 in example 2.
And step S35, the first CPE terminal receives data from the first differential protection device, and sends the data collected by the first differential protection device to the secure TF card.
And step S36, the secure TF card encrypts the data of the first differential protection device by using the target encryption algorithm and the encryption key to obtain encrypted data, and sends the encrypted data to the secure access gateway.
And step S37, the security access gateway sends the encrypted data to the second CPE terminal.
And step S38, the second CPE terminal decrypts the encrypted data by using the target encryption algorithm and the decryption key to obtain data of the first differential protection device.
The detailed procedures of steps S35-S38 can be referred to the related descriptions of steps S25-S28 in embodiment 2, and are not described herein again.
In this embodiment, the first CPE terminal receives the certificate information of the secure access gateway, and after verifying that the certificate information of the secure access gateway is legal, sends the certificate information of the secure TF card to the secure access gateway, and after verifying that the certificate information of the secure TF card is legal, the secure access gateway sends at least a decryption key of the secure TF card and the target encryption algorithm to the second CPE terminal, which may further improve the security of the differential protection method.
As another alternative embodiment of the present application, referring to fig. 5, a flowchart of an embodiment 4 of a distributed wireless communication power distribution network differential protection method provided by the present application is provided, where this embodiment mainly is an extension of the distributed wireless communication power distribution network differential protection method described in the foregoing embodiment 1, and as shown in fig. 5, the method may include, but is not limited to, the following steps:
step S41, after the first CPE terminal is powered on, the secure TF card is initialized, and a connection is established with a secure access gateway in the mobile network.
Step S42, the first CPE terminal negotiates with the secure access gateway to determine a target encryption algorithm of the secure TF card.
Step S43, the first CPE terminal sends the certificate information of the secure TF card to the secure access gateway, where the certificate information of the secure TF card includes a decryption key of the secure TF card.
And step S44, the secure access gateway at least sends the decryption key of the secure TF card and the target encryption algorithm to a second CPE terminal.
The detailed procedures of steps S41-S44 can be found in the related descriptions of steps S11-S14 in embodiment 1, and are not repeated herein.
Step S45, the network virtual server allocates a first fixed IP address and a second fixed IP address to the first CPE terminal and the second CPE terminal from its own IP address pool.
The first fixed IP (internet protocol) address and the second fixed IP address belong to the same network segment.
And step S46, the first CPE terminal receives data from the first differential protection device, and sends the data collected by the first differential protection device to the secure TF card.
The detailed process of step S46 can be referred to the related description of step S15 in embodiment 1, and is not repeated here.
And step S47, the secure TF card encrypts the data of the first differential protection device by using the target encryption algorithm and the encryption key to obtain encrypted data, and sends the encrypted data to the secure access gateway by using the first fixed IP address.
In this embodiment, step S47 is a specific implementation manner of step S16 in embodiment 1.
Step S48, the secure access gateway sends the encrypted data to the second CPE terminal by using the second fixed IP address.
Step S48 is a specific implementation manner of step S17 in example 1.
And step S49, the second CPE terminal decrypts the encrypted data by using the target encryption algorithm and the decryption key to obtain data of the first differential protection device.
In the embodiment, the network virtual server is used for distributing the fixed IP address for the CPE terminal, so that the reliability of the service is ensured, and the implementation cost of the scheme is reduced.
As another alternative embodiment of the present application, referring to fig. 6, a flowchart of an embodiment 5 of a distributed wireless communication power distribution network differential protection method provided by the present application is provided, where this embodiment mainly is an extension of the distributed wireless communication power distribution network differential protection method described in the foregoing embodiment 1, and as shown in fig. 6, the method may include, but is not limited to, the following steps:
step S51, after the first CPE terminal is powered on, the secure TF card is initialized, and a connection is established with a secure access gateway in the mobile network.
Step S52, the first CPE terminal negotiates with the secure access gateway to determine a target encryption algorithm of the secure TF card.
Step S53, the first CPE terminal sends the certificate information of the secure TF card to the secure access gateway, where the certificate information of the secure TF card includes a decryption key of the secure TF card.
And step S54, the secure access gateway at least sends the decryption key of the secure TF card and the target encryption algorithm to a second CPE terminal.
And step S55, the first CPE terminal receives data from the first differential protection device, and sends the data collected by the first differential protection device to the secure TF card.
And step S56, the secure TF card encrypts the data of the first differential protection device by using the target encryption algorithm and the encryption key to obtain encrypted data, and sends the encrypted data to the secure access gateway.
And step S57, the security access gateway sends the encrypted data to the second CPE terminal.
And step S58, the second CPE terminal decrypts the encrypted data by using the target encryption algorithm and the decryption key to obtain data of the first differential protection device.
The detailed procedures of steps S51-S58 can be found in the related descriptions of steps S11-S18 in embodiment 1, and are not repeated herein.
And step S59, the second CPE terminal sends the data collected by the first differential protection device to a second differential protection device.
And step S510, the second differential protection device carries out line fault detection according to the data collected by the first differential protection device and the data of the second differential protection device.
Line fault detection may be performed, and may include, but is not limited to: and detecting the current abrupt change.
When a line fault is detected, the second differential protection device acts rapidly to remove the fault and protect equipment.
