Quantum security chip firmware design method, system, equipment and medium

Abstract

The invention discloses a quantum security chip firmware design method, system and device and a medium, and belongs to the technical field of power system communication. According to the quantum security chip firmware design method for the electric power data, encryption communication is realized by means of quantum by constructing a quantum random number generation model, a quantum key distribution protocol implementation model, a quantum encryption algorithm integration model and a firmware security protection model, and generation of'true random numbers' is truly realized; and meanwhile, various security protection mechanisms are adopted to guarantee the security of the firmware, so that the data security of the power system can be effectively improved. According to the invention, the unique advantages of quantum cryptography are utilized, and an efficient and safe quantum security chip for data encryption is designed, so that the high requirement of a power system on data security is met; and meanwhile, the quantum security chip adopts a quantum random number generator, a quantum key distribution protocol and a quantum encryption algorithm to ensure the confidentiality, integrity and authentication of data.

Description

Technical Field

[0001] The present invention relates to a quantum security chip firmware design method, system, device and medium, belonging to the technical field of power system communication. Background Art

[0002] With the rapid development of smart grids, the data security issues of power systems are becoming increasingly prominent. Traditional data encryption methods are facing the risk of being cracked, especially in the context of quantum computers becoming a reality, traditional asymmetric encryption algorithms such as RSA and ECC will no longer be secure.

[0003] Furthermore, the existing equipment communication information interaction security of the power system relies on the ESAM (Embedded Security Control Module) chip and its encryption algorithm. The chip uses a pre-charged key method to realize encrypted transmission of the power system communication network. ESAM uses a pseudo-random number generated by an algorithm as a session key, but this pseudo-random number can be cracked by computer calculations, so it does not truly realize the generation of "true random numbers", resulting in the inability to truly encrypt power information, affecting the data security of the power system.

[0004] The information disclosed in this Background Art is only for understanding the background of the inventive concept and therefore it may include information that does not constitute the prior art. Summary of the invention

[0005] In view of the above problems or one of the above problems, the first object of the present invention is to provide a quantum security chip firmware design method, system, device and medium, by constructing a quantum random number generation model, a quantum key distribution protocol implementation model, a quantum encryption algorithm integration model, and a firmware security protection model, using quantum to achieve encrypted communication, truly realize the generation of "true random numbers", so that power information is fully encrypted and protected, ensuring the security and confidentiality of data transmission. At the same time, a variety of security protection mechanisms are used to ensure the security of the firmware itself, thereby effectively improving the data security of the power system.

[0006] In response to the above problem or one of the above problems, the second object of the present invention is to provide a quantum security system, which uses a miniaturized quantum chip to achieve "unconditional" security of data communication in the power system; utilizes the unique advantages of quantum cryptography to design a quantum security chip with efficient and secure data encryption to meet the high requirements of the power system for data security; at the same time, the quantum security chip will adopt a quantum random number generator, a quantum key distribution protocol and a quantum encryption algorithm to ensure the confidentiality, integrity and authentication of the data, and thus the present invention can play an important role in the smart grid and provide strong support for the safe and stable operation of the power system.

[0007] To achieve one of the above purposes, the first technical solution of the present invention is:

[0008] A quantum security chip firmware design method for power data, comprising the following contents:

[0009] Through the pre-built quantum random number generation model, the power system random numbers are generated using the principles of quantum mechanics, making the power system random numbers impossible to predict or copy, and used for key generation and random number filling of encryption algorithms;

[0010] Using the pre-built quantum key distribution protocol implementation model, the key distribution method based on the principles of quantum mechanics can securely distribute power system keys on public channels and set up a power system key negotiation and update mechanism to adapt to the dynamic changes of the power system;

[0011] A pre-built quantum encryption algorithm integration model is used to integrate one or more quantum encryption algorithms to perform encryption operations on the power system random number and the power system key to obtain the power system encrypted random number and the power system encryption key;

[0012] Based on the pre-built firmware security protection model and utilizing the characteristics of the security chip, the entire life cycle management of the chip firmware is performed to complete the firmware design of the quantum security chip.

[0013] After continuous exploration and experimentation, the present invention uses quantum to achieve encrypted communication by constructing a quantum random number generation model, a quantum key distribution protocol implementation model, a quantum encryption algorithm integration model, and a firmware security protection model, and truly realizes the generation of "true random numbers", so that power information is fully encrypted and protected, ensuring the security and confidentiality of data transmission. At the same time, a variety of security protection mechanisms are used to ensure the security of the firmware itself, thereby effectively improving the data security of the power system.

