Aiming at problem of information security and precaution on protective control information of smart substation, this paper puts forward a three-defensive-line model for protective control information The model includes the first line focusing on invasion risk, the second line on propagation risk and the third line on invalidation risk. Furthermore, considering weak links of the second line, this paper proposes a security protection method and corresponding security data exchange model on propagation risk of protective control information, and establishes a simulation platform for this method. Simulation results show that this method can optimize message handling mechanism under normal circumstances, and guarantee reliable transmission of key message under abnormal situation. Therefore, the proposed security protection method can effectively raise anti-risk ability of smart substation.