Next, a distributed wireless communication power distribution network differential protection system provided by the present application is introduced, and the distributed wireless communication power distribution network differential protection system described below and the distributed wireless communication power distribution network differential protection method described above may be referred to correspondingly.
Distributed wireless communication distribution network differential protection system includes: the system comprises a first CPE terminal, a safety TF card, a first differential protection device, a safety access gateway, a second CPE terminal and a second differential protection device.
The first CPE terminal is used for initializing a safe TF card after being electrified, establishing connection with a safe access gateway in a mobile network, negotiating with the safe access gateway, determining a target encryption algorithm of the safe TF card, and sending certificate information of the safe TF card to the safe access gateway, wherein the certificate information of the safe TF card comprises a decryption key of the safe TF card;
the secure access gateway is used for at least sending the decryption key of the secure TF card and the target encryption algorithm to a second CPE terminal;
the first CPE terminal is also used for receiving data from a first differential protection device and sending the data collected by the first differential protection device to the safe TF card;
the safety TF card is used for encrypting the data of the first differential protection device by using the target encryption algorithm and the encryption key to obtain encrypted data, and sending the encrypted data to the safety access gateway;
the secure access gateway is further configured to send the encrypted data to the second CPE terminal;
and the second CPE terminal is used for decrypting the encrypted data by using the target encryption algorithm and the decryption key to obtain the data of the first differential protection device.
In this embodiment, the first CPE terminal is specifically configured to send a first message to the secure access gateway, where the first message includes an SSL protocol version number, an encryption suite, a key exchange algorithm, and an MAC algorithm that are supported by the secure TF card;
the secure access gateway is specifically configured to:
selecting one SSL protocol version number, an encryption suite, a key exchange algorithm and an MAC algorithm from SSL protocol version numbers, encryption suites, key exchange algorithms and MAC algorithms supported by the secure TF card as a target SSL protocol version number, a target encryption suite, a target key exchange algorithm and a target MAC algorithm, wherein the target encryption suite comprises the target encryption algorithm;
and sending a second message containing the target SSL protocol version number, the target encryption suite, the target key exchange algorithm and the target MAC algorithm to the first CPE terminal.
The first CPE terminal may specifically be configured to:
and receiving the certificate information of the safe access gateway, and sending the certificate information of the safe TF card to the safe access gateway after verifying that the certificate information of the safe access gateway is legal.
The secure access gateway may be specifically configured to:
and verifying the certificate information of the safe TF card, and at least sending the decryption key of the safe TF card and the target encryption algorithm to a second CPE terminal after verifying that the certificate information of the safe TF card is legal.
In this embodiment, the system may further include:
the network virtual server is used for respectively allocating a first fixed IP address and a second fixed IP address to the first CPE terminal and the second CPE terminal from an internet protocol IP address pool of the network virtual server, and the first fixed IP address and the second fixed IP address belong to the same network segment;
the secure TF card is specifically configured to send the encrypted data to the secure access gateway by using the first fixed IP address;
the secure access gateway is specifically configured to send the encrypted data to the second CPE terminal using the second fixed IP address.
The second CPE terminal may be configured to send data collected by the first differential protection device to a second differential protection device;
the second differential protection device may be configured to perform line fault detection according to the data collected by the first differential protection device and the data of the second differential protection device.
It should be noted that each embodiment is mainly described as a difference from the other embodiments, and the same and similar parts between the embodiments may be referred to each other. For the device-like embodiment, since it is basically similar to the method embodiment, the description is simple, and for the relevant points, reference may be made to the partial description of the method embodiment.
Finally, it should also be noted that, herein, relational terms such as first and second, and the like may be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Also, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising an … …" does not exclude the presence of other identical elements in a process, method, article, or apparatus that comprises the element.
For convenience of description, the above devices are described as being divided into various units by function, and are described separately. Of course, the functionality of the units may be implemented in one or more software and/or hardware when implementing the present application.
From the above description of the embodiments, it is clear to those skilled in the art that the present application can be implemented by software plus necessary general hardware platform. Based on such understanding, the technical solutions of the present application may be essentially or partially implemented in the form of a software product, which may be stored in a storage medium, such as a ROM/RAM, a magnetic disk, an optical disk, etc., and includes several instructions for enabling a computer device (which may be a personal computer, a server, or a network device, etc.) to execute the method according to the embodiments or some parts of the embodiments of the present application.
The method and the system for differential protection of the distributed wireless communication power distribution network provided by the application are introduced in detail, specific examples are applied in the method to explain the principle and the implementation mode of the application, and the description of the above embodiments is only used for helping to understand the method and the core idea of the application; meanwhile, for a person skilled in the art, according to the idea of the present application, there may be variations in the specific embodiments and the application scope, and in summary, the content of the present specification should not be construed as a limitation to the present application.