[0014] As the preferred technical measures:

[0015] The quantum key distribution protocol implementation model is constructed using the BB84 protocol or the B92 protocol;

[0016] Or / and, the quantum encryption algorithm is a quantum one-time pad or a quantum key agreement algorithm.

[0017] As the preferred technical measures:

[0018] Based on the pre-built firmware security protection model and taking advantage of the characteristics of the security chip, the full life cycle management of the chip firmware is performed to complete the firmware design of the quantum security chip as follows:

[0019] First, the characteristics of the security chip, namely the fuse and the inherent security of the chip, are used to prevent the firmware from being tampered with or copied;

[0020] Secondly, manage the entire life cycle of the firmware, including firmware binding, authorization authentication, secure burning, secure loading and readback processes;

[0021] Finally, a secure isolation mechanism for key management and encryption algorithms is designed to ensure the security of keys and algorithms.

[0022] To achieve one of the above purposes, the second technical solution of the present invention is:

[0023] A quantum security system for electric power data, using the above-mentioned quantum security chip firmware design method for electric power data, comprising a quantum security chip, a CPU module, a key injection module, and an external FLASH module;

[0024] The quantum security chip includes a CPU core and an internal FLASH module, which together with an external FLASH module form a quantum security module, which is designed based on a quantum random number generation model, a quantum key distribution protocol implementation model, and a quantum encryption algorithm integration model;

[0025] The external FLASH module is used to store the injection key; the internal FLASH module is used to store the internal management information and save the imported quantum key plaintext;

[0026] The quantum security chip interacts with the CPU module in the form of an instruction set according to ESAM, and uses the key injection module to inject keys.

[0027] The present invention uses a miniaturized quantum chip to achieve "unconditional" security for data communication in the power system; utilizing the unique advantages of quantum cryptography, a quantum security chip for efficient and secure data encryption is designed to meet the high requirements of the power system for data security; at the same time, the quantum security chip is designed using a quantum random number generator, a quantum key distribution protocol, and a quantum encryption algorithm to ensure the confidentiality, integrity, and authentication of the data. Therefore, the present invention can play an important role in smart grids and provide strong support for the safe and stable operation of power systems.

[0028] As the preferred technical measures:

[0029] The quantum security module is equipped with several interactive interfaces, including the key injection USB interface, the debugging UART1 interface, the business serial port interface and the business SPI interface;

[0030] The quantum security chip includes a packaging and parsing unit, a network access authentication unit, a key application unit, a working mode switching unit, a token management unit, an index management unit, a cryptographic algorithm unit and a message processing unit;

[0031] Encapsulation and parsing unit, used for encapsulation and parsing of JSON format messages;

[0032] Network access authentication unit, used to initiate network access authentication to the secret service platform;

[0033] The key application unit is used to initiate a key application to the key service platform;

[0034] A working mode switching unit, used for switching working modes;

[0035] Token management unit, used for token management;

[0036] An index management unit, used to set a key position and a key index;

[0037] The cryptographic algorithm unit is used to set the standard 0017 protocol cryptographic algorithm;

[0038] The message processing unit is used to process the secret service platform messages.

[0039] To achieve one of the above purposes, the third technical solution of the present invention is:

[0040] A quantum security system for power data, using the above-mentioned quantum security chip firmware design method for power data, comprising a secret service platform, an edge security module, and an end security chip;

[0041] The cryptographic service platform is used to generate quantum keys and distribute quantum keys based on requests from edge security modules and / or end security chips;

[0042] The edge security module is equipped with multiple end security chips, which are distinguished and identified by the chip's own ID number;

[0043] The terminal security chip is designed based on the quantum random number generation model, quantum key distribution protocol implementation model, and quantum encryption algorithm integration model;

[0044] The edge security module and / or the end security chip initiates network access authentication to the cryptographic service platform and obtains the index Token;

[0045] Apply for quantum keys from the cryptographic service platform based on the index Token, and you can apply for quantum keys at will during the validity period of the index Token.

[0046] The present invention uses the unique advantages of quantum cryptography to design an efficient and secure data encryption chip to meet the high requirements of the power system for data security. The chip is designed using a quantum random number generator, a quantum key distribution protocol, and a quantum encryption algorithm to ensure the confidentiality, integrity, and authentication of the data.

