基于IEC60870-5-104的配电自动化通信安全协议  

Security Protocol Based on IEC60870-5-104 for Communication in Distribution Automation

作　　者：马钧[1,2] 张一斌[2] 

机构地区：[1]电力系统安全运行与控制湖南省高校重点实验室(长沙理工大学),长沙410004 [2]长沙理工大学电气与信息工程学院,长沙410015

出　　处：《计算机科学》2013年第11期81-84,共4页Computer Science

基　　金：湖南省科技厅科技计划一般项目(2012GK3053)资助

摘　　要：基于IEC60870-5-104规约的配电自动化通信过程存在信息安全隐患。为了实现配电主站前置机和配电终端之间的相互身份认证和共享密钥建立,提出了一种基于单向数字签名和单向哈希认证码算法的安全协议,分析了配电自动化通信EPON网络的结构特点以及与之相应的信息安全威胁和安全需求,给出了协议的实现过程。协议考虑了配电终端的有限计算能力,配合使用专用的安全设备,不改变原有配电终端的软硬件。对协议的安全分析证明该协议能抵御外部攻击、重放攻击和假冒攻击。与已有的协议相比,新协议具有更高的安全性和较高的效率,能够满足实际的应用需求。It has been found that there are some cyber security risks in the communication process of distribution auto- marion system（DAS）based on IEC60870-5-104 protocol. In order to realize mutual authentication and shared key estab- lishment for DAS Front-End Processor（FEP）and any terminal, this article presented a scheme based on unidirectional digital signature and unidirectional Keyed-Hashing for Message Authentication（ HMAC） algorithm. It analyzed the fea- tures of communication network architecture based on EPON in DAS, the corresponding cyber security risks and securi- ty requirements, showed the implementation procedure of the scheme. The scheme needs not change original software and hardware of legacy terminals and considers resource-constraint terminals by using dedicated security devices. Securi- ty analysis proves that the scheme can resist outsider attack, replay attack and impersonation attack. Compared with the related works, the proposed scheme is more secure and practical, which can satisfy the application requirement.

关 键 词：配电自动化 网络安全 IEC60870-5-104规约 数字签名 HMAC算法 

分 类 号：TM76[电气工程—电力系统及自动化] TP393[自动化与计算机技术—计算机应用技术]