Claims (10)

1. A differential protection method for a distributed wireless communication power distribution network is characterized by comprising the following steps:
after the first CPE terminal is powered on, initializing a safety TF card of the first CPE terminal, and establishing connection with a safety access gateway in a mobile network;
the first CPE terminal negotiates with the safety access gateway to determine a target encryption algorithm of the safety TF card;
the first CPE terminal sends certificate information of the safe TF card to the safe access gateway, wherein the certificate information of the safe TF card comprises a decryption key of the safe TF card;
the secure access gateway at least sends a decryption key of the secure TF card and the target encryption algorithm to a second CPE terminal;
the first CPE terminal receives data from a first differential protection device and sends the data collected by the first differential protection device to the safe TF card;
the safety TF card encrypts data of the first differential protection device by using the target encryption algorithm and the encryption key to obtain encrypted data, and sends the encrypted data to the safety access gateway;
the security access gateway sends the encrypted data to the second CPE terminal;
and the second CPE terminal decrypts the encrypted data by using the target encryption algorithm and the decryption key to obtain the data of the first differential protection device.
2. The method of claim 1, wherein the first CPE terminal negotiates with the secure access gateway to determine a target encryption algorithm for the secure TF card, comprising:
the first CPE terminal sends a first message to the security access gateway, wherein the first message comprises an SSL protocol version number, an encryption suite, a key exchange algorithm and an MAC algorithm which are supported by the security TF card;
the security access gateway selects one SSL protocol version number, an encryption suite, a key exchange algorithm and an MAC algorithm from SSL protocol version numbers, encryption suites, key exchange algorithms and MAC algorithms supported by the security TF card as a target SSL protocol version number, a target encryption suite, a target key exchange algorithm and a target MAC algorithm, wherein the target encryption suite comprises a target encryption algorithm;
and the security access gateway sends a second message containing the target SSL protocol version number, the target encryption suite, the target key exchange algorithm and the target MAC algorithm to the first CPE terminal.
3. The method of claim 1, wherein sending certificate information of the secure TF card to the secure access gateway by the first CPE terminal comprises:
and the first CPE terminal receives the certificate information of the safe access gateway and sends the certificate information of the safe TF card to the safe access gateway after verifying that the certificate information of the safe access gateway is legal.
4. The method according to claim 3, wherein the secure access gateway sending at least the decryption key of the secure TF card and the target encryption algorithm to a second CPE terminal, comprises:
and the secure access gateway verifies the certificate information of the secure TF card, and at least sends a decryption key of the secure TF card and the target encryption algorithm to a second CPE terminal after verifying that the certificate information of the secure TF card is legal.
5. The method according to any of claims 1-4, wherein the secure access gateway further sends at least the decryption key of the secure TF card and the target encryption algorithm to the second CPE terminal, and further comprising:
a network virtual server respectively allocates a first fixed IP address and a second fixed IP address to the first CPE terminal and the second CPE terminal from an internet protocol IP address pool of the network virtual server, wherein the first fixed IP address and the second fixed IP address belong to the same network segment;
the sending the encrypted data to the secure access gateway includes:
sending the encrypted data to the secure access gateway by using the first fixed IP address;
the sending, by the secure access gateway, the encrypted data to the second CPE terminal includes:
and the secure access gateway sends the encrypted data to the second CPE terminal by using the second fixed IP address.
6. The method according to any one of claims 1-4, further comprising:
the second CPE terminal sends the data collected by the first differential protection device to a second differential protection device;
and the second differential protection device carries out line fault detection according to the data collected by the first differential protection device and the data of the second differential protection device.
7. The utility model provides a differential protection system of distributed wireless communication distribution network which characterized in that includes: the system comprises a first CPE terminal, a safety TF card, a first differential protection device, a safety access gateway, a second CPE terminal and a second differential protection device;
the first CPE terminal is used for initializing a safe TF card after being electrified, establishing connection with a safe access gateway in a mobile network, negotiating with the safe access gateway, determining a target encryption algorithm of the safe TF card, and sending certificate information of the safe TF card to the safe access gateway, wherein the certificate information of the safe TF card comprises a decryption key of the safe TF card;
the secure access gateway is used for at least sending the decryption key of the secure TF card and the target encryption algorithm to a second CPE terminal;
the first CPE terminal is also used for receiving data from a first differential protection device and sending the data collected by the first differential protection device to the safe TF card;
the safety TF card is used for encrypting the data of the first differential protection device by using the target encryption algorithm and the encryption key to obtain encrypted data, and sending the encrypted data to the safety access gateway;
the secure access gateway is further configured to send the encrypted data to the second CPE terminal;
and the second CPE terminal is used for decrypting the encrypted data by using the target encryption algorithm and the decryption key to obtain the data of the first differential protection device.
8. The system according to claim 7, wherein the first CPE terminal is specifically configured to send a first message to the secure access gateway, where the first message includes an SSL protocol version number, an encryption suite, a key exchange algorithm, and a MAC algorithm supported by the secure TF card;
the secure access gateway is specifically configured to:
selecting one SSL protocol version number, an encryption suite, a key exchange algorithm and an MAC algorithm from SSL protocol version numbers, encryption suites, key exchange algorithms and MAC algorithms supported by the secure TF card as a target SSL protocol version number, a target encryption suite, a target key exchange algorithm and a target MAC algorithm, wherein the target encryption suite comprises the target encryption algorithm;
and sending a second message containing the target SSL protocol version number, the target encryption suite, the target key exchange algorithm and the target MAC algorithm to the first CPE terminal.
9. The system of claim 7, wherein the first CPE terminal is specifically configured to:
and receiving the certificate information of the safe access gateway, and sending the certificate information of the safe TF card to the safe access gateway after verifying that the certificate information of the safe access gateway is legal.
10. The system of claim 9, wherein the secure access gateway is specifically configured to:
and verifying the certificate information of the safe TF card, and at least sending the decryption key of the safe TF card and the target encryption algorithm to a second CPE terminal after verifying that the certificate information of the safe TF card is legal.
CN202110512177.XA 2021-05-11 2021-05-11 Differential protection method and system for distributed wireless communication power distribution network Active CN113132976B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202110512177.XA CN113132976B (en) 2021-05-11 2021-05-11 Differential protection method and system for distributed wireless communication power distribution network