[0047] As the preferred technical measures:

[0048] The edge security module or / and the end security chip is provided with a key injection unit, a session key import unit, a key management unit and an encryption and decryption unit;

[0049] Key charging unit: used to call standard interfaces according to key charging software instructions, perform interface authentication, generate random numbers, generate ECC signature key pairs, import ECC encryption key pairs, create applications, open applications, delete applications, create containers, open containers, delete containers, and read and write files;

[0050] Session key import unit: used to receive service CPU instructions to execute injection key plaintext acquisition operations and session key import operations;

[0051] The charging key plaintext acquisition operation: read the charging key ciphertext and return it to the CPU; decrypt the charging key ciphertext using the asymmetric key according to the CPU instruction and store it as a fixed index key;

[0052] Session key import operation: The CPU will obtain the session key ciphertext from the secret service platform, connect it with the plaintext index of the injection key to be used and the assigned session key ciphertext index, and send it to the quantum security module; the quantum security module uses the injection key plaintext corresponding to the index and the session key ciphertext to XOR, and then stores it according to the specified index.

[0053] Key management unit: used for encryption and decryption when no quantum key exists; due to the limited memory of the quantum security module, the first 300 quantum keys are cached in the memory and the last 600 groups are stored in the built-in FLASH;

[0054] Encryption unit: used to calculate the SM3 HASH of the data to be encrypted through the quantum security module; after the CPU fills the data according to the PKCS7padding algorithm, it sends the data to be encrypted, the data length, and the session key index to the quantum security module; the quantum security module calculates the data to be encrypted and searches for the session key according to the index, and then encrypts it through the SM4 ECB algorithm and returns the data ciphertext; the CPU performs ciphertext format encapsulation;

[0055] Decryption unit: used to send the data to be decrypted, data length, and session key index to the quantum security module. The quantum security module calculates the data to be encrypted and searches for the session key according to the index, then decrypts it through the SM4 ECB algorithm and returns the data plaintext; the CPU removes the padding data through PKCS7padding to obtain the valid data plaintext; the CPU calculates the data plaintext SM3 HASH through the quantum security module, compares it with the received data SM3 HASH, and returns the decryption result.

[0056] As the preferred technical measures:

[0057] The method to read FLASH information is as follows:

[0058] Step 1. Read FLASH to obtain the private key in the encrypted public and private keys;

[0059] Step 2. Read the total amount of key filling information: used to calculate the remaining key amount;

[0060] Step 3. Read the charging key information: file name, charging key file corresponding to the storage address in FLASH, single charging file size, key information size in the charging key file, the key file contains charging key, encrypted file, file size information, which is used for charging key to session key information conversion;

[0061] Step 4. Reading of unused key information: used to obtain the location of the key to be used and calculate the remaining key amount.

[0062] To achieve one of the above purposes, the fourth technical solution of the present invention is:

[0063] An electronic device comprising:

[0064] one or more processors;

[0065] A storage device for storing one or more programs;

[0066] When the one or more programs are executed by the one or more processors, the one or more processors implement the above-mentioned quantum security chip firmware design method for power data.

[0067] To achieve one of the above purposes, the fifth technical solution of the present invention is:

[0068] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the above-mentioned quantum security chip firmware design method for power data.

[0069] Compared with the prior art solutions, the present invention has the following beneficial effects:

[0070] After continuous exploration and experimentation, the present invention uses quantum to achieve encrypted communication by constructing a quantum random number generation model, a quantum key distribution protocol implementation model, a quantum encryption algorithm integration model, and a firmware security protection model, and truly realizes the generation of "true random numbers", so that power information is fully encrypted and protected, ensuring the security and confidentiality of data transmission. At the same time, a variety of security protection mechanisms are used to ensure the security of the firmware itself, thereby effectively improving the data security of the power system.

[0071] The present invention uses a miniaturized quantum chip to achieve "unconditional" security for data communication in the power system; utilizing the unique advantages of quantum cryptography, a quantum security chip for efficient and secure data encryption is designed to meet the high requirements of the power system for data security; at the same time, the quantum security chip is designed using a quantum random number generator, a quantum key distribution protocol, and a quantum encryption algorithm to ensure the confidentiality, integrity, and authentication of the data. Therefore, the present invention can play an important role in smart grids and provide strong support for the safe and stable operation of power systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0072] Figure 1 This is a schematic diagram of the first flow chart of the quantum security chip firmware design method of the present invention;

[0073] Figure 2 A schematic diagram of the quantum security system of the present invention;

[0074] Figure 3 A schematic diagram of the external interface of the quantum security module / chip of the present invention;

[0075] Figure 4 A schematic diagram of data interaction between the quantum security module of the present invention and the client application software;

[0076] Figure 5 Another schematic diagram of the structure of the quantum security system of the present invention;

[0077] Figure 6 A schematic diagram of a flow chart of reading FLASH information according to the present invention. DETAILED DESCRIPTION

[0078] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0079] On the contrary, the present invention covers any substitution, modification, equivalent method and scheme made on the essence and scope of the present invention as defined by the claims. Further, in order to make the public have a better understanding of the present invention, some specific details are described in detail in the following detailed description of the present invention. Those skilled in the art can fully understand the present invention without the description of these details.

