Tampering,forgery and theft of the measurement and control messages in a smart grid could cause one breakdown in the power system.However,no security measures are employed for communications in intelligent substations.Communication services in an intelligent substation have high demands for real-time performance,which must be considered when deploying security measures.This paper studies the security requirements of communication services in intelligent substations,analyzes the security capabilities and shortages of IEC 62351,and proposes a novel security scheme for intelligent substation communications.This security scheme covers internal and telecontrol communications,in which the real-time performance of each security measure is considered.In this scheme,certificateless public key cryptography(CLPKC)is used to avoid the latency of certificate exchange in certificate-based cryptosystem and the problem of key escrow in identity-based cryptosystem;the security measures of generic object-oriented substation event,sampled measure value and manufacturing message specification in IEC 62351 are improved to meet the real-time requirements of the messages as well as to provide new security features to resist repudiation and replay attacks;and the security at transport layer is modified to fit CLPKC,which implements mutual authentication by exchanging signatures.Furthermore,a deployment of CLPKC in an intelligent substation is presented.We also evaluate the security properties of the scheme and analyze the end-to-end delays of secured services by combining theoretical calculation and simulation in this paper.The results indicate that the proposed scheme meets the requirements of security and real-time performance of communications in intelligent substations.
Jie ZHANGJun’e LIXiong CHENMing NITing WANGJianbo LUO
电力广域保护系统从点到点通信逐步走向网络化通信,如何在拥塞状态下保障业务的实时性和可靠性,成为亟待解决的问题.针对传输控制协议(Transmission control protocol,TCP)不能保障实时性以及用户数据报协议(User datagram protocol,UDP)不能保障可靠性的问题,本文提出一种联合应用层纠错、检错和重发机制的UDP传输方案,在提供低时延传输服务的同时也能保障报文的可靠性.考虑到算法的复杂性,选择本原BCH(Bose-Chaudhuri-Hocquenghem)码作为纠错编码算法,设计了编码分组方法,并通过实验验证了分组方法的正确性;对增加纠错机制后的报文实时性进行了理论分析和仿真验证;为了解决突发误码和丢包情况下的可靠性问题,进一步设计了应用层检错和重发机制,并分析了时延.分析表明,在应用层增加本文所设计的纠错、检错和重发机制后增加的时延几乎可以忽略不计.最后给出了所提方法的联合应用算法,并进行了可靠性分析,结果表明本文方案的可靠性高于其他UDP传输方案.
Security mechanism detection is not only an important content of vulnerabilities evaluation but also the foundation of key strength test for wireless local area network(WLAN). This paper analyzes the specifications of WLAN security mechanisms and points out the defects in design of security mechanisms detection algorithm based on the standards. By capturing and analyzing a large number of Beacon frames from different vendor's access points(APs),we summarize the relevant fields and information elements in a Beacon frame,and present their values or status when an AP is set to every specific security mechanism. A detection algorithm of WLAN security mechanisms is proposed based on the experimental study result and the pseudo code of a reference implementation for the algorithm is designed. The validity of the algorithm is illustrated by examples,which shows it can detect every WLAN security mechanism accurately.
LI JuneYUAN KaiZHOU LiangHAN LifangLI LingWANG ZhihaoLIU YinbinHUANG Wenbin