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202110512177.XA CN113132976B (en) 2021-05-11 2021-05-11 Differential protection method and system for distributed wireless communication power distribution network

Publications (2)

Publication Number Publication Date
CN113132976A true CN113132976A (en) 2021-07-16
CN113132976B CN113132976B (en) 2022-08-12

Family

ID=76781582

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202110512177.XA Active CN113132976B (en) 2021-05-11 2021-05-11 Differential protection method and system for distributed wireless communication power distribution network

Country Status (1)

Country Link
CN (1) CN113132976B (en)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113612666A (en) * 2021-08-27 2021-11-05 国网信息通信产业集团有限公司 Method and device for measuring time delay of power distribution network differential protection network
CN115314467A (en) * 2022-06-28 2022-11-08 国网信息通信产业集团有限公司 Data communication system and method based on distribution network differential protection

Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105634737A (en) * 2014-10-31 2016-06-01 腾讯科技（深圳）有限公司 Data transmission method, terminals and system thereof
WO2016177052A1 (en) * 2015-08-21 2016-11-10 中兴通讯股份有限公司 User authentication method and apparatus
CN106797560A (en) * 2014-11-17 2017-05-31 华为技术有限公司 Method, server, base station and communication system for configuring security parameter
WO2018043573A1 (en) * 2016-09-01 2018-03-08 日本電信電話株式会社 Key exchange method and key exchange system
CN107920097A (en) * 2016-10-09 2018-04-17 ***通信有限公司研究院 A kind of method and device of unlock
CN109547051A (en) * 2018-12-04 2019-03-29 国网江苏省电力有限公司电力科学研究院 A kind of CPE terminal, data flow transmission method and public private network switching method
CN110912920A (en) * 2019-12-03 2020-03-24 望海康信(北京)科技股份公司 Data processing method, apparatus and medium
CN111954211A (en) * 2020-09-07 2020-11-17 北京计算机技术及应用研究所 Novel authentication key negotiation system of mobile terminal