[0080] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which the present invention pertains. The terms used herein are only for the purpose of describing specific embodiments and are not intended to limit the present invention. The term "or / and" as used herein includes any and all combinations of one or more of the associated listed items.

[0081] like Figure 1 As shown, the first specific embodiment of the quantum security chip firmware design method for power data of the present invention is:

[0082] A quantum security chip firmware design method for power data, comprising the following contents:

[0083] Through the pre-built quantum random number generation model, the power system random numbers are generated using the principles of quantum mechanics, making the power system random numbers impossible to predict or copy, and used for key generation and random number filling of encryption algorithms;

[0084] Using the pre-built quantum key distribution protocol implementation model, the key distribution method based on the principles of quantum mechanics can securely distribute power system keys on public channels and set up a power system key negotiation and update mechanism to adapt to the dynamic changes of the power system;

[0085] A pre-built quantum encryption algorithm integration model is used to integrate one or more quantum encryption algorithms to perform encryption operations on the power system random number and the power system key to obtain the power system encrypted random number and the power system encryption key;

[0086] Based on the pre-built firmware security protection model and utilizing the characteristics of the security chip, the entire life cycle management of the chip firmware is performed to complete the firmware design of the quantum security chip.

[0087] This paper proposes a quantum security chip firmware design method for power system data encryption, aiming to use the unique advantages of quantum cryptography to design an efficient and secure data encryption chip to meet the high requirements of power systems for data security. The chip will use a quantum random number generator, a quantum key distribution protocol, and a quantum encryption algorithm to ensure the confidentiality, integrity, and authentication of data.

[0088] In this embodiment: the quantum key distribution protocol implementation model is constructed using the BB84 protocol or the B92 protocol.

[0089] In this embodiment: the quantum encryption algorithm is a quantum one-time pad or a quantum key agreement algorithm.

[0090] In this embodiment: Based on the pre-built firmware security protection model, the characteristics of the security chip are used to manage the chip firmware throughout its life cycle, and the method for completing the firmware design of the quantum security chip is as follows:

[0091] First, the characteristics of the security chip, namely the fuse and the inherent security of the chip, are used to prevent the firmware from being tampered with or copied;

[0092] Secondly, manage the entire life cycle of the firmware, including firmware binding, authorization authentication, secure burning, secure loading and readback processes;

[0093] Finally, a secure isolation mechanism for key management and encryption algorithms is designed to ensure the security of keys and algorithms.

[0094] The first specific embodiment of the quantum security system for power data of the present invention:

[0095] A quantum security system for electric power data, using the above-mentioned quantum security chip firmware design method for electric power data, comprising a quantum security chip, a CPU module, a key injection module, and an external FLASH module;

[0096] The quantum security chip includes a CPU core and an internal FLASH module, which together with an external FLASH module form a quantum security module, which is designed based on a quantum random number generation model, a quantum key distribution protocol implementation model, and a quantum encryption algorithm integration model;

[0097] The external FLASH module is used to store the injection key; the internal FLASH module is used to store the internal management information and save the imported quantum key plaintext;

[0098] The quantum security chip interacts with the CPU module in the form of an instruction set according to ESAM, and uses the key injection module to inject keys.

[0099] In this embodiment: the quantum security module is provided with several interactive interfaces, including a key injection USB interface, a debugging UART1 interface, a service serial port interface and a service SPI interface;

[0100] The quantum security chip includes a packaging and parsing unit, a network access authentication unit, a key application unit, a working mode switching unit, a token management unit, an index management unit, a cryptographic algorithm unit and a message processing unit;

[0101] Encapsulation and parsing unit, used for encapsulation and parsing of JSON format messages;

[0102] Network access authentication unit, used to initiate network access authentication to the secret service platform;

[0103] The key application unit is used to initiate a key application to the key service platform;

[0104] A working mode switching unit, used for switching working modes;

[0105] Token management unit, used for token management;

[0106] An index management unit, used to set a key position and a key index;

[0107] The cryptographic algorithm unit is used to set the standard 0017 protocol cryptographic algorithm;

[0108] The message processing unit is used to process the secret service platform messages.

[0109] The second specific embodiment of the quantum security system for power data of the present invention:

[0110] A quantum security system for electric power data, using the above-mentioned quantum security chip firmware design method for electric power data, comprising a secret service platform, an edge security module, and an end security chip;

[0111] The cryptographic service platform is used to generate quantum keys and distribute quantum keys based on requests from edge security modules and / or end security chips;

[0112] The edge security module is equipped with multiple end security chips, which are distinguished and identified by the chip's own ID number;

[0113] The edge security module and / or the end security chip initiates network access authentication to the cryptographic service platform and obtains the index token;

[0114] Apply for quantum keys from the cryptographic service platform based on the index Token, and you can apply for quantum keys at will during the validity period of the index Token.

