【作者】 廖建容；

【导师】 段斌；

【作者基本信息】 湘潭大学 ， 电力电子与电力传动， 2007， 硕士

【摘要】 变电站自动化程度发展到以太网通信条件下，变电站操作将是基于网络的访问过程，其防误措施将主要表现为对访问行为的规范，包括控制对象对访问权限的判定。由于口令简单、方便，在变电站自动化中得到了广泛应用，但容易泄露，且不能满足报文鉴别、加密等网络通信安全的需求。本文依据IEC 61850(变电站通信网络与系统)和IEC 62351(电力系统数据与通信安全)等国际标准确定的变电站自动化发展方向，从网络环境下变电站自动化操作防误的技术需求出发，采用SRP、SRP_TLS等基于口令的信息安全技术，研究变电站自动化身份认证、访问授权、报文鉴别、报文加密等通信安全技术，并进行了实验验证和仿真演示。研究内容如下：（1）研究基于IEC 61850的变电站自动化通信。IEC 61850中各IED（智能电子设备）之间的通信采取客户／服务器(C／S )和发布／订阅(P／S)两种通信模式。IEC 61850通过抽象通信服务接口根据不同的报文类型用特殊通信(SCSM)映射到具体的通信协议栈。不管是那种具体的通信协议栈在数据链路层均采用基于C S M A／C D的I E E E 8 0 2．3（即以太网）协议。（2）分析变电站通信安全需求以及相关安全技术。通过对变电站自动化特殊的通信环境以及通信安全的需求分析得出变电站需通过身份认证实现拒绝式访问攻击（资源耗尽），以及通过访问权限控制防止非法操作。在介绍相关的安全口令技术时比较了两种安全口令技术，得出安全远程口令（SR P )的身份鉴别机制其安全强度高，并且由于是基于口令的，其鉴别算法相比于公钥证书算法要简单得多。认证双方既不需要以任何形式存储密码，也不需要在公众网上传输密码。用户可以选择一个简单的密码用于身份认证而不必担心密码遭受字典攻击。（3）研究IEC 61850三种变电站实时通信（SMV、GOOSE、GSSE）的身份认证。设计了基于口令的变电站实时数据与通信安全认证方法。（4）对变电站中基于客户/服务器模式的通信进行分析，研究采用SRP与TLS相结合实现变电站基于TCP/IP的数据与通信安全认证。更多还原

【Abstract】 In the circumstance that substation automation develops an ethernet to communication , substation operation will be excuted through network . the anti_maloperation measure will mainly be expressed for norm of access behavior include judging the access privilege of control object .Because password is simple and convenient ,so it is use widely in substation automation ,however password is susceptible to be leaked out,and can not satified with the security need in which it can realize the message authentication,encryption and so on. Based on the orientation of SAS which is proposed by international standard IEC61850(Substation atomation communication)and IEC 62351(data and communication security in power system) ,and on the consideration of the anti-maloperation technology need in SAS through network. security measures based on password such as SRP and SRP_TLS are proposed to use in SAS,through which security need can be realized such as authentication,access authorization, message authentication, message encyption and so on. Research contents as follows:(1)Research substation automation systmem communication based on IEC 61850. In which information exchange of IEDs(intelligence electronics equipments) adopt Client/Server(C/S) and Pubish/Subscriber(P/S) two kinds of communication modes through Abstract Communication Services Interface. In IEC 61850 ACSI different message mapping to the correspondance communication protocol stack through SCSM .Whatever any communication stack, the data link level all adopt IEEE802.3(erthernet) with CSMA/CD。(2)The analyse the security need of substation communication and securitytechnique.Through analysing the special communication environment an authentication is necessary. Compared two kinds of top internation password techniques while introducing related security password techniques.It is concluded Security Remote Password(SRP) is a strong authentication mechanism. Because it is a password authentication ,it is simpler more than PKI. each side need not to save keys and not to transmit keys through network. The user can select a simple password but need not to worry about dictionary attack.(3) First research authentication is only necessary security measure of the realtime communication which include three messages (GOOSE, SMV,GSE)in IEC 61850 .then designed the authentication process base on SRP.(4)On the foundation of analyzing the security needs of Client/Server communication mode,the SRP_TLS is proposed to realize the security communication and designed the process.更多还原