Patent Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105634737A (en) * 2014-10-31 2016-06-01 腾讯科技（深圳）有限公司 Data transmission method, terminals and system thereof
CN106797560A (en) * 2014-11-17 2017-05-31 华为技术有限公司 Method, server, base station and communication system for configuring security parameter
WO2016177052A1 (en) * 2015-08-21 2016-11-10 中兴通讯股份有限公司 User authentication method and apparatus
WO2018043573A1 (en) * 2016-09-01 2018-03-08 日本電信電話株式会社 Key exchange method and key exchange system
CN107920097A (en) * 2016-10-09 2018-04-17 ***通信有限公司研究院 A kind of method and device of unlock
CN109547051A (en) * 2018-12-04 2019-03-29 国网江苏省电力有限公司电力科学研究院 A kind of CPE terminal, data flow transmission method and public private network switching method
CN110912920A (en) * 2019-12-03 2020-03-24 望海康信(北京)科技股份公司 Data processing method, apparatus and medium
CN111954211A (en) * 2020-09-07 2020-11-17 北京计算机技术及应用研究所 Novel authentication key negotiation system of mobile terminal

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113612666A (en) * 2021-08-27 2021-11-05 国网信息通信产业集团有限公司 Method and device for measuring time delay of power distribution network differential protection network
CN115314467A (en) * 2022-06-28 2022-11-08 国网信息通信产业集团有限公司 Data communication system and method based on distribution network differential protection
CN115314467B (en) * 2022-06-28 2023-10-27 国网信息通信产业集团有限公司 Data communication system and method based on distribution network differential protection

Also Published As

Publication number Publication date
CN113132976B (en) 2022-08-12

Similar Documents

Publication Publication Date Title
CN107770182B (en) Data storage method of home gateway and home gateway
CN103416082B (en) Method for being authenticated using safety element to distant station
CN111277549B (en) Security service method and system adopting block chain
CN108462710B (en) Authentication and authorization method, device, authentication server and machine-readable storage medium
WO2014058166A1 (en) Data transmitting apparatus and method, and recording medium having program recorded thereon for executing said method on computer
CN113132976B (en) Differential protection method and system for distributed wireless communication power distribution network
CN108537666A (en) A kind of block catenary system and block chain network method of commerce
JP5536628B2 (en) Wireless LAN connection method, wireless LAN client, and wireless LAN access point
CN111092820B (en) Equipment node authentication method, device and system
CN111132305B (en) Method for 5G user terminal to access 5G network, user terminal equipment and medium
CN103905194A (en) Identity traceability authentication method and system
CN108347353A (en) Network collocating method, apparatus and system
CN112491829A (en) MEC platform identity authentication method and device based on 5G core network and block chain
CN108449735A (en) Method, car-mounted terminal, equipment and the computer readable storage medium of OTA communications
CN110716441A (en) Method for controlling intelligent equipment, intelligent home system, equipment and medium
CN100544253C (en) The safe re-authentication method of mobile terminal of wireless local area network
CN112950201A (en) Node management method and related device applied to block chain system
CN110602111B (en) Interface anti-brushing method and system based on long connection
CN114239072B (en) Block chain node management method and block chain network
KR20090002328A (en) Method for joining new device in wireless sensor network
CN110247905A (en) The data backup memory method and system of secure authentication mode based on Token
CN111756530A (en) Quantum service mobile engine system, network architecture and related equipment
CN105338020A (en) Business access method and device
JP2009217722A (en) Authentication processing system, authentication device, management device, authentication processing method, authentication processing program and management processing program
CN113965425A (en) Access method, device and equipment of Internet of things equipment and computer readable storage medium

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant
TR01 Transfer of patent right

Effective date of registration: 20231109

Address after: 102209 Beijing Changping District future science and Technology north city zone Smart Grid Research Institute C block 4 layer

Patentee after: STATE GRID INFORMATION & TELECOMMUNICATION GROUP Co.,Ltd.

Patentee after: State Grid Siji Location Service Co.,Ltd.

Address before: 102209 Beijing Changping District future science and Technology north city zone Smart Grid Research Institute C block 4 layer

Patentee before: STATE GRID INFORMATION & TELECOMMUNICATION GROUP Co.,Ltd.

TR01 Transfer of patent right