[0115] In this embodiment: the edge security module or / and the end security chip are provided with a key injection unit, a session key import unit, a key management unit and an encryption and decryption unit;

[0116] Key charging unit: used to call standard interfaces according to key charging software instructions, perform interface authentication, generate random numbers, generate ECC signature key pairs, import ECC encryption key pairs, create applications, open applications, delete applications, create containers, open containers, delete containers, and read and write files;

[0117] Session key import unit: used to receive service CPU instructions to execute injection key plaintext acquisition operations and session key import operations;

[0118] The charging key plaintext acquisition operation: read the charging key ciphertext and return it to the CPU; decrypt the charging key ciphertext using the asymmetric key according to the CPU instruction and store it as a fixed index key;

[0119] Session key import operation: The CPU will obtain the session key ciphertext from the secret service platform, connect it with the plaintext index of the injection key to be used and the assigned session key ciphertext index, and send it to the quantum security module; the quantum security module uses the injection key plaintext corresponding to the index and the session key ciphertext to XOR, and then stores it according to the specified index.

[0120] Key management unit: used for encryption and decryption when no quantum key exists; due to the limited memory of the quantum security module, the first 300 quantum keys are cached in the memory and the last 600 groups are stored in the built-in FLASH;

[0121] Encryption unit: used to calculate the SM3 HASH of the data to be encrypted through the quantum security module; after the CPU fills the data according to the PKCS7padding algorithm, it sends the data to be encrypted, the data length, and the session key index to the quantum security module; the quantum security module calculates the data to be encrypted and searches for the session key according to the index, and then encrypts it through the SM4 ECB algorithm and returns the data ciphertext; the CPU performs ciphertext format encapsulation;

[0122] Decryption unit: used to send the data to be decrypted, data length, and session key index to the quantum security module. The quantum security module calculates the data to be encrypted and searches for the session key according to the index, then decrypts it through the SM4 ECB algorithm and returns the data plaintext; the CPU removes the padding data through PKCS7padding to obtain the valid data plaintext; the CPU calculates the data plaintext SM3 HASH through the quantum security module, compares it with the received data SM3 HASH, and returns the decryption result.

[0123] The present invention uses miniaturized quantum chips to ensure the "unconditional" security of power system data communications.

[0124] The second specific embodiment of the quantum security chip firmware design method for power data of the present invention:

[0125] A quantum security chip firmware design method for power data includes quantum random number generator design, quantum key distribution protocol implementation, quantum encryption algorithm integration, and firmware security protection mechanism.

[0126] The design of quantum random number generator includes the following:

[0127] The quantum random number generator (QRNG) uses the principles of quantum mechanics to generate true random numbers that cannot be predicted or copied, so they can be used for key generation and random number filling in encryption algorithms. In the chip design, we will integrate an efficient QRNG module to provide high-quality random number output.

[0128] The quantum key distribution protocol is implemented, including the following:

[0129] The quantum key distribution (QKD) protocol is a key distribution method based on the principles of quantum mechanics, which can securely distribute keys over public channels. In chip design, we will implement a practical QKD protocol, such as the BB84 protocol or the B92 protocol, to ensure the secure distribution of keys. At the same time, we will also design the corresponding key negotiation and update mechanism to adapt to the dynamic changes of the power system.

[0130] Quantum encryption algorithm integration, including the following:

[0131] Quantum encryption algorithms (such as quantum one-time pad, quantum key agreement, etc.) are the core of quantum cryptography. In chip design, we will integrate one or more quantum encryption algorithms to provide efficient and secure data encryption services. These algorithms will use the random numbers generated by QRNG and the keys distributed by QKD to perform encryption operations to ensure the confidentiality of data.

[0132] Firmware security protection mechanism, including the following:

[0133] In order to ensure the security of the firmware itself, we will adopt a variety of security protection mechanisms. First, we will use the characteristics of the security chip, such as fuse burning and the inherent security of the chip, to prevent the firmware from being tampered with or copied. Secondly, we will implement the full life cycle management of the firmware, including firmware binding, authorization authentication, secure burning, secure loading and readback. Finally, we will also design a secure isolation mechanism for key management and encryption algorithms to ensure the security of keys and algorithms.

[0134] The third specific embodiment of the quantum security system for power data of the present invention:

[0135] A quantum security system for power data, comprising the following:

[0136] The quantum security chip is used with SDK. Its external FLASH is used to store the injection key, and the internal FLASH is used to store internal management information and save part of the imported quantum key plaintext. Its working composition is frame Figure 2 shown.

[0137] Quantum security module / chip external interface such as Figure 3 As shown, its interactive interface includes:

[0138] (1) Key charging USB interface (IF S1_01);

[0139] (2) Debug UART1 interface (IF S1_02);

[0140] (3) Service serial port interface (IF S1_03);

[0141] (4) Business SPI interface (IF S1_04).

[0142] like Figure 4 As shown in Figure 1, the quantum security module interacts with the client application software (terminal MCU). For specific data flows, see Table 1. The functions implemented are as follows:

[0143] 1) The module / chip itself has the function of encapsulating and parsing JSON format messages;

[0144] 2) The module / chip has the function of initiating network authentication to the secret service platform;

[0145] 3) The module / chip has the function of initiating a key application to the key service platform;

[0146] 4) The module / chip has the function of switching to working mode, is compatible with the power cloud edge function, and switches through working mode;

[0147] 5) The module / chip has token management function;

[0148] 6) The module / chip has key location and key index management functions;

[0149] 7) The module / chip has the standard 0017 protocol cryptographic algorithm function;

[0150] 8) The module has the function of identifying secret service message processing.

[0151] Table 1: Software external data flow

[0152] serial number Data Flow 1 Get chip ID 2 Preparing session keys 3 Encryption Instructions 4 Decryption Instructions 5 Check the remaining keys 6 View the session key HASH 7 Network authentication 8 Key application

[0153] Large-capacity quantum security modules and small-capacity quantum security chips still interact with the CPU in the form of an instruction set according to ESAM. When the equipment is deployed at the factory, it is pre-filled with the same quantum true random number (filling key) as the secret service platform to ensure one-time ciphertext communication with the secret service platform, including identity authentication and quantum key encryption transmission.

[0154] like Figure 5 As shown, the fourth specific embodiment of the quantum security system for power data of the present invention is:

[0155] A quantum security system for power data, comprising the following:

[0156] For edge modules and end chips, according to the power application scenario, multiple end chip devices are hung under the edge module in this embodiment. One edge module is compatible with up to 128 end chips, which are distinguished and identified by the chip's own ID number.

[0157] In this embodiment, the quantum security secret service platform is responsible for the generation of quantum keys and distributes quantum keys according to the request of the application device. The application device requests quantum keys in two steps: network authentication secret service platform, obtain token; apply for ciphertext quantum key from the secret service according to the token. Among them, the token has a validity period, and quantum keys can be applied for at will during the validity period.

[0158] In this embodiment, the implemented functions include key injection function, session key import function, key management function, encryption and decryption function, and decryption function.

[0159] Key charging function, including the following:

[0160] According to the key charging software instructions, call the standard interface, perform interface authentication, generate random numbers, generate ECC signature key pairs, import ECC encryption key pairs, create applications, open applications, delete applications, create containers, open containers, delete containers, and read and write files;

[0161] Session key import function, including the following:

[0162] The receiving service CPU instruction performs the following operations:

[0163] Obtaining the plaintext of the charging key: Reading the ciphertext of the charging key and returning it to the CPU; decrypting the ciphertext of the charging key using the asymmetric key according to the CPU instruction and storing it as a fixed index key;

[0164] Session key import, including the following:

[0165] The CPU will obtain the session key ciphertext from the secret service, connect it with the plaintext index of the injection key to be used and the assigned session key ciphertext index, and send it to the quantum security module; the quantum security module will XOR the injection key plaintext corresponding to the index with the session key ciphertext, and then store it according to the specified index.

[0166] Key management functions, including the following:

[0167] The quantum security module has 32 sets of non-quantum session keys built in, which are used for encryption and decryption when there is no quantum key. Due to the limited memory of the quantum security module, the first 300 quantum keys are cached in the memory, and the last 600 sets are stored in the built-in FLASH.

[0168] Encryption and decryption functions include the following:

[0169] Encryption function: The CPU calculates the SM3 HASH of the data to be encrypted through the quantum security module; after the CPU fills the data according to the PKCS7padding algorithm, it sends the data to be encrypted, the data length, and the session key index to the quantum security module; the quantum security module calculates the data to be encrypted and searches for the session key according to the index, and then encrypts it through the SM4 ECB algorithm and returns the data ciphertext; the CPU performs ciphertext format encapsulation;

[0170] Decryption functions include the following:

[0171] The CPU sends the data to be decrypted, data length, and session key index to the quantum security module. The quantum security module calculates the data to be encrypted and searches for the session key according to the index, then decrypts it through the SM4 ECB algorithm and returns the data plaintext. The CPU removes the padding data through PKCS7padding to obtain the valid data plaintext. The CPU calculates the data plaintext SM3 HASH through the quantum security module, compares it with the received data SM3 HASH, and returns the decryption result.

[0172] In this embodiment, Figure 6 As shown, read the FLASH information according to the following process:

[0173] Step 1. Read FLASH to obtain the private key in the encrypted public and private keys;

[0174] Step 2. Read the total amount of key filling information: used to calculate the remaining key amount;

[0175] Step 3. Read the charging key information: file name, charging key file corresponding to the storage address in FLASH, single charging file size, key information size in the charging key file (Note: the key file contains charging key, encrypted file, file size and other information), used for charging key to session key information conversion;

[0176] Step 4. Reading of unused key information: used to obtain the location of the key to be used and calculate the remaining key amount.

[0177] The quantum security chip firmware design method and chip proposed in this invention for power system data encryption will provide a new solution for power system data security. With the continuous development and maturity of quantum technology, the chip will play an important role in smart grids and provide strong support for the safe and stable operation of power systems.

[0178] An embodiment of a device applying the method of the present invention:

[0179] An electronic device comprising:

[0180] one or more processors;

[0181] A storage device for storing one or more programs;

[0182] When the one or more programs are executed by the one or more processors, the one or more processors implement the above-mentioned quantum security chip firmware design method for power data.

[0183] A computer medium embodiment using the method of the present invention:

[0184] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the above-mentioned quantum security chip firmware design method for power data.

[0185] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, and computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, optical storage, etc.) containing computer-usable program codes.

[0186] The present application is described by flowcharts or / and block diagrams of the methods, devices (systems), and computer program products of the embodiments of the present application. It should be understood that each process or / and block in the flowchart or / and block diagram and the combination of the processes or / and blocks in the flowchart or / and block diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart or / and block diagram. Figure 1 Process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0187] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 Process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0188] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 Process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0189] The model in this application is an object that objectively describes the morphological structure with the help of physical or virtual representation. The object is not equal to the object and is not limited to physical and virtual. It can be a data processing function, software program, processing mode, usage method, operation method, workflow, application process, electronic hardware, circuit module, processing system, system imitation or simulation object.

[0190] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field can still modify or replace the specific implementation methods of the present invention with equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be included in the scope of protection of the claims of the present invention.

Claims

1. A quantum security chip firmware design method for power data, characterized by: Includes the following: Through the pre-built quantum random number generation model, the power system random numbers are generated using the principles of quantum mechanics, making the power system random numbers impossible to predict or copy, and used for key generation and random number filling of encryption algorithms; Using the pre-built quantum key distribution protocol implementation model, the key distribution method based on the principles of quantum mechanics can securely distribute power system keys on public channels and set up a power system key negotiation and update mechanism to adapt to the dynamic changes of the power system; A pre-built quantum encryption algorithm integration model is used to integrate one or more quantum encryption algorithms to perform encryption operations on the power system random number and the power system key to obtain the power system encrypted random number and the power system encryption key; Based on the pre-built firmware security protection model and utilizing the characteristics of the security chip, the entire life cycle management of the chip firmware is performed to complete the firmware design of the quantum security chip.

2. A quantum security chip firmware design method for power data according to claim 1, characterized in that: The quantum key distribution protocol implementation model is constructed using the BB84 protocol or the B92 protocol; Or / and, the quantum encryption algorithm is a quantum one-time pad or a quantum key agreement algorithm.

3. A quantum security chip firmware design method for power data as claimed in claim 1, characterized in that: Based on the pre-built firmware security protection model and taking advantage of the characteristics of the security chip, the full life cycle management of the chip firmware is performed to complete the firmware design of the quantum security chip as follows: First, the characteristics of the security chip, namely the fuse and the inherent security of the chip, are used to prevent the firmware from being tampered with or copied; Secondly, manage the entire life cycle of the firmware, including firmware binding, authorization authentication, secure burning, secure loading and readback processes; Finally, a secure isolation mechanism for key management and encryption algorithms is designed to ensure the security of keys and algorithms.

4. A quantum security system for power data, characterized in that: A quantum security chip firmware design method for power data as described in any one of claims 1 to 3 is adopted, which includes a quantum security chip, a CPU module, a key injection module, and an external FLASH module; The quantum security chip includes a CPU core and an internal FLASH module, which together with an external FLASH module form a quantum security module, which is designed based on a quantum random number generation model, a quantum key distribution protocol implementation model, and a quantum encryption algorithm integration model; External FLASH module, used to store the injection key; Internal FLASH module, used to store internal management information and save imported quantum key plaintext; The quantum security chip interacts with the CPU module in the form of an instruction set according to ESAM, and uses the key injection module to inject keys.

5. A quantum security system for power data as claimed in claim 4, characterized in that: The quantum security module is equipped with several interactive interfaces, including the key injection USB interface, the debugging UART1 interface, the business serial port interface and the business SPI interface; The quantum security chip includes a packaging and parsing unit, a network access authentication unit, a key application unit, a working mode switching unit, a token management unit, an index management unit, a cryptographic algorithm unit and a message processing unit; Encapsulation and parsing unit, used for encapsulation and parsing of JSON format messages; Network access authentication unit, used to initiate network access authentication to the secret service platform; The key application unit is used to initiate a key application to the key service platform; A working mode switching unit, used for switching working modes; Token management unit, used for token management; An index management unit, used to set a key position and a key index; The cryptographic algorithm unit is used to set the standard 0017 protocol cryptographic algorithm; The message processing unit is used to process the secret service platform messages.

6. A quantum security system for power data, characterized in that: A quantum security chip firmware design method for power data as described in any one of claims 1 to 3 is adopted, which includes a secret service platform, an edge security module, and an end security chip; The cryptographic service platform is used to generate quantum keys and distribute quantum keys based on requests from edge security modules and / or end security chips; The edge security module is equipped with multiple end security chips, which are distinguished and identified by the chip's own ID number; The terminal security chip is designed based on the quantum random number generation model, quantum key distribution protocol implementation model, and quantum encryption algorithm integration model; The edge security module and / or the end security chip initiates network access authentication to the cryptographic service platform and obtains the index Token; Apply for quantum keys from the cryptographic service platform based on the index Token, and you can apply for quantum keys at will during the validity period of the index Token.

7. A quantum security system for power data as claimed in claim 6, characterized in that: The edge security module or / and the terminal security chip is provided with a key injection unit, a session key import unit, a key management unit and an encryption and decryption unit; Key charging unit: used to call standard interfaces according to key charging software instructions, perform interface authentication, generate random numbers, generate ECC signature key pairs, import ECC encryption key pairs, create applications, open applications, delete applications, create containers, open containers, delete containers, and read and write files; Session key import unit: used to receive service CPU instructions to execute injection key plaintext acquisition operations and session key import operations; The charging key plaintext acquisition operation: read the charging key ciphertext and return it to the CPU; decrypt the charging key ciphertext using the asymmetric key according to the CPU instruction and store it as a fixed index key; Session key import operation: The CPU will obtain the session key ciphertext from the secret service platform, connect it with the plaintext index of the key to be used and the ciphertext index of the allocated session key, and send it to the quantum security module; The quantum security module uses the injection key plaintext corresponding to the index and the session key ciphertext to perform XOR and then stores them according to the specified index; Key management unit: used for encryption and decryption when no quantum key exists; due to the limited memory of the quantum security module, the first 300 quantum keys are cached in the memory and the last 600 groups are stored in the built-in FLASH; Encryption unit: used to calculate the SM3 HASH of the data to be encrypted through the quantum security module; after the CPU fills the data according to the PKCS7padding algorithm, it sends the data to be encrypted, the data length, and the session key index to the quantum security module; The quantum security module calculates the data to be encrypted and searches for the session key according to the index, then encrypts it using the SM4 ECB algorithm and returns the data ciphertext; the CPU performs ciphertext format encapsulation; Decryption unit: used to send the data to be decrypted, data length, and session key index to the quantum security module. The quantum security module calculates the encrypted data and searches for the session key according to the index, then decrypts it using the SM4 ECB algorithm and returns the data plaintext. The CPU removes the padding data using PKCS7padding to obtain the valid data plaintext. The CPU calculates the data plaintext SM3 HASH through the quantum security module, compares it with the received data SM3 HASH, and returns the decryption result.

8. A quantum security system for power data as claimed in claim 7, characterized in that: The method to read FLASH information is as follows: Step 1. Read FLASH to obtain the private key in the encrypted public and private keys; Step 2. Read the total amount of key filling information: used to calculate the remaining key amount; Step 3. Read the charging key information: file name, charging key file corresponding to the storage address in FLASH, single charging file size, key information size in the charging key file, the key file contains charging key, encrypted file, file size information, which is used for charging key to session key information conversion; Step 4. Reading of unused key information: used to obtain the location of the key to be used and calculate the remaining key amount.

9. An electronic device, characterized in that: It includes: one or more processors; A storage device for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement a quantum security chip firmware design method for power data as described in any one of claims 1 to 3.

10. A computer-readable storage medium, characterized in that: A computer program is stored thereon, which, when executed by a processor, implements a quantum security chip firmware design method for power data as described in any one of claims 1 to 3.

Images